make this target current

12 files changed, 107 insertions, 6746 deletions

diff --git a/target/device/AMD/DBAu1500/kernel-patches/001-patch-2.6.16.20.patch b/target/device/AMD/DBAu1500/kernel-patches/001-patch-2.6.16.20.patch
deleted file mode 100644
index 1a1b32409..000000000
--- a/target/device/AMD/DBAu1500/kernel-patches/001-patch-2.6.16.20.patch
+++ /dev/null
@@ -1,6360 +0,0 @@
-diff --git a/Documentation/dvb/get_dvb_firmware b/Documentation/dvb/get_dvb_firmware
-index 75c28a1..948f502 100644
---- a/Documentation/dvb/get_dvb_firmware
-+++ b/Documentation/dvb/get_dvb_firmware
-@@ -240,9 +240,9 @@ sub dibusb {
- }
- 
- sub nxt2002 {
--    my $sourcefile = "Broadband4PC_4_2_11.zip";
-+    my $sourcefile = "Technisat_DVB-PC_4_4_COMPACT.zip";
-     my $url = "http://www.bbti.us/download/windows/$sourcefile";
--    my $hash = "c6d2ea47a8f456d887ada0cfb718ff2a";
-+    my $hash = "476befae8c7c1bb9648954060b1eec1f";
-     my $outfile = "dvb-fe-nxt2002.fw";
-     my $tmpdir = tempdir(DIR => "/tmp", CLEANUP => 1);
- 
-@@ -250,8 +250,8 @@ sub nxt2002 {
- 
-     wgetfile($sourcefile, $url);
-     unzip($sourcefile, $tmpdir);
--    verify("$tmpdir/SkyNETU.sys", $hash);
--    extract("$tmpdir/SkyNETU.sys", 375832, 5908, $outfile);
-+    verify("$tmpdir/SkyNET.sys", $hash);
-+    extract("$tmpdir/SkyNET.sys", 331624, 5908, $outfile);
- 
-     $outfile;
- }
-diff --git a/Makefile b/Makefile
-index cb57905..600c769 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,7 +1,7 @@
- VERSION = 2
- PATCHLEVEL = 6
- SUBLEVEL = 16
--EXTRAVERSION =
-+EXTRAVERSION = .20
- NAME=Sliding Snow Leopard
- 
- # *DOCUMENTATION*
-diff --git a/arch/alpha/kernel/setup.c b/arch/alpha/kernel/setup.c
-index b4e5f8f..45308bd 100644
---- a/arch/alpha/kernel/setup.c
-+++ b/arch/alpha/kernel/setup.c
-@@ -24,6 +24,7 @@ #include <linux/delay.h>
- #include <linux/config.h>	/* CONFIG_ALPHA_LCA etc */
- #include <linux/mc146818rtc.h>
- #include <linux/console.h>
-+#include <linux/cpu.h>
- #include <linux/errno.h>
- #include <linux/init.h>
- #include <linux/string.h>
-@@ -477,6 +478,22 @@ #undef PFN_DOWN
- #undef PFN_PHYS
- #undef PFN_MAX
- 
-+static int __init
-+register_cpus(void)
-+{
-+	int i;
-+
-+	for_each_possible_cpu(i) {
-+		struct cpu *p = kzalloc(sizeof(*p), GFP_KERNEL);
-+		if (!p)
-+			return -ENOMEM;
-+		register_cpu(p, i, NULL);
-+	}
-+	return 0;
-+}
-+
-+arch_initcall(register_cpus);
-+
- void __init
- setup_arch(char **cmdline_p)
- {
-diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c
-index 02c2db0..1852554 100644
---- a/arch/alpha/kernel/smp.c
-+++ b/arch/alpha/kernel/smp.c
-@@ -439,7 +439,7 @@ setup_smp(void)
- 			if ((cpu->flags & 0x1cc) == 0x1cc) {
- 				smp_num_probed++;
- 				/* Assume here that "whami" == index */
--				cpu_set(i, cpu_possible_map);
-+				cpu_set(i, cpu_present_mask);
- 				cpu->pal_revision = boot_cpu_palrev;
- 			}
- 
-@@ -450,9 +450,8 @@ setup_smp(void)
- 		}
- 	} else {
- 		smp_num_probed = 1;
--		cpu_set(boot_cpuid, cpu_possible_map);
-+		cpu_set(boot_cpuid, cpu_present_mask);
- 	}
--	cpu_present_mask = cpumask_of_cpu(boot_cpuid);
- 
- 	printk(KERN_INFO "SMP: %d CPUs probed -- cpu_present_mask = %lx\n",
- 	       smp_num_probed, cpu_possible_map.bits[0]);
-@@ -488,9 +487,8 @@ void __devinit
- smp_prepare_boot_cpu(void)
- {
- 	/*
--	 * Mark the boot cpu (current cpu) as both present and online
-+	 * Mark the boot cpu (current cpu) as online
- 	 */ 
--	cpu_set(smp_processor_id(), cpu_present_mask);
- 	cpu_set(smp_processor_id(), cpu_online_map);
- }
- 
-diff --git a/arch/alpha/lib/strncpy.S b/arch/alpha/lib/strncpy.S
-index 338551c..bbdef1b 100644
---- a/arch/alpha/lib/strncpy.S
-+++ b/arch/alpha/lib/strncpy.S
-@@ -43,8 +43,8 @@ strncpy:
- 
- 	.align	4
- $multiword:
--	subq	$24, 1, $2	# clear the final bits in the prev word
--	or	$2, $24, $2
-+	subq	$27, 1, $2	# clear the final bits in the prev word
-+	or	$2, $27, $2
- 	zapnot	$1, $2, $1
- 	subq	$18, 1, $18
- 
-@@ -70,8 +70,8 @@ strncpy:
- 	bne	$18, 0b
- 
- 1:	ldq_u	$1, 0($16)	# clear the leading bits in the final word
--	subq	$27, 1, $2
--	or	$2, $27, $2
-+	subq	$24, 1, $2
-+	or	$2, $24, $2
- 
- 	zap	$1, $2, $1
- 	stq_u	$1, 0($16)
-diff --git a/arch/i386/kernel/apm.c b/arch/i386/kernel/apm.c
-index 05312a8..558d2d2 100644
---- a/arch/i386/kernel/apm.c
-+++ b/arch/i386/kernel/apm.c
-@@ -1081,7 +1081,7 @@ static int apm_console_blank(int blank)
- 			break;
- 	}
- 
--	if (error == APM_NOT_ENGAGED && state != APM_STATE_READY) {
-+	if (error == APM_NOT_ENGAGED) {
- 		static int tried;
- 		int eng_error;
- 		if (tried++ == 0) {
-diff --git a/arch/i386/kernel/cpu/amd.c b/arch/i386/kernel/cpu/amd.c
-index 0810f81..d2d50cb 100644
---- a/arch/i386/kernel/cpu/amd.c
-+++ b/arch/i386/kernel/cpu/amd.c
-@@ -207,6 +207,8 @@ #define CBAR_KEY	(0X000000CB)
- 		set_bit(X86_FEATURE_K7, c->x86_capability); 
- 		break;
- 	}
-+	if (c->x86 >= 6)
-+		set_bit(X86_FEATURE_FXSAVE_LEAK, c->x86_capability);
- 
- 	display_cacheinfo(c);
- 
-diff --git a/arch/i386/kernel/cpu/cpufreq/Kconfig b/arch/i386/kernel/cpu/cpufreq/Kconfig
-index 26892d2..16f2e35 100644
---- a/arch/i386/kernel/cpu/cpufreq/Kconfig
-+++ b/arch/i386/kernel/cpu/cpufreq/Kconfig
-@@ -203,6 +203,7 @@ config X86_LONGRUN
- config X86_LONGHAUL
- 	tristate "VIA Cyrix III Longhaul"
- 	select CPU_FREQ_TABLE
-+	depends on BROKEN
- 	help
- 	  This adds the CPUFreq driver for VIA Samuel/CyrixIII, 
- 	  VIA Cyrix Samuel/C3, VIA Cyrix Ezra and VIA Cyrix Ezra-T 
-diff --git a/arch/i386/kernel/cpu/cpufreq/p4-clockmod.c b/arch/i386/kernel/cpu/cpufreq/p4-clockmod.c
-index cc73a7a..ebe1848 100644
---- a/arch/i386/kernel/cpu/cpufreq/p4-clockmod.c
-+++ b/arch/i386/kernel/cpu/cpufreq/p4-clockmod.c
-@@ -244,7 +244,7 @@ #endif
- 	for (i=1; (p4clockmod_table[i].frequency != CPUFREQ_TABLE_END); i++) {
- 		if ((i<2) && (has_N44_O17_errata[policy->cpu]))
- 			p4clockmod_table[i].frequency = CPUFREQ_ENTRY_INVALID;
--		else if (has_N60_errata[policy->cpu] && p4clockmod_table[i].frequency < 2000000)
-+		else if (has_N60_errata[policy->cpu] && ((stock_freq * i)/8) < 2000000)
- 			p4clockmod_table[i].frequency = CPUFREQ_ENTRY_INVALID;
- 		else
- 			p4clockmod_table[i].frequency = (stock_freq * i)/8;
-diff --git a/arch/i386/kernel/cpu/cpufreq/speedstep-smi.c b/arch/i386/kernel/cpu/cpufreq/speedstep-smi.c
-index 28cc5d5..cfc4276 100644
---- a/arch/i386/kernel/cpu/cpufreq/speedstep-smi.c
-+++ b/arch/i386/kernel/cpu/cpufreq/speedstep-smi.c
-@@ -75,7 +75,9 @@ static int speedstep_smi_ownership (void
- 	__asm__ __volatile__(
- 		"out %%al, (%%dx)\n"
- 		: "=D" (result)
--		: "a" (command), "b" (function), "c" (0), "d" (smi_port), "D" (0), "S" (magic)
-+		: "a" (command), "b" (function), "c" (0), "d" (smi_port),
-+			"D" (0), "S" (magic)
-+		: "memory"
- 	);
- 
- 	dprintk("result is %x\n", result);
-diff --git a/arch/i386/kernel/dmi_scan.c b/arch/i386/kernel/dmi_scan.c
-index 6a93d75..ca2a0cb 100644
---- a/arch/i386/kernel/dmi_scan.c
-+++ b/arch/i386/kernel/dmi_scan.c
-@@ -106,7 +106,7 @@ static void __init dmi_save_devices(stru
- 	struct dmi_device *dev;
- 
- 	for (i = 0; i < count; i++) {
--		char *d = ((char *) dm) + (i * 2);
-+		char *d = (char *)(dm + 1) + (i * 2);
- 
- 		/* Skip disabled device */
- 		if ((*d & 0x80) == 0)
-diff --git a/arch/i386/kernel/vm86.c b/arch/i386/kernel/vm86.c
-index f51c894..aee14fa 100644
---- a/arch/i386/kernel/vm86.c
-+++ b/arch/i386/kernel/vm86.c
-@@ -43,6 +43,7 @@ #include <linux/smp.h>
- #include <linux/smp_lock.h>
- #include <linux/highmem.h>
- #include <linux/ptrace.h>
-+#include <linux/audit.h>
- 
- #include <asm/uaccess.h>
- #include <asm/io.h>
-@@ -252,6 +253,7 @@ out:
- static void do_sys_vm86(struct kernel_vm86_struct *info, struct task_struct *tsk)
- {
- 	struct tss_struct *tss;
-+	long eax;
- /*
-  * make sure the vm86() system call doesn't try to do anything silly
-  */
-@@ -305,13 +307,19 @@ static void do_sys_vm86(struct kernel_vm
- 	tsk->thread.screen_bitmap = info->screen_bitmap;
- 	if (info->flags & VM86_SCREEN_BITMAP)
- 		mark_screen_rdonly(tsk->mm);
-+	__asm__ __volatile__("xorl %eax,%eax; movl %eax,%fs; movl %eax,%gs\n\t");
-+	__asm__ __volatile__("movl %%eax, %0\n" :"=r"(eax));
-+
-+	/*call audit_syscall_exit since we do not exit via the normal paths */
-+	if (unlikely(current->audit_context))
-+		audit_syscall_exit(current, AUDITSC_RESULT(eax), eax);
-+
- 	__asm__ __volatile__(
--		"xorl %%eax,%%eax; movl %%eax,%%fs; movl %%eax,%%gs\n\t"
- 		"movl %0,%%esp\n\t"
- 		"movl %1,%%ebp\n\t"
- 		"jmp resume_userspace"
- 		: /* no outputs */
--		:"r" (&info->regs), "r" (task_thread_info(tsk)) : "ax");
-+		:"r" (&info->regs), "r" (task_thread_info(tsk)));
- 	/* we never return here */
- }
- 
-diff --git a/arch/m32r/kernel/m32r_ksyms.c b/arch/m32r/kernel/m32r_ksyms.c
-index be8b711..6000950 100644
---- a/arch/m32r/kernel/m32r_ksyms.c
-+++ b/arch/m32r/kernel/m32r_ksyms.c
-@@ -38,10 +38,6 @@ EXPORT_SYMBOL(__udelay);
- EXPORT_SYMBOL(__delay);
- EXPORT_SYMBOL(__const_udelay);
- 
--EXPORT_SYMBOL(__get_user_1);
--EXPORT_SYMBOL(__get_user_2);
--EXPORT_SYMBOL(__get_user_4);
--
- EXPORT_SYMBOL(strpbrk);
- EXPORT_SYMBOL(strstr);
- 
-diff --git a/arch/m32r/kernel/setup.c b/arch/m32r/kernel/setup.c
-index d742037..542ed93 100644
---- a/arch/m32r/kernel/setup.c
-+++ b/arch/m32r/kernel/setup.c
-@@ -9,6 +9,7 @@
- 
- #include <linux/config.h>
- #include <linux/init.h>
-+#include <linux/kernel.h>
- #include <linux/stddef.h>
- #include <linux/fs.h>
- #include <linux/sched.h>
-@@ -218,8 +219,6 @@ #else	/* CONFIG_DISCONTIGMEM */
- extern unsigned long setup_memory(void);
- #endif	/* CONFIG_DISCONTIGMEM */
- 
--#define M32R_PCC_PCATCR	0x00ef7014	/* will move to m32r.h */
--
- void __init setup_arch(char **cmdline_p)
- {
- 	ROOT_DEV = old_decode_dev(ORIG_ROOT_DEV);
-@@ -268,15 +267,14 @@ #endif	/* CONFIG_DISCONTIGMEM */
- 	paging_init();
- }
- 
--static struct cpu cpu[NR_CPUS];
-+static struct cpu cpu_devices[NR_CPUS];
- 
- static int __init topology_init(void)
- {
--	int cpu_id;
-+	int i;
- 
--	for (cpu_id = 0; cpu_id < NR_CPUS; cpu_id++)
--		if (cpu_possible(cpu_id))
--			register_cpu(&cpu[cpu_id], cpu_id, NULL);
-+	for_each_present_cpu(i)
-+		register_cpu(&cpu_devices[i], i, NULL);
- 
- 	return 0;
- }
-diff --git a/arch/m32r/kernel/smpboot.c b/arch/m32r/kernel/smpboot.c
-index d7ec16e..840b434 100644
---- a/arch/m32r/kernel/smpboot.c
-+++ b/arch/m32r/kernel/smpboot.c
-@@ -39,8 +39,10 @@
-  *		Martin J. Bligh	: 	Added support for multi-quad systems
-  */
- 
-+#include <linux/module.h>
- #include <linux/config.h>
- #include <linux/init.h>
-+#include <linux/kernel.h>
- #include <linux/mm.h>
- #include <linux/smp_lock.h>
- #include <linux/irq.h>
-@@ -72,11 +74,15 @@ physid_mask_t phys_cpu_present_map;
- 
- /* Bitmask of currently online CPUs */
- cpumask_t cpu_online_map;
-+EXPORT_SYMBOL(cpu_online_map);
- 
- cpumask_t cpu_bootout_map;
- cpumask_t cpu_bootin_map;
--cpumask_t cpu_callout_map;
- static cpumask_t cpu_callin_map;
-+cpumask_t cpu_callout_map;
-+EXPORT_SYMBOL(cpu_callout_map);
-+cpumask_t cpu_possible_map = CPU_MASK_ALL;
-+EXPORT_SYMBOL(cpu_possible_map);
- 
- /* Per CPU bogomips and other parameters */
- struct cpuinfo_m32r cpu_data[NR_CPUS] __cacheline_aligned;
-@@ -110,7 +116,6 @@ static unsigned int calibration_result;
- 
- void smp_prepare_boot_cpu(void);
- void smp_prepare_cpus(unsigned int);
--static void smp_tune_scheduling(void);
- static void init_ipi_lock(void);
- static void do_boot_cpu(int);
- int __cpu_up(unsigned int);
-@@ -177,6 +182,9 @@ void __init smp_prepare_cpus(unsigned in
- 	}
- 	for (phys_id = 0 ; phys_id < nr_cpu ; phys_id++)
- 		physid_set(phys_id, phys_cpu_present_map);
-+#ifndef CONFIG_HOTPLUG_CPU
-+	cpu_present_map = cpu_possible_map;
-+#endif
- 
- 	show_mp_info(nr_cpu);
- 
-@@ -186,7 +194,6 @@ void __init smp_prepare_cpus(unsigned in
- 	 * Setup boot CPU information
- 	 */
- 	smp_store_cpu_info(0); /* Final full version of the data */
--	smp_tune_scheduling();
- 
- 	/*
- 	 * If SMP should be disabled, then really disable it!
-@@ -230,11 +237,6 @@ smp_done:
- 	Dprintk("Boot done.\n");
- }
- 
--static void __init smp_tune_scheduling(void)
--{
--	/* Nothing to do. */
--}
--
- /*
-  * init_ipi_lock : Initialize IPI locks.
-  */
-@@ -629,4 +631,3 @@ static void __init unmap_cpu_to_physid(i
- 	physid_2_cpu[phys_id] = -1;
- 	cpu_2_physid[cpu_id] = -1;
- }
--
-diff --git a/arch/m32r/lib/Makefile b/arch/m32r/lib/Makefile
-index e632d10..d16b4e4 100644
---- a/arch/m32r/lib/Makefile
-+++ b/arch/m32r/lib/Makefile
-@@ -2,6 +2,6 @@ #
- # Makefile for M32R-specific library files..
- #
- 
--lib-y  := checksum.o ashxdi3.o memset.o memcpy.o getuser.o \
--	  putuser.o delay.o strlen.o usercopy.o csum_partial_copy.o
-+lib-y  := checksum.o ashxdi3.o memset.o memcpy.o \
-+	  delay.o strlen.o usercopy.o csum_partial_copy.o
- 
-diff --git a/arch/m32r/lib/getuser.S b/arch/m32r/lib/getuser.S
-deleted file mode 100644
-index 58a0db0..0000000
---- a/arch/m32r/lib/getuser.S
-+++ /dev/null
-@@ -1,88 +0,0 @@
--/*
-- * __get_user functions.
-- *
-- * (C) Copyright 2001 Hirokazu Takata
-- *
-- * These functions have a non-standard call interface
-- * to make them more efficient, especially as they
-- * return an error value in addition to the "real"
-- * return value.
-- */
--
--#include <linux/config.h>
--
--/*
-- * __get_user_X
-- *
-- * Inputs:	r0 contains the address
-- *
-- * Outputs:	r0 is error code (0 or -EFAULT)
-- *		r1 contains zero-extended value
-- *
-- * These functions should not modify any other registers,
-- * as they get called from within inline assembly.
-- */
--
--#ifdef CONFIG_ISA_DUAL_ISSUE
--
--	.text
--	.balign 4
--	.globl __get_user_1
--__get_user_1:
--1:	ldub	r1, @r0		    ||	ldi	r0, #0
--	jmp	r14
--
--	.balign 4
--	.globl __get_user_2
--__get_user_2:
--2:	lduh	r1, @r0		    ||	ldi	r0, #0
--	jmp	r14
--
--	.balign 4
--	.globl __get_user_4
--__get_user_4:
--3:	ld	r1, @r0		    ||	ldi	r0, #0
--	jmp	r14
--
--bad_get_user:
--	ldi	r1, #0		    ||	ldi	r0, #-14
--	jmp	r14
--
--#else /* not CONFIG_ISA_DUAL_ISSUE */
--
--	.text
--	.balign 4
--	.globl __get_user_1
--__get_user_1:
--1:	ldub	r1, @r0
--	ldi	r0, #0
--	jmp	r14
--
--	.balign 4
--	.globl __get_user_2
--__get_user_2:
--2:	lduh	r1, @r0
--	ldi	r0, #0
--	jmp	r14
--
--	.balign 4
--	.globl __get_user_4
--__get_user_4:
--3:	ld	r1, @r0
--	ldi	r0, #0
--	jmp	r14
--
--bad_get_user:
--	ldi	r1, #0
--	ldi	r0, #-14
--	jmp	r14
--
--#endif /* not CONFIG_ISA_DUAL_ISSUE */
--
--.section __ex_table,"a"
--	.long 1b,bad_get_user
--	.long 2b,bad_get_user
--	.long 3b,bad_get_user
--.previous
--
--	.end
-diff --git a/arch/m32r/lib/putuser.S b/arch/m32r/lib/putuser.S
-deleted file mode 100644
-index 218154c..0000000
---- a/arch/m32r/lib/putuser.S
-+++ /dev/null
-@@ -1,84 +0,0 @@
--/*
-- * __put_user functions.
-- *
-- * (C) Copyright 1998 Linus Torvalds
-- * (C) Copyright 2001 Hirokazu Takata
-- *
-- * These functions have a non-standard call interface
-- * to make them more efficient.
-- */
--
--#include <linux/config.h>
--
--/*
-- * __put_user_X
-- *
-- * Inputs:	r0 contains the address
-- *		r1 contains the value
-- *
-- * Outputs:	r0 is error code (0 or -EFAULT)
-- *		r1 is corrupted (will contain "current_task").
-- *
-- * These functions should not modify any other registers,
-- * as they get called from within inline assembly.
-- */
--
--#ifdef CONFIG_ISA_DUAL_ISSUE
--
--	.text
--	.balign 4
--	.globl __put_user_1
--__put_user_1:
--1:	stb	r1, @r0		    ||	ldi	r0, #0
--	jmp	r14
--
--	.balign 4
--	.globl __put_user_2
--__put_user_2:
--2:	sth	r1, @r0		    ||	ldi	r0, #0
--	jmp	r14
--
--	.balign 4
--	.globl __put_user_4
--__put_user_4:
--3:	st	r1, @r0		    ||	ldi	r0, #0
--	jmp	r14
--
--bad_put_user:
--	ldi	r0, #-14	    ||	jmp	r14
--
--#else /* not CONFIG_ISA_DUAL_ISSUE */
--
--	.text
--	.balign 4
--	.globl __put_user_1
--__put_user_1:
--1:	stb	r1, @r0
--	ldi	r0, #0
--	jmp	r14
--
--	.balign 4
--	.globl __put_user_2
--__put_user_2:
--2:	sth	r1, @r0
--	ldi	r0, #0
--	jmp	r14
--
--	.balign 4
--	.globl __put_user_4
--__put_user_4:
--3:	st	r1, @r0
--	ldi	r0, #0
--	jmp	r14
--
--bad_put_user:
--	ldi	r0, #-14
--	jmp	r14
--
--#endif /* not CONFIG_ISA_DUAL_ISSUE */
--
--.section __ex_table,"a"
--	.long 1b,bad_put_user
--	.long 2b,bad_put_user
--	.long 3b,bad_put_user
--.previous
-diff --git a/arch/mips/kernel/branch.c b/arch/mips/kernel/branch.c
-index 374de83..b6232d9 100644
---- a/arch/mips/kernel/branch.c
-+++ b/arch/mips/kernel/branch.c
-@@ -184,7 +184,7 @@ int __compute_return_epc(struct pt_regs 
- 		bit = (insn.i_format.rt >> 2);
- 		bit += (bit != 0);
- 		bit += 23;
--		switch (insn.i_format.rt) {
-+		switch (insn.i_format.rt & 3) {
- 		case 0:	/* bc1f */
- 		case 2:	/* bc1fl */
- 			if (~fcr31 & (1 << bit))
-diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
-index 9572ed4..a761f99 100644
---- a/arch/mips/mm/c-r4k.c
-+++ b/arch/mips/mm/c-r4k.c
-@@ -154,7 +154,8 @@ static inline void blast_icache32_r4600_
- 
- static inline void tx49_blast_icache32_page_indexed(unsigned long page)
- {
--	unsigned long start = page;
-+	unsigned long indexmask = current_cpu_data.icache.waysize - 1;
-+	unsigned long start = INDEX_BASE + (page & indexmask);
- 	unsigned long end = start + PAGE_SIZE;
- 	unsigned long ws_inc = 1UL << current_cpu_data.icache.waybit;
- 	unsigned long ws_end = current_cpu_data.icache.ways <<
-diff --git a/arch/powerpc/kernel/pci_64.c b/arch/powerpc/kernel/pci_64.c
-index ba92bab..4c4449b 100644
---- a/arch/powerpc/kernel/pci_64.c
-+++ b/arch/powerpc/kernel/pci_64.c
-@@ -78,6 +78,7 @@ int global_phb_number;		/* Global phb co
- 
- /* Cached ISA bridge dev. */
- struct pci_dev *ppc64_isabridge_dev = NULL;
-+EXPORT_SYMBOL_GPL(ppc64_isabridge_dev);
- 
- static void fixup_broken_pcnet32(struct pci_dev* dev)
- {
-diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
-index f96c49b..abd758f 100644
---- a/arch/powerpc/kernel/setup_64.c
-+++ b/arch/powerpc/kernel/setup_64.c
-@@ -256,12 +256,10 @@ #endif
- 	/*
- 	 * Initialize stab / SLB management except on iSeries
- 	 */
--	if (!firmware_has_feature(FW_FEATURE_ISERIES)) {
--		if (cpu_has_feature(CPU_FTR_SLB))
--			slb_initialize();
--		else
--			stab_initialize(lpaca->stab_real);
--	}
-+	if (cpu_has_feature(CPU_FTR_SLB))
-+		slb_initialize();
-+	else if (!firmware_has_feature(FW_FEATURE_ISERIES))
-+		stab_initialize(lpaca->stab_real);
- 
- 	DBG(" <- early_setup()\n");
- }
-diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
-index 4324f8a..096dfdc 100644
---- a/arch/powerpc/kernel/signal_64.c
-+++ b/arch/powerpc/kernel/signal_64.c
-@@ -213,7 +213,7 @@ static inline void __user * get_sigframe
-         /* Default to using normal stack */
-         newsp = regs->gpr[1];
- 
--	if (ka->sa.sa_flags & SA_ONSTACK) {
-+	if ((ka->sa.sa_flags & SA_ONSTACK) && current->sas_ss_size) {
- 		if (! on_sig_stack(regs->gpr[1]))
- 			newsp = (current->sas_ss_sp + current->sas_ss_size);
- 	}
-diff --git a/arch/powerpc/platforms/powermac/setup.c b/arch/powerpc/platforms/powermac/setup.c
-index 29c2946..f649750 100644
---- a/arch/powerpc/platforms/powermac/setup.c
-+++ b/arch/powerpc/platforms/powermac/setup.c
-@@ -456,11 +456,23 @@ static int pmac_pm_finish(suspend_state_
- 	return 0;
- }
- 
-+static int pmac_pm_valid(suspend_state_t state)
-+{
-+	switch (state) {
-+	case PM_SUSPEND_DISK:
-+		return 1;
-+	/* can't do any other states via generic mechanism yet */
-+	default:
-+		return 0;
-+	}
-+}
-+
- static struct pm_ops pmac_pm_ops = {
- 	.pm_disk_mode	= PM_DISK_SHUTDOWN,
- 	.prepare	= pmac_pm_prepare,
- 	.enter		= pmac_pm_enter,
- 	.finish		= pmac_pm_finish,
-+	.valid		= pmac_pm_valid,
- };
- 
- #endif /* CONFIG_SOFTWARE_SUSPEND */
-diff --git a/arch/x86_64/ia32/Makefile b/arch/x86_64/ia32/Makefile
-index 929e6b0..e9263b4 100644
---- a/arch/x86_64/ia32/Makefile
-+++ b/arch/x86_64/ia32/Makefile
-@@ -27,5 +27,5 @@ quiet_cmd_syscall = SYSCALL $@
- $(obj)/vsyscall-%.so: $(src)/vsyscall.lds $(obj)/vsyscall-%.o FORCE
- 	$(call if_changed,syscall)
- 
--AFLAGS_vsyscall-sysenter.o = -m32
--AFLAGS_vsyscall-syscall.o = -m32
-+AFLAGS_vsyscall-sysenter.o = -m32 -Wa,-32
-+AFLAGS_vsyscall-syscall.o = -m32 -Wa,-32
-diff --git a/arch/x86_64/kernel/entry.S b/arch/x86_64/kernel/entry.S
-index 7c10e90..97583bb 100644
---- a/arch/x86_64/kernel/entry.S
-+++ b/arch/x86_64/kernel/entry.S
-@@ -180,6 +180,10 @@ rff_trace:
-  *
-  * XXX	if we had a free scratch register we could save the RSP into the stack frame
-  *      and report it properly in ps. Unfortunately we haven't.
-+ *
-+ * When user can change the frames always force IRET. That is because
-+ * it deals with uncanonical addresses better. SYSRET has trouble
-+ * with them due to bugs in both AMD and Intel CPUs.
-  */ 			 		
- 
- ENTRY(system_call)
-@@ -254,7 +258,10 @@ sysret_signal:
- 	xorl %esi,%esi # oldset -> arg2
- 	call ptregscall_common
- 1:	movl $_TIF_NEED_RESCHED,%edi
--	jmp sysret_check
-+	/* Use IRET because user could have changed frame. This
-+	   works because ptregscall_common has called FIXUP_TOP_OF_STACK. */
-+	cli
-+	jmp int_with_check
- 	
- badsys:
- 	movq $-ENOSYS,RAX-ARGOFFSET(%rsp)
-@@ -274,13 +281,9 @@ tracesys:			 
- 	ja  1f
- 	movq %r10,%rcx	/* fixup for C */
- 	call *sys_call_table(,%rax,8)
--	movq %rax,RAX-ARGOFFSET(%rsp)
--1:	SAVE_REST
--	movq %rsp,%rdi
--	call syscall_trace_leave
--	RESTORE_TOP_OF_STACK %rbx
--	RESTORE_REST
--	jmp ret_from_sys_call
-+1:	movq %rax,RAX-ARGOFFSET(%rsp)
-+	/* Use IRET because user could have changed frame */
-+	jmp int_ret_from_sys_call
- 	CFI_ENDPROC
- 		
- /* 
-@@ -408,25 +411,9 @@ ENTRY(stub_execve)
- 	CFI_ADJUST_CFA_OFFSET -8
- 	CFI_REGISTER rip, r11
- 	SAVE_REST
--	movq %r11, %r15
--	CFI_REGISTER rip, r15
- 	FIXUP_TOP_OF_STACK %r11
- 	call sys_execve
--	GET_THREAD_INFO(%rcx)
--	bt $TIF_IA32,threadinfo_flags(%rcx)
--	CFI_REMEMBER_STATE
--	jc exec_32bit
- 	RESTORE_TOP_OF_STACK %r11
--	movq %r15, %r11
--	CFI_REGISTER rip, r11
--	RESTORE_REST
--	pushq %r11
--	CFI_ADJUST_CFA_OFFSET 8
--	CFI_REL_OFFSET rip, 0
--	ret
--
--exec_32bit:
--	CFI_RESTORE_STATE
- 	movq %rax,RAX(%rsp)
- 	RESTORE_REST
- 	jmp int_ret_from_sys_call
-diff --git a/arch/x86_64/kernel/pci-gart.c b/arch/x86_64/kernel/pci-gart.c
-index 0c3f052..b9dbe3c 100644
---- a/arch/x86_64/kernel/pci-gart.c
-+++ b/arch/x86_64/kernel/pci-gart.c
-@@ -114,10 +114,6 @@ static unsigned long alloc_iommu(int siz
- static void free_iommu(unsigned long offset, int size)
- { 
- 	unsigned long flags;
--	if (size == 1) { 
--		clear_bit(offset, iommu_gart_bitmap); 
--		return;
--	}
- 	spin_lock_irqsave(&iommu_bitmap_lock, flags);
- 	__clear_bit_string(iommu_gart_bitmap, offset, size);
- 	spin_unlock_irqrestore(&iommu_bitmap_lock, flags);
-diff --git a/arch/x86_64/kernel/process.c b/arch/x86_64/kernel/process.c
-index 22a05de..818ab9e 100644
---- a/arch/x86_64/kernel/process.c
-+++ b/arch/x86_64/kernel/process.c
-@@ -527,8 +527,6 @@ __switch_to(struct task_struct *prev_p, 
- 	int cpu = smp_processor_id();  
- 	struct tss_struct *tss = &per_cpu(init_tss, cpu);
- 
--	unlazy_fpu(prev_p);
--
- 	/*
- 	 * Reload esp0, LDT and the page table pointer:
- 	 */
-@@ -591,6 +589,12 @@ __switch_to(struct task_struct *prev_p, 
- 	prev->userrsp = read_pda(oldrsp); 
- 	write_pda(oldrsp, next->userrsp); 
- 	write_pda(pcurrent, next_p); 
-+
-+ 	/* This must be here to ensure both math_state_restore() and
-+	   kernel_fpu_begin() work consistently.
-+	   And the AMD workaround requires it to be after DS reload. */
-+	unlazy_fpu(prev_p);
-+
- 	write_pda(kernelstack,
- 		  task_stack_page(next_p) + THREAD_SIZE - PDA_STACKOFFSET);
- 
-diff --git a/arch/x86_64/kernel/setup.c b/arch/x86_64/kernel/setup.c
-index aa55e3c..a4a0bb5 100644
---- a/arch/x86_64/kernel/setup.c
-+++ b/arch/x86_64/kernel/setup.c
-@@ -909,6 +909,10 @@ #endif
- 	if (c->x86 == 15 && ((level >= 0x0f48 && level < 0x0f50) || level >= 0x0f58))
- 		set_bit(X86_FEATURE_REP_GOOD, &c->x86_capability);
- 
-+	/* Enable workaround for FXSAVE leak */
-+	if (c->x86 >= 6)
-+		set_bit(X86_FEATURE_FXSAVE_LEAK, &c->x86_capability);
-+
- 	r = get_model_name(c);
- 	if (!r) { 
- 		switch (c->x86) { 
-diff --git a/arch/x86_64/kernel/traps.c b/arch/x86_64/kernel/traps.c
-index 28d50dc..a5209fd 100644
---- a/arch/x86_64/kernel/traps.c
-+++ b/arch/x86_64/kernel/traps.c
-@@ -30,6 +30,7 @@ #include <linux/module.h>
- #include <linux/moduleparam.h>
- #include <linux/nmi.h>
- #include <linux/kprobes.h>
-+#include <linux/kexec.h>
- 
- #include <asm/system.h>
- #include <asm/uaccess.h>
-@@ -434,6 +435,8 @@ #endif
- 	printk(KERN_ALERT "RIP ");
- 	printk_address(regs->rip); 
- 	printk(" RSP <%016lx>\n", regs->rsp); 
-+	if (kexec_should_crash(current))
-+		crash_kexec(regs);
- }
- 
- void die(const char * str, struct pt_regs * regs, long err)
-@@ -456,6 +459,8 @@ void __kprobes die_nmi(char *str, struct
- 	 */
- 	printk(str, safe_smp_processor_id());
- 	show_registers(regs);
-+	if (kexec_should_crash(current))
-+		crash_kexec(regs);
- 	if (panic_on_timeout || panic_on_oops)
- 		panic("nmi watchdog");
- 	printk("console shuts up ...\n");
-diff --git a/block/elevator.c b/block/elevator.c
-index 24b702d..ef1e606 100644
---- a/block/elevator.c
-+++ b/block/elevator.c
-@@ -314,6 +314,7 @@ void elv_insert(request_queue_t *q, stru
- {
- 	struct list_head *pos;
- 	unsigned ordseq;
-+	int unplug_it = 1;
- 
- 	rq->q = q;
- 
-@@ -378,6 +379,11 @@ void elv_insert(request_queue_t *q, stru
- 		}
- 
- 		list_add_tail(&rq->queuelist, pos);
-+		/*
-+		 * most requeues happen because of a busy condition, don't
-+		 * force unplug of the queue for that case.
-+		 */
-+		unplug_it = 0;
- 		break;
- 
- 	default:
-@@ -386,7 +392,7 @@ void elv_insert(request_queue_t *q, stru
- 		BUG();
- 	}
- 
--	if (blk_queue_plugged(q)) {
-+	if (unplug_it && blk_queue_plugged(q)) {
- 		int nrq = q->rq.count[READ] + q->rq.count[WRITE]
- 			- q->in_flight;
- 
-diff --git a/block/genhd.c b/block/genhd.c
-index db57546..7f406f9 100644
---- a/block/genhd.c
-+++ b/block/genhd.c
-@@ -16,8 +16,6 @@ #include <linux/kmod.h>
- #include <linux/kobj_map.h>
- #include <linux/buffer_head.h>
- 
--#define MAX_PROBE_HASH 255	/* random */
--
- static struct subsystem block_subsys;
- 
- static DECLARE_MUTEX(block_subsys_sem);
-@@ -30,108 +28,29 @@ static struct blk_major_name {
- 	struct blk_major_name *next;
- 	int major;
- 	char name[16];
--} *major_names[MAX_PROBE_HASH];
-+} *major_names[BLKDEV_MAJOR_HASH_SIZE];
- 
- /* index in the above - for now: assume no multimajor ranges */
- static inline int major_to_index(int major)
- {
--	return major % MAX_PROBE_HASH;
--}
--
--struct blkdev_info {
--        int index;
--        struct blk_major_name *bd;
--};
--
--/*
-- * iterate over a list of blkdev_info structures.  allows
-- * the major_names array to be iterated over from outside this file
-- * must be called with the block_subsys_sem held
-- */
--void *get_next_blkdev(void *dev)
--{
--        struct blkdev_info *info;
--
--        if (dev == NULL) {
--                info = kmalloc(sizeof(*info), GFP_KERNEL);
--                if (!info)
--                        goto out;
--                info->index=0;
--                info->bd = major_names[info->index];
--                if (info->bd)
--                        goto out;
--        } else {
--                info = dev;
--        }
--
--        while (info->index < ARRAY_SIZE(major_names)) {
--                if (info->bd)
--                        info->bd = info->bd->next;
--                if (info->bd)
--                        goto out;
--                /*
--                 * No devices on this chain, move to the next
--                 */
--                info->index++;
--                info->bd = (info->index < ARRAY_SIZE(major_names)) ?
--			major_names[info->index] : NULL;
--                if (info->bd)
--                        goto out;
--        }
--
--out:
--        return info;
--}
--
--void *acquire_blkdev_list(void)
--{
--        down(&block_subsys_sem);
--        return get_next_blkdev(NULL);
--}
--
--void release_blkdev_list(void *dev)
--{
--        up(&block_subsys_sem);
--        kfree(dev);
-+	return major % BLKDEV_MAJOR_HASH_SIZE;
- }
- 
-+#ifdef CONFIG_PROC_FS
- 
--/*
-- * Count the number of records in the blkdev_list.
-- * must be called with the block_subsys_sem held
-- */
--int count_blkdev_list(void)
-+void blkdev_show(struct seq_file *f, off_t offset)
- {
--	struct blk_major_name *n;
--	int i, count;
-+	struct blk_major_name *dp;
- 
--	count = 0;
--
--	for (i = 0; i < ARRAY_SIZE(major_names); i++) {
--		for (n = major_names[i]; n; n = n->next)
--				count++;
-+	if (offset < BLKDEV_MAJOR_HASH_SIZE) {
-+		down(&block_subsys_sem);
-+		for (dp = major_names[offset]; dp; dp = dp->next)
-+			seq_printf(f, "%3d %s\n", dp->major, dp->name);
-+		up(&block_subsys_sem);
- 	}
--
--	return count;
--}
--
--/*
-- * extract the major and name values from a blkdev_info struct
-- * passed in as a void to *dev.  Must be called with
-- * block_subsys_sem held
-- */
--int get_blkdev_info(void *dev, int *major, char **name)
--{
--        struct blkdev_info *info = dev;
--
--        if (info->bd == NULL)
--                return 1;
--
--        *major = info->bd->major;
--        *name = info->bd->name;
--        return 0;
- }
- 
-+#endif /* CONFIG_PROC_FS */
- 
- int register_blkdev(unsigned int major, const char *name)
- {
-diff --git a/block/ll_rw_blk.c b/block/ll_rw_blk.c
-index 0ef2971..cd995c3 100644
---- a/block/ll_rw_blk.c
-+++ b/block/ll_rw_blk.c
-@@ -1719,8 +1719,21 @@ void blk_run_queue(struct request_queue 
- 
- 	spin_lock_irqsave(q->queue_lock, flags);
- 	blk_remove_plug(q);
--	if (!elv_queue_empty(q))
--		q->request_fn(q);
-+
-+	/*
-+	 * Only recurse once to avoid overrunning the stack, let the unplug
-+	 * handling reinvoke the handler shortly if we already got there.
-+	 */
-+	if (!elv_queue_empty(q)) {
-+		if (!test_and_set_bit(QUEUE_FLAG_REENTER, &q->queue_flags)) {
-+			q->request_fn(q);
-+			clear_bit(QUEUE_FLAG_REENTER, &q->queue_flags);
-+		} else {
-+			blk_plug_device(q);
-+			kblockd_schedule_work(&q->unplug_work);
-+		}
-+	}
-+
- 	spin_unlock_irqrestore(q->queue_lock, flags);
- }
- EXPORT_SYMBOL(blk_run_queue);
-diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c
-index 07a7f97..29f3d75 100644
---- a/drivers/base/cpu.c
-+++ b/drivers/base/cpu.c
-@@ -141,7 +141,7 @@ #endif
- 	return error;
- }
- 
--struct sys_device *get_cpu_sysdev(int cpu)
-+struct sys_device *get_cpu_sysdev(unsigned cpu)
- {
- 	if (cpu < NR_CPUS)
- 		return cpu_sys_devices[cpu];
-diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
-index e97e911..4723182 100644
---- a/drivers/base/firmware_class.c
-+++ b/drivers/base/firmware_class.c
-@@ -211,18 +211,20 @@ static int
- fw_realloc_buffer(struct firmware_priv *fw_priv, int min_size)
- {
- 	u8 *new_data;
-+	int new_size = fw_priv->alloc_size;
- 
- 	if (min_size <= fw_priv->alloc_size)
- 		return 0;
- 
--	new_data = vmalloc(fw_priv->alloc_size + PAGE_SIZE);
-+	new_size = ALIGN(min_size, PAGE_SIZE);
-+	new_data = vmalloc(new_size);
- 	if (!new_data) {
- 		printk(KERN_ERR "%s: unable to alloc buffer\n", __FUNCTION__);
- 		/* Make sure that we don't keep incomplete data */
- 		fw_load_abort(fw_priv);
- 		return -ENOMEM;
- 	}
--	fw_priv->alloc_size += PAGE_SIZE;
-+	fw_priv->alloc_size = new_size;
- 	if (fw_priv->fw->data) {
- 		memcpy(new_data, fw_priv->fw->data, fw_priv->fw->size);
- 		vfree(fw_priv->fw->data);
-diff --git a/drivers/base/node.c b/drivers/base/node.c
-index 16c513a..c80c3ae 100644
---- a/drivers/base/node.c
-+++ b/drivers/base/node.c
-@@ -106,7 +106,7 @@ static ssize_t node_read_numastat(struct
- 	other_node = 0;
- 	for (i = 0; i < MAX_NR_ZONES; i++) {
- 		struct zone *z = &pg->node_zones[i];
--		for (cpu = 0; cpu < NR_CPUS; cpu++) {
-+		for_each_online_cpu(cpu) {
- 			struct per_cpu_pageset *ps = zone_pcp(z,cpu);
- 			numa_hit += ps->numa_hit;
- 			numa_miss += ps->numa_miss;
-diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
-index 0d65394..71552e1 100644
---- a/drivers/block/cciss.c
-+++ b/drivers/block/cciss.c
-@@ -1181,6 +1181,53 @@ static int revalidate_allvol(ctlr_info_t
-         return 0;
- }
- 
-+static inline void complete_buffers(struct bio *bio, int status)
-+{
-+	while (bio) {
-+		struct bio *xbh = bio->bi_next;
-+		int nr_sectors = bio_sectors(bio);
-+
-+		bio->bi_next = NULL;
-+		blk_finished_io(len);
-+		bio_endio(bio, nr_sectors << 9, status ? 0 : -EIO);
-+		bio = xbh;
-+	}
-+
-+}
-+
-+static void cciss_softirq_done(struct request *rq)
-+{
-+	CommandList_struct *cmd = rq->completion_data;
-+	ctlr_info_t *h = hba[cmd->ctlr];
-+	unsigned long flags;
-+	u64bit temp64;
-+	int i, ddir;
-+
-+	if (cmd->Request.Type.Direction == XFER_READ)
-+		ddir = PCI_DMA_FROMDEVICE;
-+	else
-+		ddir = PCI_DMA_TODEVICE;
-+
-+	/* command did not need to be retried */
-+	/* unmap the DMA mapping for all the scatter gather elements */
-+	for(i=0; i<cmd->Header.SGList; i++) {
-+		temp64.val32.lower = cmd->SG[i].Addr.lower;
-+		temp64.val32.upper = cmd->SG[i].Addr.upper;
-+		pci_unmap_page(h->pdev, temp64.val, cmd->SG[i].Len, ddir);
-+	}
-+
-+	complete_buffers(rq->bio, rq->errors);
-+
-+#ifdef CCISS_DEBUG
-+	printk("Done with %p\n", rq);
-+#endif /* CCISS_DEBUG */
-+
-+	spin_lock_irqsave(&h->lock, flags);
-+	end_that_request_last(rq, rq->errors);
-+	cmd_free(h, cmd,1);
-+	spin_unlock_irqrestore(&h->lock, flags);
-+}
-+
- /* This function will check the usage_count of the drive to be updated/added.
-  * If the usage_count is zero then the drive information will be updated and
-  * the disk will be re-registered with the kernel.  If not then it will be
-@@ -1249,6 +1296,8 @@ static void cciss_update_drive_info(int 
- 
- 		blk_queue_max_sectors(disk->queue, 512);
- 
-+		blk_queue_softirq_done(disk->queue, cciss_softirq_done);
-+
- 		disk->queue->queuedata = hba[ctlr];
- 
- 		blk_queue_hardsect_size(disk->queue,
-@@ -2148,20 +2197,6 @@ static void start_io( ctlr_info_t *h)
- 		addQ (&(h->cmpQ), c); 
- 	}
- }
--
--static inline void complete_buffers(struct bio *bio, int status)
--{
--	while (bio) {
--		struct bio *xbh = bio->bi_next; 
--		int nr_sectors = bio_sectors(bio);
--
--		bio->bi_next = NULL; 
--		blk_finished_io(len);
--		bio_endio(bio, nr_sectors << 9, status ? 0 : -EIO);
--		bio = xbh;
--	}
--
--} 
- /* Assumes that CCISS_LOCK(h->ctlr) is held. */
- /* Zeros out the error record and then resends the command back */
- /* to the controller */
-@@ -2179,39 +2214,6 @@ static inline void resend_cciss_cmd( ctl
- 	start_io(h);
- }
- 
--static void cciss_softirq_done(struct request *rq)
--{
--	CommandList_struct *cmd = rq->completion_data;
--	ctlr_info_t *h = hba[cmd->ctlr];
--	unsigned long flags;
--	u64bit temp64;
--	int i, ddir;
--
--	if (cmd->Request.Type.Direction == XFER_READ)
--		ddir = PCI_DMA_FROMDEVICE;
--	else
--		ddir = PCI_DMA_TODEVICE;
--
--	/* command did not need to be retried */
--	/* unmap the DMA mapping for all the scatter gather elements */
--	for(i=0; i<cmd->Header.SGList; i++) {
--		temp64.val32.lower = cmd->SG[i].Addr.lower;
--		temp64.val32.upper = cmd->SG[i].Addr.upper;
--		pci_unmap_page(h->pdev, temp64.val, cmd->SG[i].Len, ddir);
--	}
--
--	complete_buffers(rq->bio, rq->errors);
--
--#ifdef CCISS_DEBUG
--	printk("Done with %p\n", rq);
--#endif /* CCISS_DEBUG */ 
--
--	spin_lock_irqsave(&h->lock, flags);
--	end_that_request_last(rq, rq->errors);
--	cmd_free(h, cmd,1);
--	spin_unlock_irqrestore(&h->lock, flags);
--}
--
- /* checks the status of the job and calls complete buffers to mark all 
-  * buffers for the completed job. Note that this function does not need
-  * to hold the hba/queue lock.
-@@ -3269,8 +3271,8 @@ clean2:
- 	unregister_blkdev(hba[i]->major, hba[i]->devname);
- clean1:
- 	release_io_mem(hba[i]);
--	free_hba(i);
- 	hba[i]->busy_initializing = 0;
-+	free_hba(i);
- 	return(-1);
- }
- 
-diff --git a/drivers/block/ub.c b/drivers/block/ub.c
-index f04d864..a9485e5 100644
---- a/drivers/block/ub.c
-+++ b/drivers/block/ub.c
-@@ -704,6 +704,9 @@ static void ub_cleanup(struct ub_dev *sc
- 		kfree(lun);
- 	}
- 
-+	usb_set_intfdata(sc->intf, NULL);
-+	usb_put_intf(sc->intf);
-+	usb_put_dev(sc->dev);
- 	kfree(sc);
- }
- 
-@@ -2428,7 +2431,12 @@ static int ub_probe(struct usb_interface
- 	// sc->ifnum = intf->cur_altsetting->desc.bInterfaceNumber;
- 	usb_set_intfdata(intf, sc);
- 	usb_get_dev(sc->dev);
--	// usb_get_intf(sc->intf);	/* Do we need this? */
-+	/*
-+	 * Since we give the interface struct to the block level through
-+	 * disk->driverfs_dev, we have to pin it. Otherwise, block_uevent
-+	 * oopses on close after a disconnect (kernels 2.6.16 and up).
-+	 */
-+	usb_get_intf(sc->intf);
- 
- 	snprintf(sc->name, 12, DRV_NAME "(%d.%d)",
- 	    sc->dev->bus->busnum, sc->dev->devnum);
-@@ -2509,7 +2517,7 @@ #endif
- err_diag:
- err_dev_desc:
- 	usb_set_intfdata(intf, NULL);
--	// usb_put_intf(sc->intf);
-+	usb_put_intf(sc->intf);
- 	usb_put_dev(sc->dev);
- 	kfree(sc);
- err_core:
-@@ -2688,12 +2696,6 @@ static void ub_disconnect(struct usb_int
- 	 */
- 
- 	device_remove_file(&sc->intf->dev, &dev_attr_diag);
--	usb_set_intfdata(intf, NULL);
--	// usb_put_intf(sc->intf);
--	sc->intf = NULL;
--	usb_put_dev(sc->dev);
--	sc->dev = NULL;
--
- 	ub_put(sc);
- }
- 
-diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
-index 05ba410..8b72a61 100644
---- a/drivers/char/Kconfig
-+++ b/drivers/char/Kconfig
-@@ -187,6 +187,7 @@ config MOXA_SMARTIO
- config ISI
- 	tristate "Multi-Tech multiport card support (EXPERIMENTAL)"
- 	depends on SERIAL_NONSTANDARD
-+	select FW_LOADER
- 	help
- 	  This is a driver for the Multi-Tech cards which provide several
- 	  serial ports.  The driver is experimental and can currently only be
-diff --git a/drivers/char/agp/efficeon-agp.c b/drivers/char/agp/efficeon-agp.c
-index e7aea77..40dfc29 100644
---- a/drivers/char/agp/efficeon-agp.c
-+++ b/drivers/char/agp/efficeon-agp.c
-@@ -64,6 +64,12 @@ static struct gatt_mask efficeon_generic
- 	{.mask = 0x00000001, .type = 0}
- };
- 
-+/* This function does the same thing as mask_memory() for this chipset... */
-+static inline unsigned long efficeon_mask_memory(unsigned long addr)
-+{
-+	return addr | 0x00000001;
-+}
-+
- static struct aper_size_info_lvl2 efficeon_generic_sizes[4] =
- {
- 	{256, 65536, 0},
-@@ -251,7 +257,7 @@ static int efficeon_insert_memory(struct
- 	last_page = NULL;
- 	for (i = 0; i < count; i++) {
- 		int index = pg_start + i;
--		unsigned long insert = mem->memory[i];
-+		unsigned long insert = efficeon_mask_memory(mem->memory[i]);
- 
- 		page = (unsigned int *) efficeon_private.l1_table[index >> 10];
- 
-diff --git a/drivers/char/cs5535_gpio.c b/drivers/char/cs5535_gpio.c
-index 5d72f50..46d6603 100644
---- a/drivers/char/cs5535_gpio.c
-+++ b/drivers/char/cs5535_gpio.c
-@@ -241,9 +241,10 @@ static int __init cs5535_gpio_init(void)
- static void __exit cs5535_gpio_cleanup(void)
- {
- 	dev_t dev_id = MKDEV(major, 0);
-+
-+	cdev_del(&cs5535_gpio_cdev);
- 	unregister_chrdev_region(dev_id, CS5535_GPIO_COUNT);
--	if (gpio_base != 0)
--		release_region(gpio_base, CS5535_GPIO_SIZE);
-+	release_region(gpio_base, CS5535_GPIO_SIZE);
- }
- 
- module_init(cs5535_gpio_init);
-diff --git a/drivers/char/ipmi/ipmi_bt_sm.c b/drivers/char/ipmi/ipmi_bt_sm.c
-index 58dcdee..0030cd8 100644
---- a/drivers/char/ipmi/ipmi_bt_sm.c
-+++ b/drivers/char/ipmi/ipmi_bt_sm.c
-@@ -165,7 +165,7 @@ static int bt_start_transaction(struct s
- {
- 	unsigned int i;
- 
--	if ((size < 2) || (size > IPMI_MAX_MSG_LENGTH))
-+	if ((size < 2) || (size > (IPMI_MAX_MSG_LENGTH - 2)))
- 	       return -1;
- 
- 	if ((bt->state != BT_STATE_IDLE) && (bt->state != BT_STATE_HOSED))
-diff --git a/drivers/char/pcmcia/cm4000_cs.c b/drivers/char/pcmcia/cm4000_cs.c
-index 5fdf185..b61354a 100644
---- a/drivers/char/pcmcia/cm4000_cs.c
-+++ b/drivers/char/pcmcia/cm4000_cs.c
-@@ -2010,10 +2010,6 @@ static int __init cmm_init(void)
- 	if (!cmm_class)
- 		return -1;
- 
--	rc = pcmcia_register_driver(&cm4000_driver);
--	if (rc < 0)
--		return rc;
--
- 	major = register_chrdev(0, DEVICE_NAME, &cm4000_fops);
- 	if (major < 0) {
- 		printk(KERN_WARNING MODULE_NAME
-@@ -2021,6 +2017,12 @@ static int __init cmm_init(void)
- 		return -1;
- 	}
- 
-+	rc = pcmcia_register_driver(&cm4000_driver);
-+	if (rc < 0) {
-+		unregister_chrdev(major, DEVICE_NAME);
-+		return rc;
-+	}
-+
- 	return 0;
- }
- 
-diff --git a/drivers/char/pcmcia/cm4040_cs.c b/drivers/char/pcmcia/cm4040_cs.c
-index 466e33b..744b57d 100644
---- a/drivers/char/pcmcia/cm4040_cs.c
-+++ b/drivers/char/pcmcia/cm4040_cs.c
-@@ -769,16 +769,19 @@ static int __init cm4040_init(void)
- 	if (!cmx_class)
- 		return -1;
- 
--	rc = pcmcia_register_driver(&reader_driver);
--	if (rc < 0)
--		return rc;
--
- 	major = register_chrdev(0, DEVICE_NAME, &reader_fops);
- 	if (major < 0) {
- 		printk(KERN_WARNING MODULE_NAME
- 			": could not get major number\n");
- 		return -1;
- 	}
-+
-+	rc = pcmcia_register_driver(&reader_driver);
-+	if (rc < 0) {
-+		unregister_chrdev(major, DEVICE_NAME);
-+		return rc;
-+	}
-+
- 	return 0;
- }
- 
-diff --git a/drivers/char/snsc.c b/drivers/char/snsc.c
-index 0e7d216..d22da98 100644
---- a/drivers/char/snsc.c
-+++ b/drivers/char/snsc.c
-@@ -391,7 +391,8 @@ scdrv_init(void)
- 			format_module_id(devnamep, geo_module(geoid),
- 					 MODULE_FORMAT_BRIEF);
- 			devnamep = devname + strlen(devname);
--			sprintf(devnamep, "#%d", geo_slab(geoid));
-+			sprintf(devnamep, "^%d#%d", geo_slot(geoid),
-+				geo_slab(geoid));
- 
- 			/* allocate sysctl device data */
- 			scd = kmalloc(sizeof (struct sysctl_data_s),
-diff --git a/drivers/char/sonypi.c b/drivers/char/sonypi.c
-index f8dd852..a90f5d9 100644
---- a/drivers/char/sonypi.c
-+++ b/drivers/char/sonypi.c
-@@ -1341,6 +1341,9 @@ static int __devinit sonypi_probe(struct
- 	else if ((pcidev = pci_get_device(PCI_VENDOR_ID_INTEL,
- 					  PCI_DEVICE_ID_INTEL_ICH6_1, NULL)))
- 		sonypi_device.model = SONYPI_DEVICE_MODEL_TYPE3;
-+	else if ((pcidev = pci_get_device(PCI_VENDOR_ID_INTEL,
-+					  PCI_DEVICE_ID_INTEL_ICH7_1, NULL)))
-+		sonypi_device.model = SONYPI_DEVICE_MODEL_TYPE3;
- 	else
- 		sonypi_device.model = SONYPI_DEVICE_MODEL_TYPE2;
- 
-diff --git a/drivers/char/tipar.c b/drivers/char/tipar.c
-index eb2eb3e..079db5a 100644
---- a/drivers/char/tipar.c
-+++ b/drivers/char/tipar.c
-@@ -515,7 +515,7 @@ tipar_init_module(void)
- 		err = PTR_ERR(tipar_class);
- 		goto out_chrdev;
- 	}
--	if (parport_register_driver(&tipar_driver) || tp_count == 0) {
-+	if (parport_register_driver(&tipar_driver)) {
- 		printk(KERN_ERR "tipar: unable to register with parport\n");
- 		err = -EIO;
- 		goto out_class;
-diff --git a/drivers/char/tlclk.c b/drivers/char/tlclk.c
-index 4c27218..f58ad7f 100644
---- a/drivers/char/tlclk.c
-+++ b/drivers/char/tlclk.c
-@@ -327,7 +327,7 @@ static ssize_t store_received_ref_clk3a(
- 	return strnlen(buf, count);
- }
- 
--static DEVICE_ATTR(received_ref_clk3a, S_IWUGO, NULL,
-+static DEVICE_ATTR(received_ref_clk3a, (S_IWUSR|S_IWGRP), NULL,
- 		store_received_ref_clk3a);
- 
- 
-@@ -349,7 +349,7 @@ static ssize_t store_received_ref_clk3b(
- 	return strnlen(buf, count);
- }
- 
--static DEVICE_ATTR(received_ref_clk3b, S_IWUGO, NULL,
-+static DEVICE_ATTR(received_ref_clk3b, (S_IWUSR|S_IWGRP), NULL,
- 		store_received_ref_clk3b);
- 
- 
-@@ -371,7 +371,7 @@ static ssize_t store_enable_clk3b_output
- 	return strnlen(buf, count);
- }
- 
--static DEVICE_ATTR(enable_clk3b_output, S_IWUGO, NULL,
-+static DEVICE_ATTR(enable_clk3b_output, (S_IWUSR|S_IWGRP), NULL,
- 		store_enable_clk3b_output);
- 
- static ssize_t store_enable_clk3a_output(struct device *d,
-@@ -392,7 +392,7 @@ static ssize_t store_enable_clk3a_output
- 	return strnlen(buf, count);
- }
- 
--static DEVICE_ATTR(enable_clk3a_output, S_IWUGO, NULL,
-+static DEVICE_ATTR(enable_clk3a_output, (S_IWUSR|S_IWGRP), NULL,
- 		store_enable_clk3a_output);
- 
- static ssize_t store_enable_clkb1_output(struct device *d,
-@@ -413,7 +413,7 @@ static ssize_t store_enable_clkb1_output
- 	return strnlen(buf, count);
- }
- 
--static DEVICE_ATTR(enable_clkb1_output, S_IWUGO, NULL,
-+static DEVICE_ATTR(enable_clkb1_output, (S_IWUSR|S_IWGRP), NULL,
- 		store_enable_clkb1_output);
- 
- 
-@@ -435,7 +435,7 @@ static ssize_t store_enable_clka1_output
- 	return strnlen(buf, count);
- }
- 
--static DEVICE_ATTR(enable_clka1_output, S_IWUGO, NULL,
-+static DEVICE_ATTR(enable_clka1_output, (S_IWUSR|S_IWGRP), NULL,
- 		store_enable_clka1_output);
- 
- static ssize_t store_enable_clkb0_output(struct device *d,
-@@ -456,7 +456,7 @@ static ssize_t store_enable_clkb0_output
- 	return strnlen(buf, count);
- }
- 
--static DEVICE_ATTR(enable_clkb0_output, S_IWUGO, NULL,
-+static DEVICE_ATTR(enable_clkb0_output, (S_IWUSR|S_IWGRP), NULL,
- 		store_enable_clkb0_output);
- 
- static ssize_t store_enable_clka0_output(struct device *d,
-@@ -477,7 +477,7 @@ static ssize_t store_enable_clka0_output
- 	return strnlen(buf, count);
- }
- 
--static DEVICE_ATTR(enable_clka0_output, S_IWUGO, NULL,
-+static DEVICE_ATTR(enable_clka0_output, (S_IWUSR|S_IWGRP), NULL,
- 		store_enable_clka0_output);
- 
- static ssize_t store_select_amcb2_transmit_clock(struct device *d,
-@@ -519,7 +519,7 @@ static ssize_t store_select_amcb2_transm
- 	return strnlen(buf, count);
- }
- 
--static DEVICE_ATTR(select_amcb2_transmit_clock, S_IWUGO, NULL,
-+static DEVICE_ATTR(select_amcb2_transmit_clock, (S_IWUSR|S_IWGRP), NULL,
- 	store_select_amcb2_transmit_clock);
- 
- static ssize_t store_select_amcb1_transmit_clock(struct device *d,
-@@ -560,7 +560,7 @@ static ssize_t store_select_amcb1_transm
- 	return strnlen(buf, count);
- }
- 
--static DEVICE_ATTR(select_amcb1_transmit_clock, S_IWUGO, NULL,
-+static DEVICE_ATTR(select_amcb1_transmit_clock, (S_IWUSR|S_IWGRP), NULL,
- 		store_select_amcb1_transmit_clock);
- 
- static ssize_t store_select_redundant_clock(struct device *d,
-@@ -581,7 +581,7 @@ static ssize_t store_select_redundant_cl
- 	return strnlen(buf, count);
- }
- 
--static DEVICE_ATTR(select_redundant_clock, S_IWUGO, NULL,
-+static DEVICE_ATTR(select_redundant_clock, (S_IWUSR|S_IWGRP), NULL,
- 		store_select_redundant_clock);
- 
- static ssize_t store_select_ref_frequency(struct device *d,
-@@ -602,7 +602,7 @@ static ssize_t store_select_ref_frequenc
- 	return strnlen(buf, count);
- }
- 
--static DEVICE_ATTR(select_ref_frequency, S_IWUGO, NULL,
-+static DEVICE_ATTR(select_ref_frequency, (S_IWUSR|S_IWGRP), NULL,
- 		store_select_ref_frequency);
- 
- static ssize_t store_filter_select(struct device *d,
-@@ -623,7 +623,7 @@ static ssize_t store_filter_select(struc
- 	return strnlen(buf, count);
- }
- 
--static DEVICE_ATTR(filter_select, S_IWUGO, NULL, store_filter_select);
-+static DEVICE_ATTR(filter_select, (S_IWUSR|S_IWGRP), NULL, store_filter_select);
- 
- static ssize_t store_hardware_switching_mode(struct device *d,
- 		 struct device_attribute *attr, const char *buf, size_t count)
-@@ -643,7 +643,7 @@ static ssize_t store_hardware_switching_
- 	return strnlen(buf, count);
- }
- 
--static DEVICE_ATTR(hardware_switching_mode, S_IWUGO, NULL,
-+static DEVICE_ATTR(hardware_switching_mode, (S_IWUSR|S_IWGRP), NULL,
- 		store_hardware_switching_mode);
- 
- static ssize_t store_hardware_switching(struct device *d,
-@@ -664,7 +664,7 @@ static ssize_t store_hardware_switching(
- 	return strnlen(buf, count);
- }
- 
--static DEVICE_ATTR(hardware_switching, S_IWUGO, NULL,
-+static DEVICE_ATTR(hardware_switching, (S_IWUSR|S_IWGRP), NULL,
- 		store_hardware_switching);
- 
- static ssize_t store_refalign (struct device *d,
-@@ -684,7 +684,7 @@ static ssize_t store_refalign (struct de
- 	return strnlen(buf, count);
- }
- 
--static DEVICE_ATTR(refalign, S_IWUGO, NULL, store_refalign);
-+static DEVICE_ATTR(refalign, (S_IWUSR|S_IWGRP), NULL, store_refalign);
- 
- static ssize_t store_mode_select (struct device *d,
- 		 struct device_attribute *attr, const char *buf, size_t count)
-@@ -704,7 +704,7 @@ static ssize_t store_mode_select (struct
- 	return strnlen(buf, count);
- }
- 
--static DEVICE_ATTR(mode_select, S_IWUGO, NULL, store_mode_select);
-+static DEVICE_ATTR(mode_select, (S_IWUSR|S_IWGRP), NULL, store_mode_select);
- 
- static ssize_t store_reset (struct device *d,
- 		 struct device_attribute *attr, const char *buf, size_t count)
-@@ -724,7 +724,7 @@ static ssize_t store_reset (struct devic
- 	return strnlen(buf, count);
- }
- 
--static DEVICE_ATTR(reset, S_IWUGO, NULL, store_reset);
-+static DEVICE_ATTR(reset, (S_IWUSR|S_IWGRP), NULL, store_reset);
- 
- static struct attribute *tlclk_sysfs_entries[] = {
- 	&dev_attr_current_ref.attr,
-@@ -767,6 +767,7 @@ static int __init tlclk_init(void)
- 		printk(KERN_ERR "tlclk: can't get major %d.\n", tlclk_major);
- 		return ret;
- 	}
-+	tlclk_major = ret;
- 	alarm_events = kzalloc( sizeof(struct tlclk_alarms), GFP_KERNEL);
- 	if (!alarm_events)
- 		goto out1;
-diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
-index 53d3d06..edaee70 100644
---- a/drivers/char/tty_io.c
-+++ b/drivers/char/tty_io.c
-@@ -2706,7 +2706,11 @@ #else
- 		}
- 		task_lock(p);
- 		if (p->files) {
--			rcu_read_lock();
-+			/*
-+			 * We don't take a ref to the file, so we must
-+			 * hold ->file_lock instead.
-+			 */
-+			spin_lock(&p->files->file_lock);
- 			fdt = files_fdtable(p->files);
- 			for (i=0; i < fdt->max_fds; i++) {
- 				filp = fcheck_files(p->files, i);
-@@ -2721,7 +2725,7 @@ #else
- 					break;
- 				}
- 			}
--			rcu_read_unlock();
-+			spin_unlock(&p->files->file_lock);
- 		}
- 		task_unlock(p);
- 	} while_each_task_pid(session, PIDTYPE_SID, p);
-diff --git a/drivers/edac/Kconfig b/drivers/edac/Kconfig
-index 52f3eb4..7ecdb1e 100644
---- a/drivers/edac/Kconfig
-+++ b/drivers/edac/Kconfig
-@@ -71,7 +71,7 @@ config EDAC_E7XXX
- 
- config EDAC_E752X
- 	tristate "Intel e752x (e7520, e7525, e7320)"
--	depends on EDAC_MM_EDAC && PCI
-+	depends on EDAC_MM_EDAC && PCI && HOTPLUG
- 	help
- 	  Support for error detection and correction on the Intel
- 	  E7520, E7525, E7320 server chipsets.
-diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
-index 8e0f315..dfca749 100644
---- a/drivers/i2c/busses/i2c-i801.c
-+++ b/drivers/i2c/busses/i2c-i801.c
-@@ -478,6 +478,11 @@ static s32 i801_access(struct i2c_adapte
- 		ret = i801_transaction();
- 	}
- 
-+	/* Some BIOSes don't like it when PEC is enabled at reboot or resume
-+	   time, so we forcibly disable it after every transaction. */
-+	if (hwpec)
-+		outb_p(0, SMBAUXCTL);
-+
- 	if(block)
- 		return ret;
- 	if(ret)
-diff --git a/drivers/i2c/busses/scx200_acb.c b/drivers/i2c/busses/scx200_acb.c
-index d3478e0..ad44dd5 100644
---- a/drivers/i2c/busses/scx200_acb.c
-+++ b/drivers/i2c/busses/scx200_acb.c
-@@ -440,7 +440,6 @@ static int  __init scx200_acb_create(int
- 	struct scx200_acb_iface *iface;
- 	struct i2c_adapter *adapter;
- 	int rc = 0;
--	char description[64];
- 
- 	iface = kzalloc(sizeof(*iface), GFP_KERNEL);
- 	if (!iface) {
-@@ -459,8 +458,7 @@ static int  __init scx200_acb_create(int
- 
- 	init_MUTEX(&iface->sem);
- 
--	snprintf(description, sizeof(description), "NatSemi SCx200 ACCESS.bus [%s]", adapter->name);
--	if (request_region(base, 8, description) == 0) {
-+	if (!request_region(base, 8, adapter->name)) {
- 		dev_err(&adapter->dev, "can't allocate io 0x%x-0x%x\n",
- 			base, base + 8-1);
- 		rc = -EBUSY;
-diff --git a/drivers/i2c/chips/m41t00.c b/drivers/i2c/chips/m41t00.c
-index 2dc3d48..2836fb3 100644
---- a/drivers/i2c/chips/m41t00.c
-+++ b/drivers/i2c/chips/m41t00.c
-@@ -129,13 +129,13 @@ m41t00_set_tlet(ulong arg)
- 	if ((i2c_smbus_write_byte_data(save_client, 0, tm.tm_sec & 0x7f) < 0)
- 		|| (i2c_smbus_write_byte_data(save_client, 1, tm.tm_min & 0x7f)
- 			< 0)
--		|| (i2c_smbus_write_byte_data(save_client, 2, tm.tm_hour & 0x7f)
-+		|| (i2c_smbus_write_byte_data(save_client, 2, tm.tm_hour & 0x3f)
- 			< 0)
--		|| (i2c_smbus_write_byte_data(save_client, 4, tm.tm_mday & 0x7f)
-+		|| (i2c_smbus_write_byte_data(save_client, 4, tm.tm_mday & 0x3f)
- 			< 0)
--		|| (i2c_smbus_write_byte_data(save_client, 5, tm.tm_mon & 0x7f)
-+		|| (i2c_smbus_write_byte_data(save_client, 5, tm.tm_mon & 0x1f)
- 			< 0)
--		|| (i2c_smbus_write_byte_data(save_client, 6, tm.tm_year & 0x7f)
-+		|| (i2c_smbus_write_byte_data(save_client, 6, tm.tm_year & 0xff)
- 			< 0))
- 
- 		dev_warn(&save_client->dev,"m41t00: can't write to rtc chip\n");
-diff --git a/drivers/ide/pci/alim15x3.c b/drivers/ide/pci/alim15x3.c
-index cf84350..8b24b4f 100644
---- a/drivers/ide/pci/alim15x3.c
-+++ b/drivers/ide/pci/alim15x3.c
-@@ -731,6 +731,8 @@ static unsigned int __devinit ata66_ali1
- 	
- 	if(m5229_revision <= 0x20)
- 		tmpbyte = (tmpbyte & (~0x02)) | 0x01;
-+	else if (m5229_revision == 0xc7)
-+		tmpbyte |= 0x03;
- 	else
- 		tmpbyte |= 0x01;
- 
-diff --git a/drivers/ieee1394/ohci1394.c b/drivers/ieee1394/ohci1394.c
-index b6b96fa..a9a73f7 100644
---- a/drivers/ieee1394/ohci1394.c
-+++ b/drivers/ieee1394/ohci1394.c
-@@ -2525,7 +2525,7 @@ static irqreturn_t ohci_irq_handler(int 
- 			if (phys_dma) {
- 				reg_write(ohci,OHCI1394_PhyReqFilterHiSet, 0xffffffff);
- 				reg_write(ohci,OHCI1394_PhyReqFilterLoSet, 0xffffffff);
--				reg_write(ohci,OHCI1394_PhyUpperBound, 0xffff0000);
-+				reg_write(ohci,OHCI1394_PhyUpperBound, 0x01000000);
- 			} else {
- 				reg_write(ohci,OHCI1394_PhyReqFilterHiSet, 0x00000000);
- 				reg_write(ohci,OHCI1394_PhyReqFilterLoSet, 0x00000000);
-diff --git a/drivers/ieee1394/sbp2.c b/drivers/ieee1394/sbp2.c
-index eca92eb..d02be4a 100644
---- a/drivers/ieee1394/sbp2.c
-+++ b/drivers/ieee1394/sbp2.c
-@@ -495,22 +495,17 @@ static struct sbp2_command_info *sbp2uti
- /*
-  * This function finds the sbp2_command for a given outstanding SCpnt.
-  * Only looks at the inuse list.
-+ * Must be called with scsi_id->sbp2_command_orb_lock held.
-  */
--static struct sbp2_command_info *sbp2util_find_command_for_SCpnt(struct scsi_id_instance_data *scsi_id, void *SCpnt)
-+static struct sbp2_command_info *sbp2util_find_command_for_SCpnt(
-+		struct scsi_id_instance_data *scsi_id, void *SCpnt)
- {
- 	struct sbp2_command_info *command;
--	unsigned long flags;
- 
--	spin_lock_irqsave(&scsi_id->sbp2_command_orb_lock, flags);
--	if (!list_empty(&scsi_id->sbp2_command_orb_inuse)) {
--		list_for_each_entry(command, &scsi_id->sbp2_command_orb_inuse, list) {
--			if (command->Current_SCpnt == SCpnt) {
--				spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags);
-+	if (!list_empty(&scsi_id->sbp2_command_orb_inuse))
-+		list_for_each_entry(command, &scsi_id->sbp2_command_orb_inuse, list)
-+			if (command->Current_SCpnt == SCpnt)
- 				return command;
--			}
--		}
--	}
--	spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags);
- 	return NULL;
- }
- 
-@@ -579,17 +574,15 @@ static void sbp2util_free_command_dma(st
- 
- /*
-  * This function moves a command to the completed orb list.
-+ * Must be called with scsi_id->sbp2_command_orb_lock held.
-  */
--static void sbp2util_mark_command_completed(struct scsi_id_instance_data *scsi_id,
--					    struct sbp2_command_info *command)
-+static void sbp2util_mark_command_completed(
-+		struct scsi_id_instance_data *scsi_id,
-+		struct sbp2_command_info *command)
- {
--	unsigned long flags;
--
--	spin_lock_irqsave(&scsi_id->sbp2_command_orb_lock, flags);
- 	list_del(&command->list);
- 	sbp2util_free_command_dma(command);
- 	list_add_tail(&command->list, &scsi_id->sbp2_command_orb_completed);
--	spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags);
- }
- 
- /*
-@@ -761,12 +754,17 @@ #endif
- 
- 	/* Register the status FIFO address range. We could use the same FIFO
- 	 * for targets at different nodes. However we need different FIFOs per
--	 * target in order to support multi-unit devices. */
-+	 * target in order to support multi-unit devices.
-+	 * The FIFO is located out of the local host controller's physical range
-+	 * but, if possible, within the posted write area. Status writes will
-+	 * then be performed as unified transactions. This slightly reduces
-+	 * bandwidth usage, and some Prolific based devices seem to require it.
-+	 */
- 	scsi_id->status_fifo_addr = hpsb_allocate_and_register_addrspace(
- 			&sbp2_highlevel, ud->ne->host, &sbp2_ops,
- 			sizeof(struct sbp2_status_block), sizeof(quadlet_t),
--			~0ULL, ~0ULL);
--	if (!scsi_id->status_fifo_addr) {
-+			0x010000000000ULL, CSR1212_ALL_SPACE_END);
-+	if (scsi_id->status_fifo_addr == ~0ULL) {
- 		SBP2_ERR("failed to allocate status FIFO address range");
- 		goto failed_alloc;
- 	}
-@@ -2177,7 +2175,9 @@ static int sbp2_handle_status_write(stru
- 		 * Matched status with command, now grab scsi command pointers and check status
- 		 */
- 		SCpnt = command->Current_SCpnt;
-+		spin_lock_irqsave(&scsi_id->sbp2_command_orb_lock, flags);
- 		sbp2util_mark_command_completed(scsi_id, command);
-+		spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags);
- 
- 		if (SCpnt) {
- 
-@@ -2491,9 +2491,20 @@ static int sbp2scsi_slave_alloc(struct s
- 
- static int sbp2scsi_slave_configure(struct scsi_device *sdev)
- {
-+	struct scsi_id_instance_data *scsi_id =
-+		(struct scsi_id_instance_data *)sdev->host->hostdata[0];
-+
- 	blk_queue_dma_alignment(sdev->request_queue, (512 - 1));
- 	sdev->use_10_for_rw = 1;
- 	sdev->use_10_for_ms = 1;
-+
-+	if ((scsi_id->sbp2_firmware_revision & 0xffff00) == 0x0a2700 &&
-+	    (scsi_id->ud->model_id == 0x000021 /* gen.4 iPod */ ||
-+	     scsi_id->ud->model_id == 0x000023 /* iPod mini  */ ||
-+	     scsi_id->ud->model_id == 0x00007e /* iPod Photo */ )) {
-+		SBP2_INFO("enabling iPod workaround: decrement disk capacity");
-+		sdev->fix_capacity = 1;
-+	}
- 	return 0;
- }
- 
-@@ -2513,6 +2524,7 @@ static int sbp2scsi_abort(struct scsi_cm
- 		(struct scsi_id_instance_data *)SCpnt->device->host->hostdata[0];
- 	struct sbp2scsi_host_info *hi = scsi_id->hi;
- 	struct sbp2_command_info *command;
-+	unsigned long flags;
- 
- 	SBP2_ERR("aborting sbp2 command");
- 	scsi_print_command(SCpnt);
-@@ -2523,6 +2535,7 @@ static int sbp2scsi_abort(struct scsi_cm
- 		 * Right now, just return any matching command structures
- 		 * to the free pool.
- 		 */
-+		spin_lock_irqsave(&scsi_id->sbp2_command_orb_lock, flags);
- 		command = sbp2util_find_command_for_SCpnt(scsi_id, SCpnt);
- 		if (command) {
- 			SBP2_DEBUG("Found command to abort");
-@@ -2540,6 +2553,7 @@ static int sbp2scsi_abort(struct scsi_cm
- 				command->Current_done(command->Current_SCpnt);
- 			}
- 		}
-+		spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags);
- 
- 		/*
- 		 * Initiate a fetch agent reset.
-diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
-index ad62174..b2bed1a 100644
---- a/drivers/input/mouse/psmouse-base.c
-+++ b/drivers/input/mouse/psmouse-base.c
-@@ -300,8 +300,10 @@ static irqreturn_t psmouse_interrupt(str
-  * Check if this is a new device announcement (0xAA 0x00)
-  */
- 	if (unlikely(psmouse->packet[0] == PSMOUSE_RET_BAT && psmouse->pktcnt <= 2)) {
--		if (psmouse->pktcnt == 1)
-+		if (psmouse->pktcnt == 1) {
-+			psmouse->last = jiffies;
- 			goto out;
-+		}
- 
- 		if (psmouse->packet[1] == PSMOUSE_RET_ID) {
- 			__psmouse_set_state(psmouse, PSMOUSE_IGNORE);
-diff --git a/drivers/macintosh/therm_adt746x.c b/drivers/macintosh/therm_adt746x.c
-index 5ebfd1d..5282fec 100644
---- a/drivers/macintosh/therm_adt746x.c
-+++ b/drivers/macintosh/therm_adt746x.c
-@@ -627,8 +627,8 @@ thermostat_init(void)
- 	if(therm_type == ADT7460)
- 		device_create_file(&of_dev->dev, &dev_attr_sensor2_fan_speed);
- 
--#ifndef CONFIG_I2C_KEYWEST
--	request_module("i2c-keywest");
-+#ifndef CONFIG_I2C_POWERMAC
-+	request_module("i2c-powermac");
- #endif
- 
- 	return i2c_add_driver(&thermostat_driver);
-diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
-index f3759dd..1ed241d 100644
---- a/drivers/md/dm-snap.c
-+++ b/drivers/md/dm-snap.c
-@@ -542,8 +542,12 @@ static void snapshot_dtr(struct dm_targe
- {
- 	struct dm_snapshot *s = (struct dm_snapshot *) ti->private;
- 
-+	/* Prevent further origin writes from using this snapshot. */
-+	/* After this returns there can be no new kcopyd jobs. */
- 	unregister_snapshot(s);
- 
-+	kcopyd_client_destroy(s->kcopyd_client);
-+
- 	exit_exception_table(&s->pending, pending_cache);
- 	exit_exception_table(&s->complete, exception_cache);
- 
-@@ -552,7 +556,7 @@ static void snapshot_dtr(struct dm_targe
- 
- 	dm_put_device(ti, s->origin);
- 	dm_put_device(ti, s->cow);
--	kcopyd_client_destroy(s->kcopyd_client);
-+
- 	kfree(s);
- }
- 
-diff --git a/drivers/md/dm.c b/drivers/md/dm.c
-index 745ca1f..f6c8e8e 100644
---- a/drivers/md/dm.c
-+++ b/drivers/md/dm.c
-@@ -533,30 +533,35 @@ static void __clone_and_map(struct clone
- 
- 	} else {
- 		/*
--		 * Create two copy bios to deal with io that has
--		 * been split across a target.
-+		 * Handle a bvec that must be split between two or more targets.
- 		 */
- 		struct bio_vec *bv = bio->bi_io_vec + ci->idx;
-+		sector_t remaining = to_sector(bv->bv_len);
-+		unsigned int offset = 0;
- 
--		clone = split_bvec(bio, ci->sector, ci->idx,
--				   bv->bv_offset, max);
--		__map_bio(ti, clone, tio);
-+		do {
-+			if (offset) {
-+				ti = dm_table_find_target(ci->map, ci->sector);
-+				max = max_io_len(ci->md, ci->sector, ti);
- 
--		ci->sector += max;
--		ci->sector_count -= max;
--		ti = dm_table_find_target(ci->map, ci->sector);
--
--		len = to_sector(bv->bv_len) - max;
--		clone = split_bvec(bio, ci->sector, ci->idx,
--				   bv->bv_offset + to_bytes(max), len);
--		tio = alloc_tio(ci->md);
--		tio->io = ci->io;
--		tio->ti = ti;
--		memset(&tio->info, 0, sizeof(tio->info));
--		__map_bio(ti, clone, tio);
-+				tio = alloc_tio(ci->md);
-+				tio->io = ci->io;
-+				tio->ti = ti;
-+				memset(&tio->info, 0, sizeof(tio->info));
-+			}
-+
-+			len = min(remaining, max);
-+
-+			clone = split_bvec(bio, ci->sector, ci->idx,
-+					   bv->bv_offset + offset, len);
-+
-+			__map_bio(ti, clone, tio);
-+
-+			ci->sector += len;
-+			ci->sector_count -= len;
-+			offset += to_bytes(len);
-+		} while (remaining -= len);
- 
--		ci->sector += len;
--		ci->sector_count -= len;
- 		ci->idx++;
- 	}
- }
-@@ -1093,6 +1098,7 @@ int dm_suspend(struct mapped_device *md,
- {
- 	struct dm_table *map = NULL;
- 	DECLARE_WAITQUEUE(wait, current);
-+	struct bio *def;
- 	int r = -EINVAL;
- 
- 	down(&md->suspend_lock);
-@@ -1152,9 +1158,11 @@ int dm_suspend(struct mapped_device *md,
- 	/* were we interrupted ? */
- 	r = -EINTR;
- 	if (atomic_read(&md->pending)) {
-+		clear_bit(DMF_BLOCK_IO, &md->flags);
-+		def = bio_list_get(&md->deferred);
-+		__flush_deferred_io(md, def);
- 		up_write(&md->io_lock);
- 		unlock_fs(md);
--		clear_bit(DMF_BLOCK_IO, &md->flags);
- 		goto out;
- 	}
- 	up_write(&md->io_lock);
-diff --git a/drivers/md/kcopyd.c b/drivers/md/kcopyd.c
-index 8b3515f..fc009cb 100644
---- a/drivers/md/kcopyd.c
-+++ b/drivers/md/kcopyd.c
-@@ -44,6 +44,9 @@ struct kcopyd_client {
- 	struct page_list *pages;
- 	unsigned int nr_pages;
- 	unsigned int nr_free_pages;
-+
-+	wait_queue_head_t destroyq;
-+	atomic_t nr_jobs;
- };
- 
- static struct page_list *alloc_pl(void)
-@@ -293,10 +296,15 @@ static int run_complete_job(struct kcopy
- 	int read_err = job->read_err;
- 	unsigned int write_err = job->write_err;
- 	kcopyd_notify_fn fn = job->fn;
-+	struct kcopyd_client *kc = job->kc;
- 
--	kcopyd_put_pages(job->kc, job->pages);
-+	kcopyd_put_pages(kc, job->pages);
- 	mempool_free(job, _job_pool);
- 	fn(read_err, write_err, context);
-+
-+	if (atomic_dec_and_test(&kc->nr_jobs))
-+		wake_up(&kc->destroyq);
-+
- 	return 0;
- }
- 
-@@ -431,6 +439,7 @@ static void do_work(void *ignored)
-  */
- static void dispatch_job(struct kcopyd_job *job)
- {
-+	atomic_inc(&job->kc->nr_jobs);
- 	push(&_pages_jobs, job);
- 	wake();
- }
-@@ -670,6 +679,9 @@ int kcopyd_client_create(unsigned int nr
- 		return r;
- 	}
- 
-+	init_waitqueue_head(&kc->destroyq);
-+	atomic_set(&kc->nr_jobs, 0);
-+
- 	client_add(kc);
- 	*result = kc;
- 	return 0;
-@@ -677,6 +689,9 @@ int kcopyd_client_create(unsigned int nr
- 
- void kcopyd_client_destroy(struct kcopyd_client *kc)
- {
-+	/* Wait for completion of all jobs submitted by this client. */
-+	wait_event(kc->destroyq, !atomic_read(&kc->nr_jobs));
-+
- 	dm_io_put(kc->nr_pages);
- 	client_free_pages(kc);
- 	client_del(kc);
-diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
-index ab90a6d..039ed49 100644
---- a/drivers/md/raid10.c
-+++ b/drivers/md/raid10.c
-@@ -1436,9 +1436,9 @@ static void raid10d(mddev_t *mddev)
- 						sl--;
- 						d = r10_bio->devs[sl].devnum;
- 						rdev = conf->mirrors[d].rdev;
--						atomic_add(s, &rdev->corrected_errors);
- 						if (rdev &&
- 						    test_bit(In_sync, &rdev->flags)) {
-+							atomic_add(s, &rdev->corrected_errors);
- 							if (sync_page_io(rdev->bdev,
- 									 r10_bio->devs[sl].addr +
- 									 sect + rdev->data_offset,
-diff --git a/drivers/media/dvb/dvb-usb/cxusb.c b/drivers/media/dvb/dvb-usb/cxusb.c
-index 162f979..356a09a 100644
---- a/drivers/media/dvb/dvb-usb/cxusb.c
-+++ b/drivers/media/dvb/dvb-usb/cxusb.c
-@@ -149,6 +149,15 @@ static int cxusb_power_ctrl(struct dvb_u
- 		return cxusb_ctrl_msg(d, CMD_POWER_OFF, &b, 1, NULL, 0);
- }
- 
-+static int cxusb_bluebird_power_ctrl(struct dvb_usb_device *d, int onoff)
-+{
-+	u8 b = 0;
-+	if (onoff)
-+		return cxusb_ctrl_msg(d, CMD_POWER_ON, &b, 1, NULL, 0);
-+	else
-+		return 0;
-+}
-+
- static int cxusb_streaming_ctrl(struct dvb_usb_device *d, int onoff)
- {
- 	u8 buf[2] = { 0x03, 0x00 };
-@@ -505,7 +514,7 @@ static struct dvb_usb_properties cxusb_b
- 	.size_of_priv     = sizeof(struct cxusb_state),
- 
- 	.streaming_ctrl   = cxusb_streaming_ctrl,
--	.power_ctrl       = cxusb_power_ctrl,
-+	.power_ctrl       = cxusb_bluebird_power_ctrl,
- 	.frontend_attach  = cxusb_lgdt3303_frontend_attach,
- 	.tuner_attach     = cxusb_lgh064f_tuner_attach,
- 
-@@ -545,7 +554,7 @@ static struct dvb_usb_properties cxusb_b
- 	.size_of_priv     = sizeof(struct cxusb_state),
- 
- 	.streaming_ctrl   = cxusb_streaming_ctrl,
--	.power_ctrl       = cxusb_power_ctrl,
-+	.power_ctrl       = cxusb_bluebird_power_ctrl,
- 	.frontend_attach  = cxusb_dee1601_frontend_attach,
- 	.tuner_attach     = cxusb_dee1601_tuner_attach,
- 
-@@ -594,7 +603,7 @@ static struct dvb_usb_properties cxusb_b
- 	.size_of_priv     = sizeof(struct cxusb_state),
- 
- 	.streaming_ctrl   = cxusb_streaming_ctrl,
--	.power_ctrl       = cxusb_power_ctrl,
-+	.power_ctrl       = cxusb_bluebird_power_ctrl,
- 	.frontend_attach  = cxusb_mt352_frontend_attach,
- 	.tuner_attach     = cxusb_lgz201_tuner_attach,
- 
-@@ -634,7 +643,7 @@ static struct dvb_usb_properties cxusb_b
- 	.size_of_priv     = sizeof(struct cxusb_state),
- 
- 	.streaming_ctrl   = cxusb_streaming_ctrl,
--	.power_ctrl       = cxusb_power_ctrl,
-+	.power_ctrl       = cxusb_bluebird_power_ctrl,
- 	.frontend_attach  = cxusb_mt352_frontend_attach,
- 	.tuner_attach     = cxusb_dtt7579_tuner_attach,
- 
-diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig
-index d82c8a3..ef42a26 100644
---- a/drivers/media/video/Kconfig
-+++ b/drivers/media/video/Kconfig
-@@ -349,6 +349,7 @@ config VIDEO_AUDIO_DECODER
- config VIDEO_DECODER
- 	tristate "Add support for additional video chipsets"
- 	depends on VIDEO_DEV && I2C && EXPERIMENTAL
-+	select FW_LOADER
- 	---help---
- 	  Say Y here to compile drivers for SAA7115, SAA7127 and CX25840
- 	  video decoders.
-diff --git a/drivers/media/video/saa7127.c b/drivers/media/video/saa7127.c
-index 992c717..9e4c178 100644
---- a/drivers/media/video/saa7127.c
-+++ b/drivers/media/video/saa7127.c
-@@ -141,6 +141,7 @@ struct i2c_reg_value {
- static const struct i2c_reg_value saa7129_init_config_extra[] = {
- 	{ SAA7127_REG_OUTPUT_PORT_CONTROL, 		0x38 },
- 	{ SAA7127_REG_VTRIG, 				0xfa },
-+	{ 0, 0 }
- };
- 
- static const struct i2c_reg_value saa7127_init_config_common[] = {
-diff --git a/drivers/media/video/tuner-types.c b/drivers/media/video/tuner-types.c
-index 6fe7817..5f3d46d 100644
---- a/drivers/media/video/tuner-types.c
-+++ b/drivers/media/video/tuner-types.c
-@@ -1087,8 +1087,8 @@ static struct tuner_params tuner_tnf_533
- /* ------------ TUNER_SAMSUNG_TCPN_2121P30A - Samsung NTSC ------------ */
- 
- static struct tuner_range tuner_samsung_tcpn_2121p30a_ntsc_ranges[] = {
--	{ 16 * 175.75 /*MHz*/, 0x01, },
--	{ 16 * 410.25 /*MHz*/, 0x02, },
-+	{ 16 * 130.00 /*MHz*/, 0x01, },
-+	{ 16 * 364.50 /*MHz*/, 0x02, },
- 	{ 16 * 999.99        , 0x08, },
- };
- 
-diff --git a/drivers/mtd/nand/Kconfig b/drivers/mtd/nand/Kconfig
-index 1fc4c13..cfe288a 100644
---- a/drivers/mtd/nand/Kconfig
-+++ b/drivers/mtd/nand/Kconfig
-@@ -178,17 +178,16 @@ config MTD_NAND_DISKONCHIP_BBTWRITE
- 	  Even if you leave this disabled, you can enable BBT writes at module
- 	  load time (assuming you build diskonchip as a module) with the module
- 	  parameter "inftl_bbt_write=1".
--	  
-- config MTD_NAND_SHARPSL
-- 	bool "Support for NAND Flash on Sharp SL Series (C7xx + others)"
-- 	depends on MTD_NAND && ARCH_PXA
-- 
-- config MTD_NAND_NANDSIM
-- 	bool "Support for NAND Flash Simulator"
-- 	depends on MTD_NAND && MTD_PARTITIONS
- 
-+config MTD_NAND_SHARPSL
-+	tristate "Support for NAND Flash on Sharp SL Series (C7xx + others)"
-+	depends on MTD_NAND && ARCH_PXA
-+
-+config MTD_NAND_NANDSIM
-+	tristate "Support for NAND Flash Simulator"
-+	depends on MTD_NAND && MTD_PARTITIONS
- 	help
- 	  The simulator may simulate verious NAND flash chips for the
- 	  MTD nand layer.
-- 
-+
- endmenu
-diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
-index 84dcca3..fa29402 100644
---- a/drivers/net/e1000/e1000_main.c
-+++ b/drivers/net/e1000/e1000_main.c
-@@ -3851,6 +3851,7 @@ #endif
- 			skb_shinfo(skb)->nr_frags++;
- 			skb->len += length;
- 			skb->data_len += length;
-+			skb->truesize += length;
- 		}
- 
- 		e1000_rx_checksum(adapter, staterr,
-diff --git a/drivers/net/irda/irda-usb.c b/drivers/net/irda/irda-usb.c
-index 8936058..6e2ec56 100644
---- a/drivers/net/irda/irda-usb.c
-+++ b/drivers/net/irda/irda-usb.c
-@@ -740,7 +740,7 @@ static void irda_usb_receive(struct urb 
- 	struct sk_buff *newskb;
- 	struct sk_buff *dataskb;
- 	struct urb *next_urb;
--	int		docopy;
-+	unsigned int len, docopy;
- 
- 	IRDA_DEBUG(2, "%s(), len=%d\n", __FUNCTION__, urb->actual_length);
- 	
-@@ -851,10 +851,11 @@ static void irda_usb_receive(struct urb 
- 	dataskb->dev = self->netdev;
- 	dataskb->mac.raw  = dataskb->data;
- 	dataskb->protocol = htons(ETH_P_IRDA);
-+	len = dataskb->len;
- 	netif_rx(dataskb);
- 
- 	/* Keep stats up to date */
--	self->stats.rx_bytes += dataskb->len;
-+	self->stats.rx_bytes += len;
- 	self->stats.rx_packets++;
- 	self->netdev->last_rx = jiffies;
- 
-diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
-index 7326036..0618cd5 100644
---- a/drivers/net/sky2.c
-+++ b/drivers/net/sky2.c
-@@ -579,8 +579,8 @@ static void sky2_mac_init(struct sky2_hw
- 	reg = gma_read16(hw, port, GM_PHY_ADDR);
- 	gma_write16(hw, port, GM_PHY_ADDR, reg | GM_PAR_MIB_CLR);
- 
--	for (i = 0; i < GM_MIB_CNT_SIZE; i++)
--		gma_read16(hw, port, GM_MIB_CNT_BASE + 8 * i);
-+	for (i = GM_MIB_CNT_BASE; i <= GM_MIB_CNT_END; i += 4)
-+		gma_read16(hw, port, i);
- 	gma_write16(hw, port, GM_PHY_ADDR, reg);
- 
- 	/* transmit control */
-diff --git a/drivers/net/sky2.h b/drivers/net/sky2.h
-index dce955c..c91e0a4 100644
---- a/drivers/net/sky2.h
-+++ b/drivers/net/sky2.h
-@@ -1380,6 +1380,7 @@ enum {
- /* MIB Counters */
- #define GM_MIB_CNT_BASE	0x0100		/* Base Address of MIB Counters */
- #define GM_MIB_CNT_SIZE	44		/* Number of MIB Counters */
-+#define GM_MIB_CNT_END	0x025C		/* Last MIB counter */
- 
- /*
-  * MIB Counters base address definitions (low word) -
-diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
-index caf4102..7d00722 100644
---- a/drivers/net/tg3.c
-+++ b/drivers/net/tg3.c
-@@ -7368,21 +7368,23 @@ static int tg3_get_settings(struct net_d
- 		cmd->supported |= (SUPPORTED_1000baseT_Half |
- 				   SUPPORTED_1000baseT_Full);
- 
--	if (!(tp->tg3_flags2 & TG3_FLG2_ANY_SERDES))
-+	if (!(tp->tg3_flags2 & TG3_FLG2_ANY_SERDES)) {
- 		cmd->supported |= (SUPPORTED_100baseT_Half |
- 				  SUPPORTED_100baseT_Full |
- 				  SUPPORTED_10baseT_Half |
- 				  SUPPORTED_10baseT_Full |
- 				  SUPPORTED_MII);
--	else
-+		cmd->port = PORT_TP;
-+	} else {
- 		cmd->supported |= SUPPORTED_FIBRE;
-+		cmd->port = PORT_FIBRE;
-+	}
-   
- 	cmd->advertising = tp->link_config.advertising;
- 	if (netif_running(dev)) {
- 		cmd->speed = tp->link_config.active_speed;
- 		cmd->duplex = tp->link_config.active_duplex;
- 	}
--	cmd->port = 0;
- 	cmd->phy_address = PHY_ADDR;
- 	cmd->transceiver = 0;
- 	cmd->autoneg = tp->link_config.autoneg;
-diff --git a/drivers/net/via-rhine.c b/drivers/net/via-rhine.c
-index 2418715..56864ff 100644
---- a/drivers/net/via-rhine.c
-+++ b/drivers/net/via-rhine.c
-@@ -129,6 +129,7 @@
- 	- Massive clean-up
- 	- Rewrite PHY, media handling (remove options, full_duplex, backoff)
- 	- Fix Tx engine race for good
-+	- Craig Brind: Zero padded aligned buffers for short packets.
- 
- */
- 
-@@ -1306,7 +1307,12 @@ static int rhine_start_tx(struct sk_buff
- 			rp->stats.tx_dropped++;
- 			return 0;
- 		}
-+
-+		/* Padding is not copied and so must be redone. */
- 		skb_copy_and_csum_dev(skb, rp->tx_buf[entry]);
-+		if (skb->len < ETH_ZLEN)
-+			memset(rp->tx_buf[entry] + skb->len, 0,
-+			       ETH_ZLEN - skb->len);
- 		rp->tx_skbuff_dma[entry] = 0;
- 		rp->tx_ring[entry].addr = cpu_to_le32(rp->tx_bufs_dma +
- 						      (rp->tx_buf[entry] -
-diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
-index ef85d76..8101657 100644
---- a/drivers/net/wireless/Kconfig
-+++ b/drivers/net/wireless/Kconfig
-@@ -239,7 +239,8 @@ config IPW2200_DEBUG
- 
- config AIRO
- 	tristate "Cisco/Aironet 34X/35X/4500/4800 ISA and PCI cards"
--	depends on NET_RADIO && ISA_DMA_API && CRYPTO && (PCI || BROKEN)
-+ 	depends on NET_RADIO && ISA_DMA_API && (PCI || BROKEN)
-+	select CRYPTO
- 	---help---
- 	  This is the standard Linux driver to support Cisco/Aironet ISA and
- 	  PCI 802.11 wireless cards.
-@@ -374,6 +375,7 @@ config PCMCIA_HERMES
- config PCMCIA_SPECTRUM
- 	tristate "Symbol Spectrum24 Trilogy PCMCIA card support"
- 	depends on NET_RADIO && PCMCIA && HERMES
-+	select FW_LOADER
- 	---help---
- 
- 	  This is a driver for 802.11b cards using RAM-loadable Symbol
-@@ -387,6 +389,7 @@ config PCMCIA_SPECTRUM
- config AIRO_CS
- 	tristate "Cisco/Aironet 34X/35X/4500/4800 PCMCIA cards"
- 	depends on NET_RADIO && PCMCIA && (BROKEN || !M32R)
-+	select CRYPTO
- 	---help---
- 	  This is the standard Linux driver to support Cisco/Aironet PCMCIA
- 	  802.11 wireless cards.  This driver is the same as the Aironet
-diff --git a/drivers/net/wireless/hostap/hostap_80211_tx.c b/drivers/net/wireless/hostap/hostap_80211_tx.c
-index 4a85e63..5f398bd 100644
---- a/drivers/net/wireless/hostap/hostap_80211_tx.c
-+++ b/drivers/net/wireless/hostap/hostap_80211_tx.c
-@@ -469,7 +469,7 @@ int hostap_master_start_xmit(struct sk_b
- 	}
- 
- 	if (local->ieee_802_1x && meta->ethertype == ETH_P_PAE && tx.crypt &&
--	    !(fc & IEEE80211_FCTL_VERS)) {
-+	    !(fc & IEEE80211_FCTL_PROTECTED)) {
- 		no_encrypt = 1;
- 		PDEBUG(DEBUG_EXTRA2, "%s: TX: IEEE 802.1X - passing "
- 		       "unencrypted EAPOL frame\n", dev->name);
-diff --git a/drivers/net/wireless/ipw2200.c b/drivers/net/wireless/ipw2200.c
-index 287676a..f42e51a 100644
---- a/drivers/net/wireless/ipw2200.c
-+++ b/drivers/net/wireless/ipw2200.c
-@@ -8391,20 +8391,28 @@ static int ipw_wx_get_range(struct net_d
- 
- 	i = 0;
- 	if (priv->ieee->mode & (IEEE_B | IEEE_G)) {
--		for (j = 0; j < geo->bg_channels && i < IW_MAX_FREQUENCIES;
--		     i++, j++) {
-+		for (j = 0; j < geo->bg_channels && i < IW_MAX_FREQUENCIES; j++) {
-+			if ((priv->ieee->iw_mode == IW_MODE_ADHOC) &&
-+			    (geo->bg[j].flags & IEEE80211_CH_PASSIVE_ONLY))
-+				continue;
-+
- 			range->freq[i].i = geo->bg[j].channel;
- 			range->freq[i].m = geo->bg[j].freq * 100000;
- 			range->freq[i].e = 1;
-+			i++;
- 		}
- 	}
- 
- 	if (priv->ieee->mode & IEEE_A) {
--		for (j = 0; j < geo->a_channels && i < IW_MAX_FREQUENCIES;
--		     i++, j++) {
-+		for (j = 0; j < geo->a_channels && i < IW_MAX_FREQUENCIES; j++) {
-+			if ((priv->ieee->iw_mode == IW_MODE_ADHOC) &&
-+			    (geo->a[j].flags & IEEE80211_CH_PASSIVE_ONLY))
-+				continue;
-+
- 			range->freq[i].i = geo->a[j].channel;
- 			range->freq[i].m = geo->a[j].freq * 100000;
- 			range->freq[i].e = 1;
-+			i++;
- 		}
- 	}
- 
-@@ -9956,9 +9964,8 @@ static int ipw_ethtool_set_eeprom(struct
- 		return -EINVAL;
- 	down(&p->sem);
- 	memcpy(&p->eeprom[eeprom->offset], bytes, eeprom->len);
--	for (i = IPW_EEPROM_DATA;
--	     i < IPW_EEPROM_DATA + IPW_EEPROM_IMAGE_SIZE; i++)
--		ipw_write8(p, i, p->eeprom[i]);
-+	for (i = 0; i < IPW_EEPROM_IMAGE_SIZE; i++)
-+		ipw_write8(p, i + IPW_EEPROM_DATA, p->eeprom[i]);
- 	up(&p->sem);
- 	return 0;
- }
-diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
-index 6917c6c..c2ecae5 100644
---- a/drivers/pci/pci-acpi.c
-+++ b/drivers/pci/pci-acpi.c
-@@ -33,13 +33,10 @@ acpi_query_osc (
- 	acpi_status		status;
- 	struct acpi_object_list	input;
- 	union acpi_object 	in_params[4];
--	struct acpi_buffer	output;
--	union acpi_object 	out_obj;	
-+	struct acpi_buffer	output = {ACPI_ALLOCATE_BUFFER, NULL};
-+	union acpi_object 	*out_obj;
- 	u32			osc_dw0;
- 
--	/* Setting up output buffer */
--	output.length = sizeof(out_obj) + 3*sizeof(u32);  
--	output.pointer = &out_obj;
- 	
- 	/* Setting up input parameters */
- 	input.count = 4;
-@@ -61,12 +58,15 @@ acpi_query_osc (
- 			"Evaluate _OSC Set fails. Status = 0x%04x\n", status);
- 		return status;
- 	}
--	if (out_obj.type != ACPI_TYPE_BUFFER) {
-+	out_obj = output.pointer;
-+
-+	if (out_obj->type != ACPI_TYPE_BUFFER) {
- 		printk(KERN_DEBUG  
- 			"Evaluate _OSC returns wrong type\n");
--		return AE_TYPE;
-+		status = AE_TYPE;
-+		goto query_osc_out;
- 	}
--	osc_dw0 = *((u32 *) out_obj.buffer.pointer);
-+	osc_dw0 = *((u32 *) out_obj->buffer.pointer);
- 	if (osc_dw0) {
- 		if (osc_dw0 & OSC_REQUEST_ERROR)
- 			printk(KERN_DEBUG "_OSC request fails\n"); 
-@@ -76,15 +76,21 @@ acpi_query_osc (
- 			printk(KERN_DEBUG "_OSC invalid revision\n"); 
- 		if (osc_dw0 & OSC_CAPABILITIES_MASK_ERROR) {
- 			/* Update Global Control Set */
--			global_ctrlsets = *((u32 *)(out_obj.buffer.pointer+8));
--			return AE_OK;
-+			global_ctrlsets = *((u32 *)(out_obj->buffer.pointer+8));
-+			status = AE_OK;
-+			goto query_osc_out;
- 		}
--		return AE_ERROR;
-+		status = AE_ERROR;
-+		goto query_osc_out;
- 	}
- 
- 	/* Update Global Control Set */
--	global_ctrlsets = *((u32 *)(out_obj.buffer.pointer + 8));
--	return AE_OK;
-+	global_ctrlsets = *((u32 *)(out_obj->buffer.pointer + 8));
-+	status = AE_OK;
-+
-+query_osc_out:
-+	kfree(output.pointer);
-+	return status;
- }
- 
- 
-@@ -96,14 +102,10 @@ acpi_run_osc (
- 	acpi_status		status;
- 	struct acpi_object_list	input;
- 	union acpi_object 	in_params[4];
--	struct acpi_buffer	output;
--	union acpi_object 	out_obj;	
-+	struct acpi_buffer	output = {ACPI_ALLOCATE_BUFFER, NULL};
-+	union acpi_object 	*out_obj;
- 	u32			osc_dw0;
- 
--	/* Setting up output buffer */
--	output.length = sizeof(out_obj) + 3*sizeof(u32);  
--	output.pointer = &out_obj;
--	
- 	/* Setting up input parameters */
- 	input.count = 4;
- 	input.pointer = in_params;
-@@ -124,12 +126,14 @@ acpi_run_osc (
- 			"Evaluate _OSC Set fails. Status = 0x%04x\n", status);
- 		return status;
- 	}
--	if (out_obj.type != ACPI_TYPE_BUFFER) {
-+	out_obj = output.pointer;
-+	if (out_obj->type != ACPI_TYPE_BUFFER) {
- 		printk(KERN_DEBUG  
- 			"Evaluate _OSC returns wrong type\n");
--		return AE_TYPE;
-+		status = AE_TYPE;
-+		goto run_osc_out;
- 	}
--	osc_dw0 = *((u32 *) out_obj.buffer.pointer);
-+	osc_dw0 = *((u32 *) out_obj->buffer.pointer);
- 	if (osc_dw0) {
- 		if (osc_dw0 & OSC_REQUEST_ERROR)
- 			printk(KERN_DEBUG "_OSC request fails\n"); 
-@@ -139,11 +143,17 @@ acpi_run_osc (
- 			printk(KERN_DEBUG "_OSC invalid revision\n"); 
- 		if (osc_dw0 & OSC_CAPABILITIES_MASK_ERROR) {
- 			printk(KERN_DEBUG "_OSC FW not grant req. control\n");
--			return AE_SUPPORT;
-+			status = AE_SUPPORT;
-+			goto run_osc_out;
- 		}
--		return AE_ERROR;
-+		status = AE_ERROR;
-+		goto run_osc_out;
- 	}
--	return AE_OK;
-+	status = AE_OK;
-+
-+run_osc_out:
-+	kfree(output.pointer);
-+	return status;
- }
- 
- /**
-diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
-index dda6099..381f36b 100644
---- a/drivers/pci/quirks.c
-+++ b/drivers/pci/quirks.c
-@@ -631,6 +631,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_V
-  * non-x86 architectures (yes Via exists on PPC among other places),
-  * we must mask the PCI_INTERRUPT_LINE value versus 0xf to get
-  * interrupts delivered properly.
-+ *
-+ * Some of the on-chip devices are actually '586 devices' so they are
-+ * listed here.
-  */
- static void quirk_via_irq(struct pci_dev *dev)
- {
-@@ -639,13 +642,19 @@ static void quirk_via_irq(struct pci_dev
- 	new_irq = dev->irq & 0xf;
- 	pci_read_config_byte(dev, PCI_INTERRUPT_LINE, &irq);
- 	if (new_irq != irq) {
--		printk(KERN_INFO "PCI: Via IRQ fixup for %s, from %d to %d\n",
-+		printk(KERN_INFO "PCI: VIA IRQ fixup for %s, from %d to %d\n",
- 			pci_name(dev), irq, new_irq);
- 		udelay(15);	/* unknown if delay really needed */
- 		pci_write_config_byte(dev, PCI_INTERRUPT_LINE, new_irq);
- 	}
- }
--DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_ANY_ID, quirk_via_irq);
-+DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C586_0, quirk_via_irq);
-+DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C586_1, quirk_via_irq);
-+DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C586_2, quirk_via_irq);
-+DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C586_3, quirk_via_irq);
-+DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C686, quirk_via_irq);
-+DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C686_4, quirk_via_irq);
-+DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C686_5, quirk_via_irq);
- 
- /*
-  * VIA VT82C598 has its device ID settable and many BIOSes
-@@ -861,6 +870,7 @@ static void __init quirk_eisa_bridge(str
- }
- DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,	PCI_DEVICE_ID_INTEL_82375,	quirk_eisa_bridge );
- 
-+#ifndef CONFIG_ACPI_SLEEP
- /*
-  * On ASUS P4B boards, the SMBus PCI Device within the ICH2/4 southbridge
-  * is not activated. The myth is that Asus said that they do not want the
-@@ -872,8 +882,12 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_I
-  * bridge. Unfortunately, this device has no subvendor/subdevice ID. So it 
-  * becomes necessary to do this tweak in two steps -- I've chosen the Host
-  * bridge as trigger.
-+ *
-+ * Actually, leaving it unhidden and not redoing the quirk over suspend2ram
-+ * will cause thermal management to break down, and causing machine to
-+ * overheat.
-  */
--static int __initdata asus_hides_smbus = 0;
-+static int __initdata asus_hides_smbus;
- 
- static void __init asus_hides_smbus_hostbridge(struct pci_dev *dev)
- {
-@@ -1008,6 +1022,8 @@ static void __init asus_hides_smbus_lpc_
- }
- DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,	PCI_DEVICE_ID_INTEL_ICH6_1,	asus_hides_smbus_lpc_ich6 );
- 
-+#endif
-+
- /*
-  * SiS 96x south bridge: BIOS typically hides SMBus device...
-  */
-diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
-index bb96ce1..a4333a8 100644
---- a/drivers/pcmcia/ds.c
-+++ b/drivers/pcmcia/ds.c
-@@ -546,7 +546,7 @@ static int pcmcia_device_query(struct pc
- 			tmp = vers1->str + vers1->ofs[i];
- 
- 			length = strlen(tmp) + 1;
--			if ((length < 3) || (length > 255))
-+			if ((length < 2) || (length > 255))
- 				continue;
- 
- 			p_dev->prod_id[i] = kmalloc(sizeof(char) * length,
-diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c
-index d9152d0..9132549 100644
---- a/drivers/scsi/3w-9xxx.c
-+++ b/drivers/scsi/3w-9xxx.c
-@@ -85,7 +85,7 @@ #include <scsi/scsi_cmnd.h>
- #include "3w-9xxx.h"
- 
- /* Globals */
--#define TW_DRIVER_VERSION "2.26.02.005"
-+#define TW_DRIVER_VERSION "2.26.02.007"
- static TW_Device_Extension *twa_device_extension_list[TW_MAX_SLOT];
- static unsigned int twa_device_extension_count;
- static int twa_major = -1;
-@@ -1944,9 +1944,13 @@ static void twa_scsiop_execute_scsi_comp
- 		}
- 		if (tw_dev->srb[request_id]->use_sg == 1) {
- 			struct scatterlist *sg = (struct scatterlist *)tw_dev->srb[request_id]->request_buffer;
--			char *buf = kmap_atomic(sg->page, KM_IRQ0) + sg->offset;
-+			char *buf;
-+			unsigned long flags = 0;
-+			local_irq_save(flags);
-+			buf = kmap_atomic(sg->page, KM_IRQ0) + sg->offset;
- 			memcpy(buf, tw_dev->generic_buffer_virt[request_id], sg->length);
- 			kunmap_atomic(buf - sg->offset, KM_IRQ0);
-+			local_irq_restore(flags);
- 		}
- 	}
- } /* End twa_scsiop_execute_scsi_complete() */
-diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c
-index 25f678d..e8e41e6 100644
---- a/drivers/scsi/3w-xxxx.c
-+++ b/drivers/scsi/3w-xxxx.c
-@@ -1508,10 +1508,12 @@ static void tw_transfer_internal(TW_Devi
- 	struct scsi_cmnd *cmd = tw_dev->srb[request_id];
- 	void *buf;
- 	unsigned int transfer_len;
-+	unsigned long flags = 0;
- 
- 	if (cmd->use_sg) {
- 		struct scatterlist *sg =
- 			(struct scatterlist *)cmd->request_buffer;
-+		local_irq_save(flags);
- 		buf = kmap_atomic(sg->page, KM_IRQ0) + sg->offset;
- 		transfer_len = min(sg->length, len);
- 	} else {
-@@ -1526,6 +1528,7 @@ static void tw_transfer_internal(TW_Devi
- 
- 		sg = (struct scatterlist *)cmd->request_buffer;
- 		kunmap_atomic(buf - sg->offset, KM_IRQ0);
-+		local_irq_restore(flags);
- 	}
- }
- 
-diff --git a/drivers/scsi/libata-core.c b/drivers/scsi/libata-core.c
-index 4f91b0d..400e9d7 100644
---- a/drivers/scsi/libata-core.c
-+++ b/drivers/scsi/libata-core.c
-@@ -4293,6 +4293,7 @@ static int ata_start_drive(struct ata_po
- int ata_device_resume(struct ata_port *ap, struct ata_device *dev)
- {
- 	if (ap->flags & ATA_FLAG_SUSPENDED) {
-+		ata_busy_wait(ap, ATA_BUSY | ATA_DRQ, 200000);
- 		ap->flags &= ~ATA_FLAG_SUSPENDED;
- 		ata_set_mode(ap);
- 	}
-diff --git a/drivers/scsi/sata_mv.c b/drivers/scsi/sata_mv.c
-index 2770005..b00af08 100644
---- a/drivers/scsi/sata_mv.c
-+++ b/drivers/scsi/sata_mv.c
-@@ -1102,6 +1102,7 @@ static u8 mv_get_crpb_status(struct ata_
- 	void __iomem *port_mmio = mv_ap_base(ap);
- 	struct mv_port_priv *pp = ap->private_data;
- 	u32 out_ptr;
-+	u8 ata_status;
- 
- 	out_ptr = readl(port_mmio + EDMA_RSP_Q_OUT_PTR_OFS);
- 
-@@ -1109,6 +1110,8 @@ static u8 mv_get_crpb_status(struct ata_
- 	assert(((out_ptr >> EDMA_RSP_Q_PTR_SHIFT) & MV_MAX_Q_DEPTH_MASK) ==
- 	       pp->rsp_consumer);
- 
-+	ata_status = pp->crpb[pp->rsp_consumer].flags >> CRPB_FLAG_STATUS_SHIFT;
-+
- 	/* increment our consumer index... */
- 	pp->rsp_consumer = mv_inc_q_index(&pp->rsp_consumer);
- 
-@@ -1123,7 +1126,7 @@ static u8 mv_get_crpb_status(struct ata_
- 	writelfl(out_ptr, port_mmio + EDMA_RSP_Q_OUT_PTR_OFS);
- 
- 	/* Return ATA status register for completed CRPB */
--	return (pp->crpb[pp->rsp_consumer].flags >> CRPB_FLAG_STATUS_SHIFT);
-+	return ata_status;
- }
- 
- /**
-@@ -1192,7 +1195,6 @@ static void mv_host_intr(struct ata_host
- 	u32 hc_irq_cause;
- 	int shift, port, port0, hard_port, handled;
- 	unsigned int err_mask;
--	u8 ata_status = 0;
- 
- 	if (hc == 0) {
- 		port0 = 0;
-@@ -1210,6 +1212,7 @@ static void mv_host_intr(struct ata_host
- 		hc,relevant,hc_irq_cause);
- 
- 	for (port = port0; port < port0 + MV_PORTS_PER_HC; port++) {
-+		u8 ata_status = 0;
- 		ap = host_set->ports[port];
- 		hard_port = port & MV_PORT_MASK;	/* range 0-3 */
- 		handled = 0;	/* ensure ata_status is set if handled++ */
-diff --git a/drivers/sn/ioc3.c b/drivers/sn/ioc3.c
-index 93449a1..4bd05a0 100644
---- a/drivers/sn/ioc3.c
-+++ b/drivers/sn/ioc3.c
-@@ -677,7 +677,7 @@ #endif
- 	/* Track PCI-device specific data */
- 	pci_set_drvdata(pdev, idd);
- 	down_write(&ioc3_devices_rwsem);
--	list_add(&idd->list, &ioc3_devices);
-+	list_add_tail(&idd->list, &ioc3_devices);
- 	idd->id = ioc3_counter++;
- 	up_write(&ioc3_devices_rwsem);
- 
-diff --git a/drivers/sn/ioc4.c b/drivers/sn/ioc4.c
-index ea75b3d..771e868 100644
---- a/drivers/sn/ioc4.c
-+++ b/drivers/sn/ioc4.c
-@@ -313,7 +313,7 @@ ioc4_probe(struct pci_dev *pdev, const s
- 	idd->idd_serial_data = NULL;
- 	pci_set_drvdata(idd->idd_pdev, idd);
- 	down_write(&ioc4_devices_rwsem);
--	list_add(&idd->idd_list, &ioc4_devices);
-+	list_add_tail(&idd->idd_list, &ioc4_devices);
- 	up_write(&ioc4_devices_rwsem);
- 
- 	/* Add this IOC4 to all submodules */
-diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
-index 7135e54..96cabeb 100644
---- a/drivers/usb/core/message.c
-+++ b/drivers/usb/core/message.c
-@@ -1388,11 +1388,13 @@ free_interfaces:
- 	if (dev->state != USB_STATE_ADDRESS)
- 		usb_disable_device (dev, 1);	// Skip ep0
- 
--	i = dev->bus_mA - cp->desc.bMaxPower * 2;
--	if (i < 0)
--		dev_warn(&dev->dev, "new config #%d exceeds power "
--				"limit by %dmA\n",
--				configuration, -i);
-+	if (cp) {
-+		i = dev->bus_mA - cp->desc.bMaxPower * 2;
-+		if (i < 0)
-+			dev_warn(&dev->dev, "new config #%d exceeds power "
-+					"limit by %dmA\n",
-+					configuration, -i);
-+	}
- 
- 	if ((ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
- 			USB_REQ_SET_CONFIGURATION, 0, configuration, 0,
-diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
-index ebcca97..88419c6 100644
---- a/drivers/usb/host/ehci-sched.c
-+++ b/drivers/usb/host/ehci-sched.c
-@@ -707,6 +707,7 @@ iso_stream_init (
- 	} else {
- 		u32		addr;
- 		int		think_time;
-+		int		hs_transfers;
- 
- 		addr = dev->ttport << 24;
- 		if (!ehci_is_TDI(ehci)
-@@ -719,6 +720,7 @@ iso_stream_init (
- 		think_time = dev->tt ? dev->tt->think_time : 0;
- 		stream->tt_usecs = NS_TO_US (think_time + usb_calc_bus_time (
- 				dev->speed, is_input, 1, maxp));
-+		hs_transfers = max (1u, (maxp + 187) / 188);
- 		if (is_input) {
- 			u32	tmp;
- 
-@@ -727,12 +729,11 @@ iso_stream_init (
- 			stream->usecs = HS_USECS_ISO (1);
- 			stream->raw_mask = 1;
- 
--			/* pessimistic c-mask */
--			tmp = usb_calc_bus_time (USB_SPEED_FULL, 1, 0, maxp)
--					/ (125 * 1000);
--			stream->raw_mask |= 3 << (tmp + 9);
-+			/* c-mask as specified in USB 2.0 11.18.4 3.c */
-+			tmp = (1 << (hs_transfers + 2)) - 1;
-+			stream->raw_mask |= tmp << (8 + 2);
- 		} else
--			stream->raw_mask = smask_out [maxp / 188];
-+			stream->raw_mask = smask_out [hs_transfers - 1];
- 		bandwidth = stream->usecs + stream->c_usecs;
- 		bandwidth /= 1 << (interval + 2);
- 
-diff --git a/drivers/usb/serial/console.c b/drivers/usb/serial/console.c
-index 167f8ec..8023bb7 100644
---- a/drivers/usb/serial/console.c
-+++ b/drivers/usb/serial/console.c
-@@ -54,7 +54,7 @@ static struct console usbcons;
-  * serial.c code, except that the specifier is "ttyUSB" instead
-  * of "ttyS".
-  */
--static int __init usb_console_setup(struct console *co, char *options)
-+static int usb_console_setup(struct console *co, char *options)
- {
- 	struct usbcons_info *info = &usbcons_info;
- 	int baud = 9600;
-diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
-index 52bdf6f..fd8a50e 100644
---- a/drivers/usb/serial/option.c
-+++ b/drivers/usb/serial/option.c
-@@ -582,14 +582,14 @@ static void option_setup_urbs(struct usb
- 	portdata = usb_get_serial_port_data(port);
- 
- 	/* Do indat endpoints first */
--	for (j = 0; j <= N_IN_URB; ++j) {
-+	for (j = 0; j < N_IN_URB; ++j) {
- 		portdata->in_urbs[j] = option_setup_urb (serial,
-                   port->bulk_in_endpointAddress, USB_DIR_IN, port,
-                   portdata->in_buffer[j], IN_BUFLEN, option_indat_callback);
- 	}
- 
- 	/* outdat endpoints */
--	for (j = 0; j <= N_OUT_URB; ++j) {
-+	for (j = 0; j < N_OUT_URB; ++j) {
- 		portdata->out_urbs[j] = option_setup_urb (serial,
-                   port->bulk_out_endpointAddress, USB_DIR_OUT, port,
-                   portdata->out_buffer[j], OUT_BUFLEN, option_outdat_callback);
-diff --git a/drivers/usb/storage/Kconfig b/drivers/usb/storage/Kconfig
-index 92be101..be9eec2 100644
---- a/drivers/usb/storage/Kconfig
-+++ b/drivers/usb/storage/Kconfig
-@@ -48,7 +48,8 @@ config USB_STORAGE_FREECOM
- 
- config USB_STORAGE_ISD200
- 	bool "ISD-200 USB/ATA Bridge support"
--	depends on USB_STORAGE && BLK_DEV_IDE
-+	depends on USB_STORAGE
-+	depends on BLK_DEV_IDE=y || BLK_DEV_IDE=USB_STORAGE
- 	---help---
- 	  Say Y here if you want to use USB Mass Store devices based
- 	  on the In-Systems Design ISD-200 USB/ATA bridge.
-diff --git a/drivers/video/cfbimgblt.c b/drivers/video/cfbimgblt.c
-index 910e233..8ba6152 100644
---- a/drivers/video/cfbimgblt.c
-+++ b/drivers/video/cfbimgblt.c
-@@ -169,7 +169,7 @@ static inline void slow_imageblit(const 
- 
- 		while (j--) {
- 			l--;
--			color = (*s & 1 << (FB_BIT_NR(l))) ? fgcolor : bgcolor;
-+			color = (*s & (1 << l)) ? fgcolor : bgcolor;
- 			val |= FB_SHIFT_HIGH(color, shift);
- 			
- 			/* Did the bitshift spill bits to the next long? */
-diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
-index 996c7b5..b3094ae 100644
---- a/drivers/video/fbmem.c
-+++ b/drivers/video/fbmem.c
-@@ -669,13 +669,19 @@ fb_write(struct file *file, const char _
- 		total_size = info->fix.smem_len;
- 
- 	if (p > total_size)
--		return 0;
-+		return -EFBIG;
- 
--	if (count >= total_size)
-+	if (count > total_size) {
-+		err = -EFBIG;
- 		count = total_size;
-+	}
-+
-+	if (count + p > total_size) {
-+		if (!err)
-+			err = -ENOSPC;
- 
--	if (count + p > total_size)
- 		count = total_size - p;
-+	}
- 
- 	buffer = kmalloc((count > PAGE_SIZE) ? PAGE_SIZE : count,
- 			 GFP_KERNEL);
-@@ -717,7 +723,7 @@ fb_write(struct file *file, const char _
- 
- 	kfree(buffer);
- 
--	return (err) ? err : cnt;
-+	return (cnt) ? cnt : err;
- }
- 
- #ifdef CONFIG_KMOD
-diff --git a/drivers/video/i810/i810_main.c b/drivers/video/i810/i810_main.c
-index d8467c0..788297e 100644
---- a/drivers/video/i810/i810_main.c
-+++ b/drivers/video/i810/i810_main.c
-@@ -1508,7 +1508,7 @@ static int i810fb_cursor(struct fb_info 
- 		int size = ((cursor->image.width + 7) >> 3) *
- 			cursor->image.height;
- 		int i;
--		u8 *data = kmalloc(64 * 8, GFP_KERNEL);
-+		u8 *data = kmalloc(64 * 8, GFP_ATOMIC);
- 
- 		if (data == NULL)
- 			return -ENOMEM;
-diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
-index 3ad8455..651a9e1 100644
---- a/fs/9p/vfs_inode.c
-+++ b/fs/9p/vfs_inode.c
-@@ -614,6 +614,7 @@ static struct dentry *v9fs_vfs_lookup(st
- 
- 	sb = dir->i_sb;
- 	v9ses = v9fs_inode2v9ses(dir);
-+	dentry->d_op = &v9fs_dentry_operations;
- 	dirfid = v9fs_fid_lookup(dentry->d_parent);
- 
- 	if (!dirfid) {
-@@ -681,8 +682,6 @@ static struct dentry *v9fs_vfs_lookup(st
- 		goto FreeFcall;
- 
- 	fid->qid = fcall->params.rstat.stat.qid;
--
--	dentry->d_op = &v9fs_dentry_operations;
- 	v9fs_stat2inode(&fcall->params.rstat.stat, inode, inode->i_sb);
- 
- 	d_add(dentry, inode);
-diff --git a/fs/char_dev.c b/fs/char_dev.c
-index 21195c4..4e163af 100644
---- a/fs/char_dev.c
-+++ b/fs/char_dev.c
-@@ -15,6 +15,7 @@ #include <linux/errno.h>
- #include <linux/module.h>
- #include <linux/smp_lock.h>
- #include <linux/devfs_fs_kernel.h>
-+#include <linux/seq_file.h>
- 
- #include <linux/kobject.h>
- #include <linux/kobj_map.h>
-@@ -26,8 +27,6 @@ #endif
- 
- static struct kobj_map *cdev_map;
- 
--#define MAX_PROBE_HASH 255	/* random */
--
- static DECLARE_MUTEX(chrdevs_lock);
- 
- static struct char_device_struct {
-@@ -38,93 +37,29 @@ static struct char_device_struct {
- 	char name[64];
- 	struct file_operations *fops;
- 	struct cdev *cdev;		/* will die */
--} *chrdevs[MAX_PROBE_HASH];
-+} *chrdevs[CHRDEV_MAJOR_HASH_SIZE];
- 
- /* index in the above */
- static inline int major_to_index(int major)
- {
--	return major % MAX_PROBE_HASH;
--}
--
--struct chrdev_info {
--	int index;
--	struct char_device_struct *cd;
--};
--
--void *get_next_chrdev(void *dev)
--{
--	struct chrdev_info *info;
--
--	if (dev == NULL) {
--		info = kmalloc(sizeof(*info), GFP_KERNEL);
--		if (!info)
--			goto out;
--		info->index=0;
--		info->cd = chrdevs[info->index];
--		if (info->cd)
--			goto out;
--	} else {
--		info = dev;
--	}
--
--	while (info->index < ARRAY_SIZE(chrdevs)) {
--		if (info->cd)
--			info->cd = info->cd->next;
--		if (info->cd)
--			goto out;
--		/*
--		 * No devices on this chain, move to the next
--		 */
--		info->index++;
--		info->cd = (info->index < ARRAY_SIZE(chrdevs)) ?
--			chrdevs[info->index] : NULL;
--		if (info->cd)
--			goto out;
--	}
--
--out:
--	return info;
--}
--
--void *acquire_chrdev_list(void)
--{
--	down(&chrdevs_lock);
--	return get_next_chrdev(NULL);
--}
--
--void release_chrdev_list(void *dev)
--{
--	up(&chrdevs_lock);
--	kfree(dev);
-+	return major % CHRDEV_MAJOR_HASH_SIZE;
- }
- 
-+#ifdef CONFIG_PROC_FS
- 
--int count_chrdev_list(void)
-+void chrdev_show(struct seq_file *f, off_t offset)
- {
- 	struct char_device_struct *cd;
--	int i, count;
--
--	count = 0;
- 
--	for (i = 0; i < ARRAY_SIZE(chrdevs) ; i++) {
--		for (cd = chrdevs[i]; cd; cd = cd->next)
--			count++;
-+	if (offset < CHRDEV_MAJOR_HASH_SIZE) {
-+		down(&chrdevs_lock);
-+		for (cd = chrdevs[offset]; cd; cd = cd->next)
-+			seq_printf(f, "%3d %s\n", cd->major, cd->name);
-+		up(&chrdevs_lock);
- 	}
--
--	return count;
- }
- 
--int get_chrdev_info(void *dev, int *major, char **name)
--{
--	struct chrdev_info *info = dev;
--
--	if (info->cd == NULL)
--		return 1;
--
--	*major = info->cd->major;
--	*name = info->cd->name;
--	return 0;
--}
-+#endif /* CONFIG_PROC_FS */
- 
- /*
-  * Register a single major with a specified minor range.
-diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
-index a2c2485..3f5e38c 100644
---- a/fs/cifs/cifsencrypt.c
-+++ b/fs/cifs/cifsencrypt.c
-@@ -56,9 +56,6 @@ int cifs_sign_smb(struct smb_hdr * cifs_
- 	int rc = 0;
- 	char smb_signature[20];
- 
--	/* BB remember to initialize sequence number elsewhere and initialize mac_signing key elsewhere BB */
--	/* BB remember to add code to save expected sequence number in midQ entry BB */
--
- 	if((cifs_pdu == NULL) || (server == NULL))
- 		return -EINVAL;
- 
-@@ -85,20 +82,33 @@ int cifs_sign_smb(struct smb_hdr * cifs_
- static int cifs_calc_signature2(const struct kvec * iov, int n_vec,
- 				const char * key, char * signature)
- {
--        struct  MD5Context context;
--
--        if((iov == NULL) || (signature == NULL))
--                return -EINVAL;
-+	struct  MD5Context context;
-+	int i;
- 
--        MD5Init(&context);
--        MD5Update(&context,key,CIFS_SESSION_KEY_SIZE+16);
-+	if((iov == NULL) || (signature == NULL))
-+		return -EINVAL;
- 
--/*        MD5Update(&context,cifs_pdu->Protocol,cifs_pdu->smb_buf_length); */ /* BB FIXME BB */
-+	MD5Init(&context);
-+	MD5Update(&context,key,CIFS_SESSION_KEY_SIZE+16);
-+	for(i=0;i<n_vec;i++) {
-+		if(iov[i].iov_base == NULL) {
-+			cERROR(1,("null iovec entry"));
-+			return -EIO;
-+		} else if(iov[i].iov_len == 0)
-+			break; /* bail out if we are sent nothing to sign */
-+		/* The first entry includes a length field (which does not get
-+		   signed that occupies the first 4 bytes before the header */
-+		if(i==0) {
-+			if (iov[0].iov_len <= 8 ) /* cmd field at offset 9 */
-+				break; /* nothing to sign or corrupt header */
-+			MD5Update(&context,iov[0].iov_base+4, iov[0].iov_len-4);
-+		} else
-+			MD5Update(&context,iov[i].iov_base, iov[i].iov_len);
-+	}
- 
--        MD5Final(signature,&context);
-+	MD5Final(signature,&context);
- 
--	return -EOPNOTSUPP;
--/*        return 0; */
-+	return 0;
- }
- 
- 
-diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
-index fed55e3..5e562bc 100644
---- a/fs/cifs/dir.c
-+++ b/fs/cifs/dir.c
-@@ -441,6 +441,20 @@ cifs_lookup(struct inode *parent_dir_ino
- 	cifs_sb = CIFS_SB(parent_dir_inode->i_sb);
- 	pTcon = cifs_sb->tcon;
- 
-+	/*
-+	 * Don't allow the separator character in a path component.
-+	 * The VFS will not allow "/", but "\" is allowed by posix.
-+	 */
-+	if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS)) {
-+		int i;
-+		for (i = 0; i < direntry->d_name.len; i++)
-+			if (direntry->d_name.name[i] == '\\') {
-+				cFYI(1, ("Invalid file name"));
-+				FreeXid(xid);
-+				return ERR_PTR(-EINVAL);
-+			}
-+	}
-+
- 	/* can not grab the rename sem here since it would
- 	deadlock in the cases (beginning of sys_rename itself)
- 	in which we already have the sb rename sem */
-diff --git a/fs/compat.c b/fs/compat.c
-index 5333c7d..8491bb8 100644
---- a/fs/compat.c
-+++ b/fs/compat.c
-@@ -1215,6 +1215,10 @@ static ssize_t compat_do_readv_writev(in
- 	if (ret < 0)
- 		goto out;
- 
-+	ret = security_file_permission(file, type == READ ? MAY_READ:MAY_WRITE);
-+	if (ret)
-+		goto out;
-+
- 	fnv = NULL;
- 	if (type == READ) {
- 		fn = file->f_op->read;
-@@ -1897,7 +1901,7 @@ asmlinkage long compat_sys_ppoll(struct 
- 	}
- 
- 	if (sigmask) {
--		if (sigsetsize |= sizeof(compat_sigset_t))
-+		if (sigsetsize != sizeof(compat_sigset_t))
- 			return -EINVAL;
- 		if (copy_from_user(&ss32, sigmask, sizeof(ss32)))
- 			return -EFAULT;
-diff --git a/fs/ext3/resize.c b/fs/ext3/resize.c
-index 1041dab..14f5f6e 100644
---- a/fs/ext3/resize.c
-+++ b/fs/ext3/resize.c
-@@ -974,6 +974,7 @@ int ext3_group_extend(struct super_block
- 	if (o_blocks_count != le32_to_cpu(es->s_blocks_count)) {
- 		ext3_warning(sb, __FUNCTION__,
- 			     "multiple resizers run on filesystem!");
-+		unlock_super(sb);
- 		err = -EBUSY;
- 		goto exit_put;
- 	}
-diff --git a/fs/fuse/file.c b/fs/fuse/file.c
-index 6f05379..ce93cf9 100644
---- a/fs/fuse/file.c
-+++ b/fs/fuse/file.c
-@@ -397,8 +397,12 @@ static int fuse_readpages(struct file *f
- 		return -EINTR;
- 
- 	err = read_cache_pages(mapping, pages, fuse_readpages_fill, &data);
--	if (!err)
--		fuse_send_readpages(data.req, file, inode);
-+	if (!err) {
-+		if (data.req->num_pages)
-+			fuse_send_readpages(data.req, file, inode);
-+		else
-+			fuse_put_request(fc, data.req);
-+	}
- 	return err;
- }
- 
-diff --git a/fs/locks.c b/fs/locks.c
-index 909eab8..39b038b 100644
---- a/fs/locks.c
-+++ b/fs/locks.c
-@@ -432,15 +432,14 @@ static struct lock_manager_operations le
-  */
- static int lease_init(struct file *filp, int type, struct file_lock *fl)
-  {
-+	if (assign_type(fl, type) != 0)
-+		return -EINVAL;
-+
- 	fl->fl_owner = current->files;
- 	fl->fl_pid = current->tgid;
- 
- 	fl->fl_file = filp;
- 	fl->fl_flags = FL_LEASE;
--	if (assign_type(fl, type) != 0) {
--		locks_free_lock(fl);
--		return -EINVAL;
--	}
- 	fl->fl_start = 0;
- 	fl->fl_end = OFFSET_MAX;
- 	fl->fl_ops = NULL;
-@@ -452,16 +451,19 @@ static int lease_init(struct file *filp,
- static int lease_alloc(struct file *filp, int type, struct file_lock **flp)
- {
- 	struct file_lock *fl = locks_alloc_lock();
--	int error;
-+	int error = -ENOMEM;
- 
- 	if (fl == NULL)
--		return -ENOMEM;
-+		goto out;
- 
- 	error = lease_init(filp, type, fl);
--	if (error)
--		return error;
-+	if (error) {
-+		locks_free_lock(fl);
-+		fl = NULL;
-+	}
-+out:
- 	*flp = fl;
--	return 0;
-+	return error;
- }
- 
- /* Check if two locks overlap each other.
-@@ -712,8 +714,9 @@ EXPORT_SYMBOL(posix_locks_deadlock);
-  * at the head of the list, but that's secret knowledge known only to
-  * flock_lock_file and posix_lock_file.
-  */
--static int flock_lock_file(struct file *filp, struct file_lock *new_fl)
-+static int flock_lock_file(struct file *filp, struct file_lock *request)
- {
-+	struct file_lock *new_fl = NULL;
- 	struct file_lock **before;
- 	struct inode * inode = filp->f_dentry->d_inode;
- 	int error = 0;
-@@ -728,17 +731,19 @@ static int flock_lock_file(struct file *
- 			continue;
- 		if (filp != fl->fl_file)
- 			continue;
--		if (new_fl->fl_type == fl->fl_type)
-+		if (request->fl_type == fl->fl_type)
- 			goto out;
- 		found = 1;
- 		locks_delete_lock(before);
- 		break;
- 	}
--	unlock_kernel();
- 
--	if (new_fl->fl_type == F_UNLCK)
--		return 0;
-+	if (request->fl_type == F_UNLCK)
-+		goto out;
- 
-+	new_fl = locks_alloc_lock();
-+	if (new_fl == NULL)
-+		goto out;
- 	/*
- 	 * If a higher-priority process was blocked on the old file lock,
- 	 * give it the opportunity to lock the file.
-@@ -746,26 +751,27 @@ static int flock_lock_file(struct file *
- 	if (found)
- 		cond_resched();
- 
--	lock_kernel();
- 	for_each_lock(inode, before) {
- 		struct file_lock *fl = *before;
- 		if (IS_POSIX(fl))
- 			break;
- 		if (IS_LEASE(fl))
- 			continue;
--		if (!flock_locks_conflict(new_fl, fl))
-+		if (!flock_locks_conflict(request, fl))
- 			continue;
- 		error = -EAGAIN;
--		if (new_fl->fl_flags & FL_SLEEP) {
--			locks_insert_block(fl, new_fl);
--		}
-+		if (request->fl_flags & FL_SLEEP)
-+			locks_insert_block(fl, request);
- 		goto out;
- 	}
-+	locks_copy_lock(new_fl, request);
- 	locks_insert_lock(&inode->i_flock, new_fl);
--	error = 0;
-+	new_fl = NULL;
- 
- out:
- 	unlock_kernel();
-+	if (new_fl)
-+		locks_free_lock(new_fl);
- 	return error;
- }
- 
-@@ -1337,6 +1343,7 @@ static int __setlease(struct file *filp,
- 		goto out;
- 
- 	if (my_before != NULL) {
-+		*flp = *my_before;
- 		error = lease->fl_lmops->fl_change(my_before, arg);
- 		goto out;
- 	}
-@@ -1529,9 +1536,7 @@ asmlinkage long sys_flock(unsigned int f
- 		error = flock_lock_file_wait(filp, lock);
- 
-  out_free:
--	if (list_empty(&lock->fl_link)) {
--		locks_free_lock(lock);
--	}
-+	locks_free_lock(lock);
- 
-  out_putf:
- 	fput(filp);
-@@ -2212,7 +2217,12 @@ void steal_locks(fl_owner_t from)
- 
- 	lock_kernel();
- 	j = 0;
--	rcu_read_lock();
-+
-+	/*
-+	 * We are not taking a ref to the file structures, so
-+	 * we need to acquire ->file_lock.
-+	 */
-+	spin_lock(&files->file_lock);
- 	fdt = files_fdtable(files);
- 	for (;;) {
- 		unsigned long set;
-@@ -2230,7 +2240,7 @@ void steal_locks(fl_owner_t from)
- 			set >>= 1;
- 		}
- 	}
--	rcu_read_unlock();
-+	spin_unlock(&files->file_lock);
- 	unlock_kernel();
- }
- EXPORT_SYMBOL(steal_locks);
-diff --git a/fs/nfsd/nfs3proc.c b/fs/nfsd/nfs3proc.c
-index 6d2dfed..f61142a 100644
---- a/fs/nfsd/nfs3proc.c
-+++ b/fs/nfsd/nfs3proc.c
-@@ -682,7 +682,7 @@ static struct svc_procedure		nfsd_proced
-   PROC(lookup,	 dirop,		dirop,		fhandle2, RC_NOCACHE, ST+FH+pAT+pAT),
-   PROC(access,	 access,	access,		fhandle,  RC_NOCACHE, ST+pAT+1),
-   PROC(readlink, readlink,	readlink,	fhandle,  RC_NOCACHE, ST+pAT+1+NFS3_MAXPATHLEN/4),
--  PROC(read,	 read,		read,		fhandle,  RC_NOCACHE, ST+pAT+4+NFSSVC_MAXBLKSIZE),
-+  PROC(read,	 read,		read,		fhandle,  RC_NOCACHE, ST+pAT+4+NFSSVC_MAXBLKSIZE/4),
-   PROC(write,	 write,		write,		fhandle,  RC_REPLBUFF, ST+WC+4),
-   PROC(create,	 create,	create,		fhandle2, RC_REPLBUFF, ST+(1+FH+pAT)+WC),
-   PROC(mkdir,	 mkdir,		create,		fhandle2, RC_REPLBUFF, ST+(1+FH+pAT)+WC),
-diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
-index 6d63f1d..ca8a4c4 100644
---- a/fs/nfsd/nfs4proc.c
-+++ b/fs/nfsd/nfs4proc.c
-@@ -975,7 +975,7 @@ #define PROC(name, argt, rest, relt, cac
-  */
- static struct svc_procedure		nfsd_procedures4[2] = {
-   PROC(null,	 void,		void,		void,	  RC_NOCACHE, 1),
--  PROC(compound, compound,	compound,	compound, RC_NOCACHE, NFSD_BUFSIZE)
-+  PROC(compound, compound,	compound,	compound, RC_NOCACHE, NFSD_BUFSIZE/4)
- };
- 
- struct svc_version	nfsd_version4 = {
-diff --git a/fs/nfsd/nfsproc.c b/fs/nfsd/nfsproc.c
-index 3e6b75c..06cd0db 100644
---- a/fs/nfsd/nfsproc.c
-+++ b/fs/nfsd/nfsproc.c
-@@ -553,7 +553,7 @@ static struct svc_procedure		nfsd_proced
-   PROC(none,	 void,		void,		none,		RC_NOCACHE, ST),
-   PROC(lookup,	 diropargs,	diropres,	fhandle,	RC_NOCACHE, ST+FH+AT),
-   PROC(readlink, readlinkargs,	readlinkres,	none,		RC_NOCACHE, ST+1+NFS_MAXPATHLEN/4),
--  PROC(read,	 readargs,	readres,	fhandle,	RC_NOCACHE, ST+AT+1+NFSSVC_MAXBLKSIZE),
-+  PROC(read,	 readargs,	readres,	fhandle,	RC_NOCACHE, ST+AT+1+NFSSVC_MAXBLKSIZE/4),
-   PROC(none,	 void,		void,		none,		RC_NOCACHE, ST),
-   PROC(write,	 writeargs,	attrstat,	fhandle,	RC_REPLBUFF, ST+AT),
-   PROC(create,	 createargs,	diropres,	fhandle,	RC_REPLBUFF, ST+FH+AT),
-diff --git a/fs/open.c b/fs/open.c
-index 70e0230..f697914 100644
---- a/fs/open.c
-+++ b/fs/open.c
-@@ -330,7 +330,10 @@ out:
- 
- asmlinkage long sys_ftruncate(unsigned int fd, unsigned long length)
- {
--	return do_sys_ftruncate(fd, length, 1);
-+	long ret = do_sys_ftruncate(fd, length, 1);
-+	/* avoid REGPARM breakage on x86: */
-+	prevent_tail_call(ret);
-+	return ret;
- }
- 
- /* LFS versions of truncate are only needed on 32 bit machines */
-@@ -342,7 +345,10 @@ asmlinkage long sys_truncate64(const cha
- 
- asmlinkage long sys_ftruncate64(unsigned int fd, loff_t length)
- {
--	return do_sys_ftruncate(fd, length, 0);
-+	long ret = do_sys_ftruncate(fd, length, 0);
-+	/* avoid REGPARM breakage on x86: */
-+	prevent_tail_call(ret);
-+	return ret;
- }
- #endif
- 
-@@ -1083,20 +1089,30 @@ long do_sys_open(int dfd, const char __u
- 
- asmlinkage long sys_open(const char __user *filename, int flags, int mode)
- {
-+	long ret;
-+
- 	if (force_o_largefile())
- 		flags |= O_LARGEFILE;
- 
--	return do_sys_open(AT_FDCWD, filename, flags, mode);
-+	ret = do_sys_open(AT_FDCWD, filename, flags, mode);
-+	/* avoid REGPARM breakage on x86: */
-+	prevent_tail_call(ret);
-+	return ret;
- }
- EXPORT_SYMBOL_GPL(sys_open);
- 
- asmlinkage long sys_openat(int dfd, const char __user *filename, int flags,
- 			   int mode)
- {
-+	long ret;
-+
- 	if (force_o_largefile())
- 		flags |= O_LARGEFILE;
- 
--	return do_sys_open(dfd, filename, flags, mode);
-+	ret = do_sys_open(dfd, filename, flags, mode);
-+	/* avoid REGPARM breakage on x86: */
-+	prevent_tail_call(ret);
-+	return ret;
- }
- EXPORT_SYMBOL_GPL(sys_openat);
- 
-diff --git a/fs/partitions/check.c b/fs/partitions/check.c
-index f924f45..2ef03aa 100644
---- a/fs/partitions/check.c
-+++ b/fs/partitions/check.c
-@@ -345,6 +345,7 @@ static char *make_block_name(struct gend
- 	char *name;
- 	static char *block_str = "block:";
- 	int size;
-+	char *s;
- 
- 	size = strlen(block_str) + strlen(disk->disk_name) + 1;
- 	name = kmalloc(size, GFP_KERNEL);
-@@ -352,6 +353,10 @@ static char *make_block_name(struct gend
- 		return NULL;
- 	strcpy(name, block_str);
- 	strcat(name, disk->disk_name);
-+	/* ewww... some of these buggers have / in name... */
-+	s = strchr(name, '/');
-+	if (s)
-+		*s = '!';
- 	return name;
- }
- 
-diff --git a/fs/proc/base.c b/fs/proc/base.c
-index 20feb75..c192cb2 100644
---- a/fs/proc/base.c
-+++ b/fs/proc/base.c
-@@ -294,16 +294,20 @@ static int proc_fd_link(struct inode *in
- 
- 	files = get_files_struct(task);
- 	if (files) {
--		rcu_read_lock();
-+		/*
-+		 * We are not taking a ref to the file structure, so we must
-+		 * hold ->file_lock.
-+		 */
-+		spin_lock(&files->file_lock);
- 		file = fcheck_files(files, fd);
- 		if (file) {
- 			*mnt = mntget(file->f_vfsmnt);
- 			*dentry = dget(file->f_dentry);
--			rcu_read_unlock();
-+			spin_unlock(&files->file_lock);
- 			put_files_struct(files);
- 			return 0;
- 		}
--		rcu_read_unlock();
-+		spin_unlock(&files->file_lock);
- 		put_files_struct(files);
- 	}
- 	return -ENOENT;
-@@ -1485,7 +1489,12 @@ static struct dentry *proc_lookupfd(stru
- 	if (!files)
- 		goto out_unlock;
- 	inode->i_mode = S_IFLNK;
--	rcu_read_lock();
-+
-+	/*
-+	 * We are not taking a ref to the file structure, so we must
-+	 * hold ->file_lock.
-+	 */
-+	spin_lock(&files->file_lock);
- 	file = fcheck_files(files, fd);
- 	if (!file)
- 		goto out_unlock2;
-@@ -1493,7 +1502,7 @@ static struct dentry *proc_lookupfd(stru
- 		inode->i_mode |= S_IRUSR | S_IXUSR;
- 	if (file->f_mode & 2)
- 		inode->i_mode |= S_IWUSR | S_IXUSR;
--	rcu_read_unlock();
-+	spin_unlock(&files->file_lock);
- 	put_files_struct(files);
- 	inode->i_op = &proc_pid_link_inode_operations;
- 	inode->i_size = 64;
-@@ -1503,7 +1512,7 @@ static struct dentry *proc_lookupfd(stru
- 	return NULL;
- 
- out_unlock2:
--	rcu_read_unlock();
-+	spin_unlock(&files->file_lock);
- 	put_files_struct(files);
- out_unlock:
- 	iput(inode);
-diff --git a/fs/proc/proc_misc.c b/fs/proc/proc_misc.c
-index 1d24fea..0c78312 100644
---- a/fs/proc/proc_misc.c
-+++ b/fs/proc/proc_misc.c
-@@ -249,144 +249,60 @@ static int cpuinfo_open(struct inode *in
- 	return seq_open(file, &cpuinfo_op);
- }
- 
--enum devinfo_states {
--	CHR_HDR,
--	CHR_LIST,
--	BLK_HDR,
--	BLK_LIST,
--	DEVINFO_DONE
--};
--
--struct devinfo_state {
--	void *chrdev;
--	void *blkdev;
--	unsigned int num_records;
--	unsigned int cur_record;
--	enum devinfo_states state;
-+static struct file_operations proc_cpuinfo_operations = {
-+	.open		= cpuinfo_open,
-+	.read		= seq_read,
-+	.llseek		= seq_lseek,
-+	.release	= seq_release,
- };
- 
--static void *devinfo_start(struct seq_file *f, loff_t *pos)
-+static int devinfo_show(struct seq_file *f, void *v)
- {
--	struct devinfo_state *info = f->private;
-+	int i = *(loff_t *) v;
- 
--	if (*pos) {
--		if ((info) && (*pos <= info->num_records))
--			return info;
--		return NULL;
-+	if (i < CHRDEV_MAJOR_HASH_SIZE) {
-+		if (i == 0)
-+			seq_printf(f, "Character devices:\n");
-+		chrdev_show(f, i);
-+	} else {
-+		i -= CHRDEV_MAJOR_HASH_SIZE;
-+		if (i == 0)
-+			seq_printf(f, "\nBlock devices:\n");
-+		blkdev_show(f, i);
- 	}
--	info = kmalloc(sizeof(*info), GFP_KERNEL);
--	f->private = info;
--	info->chrdev = acquire_chrdev_list();
--	info->blkdev = acquire_blkdev_list();
--	info->state = CHR_HDR;
--	info->num_records = count_chrdev_list();
--	info->num_records += count_blkdev_list();
--	info->num_records += 2; /* Character and Block headers */
--	*pos = 1;
--	info->cur_record = *pos;
--	return info;
-+	return 0;
- }
- 
--static void *devinfo_next(struct seq_file *f, void *v, loff_t *pos)
-+static void *devinfo_start(struct seq_file *f, loff_t *pos)
- {
--	int idummy;
--	char *ndummy;
--	struct devinfo_state *info = f->private;
--
--	switch (info->state) {
--		case CHR_HDR:
--			info->state = CHR_LIST;
--			(*pos)++;
--			/*fallthrough*/
--		case CHR_LIST:
--			if (get_chrdev_info(info->chrdev,&idummy,&ndummy)) {
--				/*
--				 * The character dev list is complete
--				 */
--				info->state = BLK_HDR;
--			} else {
--				info->chrdev = get_next_chrdev(info->chrdev);
--			}
--			(*pos)++;
--			break;
--		case BLK_HDR:
--			info->state = BLK_LIST;
--			(*pos)++;
--			break;
--		case BLK_LIST:
--			if (get_blkdev_info(info->blkdev,&idummy,&ndummy)) {
--				/*
--				 * The block dev list is complete
--				 */
--				info->state = DEVINFO_DONE;
--			} else {
--				info->blkdev = get_next_blkdev(info->blkdev);
--			}
--			(*pos)++;
--			break;
--		case DEVINFO_DONE:
--			(*pos)++;
--			info->cur_record = *pos;
--			info = NULL;
--			break;
--		default:
--			break;
--	}
--	if (info)
--		info->cur_record = *pos;
--	return info;
-+	if (*pos < (BLKDEV_MAJOR_HASH_SIZE + CHRDEV_MAJOR_HASH_SIZE))
-+		return pos;
-+	return NULL;
- }
- 
--static void devinfo_stop(struct seq_file *f, void *v)
-+static void *devinfo_next(struct seq_file *f, void *v, loff_t *pos)
- {
--	struct devinfo_state *info = f->private;
--
--	if (info) {
--		release_chrdev_list(info->chrdev);
--		release_blkdev_list(info->blkdev);
--		f->private = NULL;
--		kfree(info);
--	}
-+	(*pos)++;
-+	if (*pos >= (BLKDEV_MAJOR_HASH_SIZE + CHRDEV_MAJOR_HASH_SIZE))
-+		return NULL;
-+	return pos;
- }
- 
--static int devinfo_show(struct seq_file *f, void *arg)
--{
--	int major;
--	char *name;
--	struct devinfo_state *info = f->private;
--
--	switch(info->state) {
--		case CHR_HDR:
--			seq_printf(f,"Character devices:\n");
--			/* fallthrough */
--		case CHR_LIST:
--			if (!get_chrdev_info(info->chrdev,&major,&name))
--				seq_printf(f,"%3d %s\n",major,name);
--			break;
--		case BLK_HDR:
--			seq_printf(f,"\nBlock devices:\n");
--			/* fallthrough */
--		case BLK_LIST:
--			if (!get_blkdev_info(info->blkdev,&major,&name))
--				seq_printf(f,"%3d %s\n",major,name);
--			break;
--		default:
--			break;
--	}
--
--	return 0;
-+static void devinfo_stop(struct seq_file *f, void *v)
-+{
-+	/* Nothing to do */
- }
- 
--static  struct seq_operations devinfo_op = {
--	.start  = devinfo_start,
--	.next   = devinfo_next,
--	.stop   = devinfo_stop,
--	.show   = devinfo_show,
-+static struct seq_operations devinfo_ops = {
-+	.start = devinfo_start,
-+	.next  = devinfo_next,
-+	.stop  = devinfo_stop,
-+	.show  = devinfo_show
- };
- 
--static int devinfo_open(struct inode *inode, struct file *file)
-+static int devinfo_open(struct inode *inode, struct file *filp)
- {
--	return seq_open(file, &devinfo_op);
-+	return seq_open(filp, &devinfo_ops);
- }
- 
- static struct file_operations proc_devinfo_operations = {
-@@ -396,13 +312,6 @@ static struct file_operations proc_devin
- 	.release	= seq_release,
- };
- 
--static struct file_operations proc_cpuinfo_operations = {
--	.open		= cpuinfo_open,
--	.read		= seq_read,
--	.llseek		= seq_lseek,
--	.release	= seq_release,
--};
--
- extern struct seq_operations vmstat_op;
- static int vmstat_open(struct inode *inode, struct file *file)
- {
-diff --git a/fs/proc/vmcore.c b/fs/proc/vmcore.c
-index 4063fb3..164a7d0 100644
---- a/fs/proc/vmcore.c
-+++ b/fs/proc/vmcore.c
-@@ -103,8 +103,8 @@ static ssize_t read_vmcore(struct file *
- 				size_t buflen, loff_t *fpos)
- {
- 	ssize_t acc = 0, tmp;
--	size_t tsz, nr_bytes;
--	u64 start;
-+	size_t tsz;
-+	u64 start, nr_bytes;
- 	struct vmcore *curr_m = NULL;
- 
- 	if (buflen == 0 || *fpos >= vmcore_size)
-diff --git a/fs/reiserfs/xattr_acl.c b/fs/reiserfs/xattr_acl.c
-index ab8894c..9df778a 100644
---- a/fs/reiserfs/xattr_acl.c
-+++ b/fs/reiserfs/xattr_acl.c
-@@ -408,8 +408,9 @@ int reiserfs_cache_default_acl(struct in
- 		acl = reiserfs_get_acl(inode, ACL_TYPE_DEFAULT);
- 		reiserfs_read_unlock_xattrs(inode->i_sb);
- 		reiserfs_read_unlock_xattr_i(inode);
--		ret = acl ? 1 : 0;
--		posix_acl_release(acl);
-+		ret = (acl && !IS_ERR(acl));
-+		if (ret)
-+			posix_acl_release(acl);
- 	}
- 
- 	return ret;
-diff --git a/fs/smbfs/dir.c b/fs/smbfs/dir.c
-index 0424d06..45862ec 100644
---- a/fs/smbfs/dir.c
-+++ b/fs/smbfs/dir.c
-@@ -434,6 +434,11 @@ smb_lookup(struct inode *dir, struct den
- 	if (dentry->d_name.len > SMB_MAXNAMELEN)
- 		goto out;
- 
-+	/* Do not allow lookup of names with backslashes in */
-+	error = -EINVAL;
-+	if (memchr(dentry->d_name.name, '\\', dentry->d_name.len))
-+		goto out;
-+
- 	lock_kernel();
- 	error = smb_proc_getattr(dentry, &finfo);
- #ifdef SMBFS_PARANOIA
-diff --git a/fs/smbfs/request.c b/fs/smbfs/request.c
-index c71c375..c71dd27 100644
---- a/fs/smbfs/request.c
-+++ b/fs/smbfs/request.c
-@@ -339,9 +339,11 @@ #endif
- 		/*
- 		 * On timeout or on interrupt we want to try and remove the
- 		 * request from the recvq/xmitq.
-+		 * First check if the request is still part of a queue. (May
-+		 * have been removed by some error condition)
- 		 */
- 		smb_lock_server(server);
--		if (!(req->rq_flags & SMB_REQ_RECEIVED)) {
-+		if (!list_empty(&req->rq_queue)) {
- 			list_del_init(&req->rq_queue);
- 			smb_rput(req);
- 		}
-diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
-index 49bd219..cfd290d 100644
---- a/fs/sysfs/dir.c
-+++ b/fs/sysfs/dir.c
-@@ -302,6 +302,7 @@ void sysfs_remove_dir(struct kobject * k
- 	 * Drop reference from dget() on entrance.
- 	 */
- 	dput(dentry);
-+	kobj->dentry = NULL;
- }
- 
- int sysfs_rename_dir(struct kobject * kobj, const char *new_name)
-diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
-index d0e3d84..2ecc58c 100644
---- a/fs/sysfs/file.c
-+++ b/fs/sysfs/file.c
-@@ -183,7 +183,7 @@ fill_write_buffer(struct sysfs_buffer * 
- 		return -ENOMEM;
- 
- 	if (count >= PAGE_SIZE)
--		count = PAGE_SIZE;
-+		count = PAGE_SIZE - 1;
- 	error = copy_from_user(buffer->page,buf,count);
- 	buffer->needs_read_fill = 1;
- 	return error ? -EFAULT : count;
-diff --git a/fs/sysfs/inode.c b/fs/sysfs/inode.c
-index 689f7bc..6beee6f 100644
---- a/fs/sysfs/inode.c
-+++ b/fs/sysfs/inode.c
-@@ -227,12 +227,16 @@ void sysfs_drop_dentry(struct sysfs_dire
- void sysfs_hash_and_remove(struct dentry * dir, const char * name)
- {
- 	struct sysfs_dirent * sd;
--	struct sysfs_dirent * parent_sd = dir->d_fsdata;
-+	struct sysfs_dirent * parent_sd;
-+
-+	if (!dir)
-+		return;
- 
- 	if (dir->d_inode == NULL)
- 		/* no inode means this hasn't been made visible yet */
- 		return;
- 
-+	parent_sd = dir->d_fsdata;
- 	mutex_lock(&dir->d_inode->i_mutex);
- 	list_for_each_entry(sd, &parent_sd->s_children, s_sibling) {
- 		if (!sd->s_element)
-diff --git a/fs/sysfs/symlink.c b/fs/sysfs/symlink.c
-index e38d633..e5ce6e7 100644
---- a/fs/sysfs/symlink.c
-+++ b/fs/sysfs/symlink.c
-@@ -66,6 +66,7 @@ static int sysfs_add_link(struct dentry 
- 	if (!error)
- 		return 0;
- 
-+	kobject_put(target);
- 	kfree(sl->link_name);
- exit2:
- 	kfree(sl);
-diff --git a/fs/xfs/linux-2.6/xfs_aops.c b/fs/xfs/linux-2.6/xfs_aops.c
-index 74d8be8..a980736 100644
---- a/fs/xfs/linux-2.6/xfs_aops.c
-+++ b/fs/xfs/linux-2.6/xfs_aops.c
-@@ -616,7 +616,7 @@ xfs_is_delayed_page(
- 				acceptable = (type == IOMAP_UNWRITTEN);
- 			else if (buffer_delay(bh))
- 				acceptable = (type == IOMAP_DELAY);
--			else if (buffer_mapped(bh))
-+			else if (buffer_dirty(bh) && buffer_mapped(bh))
- 				acceptable = (type == 0);
- 			else
- 				break;
-diff --git a/fs/xfs/linux-2.6/xfs_iops.c b/fs/xfs/linux-2.6/xfs_iops.c
-index d7f6f2d..43808e2 100644
---- a/fs/xfs/linux-2.6/xfs_iops.c
-+++ b/fs/xfs/linux-2.6/xfs_iops.c
-@@ -673,8 +673,7 @@ linvfs_setattr(
- 	if (ia_valid & ATTR_ATIME) {
- 		vattr.va_mask |= XFS_AT_ATIME;
- 		vattr.va_atime = attr->ia_atime;
--		if (ia_valid & ATTR_ATIME_SET)
--			inode->i_atime = attr->ia_atime;
-+		inode->i_atime = attr->ia_atime;
- 	}
- 	if (ia_valid & ATTR_MTIME) {
- 		vattr.va_mask |= XFS_AT_MTIME;
-diff --git a/include/asm-i386/cpufeature.h b/include/asm-i386/cpufeature.h
-index c4ec2a4..9d15eec 100644
---- a/include/asm-i386/cpufeature.h
-+++ b/include/asm-i386/cpufeature.h
-@@ -70,6 +70,7 @@ #define X86_FEATURE_K7		(3*32+ 5) /* Ath
- #define X86_FEATURE_P3		(3*32+ 6) /* P3 */
- #define X86_FEATURE_P4		(3*32+ 7) /* P4 */
- #define X86_FEATURE_CONSTANT_TSC (3*32+ 8) /* TSC ticks at a constant rate */
-+#define X86_FEATURE_FXSAVE_LEAK (3*32+10) /* FXSAVE leaks FOP/FIP/FOP */
- 
- /* Intel-defined CPU features, CPUID level 0x00000001 (ecx), word 4 */
- #define X86_FEATURE_XMM3	(4*32+ 0) /* Streaming SIMD Extensions-3 */
-diff --git a/include/asm-i386/i387.h b/include/asm-i386/i387.h
-index 152d0ba..bc1d6ed 100644
---- a/include/asm-i386/i387.h
-+++ b/include/asm-i386/i387.h
-@@ -13,6 +13,7 @@ #define __ASM_I386_I387_H
- 
- #include <linux/sched.h>
- #include <linux/init.h>
-+#include <linux/kernel_stat.h>
- #include <asm/processor.h>
- #include <asm/sigcontext.h>
- #include <asm/user.h>
-@@ -38,17 +39,38 @@ #define restore_fpu(tsk)			\
- extern void kernel_fpu_begin(void);
- #define kernel_fpu_end() do { stts(); preempt_enable(); } while(0)
- 
-+/* We need a safe address that is cheap to find and that is already
-+   in L1 during context switch. The best choices are unfortunately
-+   different for UP and SMP */
-+#ifdef CONFIG_SMP
-+#define safe_address (__per_cpu_offset[0])
-+#else
-+#define safe_address (kstat_cpu(0).cpustat.user)
-+#endif
-+
- /*
-  * These must be called with preempt disabled
-  */
- static inline void __save_init_fpu( struct task_struct *tsk )
- {
-+	/* Use more nops than strictly needed in case the compiler
-+	   varies code */
- 	alternative_input(
--		"fnsave %1 ; fwait ;" GENERIC_NOP2,
--		"fxsave %1 ; fnclex",
-+		"fnsave %[fx] ;fwait;" GENERIC_NOP8 GENERIC_NOP4,
-+		"fxsave %[fx]\n"
-+		"bt $7,%[fsw] ; jnc 1f ; fnclex\n1:",
- 		X86_FEATURE_FXSR,
--		"m" (tsk->thread.i387.fxsave)
--		:"memory");
-+		[fx] "m" (tsk->thread.i387.fxsave),
-+		[fsw] "m" (tsk->thread.i387.fxsave.swd) : "memory");
-+	/* AMD K7/K8 CPUs don't save/restore FDP/FIP/FOP unless an exception
-+	   is pending.  Clear the x87 state here by setting it to fixed
-+   	   values. safe_address is a random variable that should be in L1 */
-+	alternative_input(
-+		GENERIC_NOP8 GENERIC_NOP2,
-+		"emms\n\t"	  	/* clear stack tags */
-+		"fildl %[addr]", 	/* set F?P to defined value */
-+		X86_FEATURE_FXSAVE_LEAK,
-+		[addr] "m" (safe_address));
- 	task_thread_info(tsk)->status &= ~TS_USEDFPU;
- }
- 
-diff --git a/include/asm-i386/pgtable-2level.h b/include/asm-i386/pgtable-2level.h
-index 74ef721..d76c61d 100644
---- a/include/asm-i386/pgtable-2level.h
-+++ b/include/asm-i386/pgtable-2level.h
-@@ -18,6 +18,9 @@ #define set_pte_at(mm,addr,ptep,pteval) 
- #define set_pte_atomic(pteptr, pteval) set_pte(pteptr,pteval)
- #define set_pmd(pmdptr, pmdval) (*(pmdptr) = (pmdval))
- 
-+#define pte_clear(mm,addr,xp)	do { set_pte_at(mm, addr, xp, __pte(0)); } while (0)
-+#define pmd_clear(xp)	do { set_pmd(xp, __pmd(0)); } while (0)
-+
- #define ptep_get_and_clear(mm,addr,xp)	__pte(xchg(&(xp)->pte_low, 0))
- #define pte_same(a, b)		((a).pte_low == (b).pte_low)
- #define pte_page(x)		pfn_to_page(pte_pfn(x))
-diff --git a/include/asm-i386/pgtable-3level.h b/include/asm-i386/pgtable-3level.h
-index f1a8b45..3dda0f6 100644
---- a/include/asm-i386/pgtable-3level.h
-+++ b/include/asm-i386/pgtable-3level.h
-@@ -85,6 +85,26 @@ ((unsigned long) __va(pud_val(pud) & PAG
- #define pmd_offset(pud, address) ((pmd_t *) pud_page(*(pud)) + \
- 			pmd_index(address))
- 
-+/*
-+ * For PTEs and PDEs, we must clear the P-bit first when clearing a page table
-+ * entry, so clear the bottom half first and enforce ordering with a compiler
-+ * barrier.
-+ */
-+static inline void pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
-+{
-+	ptep->pte_low = 0;
-+	smp_wmb();
-+	ptep->pte_high = 0;
-+}
-+
-+static inline void pmd_clear(pmd_t *pmd)
-+{
-+	u32 *tmp = (u32 *)pmd;
-+	*tmp = 0;
-+	smp_wmb();
-+	*(tmp + 1) = 0;
-+}
-+
- static inline pte_t ptep_get_and_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
- {
- 	pte_t res;
-diff --git a/include/asm-i386/pgtable.h b/include/asm-i386/pgtable.h
-index 088a945..6313403 100644
---- a/include/asm-i386/pgtable.h
-+++ b/include/asm-i386/pgtable.h
-@@ -204,12 +204,10 @@ #undef TEST_ACCESS_OK
- extern unsigned long pg0[];
- 
- #define pte_present(x)	((x).pte_low & (_PAGE_PRESENT | _PAGE_PROTNONE))
--#define pte_clear(mm,addr,xp)	do { set_pte_at(mm, addr, xp, __pte(0)); } while (0)
- 
- /* To avoid harmful races, pmd_none(x) should check only the lower when PAE */
- #define pmd_none(x)	(!(unsigned long)pmd_val(x))
- #define pmd_present(x)	(pmd_val(x) & _PAGE_PRESENT)
--#define pmd_clear(xp)	do { set_pmd(xp, __pmd(0)); } while (0)
- #define	pmd_bad(x)	((pmd_val(x) & (~PAGE_MASK & ~_PAGE_USER)) != _KERNPG_TABLE)
- 
- 
-@@ -269,7 +267,7 @@ static inline pte_t ptep_get_and_clear_f
- 	pte_t pte;
- 	if (full) {
- 		pte = *ptep;
--		*ptep = __pte(0);
-+		pte_clear(mm, addr, ptep);
- 	} else {
- 		pte = ptep_get_and_clear(mm, addr, ptep);
- 	}
-diff --git a/include/asm-m32r/smp.h b/include/asm-m32r/smp.h
-index 7885b7d..1184293 100644
---- a/include/asm-m32r/smp.h
-+++ b/include/asm-m32r/smp.h
-@@ -67,7 +67,8 @@ #define cpu_to_physid(cpu_id)	cpu_2_phys
- #define raw_smp_processor_id()	(current_thread_info()->cpu)
- 
- extern cpumask_t cpu_callout_map;
--#define cpu_possible_map cpu_callout_map
-+extern cpumask_t cpu_possible_map;
-+extern cpumask_t cpu_present_map;
- 
- static __inline__ int hard_smp_processor_id(void)
- {
-diff --git a/include/asm-m32r/uaccess.h b/include/asm-m32r/uaccess.h
-index e8ae619..819cc28 100644
---- a/include/asm-m32r/uaccess.h
-+++ b/include/asm-m32r/uaccess.h
-@@ -5,17 +5,9 @@ #define _ASM_M32R_UACCESS_H
-  *  linux/include/asm-m32r/uaccess.h
-  *
-  *  M32R version.
-- *    Copyright (C) 2004  Hirokazu Takata <takata at linux-m32r.org>
-+ *    Copyright (C) 2004, 2006  Hirokazu Takata <takata at linux-m32r.org>
-  */
- 
--#undef UACCESS_DEBUG
--
--#ifdef UACCESS_DEBUG
--#define UAPRINTK(args...) printk(args)
--#else
--#define UAPRINTK(args...)
--#endif /* UACCESS_DEBUG */
--
- /*
-  * User space memory access functions
-  */
-@@ -38,27 +30,29 @@ #define VERIFY_WRITE 1
- #define MAKE_MM_SEG(s)	((mm_segment_t) { (s) })
- 
- #ifdef CONFIG_MMU
-+
- #define KERNEL_DS	MAKE_MM_SEG(0xFFFFFFFF)
- #define USER_DS		MAKE_MM_SEG(PAGE_OFFSET)
--#else
--#define KERNEL_DS	MAKE_MM_SEG(0xFFFFFFFF)
--#define USER_DS		MAKE_MM_SEG(0xFFFFFFFF)
--#endif /* CONFIG_MMU */
--
- #define get_ds()	(KERNEL_DS)
--#ifdef CONFIG_MMU
- #define get_fs()	(current_thread_info()->addr_limit)
- #define set_fs(x)	(current_thread_info()->addr_limit = (x))
--#else
-+
-+#else /* not CONFIG_MMU */
-+
-+#define KERNEL_DS	MAKE_MM_SEG(0xFFFFFFFF)
-+#define USER_DS		MAKE_MM_SEG(0xFFFFFFFF)
-+#define get_ds()	(KERNEL_DS)
-+
- static inline mm_segment_t get_fs(void)
- {
--  return USER_DS;
-+	return USER_DS;
- }
- 
- static inline void set_fs(mm_segment_t s)
- {
- }
--#endif /* CONFIG_MMU */
-+
-+#endif /* not CONFIG_MMU */
- 
- #define segment_eq(a,b)	((a).seg == (b).seg)
- 
-@@ -83,9 +77,9 @@ #define __range_ok(addr,size) ({					\
- 		"	subx	%0, %0\n"				\
- 		"	cmpu	%4, %1\n"				\
- 		"	subx	%0, %5\n"				\
--		: "=&r"(flag), "=r"(sum)				\
--		: "1"(addr), "r"((int)(size)), 				\
--		  "r"(current_thread_info()->addr_limit.seg), "r"(0)	\
-+		: "=&r" (flag), "=r" (sum)				\
-+		: "1" (addr), "r" ((int)(size)), 			\
-+		  "r" (current_thread_info()->addr_limit.seg), "r" (0)	\
- 		: "cbit" );						\
- 	flag; })
- 
-@@ -113,10 +107,10 @@ #define access_ok(type,addr,size) (likel
- #else
- static inline int access_ok(int type, const void *addr, unsigned long size)
- {
--  extern unsigned long memory_start, memory_end;
--  unsigned long val = (unsigned long)addr;
-+	extern unsigned long memory_start, memory_end;
-+	unsigned long val = (unsigned long)addr;
- 
--  return ((val >= memory_start) && ((val + size) < memory_end));
-+	return ((val >= memory_start) && ((val + size) < memory_end));
- }
- #endif /* CONFIG_MMU */
- 
-@@ -155,39 +149,6 @@ extern int fixup_exception(struct pt_reg
-  * accesses to the same area of user memory).
-  */
- 
--extern void __get_user_1(void);
--extern void __get_user_2(void);
--extern void __get_user_4(void);
--
--#ifndef MODULE
--#define __get_user_x(size,ret,x,ptr) 					\
--	__asm__ __volatile__(						\
--		"	mv	r0, %0\n"				\
--		"	mv	r1, %1\n" 				\
--		"	bl __get_user_" #size "\n"			\
--		"	mv	%0, r0\n"				\
--		"	mv	%1, r1\n" 				\
--		: "=r"(ret), "=r"(x) 					\
--		: "0"(ptr)						\
--		: "r0", "r1", "r14" )
--#else /* MODULE */
--/*
-- * Use "jl" instead of "bl" for MODULE
-- */
--#define __get_user_x(size,ret,x,ptr) 					\
--	__asm__ __volatile__(						\
--		"	mv	r0, %0\n"				\
--		"	mv	r1, %1\n" 				\
--		"	seth	lr, #high(__get_user_" #size ")\n"	\
--		"	or3	lr, lr, #low(__get_user_" #size ")\n"	\
--		"	jl 	lr\n"					\
--		"	mv	%0, r0\n"				\
--		"	mv	%1, r1\n" 				\
--		: "=r"(ret), "=r"(x) 					\
--		: "0"(ptr)						\
--		: "r0", "r1", "r14" )
--#endif
--
- /* Careful: we have to cast the result to the type of the pointer for sign
-    reasons */
- /**
-@@ -208,20 +169,7 @@ #endif
-  * On error, the variable @x is set to zero.
-  */
- #define get_user(x,ptr)							\
--({	int __ret_gu;							\
--	unsigned long __val_gu;						\
--	__chk_user_ptr(ptr);						\
--	switch(sizeof (*(ptr))) {					\
--	case 1:  __get_user_x(1,__ret_gu,__val_gu,ptr); break;		\
--	case 2:  __get_user_x(2,__ret_gu,__val_gu,ptr); break;		\
--	case 4:  __get_user_x(4,__ret_gu,__val_gu,ptr); break;		\
--	default: __get_user_x(X,__ret_gu,__val_gu,ptr); break;		\
--	}								\
--	(x) = (__typeof__(*(ptr)))__val_gu;				\
--	__ret_gu;							\
--})
--
--extern void __put_user_bad(void);
-+	__get_user_check((x),(ptr),sizeof(*(ptr)))
- 
- /**
-  * put_user: - Write a simple value into user space.
-@@ -240,8 +188,7 @@ extern void __put_user_bad(void);
-  * Returns zero on success, or -EFAULT on error.
-  */
- #define put_user(x,ptr)							\
--  __put_user_check((__typeof__(*(ptr)))(x),(ptr),sizeof(*(ptr)))
--
-+	__put_user_check((__typeof__(*(ptr)))(x),(ptr),sizeof(*(ptr)))
- 
- /**
-  * __get_user: - Get a simple variable from user space, with less checking.
-@@ -264,8 +211,64 @@ #define put_user(x,ptr)							\
-  * On error, the variable @x is set to zero.
-  */
- #define __get_user(x,ptr) \
--  __get_user_nocheck((x),(ptr),sizeof(*(ptr)))
-+	__get_user_nocheck((x),(ptr),sizeof(*(ptr)))
- 
-+#define __get_user_nocheck(x,ptr,size)					\
-+({									\
-+	long __gu_err = 0;						\
-+	unsigned long __gu_val;						\
-+	might_sleep();							\
-+	__get_user_size(__gu_val,(ptr),(size),__gu_err);		\
-+	(x) = (__typeof__(*(ptr)))__gu_val;				\
-+	__gu_err;							\
-+})
-+
-+#define __get_user_check(x,ptr,size)					\
-+({									\
-+	long __gu_err = -EFAULT;					\
-+	unsigned long __gu_val = 0;					\
-+	const __typeof__(*(ptr)) __user *__gu_addr = (ptr);		\
-+	might_sleep();							\
-+	if (access_ok(VERIFY_READ,__gu_addr,size))			\
-+		__get_user_size(__gu_val,__gu_addr,(size),__gu_err);	\
-+	(x) = (__typeof__(*(ptr)))__gu_val;				\
-+	__gu_err;							\
-+})
-+
-+extern long __get_user_bad(void);
-+
-+#define __get_user_size(x,ptr,size,retval)				\
-+do {									\
-+	retval = 0;							\
-+	__chk_user_ptr(ptr);						\
-+	switch (size) {							\
-+	  case 1: __get_user_asm(x,ptr,retval,"ub"); break;		\
-+	  case 2: __get_user_asm(x,ptr,retval,"uh"); break;		\
-+	  case 4: __get_user_asm(x,ptr,retval,""); break;		\
-+	  default: (x) = __get_user_bad();				\
-+	}								\
-+} while (0)
-+
-+#define __get_user_asm(x, addr, err, itype)				\
-+	__asm__ __volatile__(						\
-+		"	.fillinsn\n"					\
-+		"1:	ld"itype" %1,@%2\n"				\
-+		"	.fillinsn\n"					\
-+		"2:\n"							\
-+		".section .fixup,\"ax\"\n"				\
-+		"	.balign 4\n"					\
-+		"3:	ldi %0,%3\n"					\
-+		"	seth r14,#high(2b)\n"				\
-+		"	or3 r14,r14,#low(2b)\n"				\
-+		"	jmp r14\n"					\
-+		".previous\n"						\
-+		".section __ex_table,\"a\"\n"				\
-+		"	.balign 4\n"					\
-+		"	.long 1b,3b\n"					\
-+		".previous"						\
-+		: "=&r" (err), "=&r" (x)				\
-+		: "r" (addr), "i" (-EFAULT), "0" (err)			\
-+		: "r14", "memory")
- 
- /**
-  * __put_user: - Write a simple value into user space, with less checking.
-@@ -287,11 +290,13 @@ #define __get_user(x,ptr) \
-  * Returns zero on success, or -EFAULT on error.
-  */
- #define __put_user(x,ptr) \
--  __put_user_nocheck((__typeof__(*(ptr)))(x),(ptr),sizeof(*(ptr)))
-+	__put_user_nocheck((__typeof__(*(ptr)))(x),(ptr),sizeof(*(ptr)))
-+
- 
- #define __put_user_nocheck(x,ptr,size)					\
- ({									\
- 	long __pu_err;							\
-+	might_sleep();							\
- 	__put_user_size((x),(ptr),(size),__pu_err);			\
- 	__pu_err;							\
- })
-@@ -308,28 +313,28 @@ ({									\
- })
- 
- #if defined(__LITTLE_ENDIAN__)
--#define __put_user_u64(x, addr, err)                                    \
--        __asm__ __volatile__(                                           \
--                "       .fillinsn\n"                                    \
--                "1:     st %L1,@%2\n"                                    \
--                "       .fillinsn\n"                                    \
--                "2:     st %H1,@(4,%2)\n"                                \
--                "       .fillinsn\n"                                    \
--                "3:\n"                                                  \
--                ".section .fixup,\"ax\"\n"                              \
--                "       .balign 4\n"                                    \
--                "4:     ldi %0,%3\n"                                    \
--                "       seth r14,#high(3b)\n"                           \
--                "       or3 r14,r14,#low(3b)\n"                         \
--                "       jmp r14\n"                                      \
--                ".previous\n"                                           \
--                ".section __ex_table,\"a\"\n"                           \
--                "       .balign 4\n"                                    \
--                "       .long 1b,4b\n"                                  \
--                "       .long 2b,4b\n"                                  \
--                ".previous"                                             \
--                : "=&r"(err)                                             \
--                : "r"(x), "r"(addr), "i"(-EFAULT), "0"(err)		\
-+#define __put_user_u64(x, addr, err)					\
-+        __asm__ __volatile__(						\
-+                "       .fillinsn\n"					\
-+                "1:     st %L1,@%2\n"					\
-+                "       .fillinsn\n"					\
-+                "2:     st %H1,@(4,%2)\n"				\
-+                "       .fillinsn\n"					\
-+                "3:\n"							\
-+                ".section .fixup,\"ax\"\n"				\
-+                "       .balign 4\n"					\
-+                "4:     ldi %0,%3\n"					\
-+                "       seth r14,#high(3b)\n"				\
-+                "       or3 r14,r14,#low(3b)\n"				\
-+                "       jmp r14\n"					\
-+                ".previous\n"						\
-+                ".section __ex_table,\"a\"\n"				\
-+                "       .balign 4\n"					\
-+                "       .long 1b,4b\n"					\
-+                "       .long 2b,4b\n"					\
-+                ".previous"						\
-+                : "=&r" (err)						\
-+                : "r" (x), "r" (addr), "i" (-EFAULT), "0" (err)		\
-                 : "r14", "memory")
- 
- #elif defined(__BIG_ENDIAN__)
-@@ -353,13 +358,15 @@ #define __put_user_u64(x, addr, err)				
- 		"	.long 1b,4b\n"					\
- 		"	.long 2b,4b\n"					\
- 		".previous"						\
--		: "=&r"(err)						\
--		: "r"(x), "r"(addr), "i"(-EFAULT), "0"(err)		\
-+		: "=&r" (err)						\
-+		: "r" (x), "r" (addr), "i" (-EFAULT), "0" (err)		\
- 		: "r14", "memory")
- #else
- #error no endian defined
- #endif
- 
-+extern void __put_user_bad(void);
-+
- #define __put_user_size(x,ptr,size,retval)				\
- do {									\
- 	retval = 0;							\
-@@ -398,52 +405,8 @@ #define __put_user_asm(x, addr, err, ity
- 		"	.balign 4\n"					\
- 		"	.long 1b,3b\n"					\
- 		".previous"						\
--		: "=&r"(err)						\
--		: "r"(x), "r"(addr), "i"(-EFAULT), "0"(err)		\
--		: "r14", "memory")
--
--#define __get_user_nocheck(x,ptr,size)					\
--({									\
--	long __gu_err;							\
--	unsigned long __gu_val;						\
--	__get_user_size(__gu_val,(ptr),(size),__gu_err);		\
--	(x) = (__typeof__(*(ptr)))__gu_val;				\
--	__gu_err;							\
--})
--
--extern long __get_user_bad(void);
--
--#define __get_user_size(x,ptr,size,retval)				\
--do {									\
--	retval = 0;							\
--	__chk_user_ptr(ptr);						\
--	switch (size) {							\
--	  case 1: __get_user_asm(x,ptr,retval,"ub"); break;		\
--	  case 2: __get_user_asm(x,ptr,retval,"uh"); break;		\
--	  case 4: __get_user_asm(x,ptr,retval,""); break;		\
--	  default: (x) = __get_user_bad();				\
--	}								\
--} while (0)
--
--#define __get_user_asm(x, addr, err, itype)				\
--	__asm__ __volatile__(						\
--		"	.fillinsn\n"					\
--		"1:	ld"itype" %1,@%2\n"				\
--		"	.fillinsn\n"					\
--		"2:\n"							\
--		".section .fixup,\"ax\"\n"				\
--		"	.balign 4\n"					\
--		"3:	ldi %0,%3\n"					\
--		"	seth r14,#high(2b)\n"				\
--		"	or3 r14,r14,#low(2b)\n"				\
--		"	jmp r14\n"					\
--		".previous\n"						\
--		".section __ex_table,\"a\"\n"				\
--		"	.balign 4\n"					\
--		"	.long 1b,3b\n"					\
--		".previous"						\
--		: "=&r"(err), "=&r"(x)					\
--		: "r"(addr), "i"(-EFAULT), "0"(err)			\
-+		: "=&r" (err)						\
-+		: "r" (x), "r" (addr), "i" (-EFAULT), "0" (err)		\
- 		: "r14", "memory")
- 
- /*
-@@ -453,7 +416,6 @@ #define __get_user_asm(x, addr, err, ity
-  * anything, so this is accurate.
-  */
- 
--
- /*
-  * Copy To/From Userspace
-  */
-@@ -511,8 +473,9 @@ do {									\
- 		"	.long 2b,9b\n"					\
- 		"	.long 3b,9b\n"					\
- 		".previous\n"						\
--		: "=&r"(__dst), "=&r"(__src), "=&r"(size), "=&r"(__c)	\
--		: "0"(to), "1"(from), "2"(size), "3"(size / 4)		\
-+		: "=&r" (__dst), "=&r" (__src), "=&r" (size),		\
-+		  "=&r" (__c)						\
-+		: "0" (to), "1" (from), "2" (size), "3" (size / 4)	\
- 		: "r14", "memory");					\
- } while (0)
- 
-@@ -573,8 +536,9 @@ do {									\
- 		"	.long 2b,7b\n"					\
- 		"	.long 3b,7b\n"					\
- 		".previous\n"						\
--		: "=&r"(__dst), "=&r"(__src), "=&r"(size), "=&r"(__c)	\
--		: "0"(to), "1"(from), "2"(size), "3"(size / 4)		\
-+		: "=&r" (__dst), "=&r" (__src), "=&r" (size),		\
-+		  "=&r" (__c)						\
-+		: "0" (to), "1" (from), "2" (size), "3" (size / 4)	\
- 		: "r14", "memory");					\
- } while (0)
- 
-@@ -676,7 +640,7 @@ #define __copy_from_user(to,from,n)			\
- #define copy_from_user(to,from,n)			\
- ({							\
- 	might_sleep();					\
--__generic_copy_from_user((to),(from),(n));	\
-+	__generic_copy_from_user((to),(from),(n));	\
- })
- 
- long __must_check strncpy_from_user(char *dst, const char __user *src,
-diff --git a/include/asm-mips/bitops.h b/include/asm-mips/bitops.h
-index 8e80205..849155a 100644
---- a/include/asm-mips/bitops.h
-+++ b/include/asm-mips/bitops.h
-@@ -654,7 +654,12 @@ static inline unsigned long fls(unsigned
- {
- #ifdef CONFIG_32BIT
- #ifdef CONFIG_CPU_MIPS32
--	__asm__ ("clz %0, %1" : "=r" (word) : "r" (word));
-+	__asm__ (
-+	"	.set	mips32					\n"
-+	"	clz	%0, %1					\n"
-+	"	.set	mips0					\n"
-+	: "=r" (word)
-+	: "r" (word));
- 
- 	return 32 - word;
- #else
-@@ -678,7 +683,12 @@ #endif /* CONFIG_32BIT */
- #ifdef CONFIG_64BIT
- #ifdef CONFIG_CPU_MIPS64
- 
--	__asm__ ("dclz %0, %1" : "=r" (word) : "r" (word));
-+	__asm__ (
-+	"	.set	mips64					\n"
-+	"	dclz	%0, %1					\n"
-+	"	.set	mips0					\n"
-+	: "=r" (word)
-+	: "r" (word));
- 
- 	return 64 - word;
- #else
-diff --git a/include/asm-mips/byteorder.h b/include/asm-mips/byteorder.h
-index 584f812..4ce5bc3 100644
---- a/include/asm-mips/byteorder.h
-+++ b/include/asm-mips/byteorder.h
-@@ -19,7 +19,9 @@ #ifdef CONFIG_CPU_MIPSR2
- static __inline__ __attribute_const__ __u16 ___arch__swab16(__u16 x)
- {
- 	__asm__(
-+	"	.set	mips32r2		\n"
- 	"	wsbh	%0, %1			\n"
-+	"	.set	mips0			\n"
- 	: "=r" (x)
- 	: "r" (x));
- 
-@@ -30,8 +32,10 @@ #define __arch__swab16(x)	___arch__swab1
- static __inline__ __attribute_const__ __u32 ___arch__swab32(__u32 x)
- {
- 	__asm__(
-+	"	.set	mips32r2		\n"
- 	"	wsbh	%0, %1			\n"
- 	"	rotr	%0, %0, 16		\n"
-+	"	.set	mips0			\n"
- 	: "=r" (x)
- 	: "r" (x));
- 
-diff --git a/include/asm-mips/interrupt.h b/include/asm-mips/interrupt.h
-index 7743487..50baf6b 100644
---- a/include/asm-mips/interrupt.h
-+++ b/include/asm-mips/interrupt.h
-@@ -20,7 +20,9 @@ __asm__ (
- 	"	.set	reorder						\n"
- 	"	.set	noat						\n"
- #ifdef CONFIG_CPU_MIPSR2
-+	"	.set	mips32r2					\n"
- 	"	ei							\n"
-+	"	.set	mips0						\n"
- #else
- 	"	mfc0	$1,$12						\n"
- 	"	ori	$1,0x1f						\n"
-@@ -63,7 +65,9 @@ __asm__ (
- 	"	.set	push						\n"
- 	"	.set	noat						\n"
- #ifdef CONFIG_CPU_MIPSR2
-+	"	.set	mips32r2					\n"
- 	"	di							\n"
-+	"	.set	mips0						\n"
- #else
- 	"	mfc0	$1,$12						\n"
- 	"	ori	$1,0x1f						\n"
-@@ -103,8 +107,10 @@ __asm__ (
- 	"	.set	reorder						\n"
- 	"	.set	noat						\n"
- #ifdef CONFIG_CPU_MIPSR2
-+	"	.set	mips32r2					\n"
- 	"	di	\\result					\n"
- 	"	andi	\\result, 1					\n"
-+	"	.set	mips0						\n"
- #else
- 	"	mfc0	\\result, $12					\n"
- 	"	ori	$1, \\result, 0x1f				\n"
-@@ -133,9 +139,11 @@ #if defined(CONFIG_CPU_MIPSR2) && define
- 	 * Slow, but doesn't suffer from a relativly unlikely race
- 	 * condition we're having since days 1.
- 	 */
-+	"	.set	mips32r2					\n"
- 	"	beqz	\\flags, 1f					\n"
- 	"	 di							\n"
- 	"	ei							\n"
-+	"	.set	mips0						\n"
- 	"1:								\n"
- #elif defined(CONFIG_CPU_MIPSR2)
- 	/*
-diff --git a/include/asm-mips/r4kcache.h b/include/asm-mips/r4kcache.h
-index 0bcb79a..d9ee097 100644
---- a/include/asm-mips/r4kcache.h
-+++ b/include/asm-mips/r4kcache.h
-@@ -37,7 +37,7 @@ #define cache_op(op,addr)						\
- 	"	cache	%0, %1					\n"	\
- 	"	.set	pop					\n"	\
- 	:								\
--	: "i" (op), "m" (*(unsigned char *)(addr)))
-+	: "i" (op), "R" (*(unsigned char *)(addr)))
- 
- static inline void flush_icache_line_indexed(unsigned long addr)
- {
-diff --git a/include/asm-powerpc/floppy.h b/include/asm-powerpc/floppy.h
-index e258778..608164c 100644
---- a/include/asm-powerpc/floppy.h
-+++ b/include/asm-powerpc/floppy.h
-@@ -35,6 +35,7 @@ #define fd_free_irq()           free_irq
- #ifdef CONFIG_PCI
- 
- #include <linux/pci.h>
-+#include <asm/ppc-pci.h>	/* for ppc64_isabridge_dev */
- 
- #define fd_dma_setup(addr,size,mode,io) powerpc_fd_dma_setup(addr,size,mode,io)
- 
-@@ -52,12 +53,12 @@ static __inline__ int powerpc_fd_dma_set
- 	if (bus_addr 
- 	    && (addr != prev_addr || size != prev_size || dir != prev_dir)) {
- 		/* different from last time -- unmap prev */
--		pci_unmap_single(NULL, bus_addr, prev_size, prev_dir);
-+		pci_unmap_single(ppc64_isabridge_dev, bus_addr, prev_size, prev_dir);
- 		bus_addr = 0;
- 	}
- 
- 	if (!bus_addr)	/* need to map it */
--		bus_addr = pci_map_single(NULL, addr, size, dir);
-+		bus_addr = pci_map_single(ppc64_isabridge_dev, addr, size, dir);
- 
- 	/* remember this one as prev */
- 	prev_addr = addr;
-diff --git a/include/asm-x86_64/cpufeature.h b/include/asm-x86_64/cpufeature.h
-index 76bb619..662964b 100644
---- a/include/asm-x86_64/cpufeature.h
-+++ b/include/asm-x86_64/cpufeature.h
-@@ -64,6 +64,7 @@ #define X86_FEATURE_CENTAUR_MCR	(3*32+ 3
- #define X86_FEATURE_REP_GOOD	(3*32+ 4) /* rep microcode works well on this CPU */
- #define X86_FEATURE_CONSTANT_TSC (3*32+5) /* TSC runs at constant rate */
- #define X86_FEATURE_SYNC_RDTSC  (3*32+6)  /* RDTSC syncs CPU core */
-+#define X86_FEATURE_FXSAVE_LEAK (3*32+7)  /* FIP/FOP/FDP leaks through FXSAVE */
- 
- /* Intel-defined CPU features, CPUID level 0x00000001 (ecx), word 4 */
- #define X86_FEATURE_XMM3	(4*32+ 0) /* Streaming SIMD Extensions-3 */
-diff --git a/include/asm-x86_64/i387.h b/include/asm-x86_64/i387.h
-index 876eb9a..cba8a3b 100644
---- a/include/asm-x86_64/i387.h
-+++ b/include/asm-x86_64/i387.h
-@@ -72,6 +72,23 @@ #define set_fpu_cwd(t,val) ((t)->thread.
- #define set_fpu_swd(t,val) ((t)->thread.i387.fxsave.swd = (val))
- #define set_fpu_fxsr_twd(t,val) ((t)->thread.i387.fxsave.twd = (val))
- 
-+#define X87_FSW_ES (1 << 7)	/* Exception Summary */
-+
-+/* AMD CPUs don't save/restore FDP/FIP/FOP unless an exception
-+   is pending. Clear the x87 state here by setting it to fixed
-+   values. The kernel data segment can be sometimes 0 and sometimes
-+   new user value. Both should be ok.
-+   Use the PDA as safe address because it should be already in L1. */
-+static inline void clear_fpu_state(struct i387_fxsave_struct *fx)
-+{
-+	if (unlikely(fx->swd & X87_FSW_ES))
-+		 asm volatile("fnclex");
-+	alternative_input(ASM_NOP8 ASM_NOP2,
-+	     	     "    emms\n"		/* clear stack tags */
-+	     	     "    fildl %%gs:0",	/* load to clear state */
-+		     X86_FEATURE_FXSAVE_LEAK);
-+}
-+
- static inline int restore_fpu_checking(struct i387_fxsave_struct *fx) 
- { 
- 	int err;
-@@ -119,6 +136,7 @@ #else
- #endif
- 	if (unlikely(err))
- 		__clear_user(fx, sizeof(struct i387_fxsave_struct));
-+	/* No need to clear here because the caller clears USED_MATH */
- 	return err;
- } 
- 
-@@ -149,7 +167,7 @@ #else
- 				"i" (offsetof(__typeof__(*tsk),
- 					      thread.i387.fxsave)));
- #endif
--	__asm__ __volatile__("fnclex");
-+	clear_fpu_state(&tsk->thread.i387.fxsave);
- }
- 
- static inline void kernel_fpu_begin(void)
-diff --git a/include/linux/cpu.h b/include/linux/cpu.h
-index 0ed1d48..d612b89 100644
---- a/include/linux/cpu.h
-+++ b/include/linux/cpu.h
-@@ -32,7 +32,7 @@ struct cpu {
- };
- 
- extern int register_cpu(struct cpu *, int, struct node *);
--extern struct sys_device *get_cpu_sysdev(int cpu);
-+extern struct sys_device *get_cpu_sysdev(unsigned cpu);
- #ifdef CONFIG_HOTPLUG_CPU
- extern void unregister_cpu(struct cpu *, struct node *);
- #endif
-diff --git a/include/linux/cpumask.h b/include/linux/cpumask.h
-index 60e56c6..a47ad70 100644
---- a/include/linux/cpumask.h
-+++ b/include/linux/cpumask.h
-@@ -408,6 +408,7 @@ ({						\
- })
- 
- #define for_each_cpu(cpu)	  for_each_cpu_mask((cpu), cpu_possible_map)
-+#define for_each_possible_cpu(cpu)  for_each_cpu_mask((cpu), cpu_possible_map)
- #define for_each_online_cpu(cpu)  for_each_cpu_mask((cpu), cpu_online_map)
- #define for_each_present_cpu(cpu) for_each_cpu_mask((cpu), cpu_present_map)
- 
-diff --git a/include/linux/fb.h b/include/linux/fb.h
-index 2cb19e6..2fdd8ae 100644
---- a/include/linux/fb.h
-+++ b/include/linux/fb.h
-@@ -839,12 +839,10 @@ #if defined (__BIG_ENDIAN)
- #define FB_LEFT_POS(bpp)          (32 - bpp)
- #define FB_SHIFT_HIGH(val, bits)  ((val) >> (bits))
- #define FB_SHIFT_LOW(val, bits)   ((val) << (bits))
--#define FB_BIT_NR(b)              (7 - (b))
- #else
- #define FB_LEFT_POS(bpp)          (0)
- #define FB_SHIFT_HIGH(val, bits)  ((val) << (bits))
- #define FB_SHIFT_LOW(val, bits)   ((val) >> (bits))
--#define FB_BIT_NR(b)              (b)
- #endif
- 
-     /*
-diff --git a/include/linux/fs.h b/include/linux/fs.h
-index 128d008..872042f 100644
---- a/include/linux/fs.h
-+++ b/include/linux/fs.h
-@@ -1383,6 +1383,7 @@ extern int bd_claim(struct block_device 
- extern void bd_release(struct block_device *);
- 
- /* fs/char_dev.c */
-+#define CHRDEV_MAJOR_HASH_SIZE	255
- extern int alloc_chrdev_region(dev_t *, unsigned, unsigned, const char *);
- extern int register_chrdev_region(dev_t, unsigned, const char *);
- extern int register_chrdev(unsigned int, const char *,
-@@ -1390,25 +1391,17 @@ extern int register_chrdev(unsigned int,
- extern int unregister_chrdev(unsigned int, const char *);
- extern void unregister_chrdev_region(dev_t, unsigned);
- extern int chrdev_open(struct inode *, struct file *);
--extern int get_chrdev_list(char *);
--extern void *acquire_chrdev_list(void);
--extern int count_chrdev_list(void);
--extern void *get_next_chrdev(void *);
--extern int get_chrdev_info(void *, int *, char **);
--extern void release_chrdev_list(void *);
-+extern void chrdev_show(struct seq_file *,off_t);
- 
- /* fs/block_dev.c */
-+#define BLKDEV_MAJOR_HASH_SIZE	255
- #define BDEVNAME_SIZE	32	/* Largest string for a blockdev identifier */
- extern const char *__bdevname(dev_t, char *buffer);
- extern const char *bdevname(struct block_device *bdev, char *buffer);
- extern struct block_device *lookup_bdev(const char *);
- extern struct block_device *open_bdev_excl(const char *, int, void *);
- extern void close_bdev_excl(struct block_device *);
--extern void *acquire_blkdev_list(void);
--extern int count_blkdev_list(void);
--extern void *get_next_blkdev(void *);
--extern int get_blkdev_info(void *, int *, char **);
--extern void release_blkdev_list(void *);
-+extern void blkdev_show(struct seq_file *,off_t);
- 
- extern void init_special_inode(struct inode *, umode_t, dev_t);
- 
-diff --git a/include/linux/mm.h b/include/linux/mm.h
-index 498ff87..279446e 100644
---- a/include/linux/mm.h
-+++ b/include/linux/mm.h
-@@ -229,10 +229,9 @@ struct page {
- 		unsigned long private;		/* Mapping-private opaque data:
- 					 	 * usually used for buffer_heads
- 						 * if PagePrivate set; used for
--						 * swp_entry_t if PageSwapCache.
--						 * When page is free, this
-+						 * swp_entry_t if PageSwapCache;
- 						 * indicates order in the buddy
--						 * system.
-+						 * system if PG_buddy is set.
- 						 */
- 		struct address_space *mapping;	/* If low bit clear, points to
- 						 * inode address_space, or NULL.
-diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
-index d52999c..d7ce72e 100644
---- a/include/linux/page-flags.h
-+++ b/include/linux/page-flags.h
-@@ -74,7 +74,9 @@ #define PG_swapcache		15	/* Swap page: s
- #define PG_mappedtodisk		16	/* Has blocks allocated on-disk */
- #define PG_reclaim		17	/* To be reclaimed asap */
- #define PG_nosave_free		18	/* Free, should not be written */
--#define PG_uncached		19	/* Page has been mapped as uncached */
-+#define PG_buddy		19	/* Page is free, on buddy lists */
-+
-+#define PG_uncached		20	/* Page has been mapped as uncached */
- 
- /*
-  * Global page accounting.  One instance per CPU.  Only unsigned longs are
-@@ -319,6 +321,10 @@ #define PageNosaveFree(page)	test_bit(PG
- #define SetPageNosaveFree(page)	set_bit(PG_nosave_free, &(page)->flags)
- #define ClearPageNosaveFree(page)		clear_bit(PG_nosave_free, &(page)->flags)
- 
-+#define PageBuddy(page)		test_bit(PG_buddy, &(page)->flags)
-+#define __SetPageBuddy(page)	__set_bit(PG_buddy, &(page)->flags)
-+#define __ClearPageBuddy(page)	__clear_bit(PG_buddy, &(page)->flags)
-+
- #define PageMappedToDisk(page)	test_bit(PG_mappedtodisk, &(page)->flags)
- #define SetPageMappedToDisk(page) set_bit(PG_mappedtodisk, &(page)->flags)
- #define ClearPageMappedToDisk(page) clear_bit(PG_mappedtodisk, &(page)->flags)
-diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h
-index aa6322d..6c1e347 100644
---- a/include/linux/proc_fs.h
-+++ b/include/linux/proc_fs.h
-@@ -78,7 +78,7 @@ struct kcore_list {
- struct vmcore {
- 	struct list_head list;
- 	unsigned long long paddr;
--	unsigned long size;
-+	unsigned long long size;
- 	loff_t offset;
- };
- 
-diff --git a/include/linux/raid/raid1.h b/include/linux/raid/raid1.h
-index 9d5494a..3009c81 100644
---- a/include/linux/raid/raid1.h
-+++ b/include/linux/raid/raid1.h
-@@ -130,6 +130,6 @@ #define R1BIO_BarrierRetry 5
-  * with failure when last write completes (and all failed).
-  * Record that bi_end_io was called with this flag...
-  */
--#define	R1BIO_Returned 4
-+#define	R1BIO_Returned 6
- 
- #endif
-diff --git a/include/linux/rtc.h b/include/linux/rtc.h
-index 0b2ba67..b739ac1 100644
---- a/include/linux/rtc.h
-+++ b/include/linux/rtc.h
-@@ -11,8 +11,6 @@
- #ifndef _LINUX_RTC_H_
- #define _LINUX_RTC_H_
- 
--#include <linux/interrupt.h>
--
- /*
-  * The struct used to pass data via the following ioctl. Similar to the
-  * struct tm in <time.h>, but it needs to be here so that the kernel 
-@@ -95,6 +93,8 @@ #define RTC_PLL_SET	_IOW('p', 0x12, stru
- 
- #ifdef __KERNEL__
- 
-+#include <linux/interrupt.h>
-+
- typedef struct rtc_task {
- 	void (*func)(void *private_data);
- 	void *private_data;
-diff --git a/include/net/ip.h b/include/net/ip.h
-index fab3d5b..ed84d04 100644
---- a/include/net/ip.h
-+++ b/include/net/ip.h
-@@ -95,6 +95,7 @@ extern int		ip_local_deliver(struct sk_b
- extern int		ip_mr_input(struct sk_buff *skb);
- extern int		ip_output(struct sk_buff *skb);
- extern int		ip_mc_output(struct sk_buff *skb);
-+extern int		ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *));
- extern int		ip_do_nat(struct sk_buff *skb);
- extern void		ip_send_check(struct iphdr *ip);
- extern int		ip_queue_xmit(struct sk_buff *skb, int ipfragok);
-diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
-index e673b2c..aa6033c 100644
---- a/include/net/sctp/sctp.h
-+++ b/include/net/sctp/sctp.h
-@@ -461,12 +461,12 @@ static inline int sctp_frag_point(const 
-  * there is room for a param header too.
-  */
- #define sctp_walk_params(pos, chunk, member)\
--_sctp_walk_params((pos), (chunk), WORD_ROUND(ntohs((chunk)->chunk_hdr.length)), member)
-+_sctp_walk_params((pos), (chunk), ntohs((chunk)->chunk_hdr.length), member)
- 
- #define _sctp_walk_params(pos, chunk, end, member)\
- for (pos.v = chunk->member;\
-      pos.v <= (void *)chunk + end - sizeof(sctp_paramhdr_t) &&\
--     pos.v <= (void *)chunk + end - WORD_ROUND(ntohs(pos.p->length)) &&\
-+     pos.v <= (void *)chunk + end - ntohs(pos.p->length) &&\
-      ntohs(pos.p->length) >= sizeof(sctp_paramhdr_t);\
-      pos.v += WORD_ROUND(ntohs(pos.p->length)))
- 
-@@ -477,7 +477,7 @@ #define _sctp_walk_errors(err, chunk_hdr
- for (err = (sctp_errhdr_t *)((void *)chunk_hdr + \
- 	    sizeof(sctp_chunkhdr_t));\
-      (void *)err <= (void *)chunk_hdr + end - sizeof(sctp_errhdr_t) &&\
--     (void *)err <= (void *)chunk_hdr + end - WORD_ROUND(ntohs(err->length)) &&\
-+     (void *)err <= (void *)chunk_hdr + end - ntohs(err->length) &&\
-      ntohs(err->length) >= sizeof(sctp_errhdr_t); \
-      err = (sctp_errhdr_t *)((void *)err + WORD_ROUND(ntohs(err->length))))
- 
-diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
-index 072f407..acb2ce1 100644
---- a/include/net/sctp/structs.h
-+++ b/include/net/sctp/structs.h
-@@ -702,6 +702,7 @@ struct sctp_chunk {
- 	__u8 tsn_gap_acked;	/* Is this chunk acked by a GAP ACK? */
- 	__s8 fast_retransmit;	 /* Is this chunk fast retransmitted? */
- 	__u8 tsn_missing_report; /* Data chunk missing counter. */
-+	__u8 data_accepted; 	/* At least 1 chunk in this packet accepted */
- };
- 
- void sctp_chunk_hold(struct sctp_chunk *);
-diff --git a/ipc/shm.c b/ipc/shm.c
-index 9162123..f409726 100644
---- a/ipc/shm.c
-+++ b/ipc/shm.c
-@@ -161,6 +161,8 @@ static int shm_mmap(struct file * file, 
- 	ret = shmem_mmap(file, vma);
- 	if (ret == 0) {
- 		vma->vm_ops = &shm_vm_ops;
-+		if (!(vma->vm_flags & VM_WRITE))
-+			vma->vm_flags &= ~VM_MAYWRITE;
- 		shm_inc(file->f_dentry->d_inode->i_ino);
- 	}
- 
-diff --git a/ipc/util.c b/ipc/util.c
-index 8626219..303b058 100644
---- a/ipc/util.c
-+++ b/ipc/util.c
-@@ -182,8 +182,7 @@ static int grow_ary(struct ipc_ids* ids,
- 	if(new == NULL)
- 		return size;
- 	new->size = newsize;
--	memcpy(new->p, ids->entries->p, sizeof(struct kern_ipc_perm *)*size +
--					sizeof(struct ipc_id_ary));
-+	memcpy(new->p, ids->entries->p, sizeof(struct kern_ipc_perm *)*size);
- 	for(i=size;i<newsize;i++) {
- 		new->p[i] = NULL;
- 	}
-diff --git a/kernel/auditsc.c b/kernel/auditsc.c
-index d7e7e63..cfaa4a2 100644
---- a/kernel/auditsc.c
-+++ b/kernel/auditsc.c
-@@ -966,11 +966,6 @@ void audit_syscall_entry(struct task_str
- 	if (context->in_syscall) {
- 		struct audit_context *newctx;
- 
--#if defined(__NR_vm86) && defined(__NR_vm86old)
--		/* vm86 mode should only be entered once */
--		if (major == __NR_vm86 || major == __NR_vm86old)
--			return;
--#endif
- #if AUDIT_DEBUG
- 		printk(KERN_ERR
- 		       "audit(:%d) pid=%d in syscall=%d;"
-diff --git a/kernel/exec_domain.c b/kernel/exec_domain.c
-index 867d6db..c01cead 100644
---- a/kernel/exec_domain.c
-+++ b/kernel/exec_domain.c
-@@ -140,6 +140,7 @@ __set_personality(u_long personality)
- 	ep = lookup_exec_domain(personality);
- 	if (ep == current_thread_info()->exec_domain) {
- 		current->personality = personality;
-+		module_put(ep->module);
- 		return 0;
- 	}
- 
-diff --git a/kernel/fork.c b/kernel/fork.c
-index b373322..9d4e0d8 100644
---- a/kernel/fork.c
-+++ b/kernel/fork.c
-@@ -720,7 +720,7 @@ out_release:
- 	free_fdset (new_fdt->open_fds, new_fdt->max_fdset);
- 	free_fd_array(new_fdt->fd, new_fdt->max_fds);
- 	kmem_cache_free(files_cachep, newf);
--	goto out;
-+	return NULL;
- }
- 
- static int copy_files(unsigned long clone_flags, struct task_struct * tsk)
-diff --git a/kernel/power/process.c b/kernel/power/process.c
-index 28de118..67b2cdd 100644
---- a/kernel/power/process.c
-+++ b/kernel/power/process.c
-@@ -25,8 +25,7 @@ static inline int freezeable(struct task
- 	    (p->flags & PF_NOFREEZE) ||
- 	    (p->exit_state == EXIT_ZOMBIE) ||
- 	    (p->exit_state == EXIT_DEAD) ||
--	    (p->state == TASK_STOPPED) ||
--	    (p->state == TASK_TRACED))
-+	    (p->state == TASK_STOPPED))
- 		return 0;
- 	return 1;
- }
-diff --git a/kernel/ptrace.c b/kernel/ptrace.c
-index d95a72c..48453c3 100644
---- a/kernel/ptrace.c
-+++ b/kernel/ptrace.c
-@@ -57,10 +57,6 @@ void ptrace_untrace(task_t *child)
- 			signal_wake_up(child, 1);
- 		}
- 	}
--	if (child->signal->flags & SIGNAL_GROUP_EXIT) {
--		sigaddset(&child->pending.signal, SIGKILL);
--		signal_wake_up(child, 1);
--	}
- 	spin_unlock(&child->sighand->siglock);
- }
- 
-@@ -82,7 +78,8 @@ void __ptrace_unlink(task_t *child)
- 		SET_LINKS(child);
- 	}
- 
--	ptrace_untrace(child);
-+	if (child->state == TASK_TRACED)
-+		ptrace_untrace(child);
- }
- 
- /*
-@@ -152,12 +149,34 @@ int ptrace_may_attach(struct task_struct
- int ptrace_attach(struct task_struct *task)
- {
- 	int retval;
--	task_lock(task);
-+
- 	retval = -EPERM;
- 	if (task->pid <= 1)
--		goto bad;
-+		goto out;
- 	if (task->tgid == current->tgid)
--		goto bad;
-+		goto out;
-+
-+repeat:
-+	/*
-+	 * Nasty, nasty.
-+	 *
-+	 * We want to hold both the task-lock and the
-+	 * tasklist_lock for writing at the same time.
-+	 * But that's against the rules (tasklist_lock
-+	 * is taken for reading by interrupts on other
-+	 * cpu's that may have task_lock).
-+	 */
-+	task_lock(task);
-+	local_irq_disable();
-+	if (!write_trylock(&tasklist_lock)) {
-+		local_irq_enable();
-+		task_unlock(task);
-+		do {
-+			cpu_relax();
-+		} while (!write_can_lock(&tasklist_lock));
-+		goto repeat;
-+	}
-+
- 	/* the same process cannot be attached many times */
- 	if (task->ptrace & PT_PTRACED)
- 		goto bad;
-@@ -170,17 +189,15 @@ int ptrace_attach(struct task_struct *ta
- 				      ? PT_ATTACHED : 0);
- 	if (capable(CAP_SYS_PTRACE))
- 		task->ptrace |= PT_PTRACE_CAP;
--	task_unlock(task);
- 
--	write_lock_irq(&tasklist_lock);
- 	__ptrace_link(task, current);
--	write_unlock_irq(&tasklist_lock);
- 
- 	force_sig_specific(SIGSTOP, task);
--	return 0;
- 
- bad:
-+	write_unlock_irq(&tasklist_lock);
- 	task_unlock(task);
-+out:
- 	return retval;
- }
- 
-@@ -421,21 +438,22 @@ #endif
-  */
- int ptrace_traceme(void)
- {
--	int ret;
-+	int ret = -EPERM;
- 
- 	/*
- 	 * Are we already being traced?
- 	 */
--	if (current->ptrace & PT_PTRACED)
--		return -EPERM;
--	ret = security_ptrace(current->parent, current);
--	if (ret)
--		return -EPERM;
--	/*
--	 * Set the ptrace bit in the process ptrace flags.
--	 */
--	current->ptrace |= PT_PTRACED;
--	return 0;
-+	task_lock(current);
-+	if (!(current->ptrace & PT_PTRACED)) {
-+		ret = security_ptrace(current->parent, current);
-+		/*
-+		 * Set the ptrace bit in the process ptrace flags.
-+		 */
-+		if (!ret)
-+			current->ptrace |= PT_PTRACED;
-+	}
-+	task_unlock(current);
-+	return ret;
- }
- 
- /**
-diff --git a/kernel/sched.c b/kernel/sched.c
-index 4d46e90..4e7efac 100644
---- a/kernel/sched.c
-+++ b/kernel/sched.c
-@@ -237,6 +237,7 @@ #ifdef CONFIG_SMP
- 
- 	task_t *migration_thread;
- 	struct list_head migration_queue;
-+	int cpu;
- #endif
- 
- #ifdef CONFIG_SCHEDSTATS
-@@ -1660,6 +1661,9 @@ #ifdef CONFIG_SMP
- /*
-  * double_rq_lock - safely lock two runqueues
-  *
-+ * We must take them in cpu order to match code in
-+ * dependent_sleeper and wake_dependent_sleeper.
-+ *
-  * Note this does not disable interrupts like task_rq_lock,
-  * you need to do so manually before calling.
-  */
-@@ -1671,7 +1675,7 @@ static void double_rq_lock(runqueue_t *r
- 		spin_lock(&rq1->lock);
- 		__acquire(rq2->lock);	/* Fake it out ;) */
- 	} else {
--		if (rq1 < rq2) {
-+		if (rq1->cpu < rq2->cpu) {
- 			spin_lock(&rq1->lock);
- 			spin_lock(&rq2->lock);
- 		} else {
-@@ -1707,7 +1711,7 @@ static void double_lock_balance(runqueue
- 	__acquires(this_rq->lock)
- {
- 	if (unlikely(!spin_trylock(&busiest->lock))) {
--		if (busiest < this_rq) {
-+		if (busiest->cpu < this_rq->cpu) {
- 			spin_unlock(&this_rq->lock);
- 			spin_lock(&busiest->lock);
- 			spin_lock(&this_rq->lock);
-@@ -6035,6 +6039,7 @@ #ifdef CONFIG_SMP
- 		rq->push_cpu = 0;
- 		rq->migration_thread = NULL;
- 		INIT_LIST_HEAD(&rq->migration_queue);
-+		rq->cpu = i;
- #endif
- 		atomic_set(&rq->nr_iowait, 0);
- 
-diff --git a/kernel/signal.c b/kernel/signal.c
-index ea15410..acbccf7 100644
---- a/kernel/signal.c
-+++ b/kernel/signal.c
-@@ -975,7 +975,6 @@ __group_complete_signal(int sig, struct 
- 		if (t == NULL)
- 			/* restart balancing at this thread */
- 			t = p->signal->curr_target = p;
--		BUG_ON(t->tgid != p->tgid);
- 
- 		while (!wants_signal(sig, t)) {
- 			t = next_thread(t);
-@@ -1689,6 +1688,7 @@ static void ptrace_stop(int exit_code, i
- 	/* Let the debugger run.  */
- 	set_current_state(TASK_TRACED);
- 	spin_unlock_irq(&current->sighand->siglock);
-+	try_to_freeze();
- 	read_lock(&tasklist_lock);
- 	if (likely(current->ptrace & PT_PTRACED) &&
- 	    likely(current->parent != current->real_parent ||
-@@ -1942,9 +1942,9 @@ relock:
- 			/* Let the debugger run.  */
- 			ptrace_stop(signr, signr, info);
- 
--			/* We're back.  Did the debugger cancel the sig or group_exit? */
-+			/* We're back.  Did the debugger cancel the sig?  */
- 			signr = current->exit_code;
--			if (signr == 0 || current->signal->flags & SIGNAL_GROUP_EXIT)
-+			if (signr == 0)
- 				continue;
- 
- 			current->exit_code = 0;
-diff --git a/kernel/sys.c b/kernel/sys.c
-index f91218a..105e102 100644
---- a/kernel/sys.c
-+++ b/kernel/sys.c
-@@ -1657,7 +1657,19 @@ asmlinkage long sys_setrlimit(unsigned i
- 	    (cputime_eq(current->signal->it_prof_expires, cputime_zero) ||
- 	     new_rlim.rlim_cur <= cputime_to_secs(
- 		     current->signal->it_prof_expires))) {
--		cputime_t cputime = secs_to_cputime(new_rlim.rlim_cur);
-+		unsigned long rlim_cur = new_rlim.rlim_cur;
-+		cputime_t cputime;
-+
-+		if (rlim_cur == 0) {
-+			/*
-+			 * The caller is asking for an immediate RLIMIT_CPU
-+			 * expiry.  But we use the zero value to mean "it was
-+			 * never set".  So let's cheat and make it one second
-+			 * instead
-+			 */
-+			rlim_cur = 1;
-+		}
-+		cputime = secs_to_cputime(rlim_cur);
- 		read_lock(&tasklist_lock);
- 		spin_lock_irq(&current->sighand->siglock);
- 		set_process_cpu_timer(current, CPUCLOCK_PROF,
-diff --git a/kernel/uid16.c b/kernel/uid16.c
-index aa25605..187e2a4 100644
---- a/kernel/uid16.c
-+++ b/kernel/uid16.c
-@@ -20,43 +20,67 @@ #include <asm/uaccess.h>
- 
- asmlinkage long sys_chown16(const char __user * filename, old_uid_t user, old_gid_t group)
- {
--	return sys_chown(filename, low2highuid(user), low2highgid(group));
-+	long ret = sys_chown(filename, low2highuid(user), low2highgid(group));
-+	/* avoid REGPARM breakage on x86: */
-+	prevent_tail_call(ret);
-+	return ret;
- }
- 
- asmlinkage long sys_lchown16(const char __user * filename, old_uid_t user, old_gid_t group)
- {
--	return sys_lchown(filename, low2highuid(user), low2highgid(group));
-+	long ret = sys_lchown(filename, low2highuid(user), low2highgid(group));
-+	/* avoid REGPARM breakage on x86: */
-+	prevent_tail_call(ret);
-+	return ret;
- }
- 
- asmlinkage long sys_fchown16(unsigned int fd, old_uid_t user, old_gid_t group)
- {
--	return sys_fchown(fd, low2highuid(user), low2highgid(group));
-+	long ret = sys_fchown(fd, low2highuid(user), low2highgid(group));
-+	/* avoid REGPARM breakage on x86: */
-+	prevent_tail_call(ret);
-+	return ret;
- }
- 
- asmlinkage long sys_setregid16(old_gid_t rgid, old_gid_t egid)
- {
--	return sys_setregid(low2highgid(rgid), low2highgid(egid));
-+	long ret = sys_setregid(low2highgid(rgid), low2highgid(egid));
-+	/* avoid REGPARM breakage on x86: */
-+	prevent_tail_call(ret);
-+	return ret;
- }
- 
- asmlinkage long sys_setgid16(old_gid_t gid)
- {
--	return sys_setgid(low2highgid(gid));
-+	long ret = sys_setgid(low2highgid(gid));
-+	/* avoid REGPARM breakage on x86: */
-+	prevent_tail_call(ret);
-+	return ret;
- }
- 
- asmlinkage long sys_setreuid16(old_uid_t ruid, old_uid_t euid)
- {
--	return sys_setreuid(low2highuid(ruid), low2highuid(euid));
-+	long ret = sys_setreuid(low2highuid(ruid), low2highuid(euid));
-+	/* avoid REGPARM breakage on x86: */
-+	prevent_tail_call(ret);
-+	return ret;
- }
- 
- asmlinkage long sys_setuid16(old_uid_t uid)
- {
--	return sys_setuid(low2highuid(uid));
-+	long ret = sys_setuid(low2highuid(uid));
-+	/* avoid REGPARM breakage on x86: */
-+	prevent_tail_call(ret);
-+	return ret;
- }
- 
- asmlinkage long sys_setresuid16(old_uid_t ruid, old_uid_t euid, old_uid_t suid)
- {
--	return sys_setresuid(low2highuid(ruid), low2highuid(euid),
--		low2highuid(suid));
-+	long ret = sys_setresuid(low2highuid(ruid), low2highuid(euid),
-+				 low2highuid(suid));
-+	/* avoid REGPARM breakage on x86: */
-+	prevent_tail_call(ret);
-+	return ret;
- }
- 
- asmlinkage long sys_getresuid16(old_uid_t __user *ruid, old_uid_t __user *euid, old_uid_t __user *suid)
-@@ -72,8 +96,11 @@ asmlinkage long sys_getresuid16(old_uid_
- 
- asmlinkage long sys_setresgid16(old_gid_t rgid, old_gid_t egid, old_gid_t sgid)
- {
--	return sys_setresgid(low2highgid(rgid), low2highgid(egid),
--		low2highgid(sgid));
-+	long ret = sys_setresgid(low2highgid(rgid), low2highgid(egid),
-+				 low2highgid(sgid));
-+	/* avoid REGPARM breakage on x86: */
-+	prevent_tail_call(ret);
-+	return ret;
- }
- 
- asmlinkage long sys_getresgid16(old_gid_t __user *rgid, old_gid_t __user *egid, old_gid_t __user *sgid)
-@@ -89,12 +116,18 @@ asmlinkage long sys_getresgid16(old_gid_
- 
- asmlinkage long sys_setfsuid16(old_uid_t uid)
- {
--	return sys_setfsuid(low2highuid(uid));
-+	long ret = sys_setfsuid(low2highuid(uid));
-+	/* avoid REGPARM breakage on x86: */
-+	prevent_tail_call(ret);
-+	return ret;
- }
- 
- asmlinkage long sys_setfsgid16(old_gid_t gid)
- {
--	return sys_setfsgid(low2highgid(gid));
-+	long ret = sys_setfsgid(low2highgid(gid));
-+	/* avoid REGPARM breakage on x86: */
-+	prevent_tail_call(ret);
-+	return ret;
- }
- 
- static int groups16_to_user(old_gid_t __user *grouplist,
-diff --git a/mm/madvise.c b/mm/madvise.c
-index af3d573..4e19615 100644
---- a/mm/madvise.c
-+++ b/mm/madvise.c
-@@ -168,6 +168,9 @@ static long madvise_remove(struct vm_are
- 			return -EINVAL;
- 	}
- 
-+	if ((vma->vm_flags & (VM_SHARED|VM_WRITE)) != (VM_SHARED|VM_WRITE))
-+		return -EACCES;
-+
- 	mapping = vma->vm_file->f_mapping;
- 
- 	offset = (loff_t)(start - vma->vm_start)
-diff --git a/mm/mempolicy.c b/mm/mempolicy.c
-index b21869a..8d7ddf0 100644
---- a/mm/mempolicy.c
-+++ b/mm/mempolicy.c
-@@ -1796,7 +1796,6 @@ static void gather_stats(struct page *pa
- 		md->mapcount_max = count;
- 
- 	md->node[page_to_nid(page)]++;
--	cond_resched();
- }
- 
- #ifdef CONFIG_HUGETLB_PAGE
-diff --git a/mm/page_alloc.c b/mm/page_alloc.c
-index 234bd48..8b3cde1 100644
---- a/mm/page_alloc.c
-+++ b/mm/page_alloc.c
-@@ -153,7 +153,8 @@ static void bad_page(struct page *page)
- 			1 << PG_reclaim |
- 			1 << PG_slab    |
- 			1 << PG_swapcache |
--			1 << PG_writeback );
-+			1 << PG_writeback |
-+			1 << PG_buddy );
- 	set_page_count(page, 0);
- 	reset_page_mapcount(page);
- 	page->mapping = NULL;
-@@ -224,12 +225,12 @@ static inline unsigned long page_order(s
- 
- static inline void set_page_order(struct page *page, int order) {
- 	set_page_private(page, order);
--	__SetPagePrivate(page);
-+	__SetPageBuddy(page);
- }
- 
- static inline void rmv_page_order(struct page *page)
- {
--	__ClearPagePrivate(page);
-+	__ClearPageBuddy(page);
- 	set_page_private(page, 0);
- }
- 
-@@ -268,11 +269,13 @@ __find_combined_index(unsigned long page
-  * This function checks whether a page is free && is the buddy
-  * we can do coalesce a page and its buddy if
-  * (a) the buddy is not in a hole &&
-- * (b) the buddy is free &&
-- * (c) the buddy is on the buddy system &&
-- * (d) a page and its buddy have the same order.
-- * for recording page's order, we use page_private(page) and PG_private.
-+ * (b) the buddy is in the buddy system &&
-+ * (c) a page and its buddy have the same order.
-+ *
-+ * For recording whether a page is in the buddy system, we use PG_buddy.
-+ * Setting, clearing, and testing PG_buddy is serialized by zone->lock.
-  *
-+ * For recording page's order, we use page_private(page).
-  */
- static inline int page_is_buddy(struct page *page, int order)
- {
-@@ -281,10 +284,10 @@ #ifdef CONFIG_HOLES_IN_ZONE
- 		return 0;
- #endif
- 
--       if (PagePrivate(page)           &&
--           (page_order(page) == order) &&
--            page_count(page) == 0)
-+	if (PageBuddy(page) && page_order(page) == order) {
-+		BUG_ON(page_count(page) != 0);
-                return 1;
-+	}
-        return 0;
- }
- 
-@@ -301,7 +304,7 @@ #endif
-  * as necessary, plus some accounting needed to play nicely with other
-  * parts of the VM system.
-  * At each level, we keep a list of pages, which are heads of continuous
-- * free pages of length of (1 << order) and marked with PG_Private.Page's
-+ * free pages of length of (1 << order) and marked with PG_buddy. Page's
-  * order is recorded in page_private(page) field.
-  * So when we are allocating or freeing one, we can derive the state of the
-  * other.  That is, if we allocate a small block, and both were   
-@@ -364,7 +367,8 @@ static inline int free_pages_check(struc
- 			1 << PG_slab	|
- 			1 << PG_swapcache |
- 			1 << PG_writeback |
--			1 << PG_reserved ))))
-+			1 << PG_reserved |
-+			1 << PG_buddy ))))
- 		bad_page(page);
- 	if (PageDirty(page))
- 		__ClearPageDirty(page);
-@@ -522,7 +526,8 @@ static int prep_new_page(struct page *pa
- 			1 << PG_slab    |
- 			1 << PG_swapcache |
- 			1 << PG_writeback |
--			1 << PG_reserved ))))
-+			1 << PG_reserved |
-+			1 << PG_buddy ))))
- 		bad_page(page);
- 
- 	/*
-@@ -944,7 +949,8 @@ restart:
- 		alloc_flags |= ALLOC_HARDER;
- 	if (gfp_mask & __GFP_HIGH)
- 		alloc_flags |= ALLOC_HIGH;
--	alloc_flags |= ALLOC_CPUSET;
-+	if (wait)
-+		alloc_flags |= ALLOC_CPUSET;
- 
- 	/*
- 	 * Go through the zonelist again. Let __GFP_HIGH and allocations
-diff --git a/mm/shmem.c b/mm/shmem.c
-index 7c455fb..f0eb2f2 100644
---- a/mm/shmem.c
-+++ b/mm/shmem.c
-@@ -2172,6 +2172,7 @@ #ifdef CONFIG_TMPFS
- 	.prepare_write	= shmem_prepare_write,
- 	.commit_write	= simple_commit_write,
- #endif
-+	.migratepage	= migrate_page,
- };
- 
- static struct file_operations shmem_file_operations = {
-diff --git a/mm/vmscan.c b/mm/vmscan.c
-index 4fe7e3a..1d64dc1 100644
---- a/mm/vmscan.c
-+++ b/mm/vmscan.c
-@@ -949,6 +949,17 @@ redo:
- 			goto unlock_both;
-                 }
- 
-+		/* Make sure the dirty bit is up to date */
-+		if (try_to_unmap(page, 1) == SWAP_FAIL) {
-+			rc = -EPERM;
-+			goto unlock_both;
-+		}
-+
-+		if (page_mapcount(page)) {
-+			rc = -EAGAIN;
-+			goto unlock_both;
-+		}
-+
- 		/*
- 		 * Default handling if a filesystem does not provide
- 		 * a migration function. We can only migrate clean
-diff --git a/net/atm/clip.c b/net/atm/clip.c
-index 73370de..1842a4e 100644
---- a/net/atm/clip.c
-+++ b/net/atm/clip.c
-@@ -613,12 +613,19 @@ static int clip_create(int number)
- 
- 
- static int clip_device_event(struct notifier_block *this,unsigned long event,
--    void *dev)
-+			     void *arg)
- {
-+	struct net_device *dev = arg;
-+
-+	if (event == NETDEV_UNREGISTER) {
-+		neigh_ifdown(&clip_tbl, dev);
-+		return NOTIFY_DONE;
-+	}
-+
- 	/* ignore non-CLIP devices */
--	if (((struct net_device *) dev)->type != ARPHRD_ATM ||
--	    ((struct net_device *) dev)->hard_start_xmit != clip_start_xmit)
-+	if (dev->type != ARPHRD_ATM || dev->hard_start_xmit != clip_start_xmit)
- 		return NOTIFY_DONE;
-+
- 	switch (event) {
- 		case NETDEV_UP:
- 			DPRINTK("clip_device_event NETDEV_UP\n");
-@@ -686,14 +693,12 @@ static struct notifier_block clip_inet_n
- static void atmarpd_close(struct atm_vcc *vcc)
- {
- 	DPRINTK("atmarpd_close\n");
--	atmarpd = NULL; /* assumed to be atomic */
--	barrier();
--	unregister_inetaddr_notifier(&clip_inet_notifier);
--	unregister_netdevice_notifier(&clip_dev_notifier);
--	if (skb_peek(&sk_atm(vcc)->sk_receive_queue))
--		printk(KERN_ERR "atmarpd_close: closing with requests "
--		    "pending\n");
-+
-+	rtnl_lock();
-+	atmarpd = NULL;
- 	skb_queue_purge(&sk_atm(vcc)->sk_receive_queue);
-+	rtnl_unlock();
-+
- 	DPRINTK("(done)\n");
- 	module_put(THIS_MODULE);
- }
-@@ -714,7 +719,12 @@ static struct atm_dev atmarpd_dev = {
- 
- static int atm_init_atmarp(struct atm_vcc *vcc)
- {
--	if (atmarpd) return -EADDRINUSE;
-+	rtnl_lock();
-+	if (atmarpd) {
-+		rtnl_unlock();
-+		return -EADDRINUSE;
-+	}
-+
- 	if (start_timer) {
- 		start_timer = 0;
- 		init_timer(&idle_timer);
-@@ -731,10 +741,7 @@ static int atm_init_atmarp(struct atm_vc
- 	vcc->push = NULL;
- 	vcc->pop = NULL; /* crash */
- 	vcc->push_oam = NULL; /* crash */
--	if (register_netdevice_notifier(&clip_dev_notifier))
--		printk(KERN_ERR "register_netdevice_notifier failed\n");
--	if (register_inetaddr_notifier(&clip_inet_notifier))
--		printk(KERN_ERR "register_inetaddr_notifier failed\n");
-+	rtnl_unlock();
- 	return 0;
- }
- 
-@@ -992,6 +999,8 @@ static int __init atm_clip_init(void)
- 
- 	clip_tbl_hook = &clip_tbl;
- 	register_atm_ioctl(&clip_ioctl_ops);
-+	register_netdevice_notifier(&clip_dev_notifier);
-+	register_inetaddr_notifier(&clip_inet_notifier);
- 
- #ifdef CONFIG_PROC_FS
- {
-@@ -1012,6 +1021,9 @@ static void __exit atm_clip_exit(void)
- 
- 	remove_proc_entry("arp", atm_proc_root);
- 
-+	unregister_inetaddr_notifier(&clip_inet_notifier);
-+	unregister_netdevice_notifier(&clip_dev_notifier);
-+
- 	deregister_atm_ioctl(&clip_ioctl_ops);
- 
- 	/* First, stop the idle timer, so it stops banging
-diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
-index e060aad..9e27373 100644
---- a/net/bridge/br_netfilter.c
-+++ b/net/bridge/br_netfilter.c
-@@ -739,6 +739,15 @@ out:
- 	return NF_STOLEN;
- }
- 
-+static int br_nf_dev_queue_xmit(struct sk_buff *skb)
-+{
-+	if (skb->protocol == htons(ETH_P_IP) &&
-+	    skb->len > skb->dev->mtu &&
-+	    !(skb_shinfo(skb)->ufo_size || skb_shinfo(skb)->tso_size))
-+		return ip_fragment(skb, br_dev_queue_push_xmit);
-+	else
-+		return br_dev_queue_push_xmit(skb);
-+}
- 
- /* PF_BRIDGE/POST_ROUTING ********************************************/
- static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff **pskb,
-@@ -798,7 +807,7 @@ #if defined(CONFIG_VLAN_8021Q) || define
- 		realoutdev = nf_bridge->netoutdev;
- #endif
- 	NF_HOOK(pf, NF_IP_POST_ROUTING, skb, NULL, realoutdev,
--	        br_dev_queue_push_xmit);
-+	        br_nf_dev_queue_xmit);
- 
- 	return NF_STOLEN;
- 
-@@ -843,7 +852,7 @@ static unsigned int ip_sabotage_out(unsi
- 	if ((out->hard_start_xmit == br_dev_xmit &&
- 	    okfn != br_nf_forward_finish &&
- 	    okfn != br_nf_local_out_finish &&
--	    okfn != br_dev_queue_push_xmit)
-+	    okfn != br_nf_dev_queue_xmit)
- #if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
- 	    || ((out->priv_flags & IFF_802_1Q_VLAN) &&
- 	    VLAN_DEV_INFO(out)->real_dev->hard_start_xmit == br_dev_xmit)
-diff --git a/net/core/dev.c b/net/core/dev.c
-index 2afb0de..12a214c 100644
---- a/net/core/dev.c
-+++ b/net/core/dev.c
-@@ -2932,11 +2932,11 @@ void netdev_run_todo(void)
- 
- 		switch(dev->reg_state) {
- 		case NETREG_REGISTERING:
-+			dev->reg_state = NETREG_REGISTERED;
- 			err = netdev_register_sysfs(dev);
- 			if (err)
- 				printk(KERN_ERR "%s: failed sysfs registration (%d)\n",
- 				       dev->name, err);
--			dev->reg_state = NETREG_REGISTERED;
- 			break;
- 
- 		case NETREG_UNREGISTERING:
-diff --git a/net/core/sock.c b/net/core/sock.c
-index 6e00811..5621198 100644
---- a/net/core/sock.c
-+++ b/net/core/sock.c
-@@ -404,8 +404,9 @@ #ifdef CONFIG_NETDEVICES
- 			if (!valbool) {
- 				sk->sk_bound_dev_if = 0;
- 			} else {
--				if (optlen > IFNAMSIZ) 
--					optlen = IFNAMSIZ; 
-+				if (optlen > IFNAMSIZ - 1)
-+					optlen = IFNAMSIZ - 1;
-+				memset(devname, 0, sizeof(devname));
- 				if (copy_from_user(devname, optval, optlen)) {
- 					ret = -EFAULT;
- 					break;
-diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
-index e320b32..24009be 100644
---- a/net/ipv4/fib_trie.c
-+++ b/net/ipv4/fib_trie.c
-@@ -314,11 +314,6 @@ static void __leaf_free_rcu(struct rcu_h
- 	kfree(container_of(head, struct leaf, rcu));
- }
- 
--static inline void free_leaf(struct leaf *leaf)
--{
--	call_rcu(&leaf->rcu, __leaf_free_rcu);
--}
--
- static void __leaf_info_free_rcu(struct rcu_head *head)
- {
- 	kfree(container_of(head, struct leaf_info, rcu));
-@@ -357,7 +352,12 @@ static void __tnode_free_rcu(struct rcu_
- 
- static inline void tnode_free(struct tnode *tn)
- {
--	call_rcu(&tn->rcu, __tnode_free_rcu);
-+	if(IS_LEAF(tn)) {
-+		struct leaf *l = (struct leaf *) tn;
-+		call_rcu_bh(&l->rcu, __leaf_free_rcu);
-+	}
-+        else
-+		call_rcu(&tn->rcu, __tnode_free_rcu);
- }
- 
- static struct leaf *leaf_new(void)
-diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
-index 8ee4d01..8dcba38 100644
---- a/net/ipv4/ip_output.c
-+++ b/net/ipv4/ip_output.c
-@@ -86,8 +86,6 @@ #include <linux/tcp.h>
- 
- int sysctl_ip_default_ttl = IPDEFTTL;
- 
--static int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff*));
--
- /* Generate a checksum for an outgoing IP datagram. */
- __inline__ void ip_send_check(struct iphdr *iph)
- {
-@@ -421,7 +419,7 @@ #endif
-  *	single device frame, and queue such a frame for sending.
-  */
- 
--static int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff*))
-+int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff*))
- {
- 	struct iphdr *iph;
- 	int raw = 0;
-@@ -673,6 +671,8 @@ fail:
- 	return err;
- }
- 
-+EXPORT_SYMBOL(ip_fragment);
-+
- int
- ip_generic_getfrag(void *from, char *to, int offset, int len, int odd, struct sk_buff *skb)
- {
-@@ -1249,11 +1249,7 @@ int ip_push_pending_frames(struct sock *
- 	iph->tos = inet->tos;
- 	iph->tot_len = htons(skb->len);
- 	iph->frag_off = df;
--	if (!df) {
--		__ip_select_ident(iph, &rt->u.dst, 0);
--	} else {
--		iph->id = htons(inet->id++);
--	}
-+	ip_select_ident(iph, &rt->u.dst, sk);
- 	iph->ttl = ttl;
- 	iph->protocol = sk->sk_protocol;
- 	iph->saddr = rt->rt_src;
-diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
-index 7d7ab94..12bfc25 100644
---- a/net/ipv4/netfilter/arp_tables.c
-+++ b/net/ipv4/netfilter/arp_tables.c
-@@ -941,7 +941,7 @@ static int do_add_counters(void __user *
- 
- 	write_lock_bh(&t->lock);
- 	private = t->private;
--	if (private->number != paddc->num_counters) {
-+	if (private->number != tmp.num_counters) {
- 		ret = -EINVAL;
- 		goto unlock_up_free;
- 	}
-diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c
-index 84c66db..43f6b45 100644
---- a/net/ipv4/netfilter/ip_conntrack_core.c
-+++ b/net/ipv4/netfilter/ip_conntrack_core.c
-@@ -1318,6 +1318,7 @@ getorigdst(struct sock *sk, int optval, 
- 			.tuple.dst.u.tcp.port;
- 		sin.sin_addr.s_addr = ct->tuplehash[IP_CT_DIR_ORIGINAL]
- 			.tuple.dst.ip;
-+		memset(sin.sin_zero, 0, sizeof(sin.sin_zero));
- 
- 		DEBUGP("SO_ORIGINAL_DST: %u.%u.%u.%u %u\n",
- 		       NIPQUAD(sin.sin_addr.s_addr), ntohs(sin.sin_port));
-diff --git a/net/ipv4/netfilter/ip_conntrack_netlink.c b/net/ipv4/netfilter/ip_conntrack_netlink.c
-index e0b5926..d4e6d0a 100644
---- a/net/ipv4/netfilter/ip_conntrack_netlink.c
-+++ b/net/ipv4/netfilter/ip_conntrack_netlink.c
-@@ -1619,7 +1619,7 @@ static void __exit ctnetlink_exit(void)
- 	printk("ctnetlink: unregistering from nfnetlink.\n");
- 
- #ifdef CONFIG_IP_NF_CONNTRACK_EVENTS
--	ip_conntrack_unregister_notifier(&ctnl_notifier_exp);
-+	ip_conntrack_expect_unregister_notifier(&ctnl_notifier_exp);
- 	ip_conntrack_unregister_notifier(&ctnl_notifier);
- #endif
- 
-diff --git a/net/ipv4/netfilter/ip_conntrack_proto_sctp.c b/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
-index be602e8..df67679 100644
---- a/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
-+++ b/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
-@@ -235,12 +235,15 @@ static int do_basic_checks(struct ip_con
- 			flag = 1;
- 		}
- 
--		/* Cookie Ack/Echo chunks not the first OR 
--		   Init / Init Ack / Shutdown compl chunks not the only chunks */
--		if ((sch->type == SCTP_CID_COOKIE_ACK 
-+		/*
-+		 * Cookie Ack/Echo chunks not the first OR
-+		 * Init / Init Ack / Shutdown compl chunks not the only chunks
-+		 * OR zero-length.
-+		 */
-+		if (((sch->type == SCTP_CID_COOKIE_ACK
- 			|| sch->type == SCTP_CID_COOKIE_ECHO
- 			|| flag)
--		     && count !=0 ) {
-+		      && count !=0) || !sch->length) {
- 			DEBUGP("Basic checks failed\n");
- 			return 1;
- 		}
-diff --git a/net/ipv4/netfilter/ip_nat_snmp_basic.c b/net/ipv4/netfilter/ip_nat_snmp_basic.c
-index 4f95d47..df57e7a 100644
---- a/net/ipv4/netfilter/ip_nat_snmp_basic.c
-+++ b/net/ipv4/netfilter/ip_nat_snmp_basic.c
-@@ -1000,12 +1000,12 @@ static unsigned char snmp_trap_decode(st
- 		
- 	return 1;
- 
-+err_addr_free:
-+	kfree((unsigned long *)trap->ip_address);
-+
- err_id_free:
- 	kfree(trap->id);
- 
--err_addr_free:
--	kfree((unsigned long *)trap->ip_address);
--	
- 	return 0;
- }
- 
-@@ -1123,11 +1123,10 @@ static int snmp_parse_mangle(unsigned ch
- 		struct snmp_v1_trap trap;
- 		unsigned char ret = snmp_trap_decode(&ctx, &trap, map, check);
- 		
--		/* Discard trap allocations regardless */
--		kfree(trap.id);
--		kfree((unsigned long *)trap.ip_address);
--		
--		if (!ret)
-+		if (ret) {
-+			kfree(trap.id);
-+			kfree((unsigned long *)trap.ip_address);
-+		} else 
- 			return ret;
- 		
- 	} else {
-diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
-index 16f47c6..735d5ff 100644
---- a/net/ipv4/netfilter/ip_tables.c
-+++ b/net/ipv4/netfilter/ip_tables.c
-@@ -1063,7 +1063,7 @@ do_add_counters(void __user *user, unsig
- 
- 	write_lock_bh(&t->lock);
- 	private = t->private;
--	if (private->number != paddc->num_counters) {
-+	if (private->number != tmp.num_counters) {
- 		ret = -EINVAL;
- 		goto unlock_up_free;
- 	}
-diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
-index 6c8624a..62a0f52 100644
---- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
-+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
-@@ -354,6 +354,7 @@ getorigdst(struct sock *sk, int optval, 
- 			.tuple.dst.u.tcp.port;
- 		sin.sin_addr.s_addr = ct->tuplehash[IP_CT_DIR_ORIGINAL]
- 			.tuple.dst.u3.ip;
-+		memset(sin.sin_zero, 0, sizeof(sin.sin_zero));
- 
- 		DEBUGP("SO_ORIGINAL_DST: %u.%u.%u.%u %u\n",
- 		       NIPQUAD(sin.sin_addr.s_addr), ntohs(sin.sin_port));
-diff --git a/net/ipv4/route.c b/net/ipv4/route.c
-index fca5fe0..a67955e 100644
---- a/net/ipv4/route.c
-+++ b/net/ipv4/route.c
-@@ -2750,7 +2750,10 @@ int inet_rtm_getroute(struct sk_buff *in
- 	/* Reserve room for dummy headers, this skb can pass
- 	   through good chunk of routing engine.
- 	 */
--	skb->mac.raw = skb->data;
-+	skb->mac.raw = skb->nh.raw = skb->data;
-+
-+	/* Bugfix: need to give ip_route_input enough of an IP header to not gag. */
-+	skb->nh.iph->protocol = IPPROTO_ICMP;
- 	skb_reserve(skb, MAX_HEADER + sizeof(struct iphdr));
- 
- 	if (rta[RTA_SRC - 1])
-diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
-index 9f498a6..310f2e6 100644
---- a/net/ipv4/tcp_output.c
-+++ b/net/ipv4/tcp_output.c
-@@ -537,7 +537,9 @@ int tcp_fragment(struct sock *sk, struct
- 	buff = sk_stream_alloc_skb(sk, nsize, GFP_ATOMIC);
- 	if (buff == NULL)
- 		return -ENOMEM; /* We'll just try again later. */
--	sk_charge_skb(sk, buff);
-+
-+	buff->truesize = skb->len - len;
-+	skb->truesize -= buff->truesize;
- 
- 	/* Correct the sequence numbers. */
- 	TCP_SKB_CB(buff)->seq = TCP_SKB_CB(skb)->seq + len;
-diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
-index 2a1e7e4..d88cab7 100644
---- a/net/ipv6/exthdrs.c
-+++ b/net/ipv6/exthdrs.c
-@@ -489,6 +489,18 @@ int ipv6_parse_hopopts(struct sk_buff *s
- {
- 	struct inet6_skb_parm *opt = IP6CB(skb);
- 
-+	/*
-+	 * skb->nh.raw is equal to skb->data, and
-+	 * skb->h.raw - skb->nh.raw is always equal to
-+	 * sizeof(struct ipv6hdr) by definition of
-+	 * hop-by-hop options.
-+	 */
-+	if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + 8) ||
-+	    !pskb_may_pull(skb, sizeof(struct ipv6hdr) + ((skb->h.raw[1] + 1) << 3))) {
-+		kfree_skb(skb);
-+		return -1;
-+	}
-+
- 	opt->hop = sizeof(struct ipv6hdr);
- 	if (ip6_parse_tlv(tlvprochopopt_lst, skb)) {
- 		skb->h.raw += (skb->h.raw[1]+1)<<3;
-diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
-index 74ff56c..dd6ad42 100644
---- a/net/ipv6/netfilter/ip6_tables.c
-+++ b/net/ipv6/netfilter/ip6_tables.c
-@@ -1120,7 +1120,7 @@ do_add_counters(void __user *user, unsig
- 
- 	write_lock_bh(&t->lock);
- 	private = t->private;
--	if (private->number != paddc->num_counters) {
-+	if (private->number != tmp.num_counters) {
- 		ret = -EINVAL;
- 		goto unlock_up_free;
- 	}
-diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
-index 91cce8b..88c840f 100644
---- a/net/ipv6/xfrm6_policy.c
-+++ b/net/ipv6/xfrm6_policy.c
-@@ -191,16 +191,18 @@ error:
- static inline void
- _decode_session6(struct sk_buff *skb, struct flowi *fl)
- {
--	u16 offset = sizeof(struct ipv6hdr);
-+	u16 offset = skb->h.raw - skb->nh.raw;
- 	struct ipv6hdr *hdr = skb->nh.ipv6h;
--	struct ipv6_opt_hdr *exthdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
--	u8 nexthdr = skb->nh.ipv6h->nexthdr;
-+	struct ipv6_opt_hdr *exthdr;
-+	u8 nexthdr = skb->nh.raw[IP6CB(skb)->nhoff];
- 
- 	memset(fl, 0, sizeof(struct flowi));
- 	ipv6_addr_copy(&fl->fl6_dst, &hdr->daddr);
- 	ipv6_addr_copy(&fl->fl6_src, &hdr->saddr);
- 
- 	while (pskb_may_pull(skb, skb->nh.raw + offset + 1 - skb->data)) {
-+		exthdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
-+
- 		switch (nexthdr) {
- 		case NEXTHDR_ROUTING:
- 		case NEXTHDR_HOP:
-diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
-index 9ff3463..40edeef 100644
---- a/net/netfilter/nf_conntrack_netlink.c
-+++ b/net/netfilter/nf_conntrack_netlink.c
-@@ -1641,7 +1641,7 @@ static void __exit ctnetlink_exit(void)
- 	printk("ctnetlink: unregistering from nfnetlink.\n");
- 
- #ifdef CONFIG_NF_CONNTRACK_EVENTS
--	nf_conntrack_unregister_notifier(&ctnl_notifier_exp);
-+	nf_conntrack_expect_unregister_notifier(&ctnl_notifier_exp);
- 	nf_conntrack_unregister_notifier(&ctnl_notifier);
- #endif
- 
-diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
-index cf798e6..cd2326d 100644
---- a/net/netfilter/nf_conntrack_proto_sctp.c
-+++ b/net/netfilter/nf_conntrack_proto_sctp.c
-@@ -240,12 +240,15 @@ static int do_basic_checks(struct nf_con
- 			flag = 1;
- 		}
- 
--		/* Cookie Ack/Echo chunks not the first OR 
--		   Init / Init Ack / Shutdown compl chunks not the only chunks */
--		if ((sch->type == SCTP_CID_COOKIE_ACK 
-+		/*
-+		 * Cookie Ack/Echo chunks not the first OR
-+		 * Init / Init Ack / Shutdown compl chunks not the only chunks
-+		 * OR zero-length.
-+		 */
-+		if (((sch->type == SCTP_CID_COOKIE_ACK
- 			|| sch->type == SCTP_CID_COOKIE_ECHO
- 			|| flag)
--		     && count !=0 ) {
-+		      && count !=0) || !sch->length) {
- 			DEBUGP("Basic checks failed\n");
- 			return 1;
- 		}
-diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c
-index 297b895..cf0c767 100644
---- a/net/sctp/inqueue.c
-+++ b/net/sctp/inqueue.c
-@@ -149,6 +149,7 @@ struct sctp_chunk *sctp_inq_pop(struct s
- 		/* This is the first chunk in the packet.  */
- 		chunk->singleton = 1;
- 		ch = (sctp_chunkhdr_t *) chunk->skb->data;
-+		chunk->data_accepted = 0;
- 	}
- 
-         chunk->chunk_hdr = ch;
-diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
-index 2b9a832..9395e09 100644
---- a/net/sctp/sm_statefuns.c
-+++ b/net/sctp/sm_statefuns.c
-@@ -636,8 +636,9 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(co
- 	 */
-         chunk->subh.cookie_hdr =
- 		(struct sctp_signed_cookie *)chunk->skb->data;
--	skb_pull(chunk->skb,
--		 ntohs(chunk->chunk_hdr->length) - sizeof(sctp_chunkhdr_t));
-+	if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
-+					 sizeof(sctp_chunkhdr_t)))
-+		goto nomem;
- 
- 	/* 5.1 D) Upon reception of the COOKIE ECHO chunk, Endpoint
- 	 * "Z" will reply with a COOKIE ACK chunk after building a TCB
-@@ -965,7 +966,8 @@ sctp_disposition_t sctp_sf_beat_8_3(cons
- 	 */
- 	chunk->subh.hb_hdr = (sctp_heartbeathdr_t *) chunk->skb->data;
- 	paylen = ntohs(chunk->chunk_hdr->length) - sizeof(sctp_chunkhdr_t);
--	skb_pull(chunk->skb, paylen);
-+	if (!pskb_pull(chunk->skb, paylen))
-+		goto nomem;
- 
- 	reply = sctp_make_heartbeat_ack(asoc, chunk,
- 					chunk->subh.hb_hdr, paylen);
-@@ -1028,6 +1030,12 @@ sctp_disposition_t sctp_sf_backbeat_8_3(
- 						  commands);
- 
- 	hbinfo = (sctp_sender_hb_info_t *) chunk->skb->data;
-+	/* Make sure that the length of the parameter is what we expect */
-+	if (ntohs(hbinfo->param_hdr.length) !=
-+				    sizeof(sctp_sender_hb_info_t)) {
-+		return SCTP_DISPOSITION_DISCARD;
-+	}
-+
- 	from_addr = hbinfo->daddr;
- 	link = sctp_assoc_lookup_paddr(asoc, &from_addr);
- 
-@@ -1860,8 +1868,9 @@ sctp_disposition_t sctp_sf_do_5_2_4_dupc
- 	 * are in good shape.
- 	 */
-         chunk->subh.cookie_hdr = (struct sctp_signed_cookie *)chunk->skb->data;
--	skb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
--		 sizeof(sctp_chunkhdr_t));
-+	if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
-+					sizeof(sctp_chunkhdr_t)))
-+		goto nomem;
- 
- 	/* In RFC 2960 5.2.4 3, if both Verification Tags in the State Cookie
- 	 * of a duplicate COOKIE ECHO match the Verification Tags of the
-@@ -5151,7 +5160,9 @@ static int sctp_eat_data(const struct sc
- 	int tmp;
- 	__u32 tsn;
- 	int account_value;
-+	struct sctp_tsnmap *map = (struct sctp_tsnmap *)&asoc->peer.tsn_map;
- 	struct sock *sk = asoc->base.sk;
-+	int rcvbuf_over = 0;
- 
- 	data_hdr = chunk->subh.data_hdr = (sctp_datahdr_t *)chunk->skb->data;
- 	skb_pull(chunk->skb, sizeof(sctp_datahdr_t));
-@@ -5162,10 +5173,16 @@ static int sctp_eat_data(const struct sc
- 	/* ASSERT:  Now skb->data is really the user data.  */
- 
- 	/*
--	 * if we are established, and we have used up our receive
--	 * buffer memory, drop the frame
--	 */
--	if (asoc->state == SCTP_STATE_ESTABLISHED) {
-+	 * If we are established, and we have used up our receive buffer
-+	 * memory, think about droping the frame.
-+	 * Note that we have an opportunity to improve performance here.
-+	 * If we accept one chunk from an skbuff, we have to keep all the
-+	 * memory of that skbuff around until the chunk is read into user
-+	 * space. Therefore, once we accept 1 chunk we may as well accept all
-+	 * remaining chunks in the skbuff. The data_accepted flag helps us do
-+	 * that.
-+	 */
-+	if ((asoc->state == SCTP_STATE_ESTABLISHED) && (!chunk->data_accepted)) {
- 		/*
- 		 * If the receive buffer policy is 1, then each
- 		 * association can allocate up to sk_rcvbuf bytes
-@@ -5176,9 +5193,25 @@ static int sctp_eat_data(const struct sc
- 			account_value = atomic_read(&asoc->rmem_alloc);
- 		else
- 			account_value = atomic_read(&sk->sk_rmem_alloc);
--
--		if (account_value > sk->sk_rcvbuf)
--			return SCTP_IERROR_IGNORE_TSN;
-+		if (account_value > sk->sk_rcvbuf) {
-+			/*
-+			 * We need to make forward progress, even when we are
-+			 * under memory pressure, so we always allow the
-+			 * next tsn after the ctsn ack point to be accepted.
-+			 * This lets us avoid deadlocks in which we have to
-+			 * drop frames that would otherwise let us drain the
-+			 * receive queue.
-+			 */
-+			if ((sctp_tsnmap_get_ctsn(map) + 1) != tsn)
-+				return SCTP_IERROR_IGNORE_TSN;
-+
-+			/*
-+			 * We're going to accept the frame but we should renege
-+			 * to make space for it. This will send us down that
-+			 * path later in this function.
-+			 */
-+			rcvbuf_over = 1;
-+		}
- 	}
- 
- 	/* Process ECN based congestion.
-@@ -5226,6 +5259,7 @@ static int sctp_eat_data(const struct sc
- 	datalen -= sizeof(sctp_data_chunk_t);
- 
- 	deliver = SCTP_CMD_CHUNK_ULP;
-+	chunk->data_accepted = 1;
- 
- 	/* Think about partial delivery. */
- 	if ((datalen >= asoc->rwnd) && (!asoc->ulpq.pd_mode)) {
-@@ -5242,7 +5276,8 @@ static int sctp_eat_data(const struct sc
- 	 * large spill over.
- 	 */
- 	if (!asoc->rwnd || asoc->rwnd_over ||
--	    (datalen > asoc->rwnd + asoc->frag_point)) {
-+	    (datalen > asoc->rwnd + asoc->frag_point) ||
-+	    rcvbuf_over) {
- 
- 		/* If this is the next TSN, consider reneging to make
- 		 * room.   Note: Playing nice with a confused sender.  A
-@@ -5250,8 +5285,8 @@ static int sctp_eat_data(const struct sc
- 		 * space and in the future we may want to detect and
- 		 * do more drastic reneging.
- 		 */
--		if (sctp_tsnmap_has_gap(&asoc->peer.tsn_map) &&
--		    (sctp_tsnmap_get_ctsn(&asoc->peer.tsn_map) + 1) == tsn) {
-+		if (sctp_tsnmap_has_gap(map) &&
-+		    (sctp_tsnmap_get_ctsn(map) + 1) == tsn) {
- 			SCTP_DEBUG_PRINTK("Reneging for tsn:%u\n", tsn);
- 			deliver = SCTP_CMD_RENEGE;
- 		} else {
-diff --git a/net/sctp/sm_statetable.c b/net/sctp/sm_statetable.c
-index 75ef104..8bcca56 100644
---- a/net/sctp/sm_statetable.c
-+++ b/net/sctp/sm_statetable.c
-@@ -366,9 +366,9 @@ #define TYPE_SCTP_ECN_ECNE { \
- 	/* SCTP_STATE_EMPTY */ \
- 	{.fn = sctp_sf_ootb, .name = "sctp_sf_ootb"}, \
- 	/* SCTP_STATE_CLOSED */ \
--	{.fn = sctp_sf_bug, .name = "sctp_sf_bug"}, \
-+	{.fn = sctp_sf_discard_chunk, .name = "sctp_sf_discard_chunk"}, \
- 	/* SCTP_STATE_COOKIE_WAIT */ \
--	{.fn = sctp_sf_bug, .name = "sctp_sf_bug"}, \
-+	{.fn = sctp_sf_discard_chunk, .name = "sctp_sf_discard_chunk"}, \
- 	/* SCTP_STATE_COOKIE_ECHOED */ \
- 	{.fn = sctp_sf_do_ecne, .name = "sctp_sf_do_ecne"}, \
- 	/* SCTP_STATE_ESTABLISHED */ \
-@@ -380,7 +380,7 @@ #define TYPE_SCTP_ECN_ECNE { \
- 	/* SCTP_STATE_SHUTDOWN_RECEIVED */ \
- 	{.fn = sctp_sf_do_ecne, .name = "sctp_sf_do_ecne"}, \
- 	/* SCTP_STATE_SHUTDOWN_ACK_SENT */ \
--	{.fn = sctp_sf_bug, .name = "sctp_sf_bug"}, \
-+	{.fn = sctp_sf_discard_chunk, .name = "sctp_sf_discard_chunk"}, \
- } /* TYPE_SCTP_ECN_ECNE */
- 
- #define TYPE_SCTP_ECN_CWR { \
-@@ -401,7 +401,7 @@ #define TYPE_SCTP_ECN_CWR { \
- 	/* SCTP_STATE_SHUTDOWN_RECEIVED */ \
- 	{.fn = sctp_sf_discard_chunk, .name = "sctp_sf_discard_chunk"}, \
- 	/* SCTP_STATE_SHUTDOWN_ACK_SENT */ \
--	{.fn = sctp_sf_bug, .name = "sctp_sf_bug"}, \
-+	{.fn = sctp_sf_discard_chunk, .name = "sctp_sf_discard_chunk"}, \
- } /* TYPE_SCTP_ECN_CWR */
- 
- #define TYPE_SCTP_SHUTDOWN_COMPLETE { \
-@@ -647,7 +647,7 @@ #define TYPE_SCTP_PRIMITIVE_REQUESTHEART
- 	/* SCTP_STATE_EMPTY */ \
- 	{.fn = sctp_sf_bug, .name = "sctp_sf_bug"}, \
- 	/* SCTP_STATE_CLOSED */ \
--	{.fn = sctp_sf_bug, .name = "sctp_sf_bug"}, \
-+	{.fn = sctp_sf_error_closed, .name = "sctp_sf_error_closed"}, \
- 	/* SCTP_STATE_COOKIE_WAIT */ \
- 	{.fn = sctp_sf_do_prm_requestheartbeat,		      \
- 	 .name = "sctp_sf_do_prm_requestheartbeat"},          \
-diff --git a/net/sctp/ulpqueue.c b/net/sctp/ulpqueue.c
-index 2080b2d..575e556 100644
---- a/net/sctp/ulpqueue.c
-+++ b/net/sctp/ulpqueue.c
-@@ -279,6 +279,7 @@ static inline void sctp_ulpq_store_reasm
- static struct sctp_ulpevent *sctp_make_reassembled_event(struct sk_buff_head *queue, struct sk_buff *f_frag, struct sk_buff *l_frag)
- {
- 	struct sk_buff *pos;
-+	struct sk_buff *new = NULL;
- 	struct sctp_ulpevent *event;
- 	struct sk_buff *pnext, *last;
- 	struct sk_buff *list = skb_shinfo(f_frag)->frag_list;
-@@ -297,11 +298,33 @@ static struct sctp_ulpevent *sctp_make_r
- 	 */
- 	if (last)
- 		last->next = pos;
--	else
--		skb_shinfo(f_frag)->frag_list = pos;
-+ 	else {
-+ 		if (skb_cloned(f_frag)) {
-+ 			/* This is a cloned skb, we can't just modify
-+ 			 * the frag_list.  We need a new skb to do that.
-+ 			 * Instead of calling skb_unshare(), we'll do it
-+ 			 * ourselves since we need to delay the free.
-+ 			 */
-+ 			new = skb_copy(f_frag, GFP_ATOMIC);
-+ 			if (!new)
-+ 				return NULL;	/* try again later */
-+
-+ 			new->sk = f_frag->sk;
-+
-+ 			skb_shinfo(new)->frag_list = pos;
-+ 		} else
-+ 			skb_shinfo(f_frag)->frag_list = pos;
-+ 	}
- 
- 	/* Remove the first fragment from the reassembly queue.  */
- 	__skb_unlink(f_frag, queue);
-+
-+ 	/* if we did unshare, then free the old skb and re-assign */
-+ 	if (new) {
-+ 		kfree_skb(f_frag);
-+ 		f_frag = new;
-+ 	}
-+
- 	while (pos) {
- 
- 		pnext = pos->next;
-diff --git a/security/keys/key.c b/security/keys/key.c
-index 99781b7..0e2584e 100644
---- a/security/keys/key.c
-+++ b/security/keys/key.c
-@@ -785,6 +785,10 @@ key_ref_t key_create_or_update(key_ref_t
- 
- 	key_check(keyring);
- 
-+	key_ref = ERR_PTR(-ENOTDIR);
-+	if (keyring->type != &key_type_keyring)
-+		goto error_2;
-+
- 	down_write(&keyring->sem);
- 
- 	/* if we're going to allocate a new key, we're going to have
-diff --git a/security/keys/keyring.c b/security/keys/keyring.c
-index d65a180..bffa924 100644
---- a/security/keys/keyring.c
-+++ b/security/keys/keyring.c
-@@ -437,6 +437,7 @@ EXPORT_SYMBOL(keyring_search);
- /*
-  * search the given keyring only (no recursion)
-  * - keyring must be locked by caller
-+ * - caller must guarantee that the keyring is a keyring
-  */
- key_ref_t __keyring_search_one(key_ref_t keyring_ref,
- 			       const struct key_type *ktype,
-diff --git a/security/selinux/ss/mls.c b/security/selinux/ss/mls.c
-index 640d0bf..84047f6 100644
---- a/security/selinux/ss/mls.c
-+++ b/security/selinux/ss/mls.c
-@@ -264,7 +264,7 @@ int mls_context_to_sid(char oldc,
- 
- 	if (!selinux_mls_enabled) {
- 		if (def_sid != SECSID_NULL && oldc)
--			*scontext += strlen(*scontext);
-+			*scontext += strlen(*scontext)+1;
- 		return 0;
- 	}
- 
-diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
-index 8a76492..6375dd5 100644
---- a/security/selinux/ss/services.c
-+++ b/security/selinux/ss/services.c
-@@ -592,6 +592,10 @@ int security_sid_to_context(u32 sid, cha
- 
- 			*scontext_len = strlen(initial_sid_to_string[sid]) + 1;
- 			scontextp = kmalloc(*scontext_len,GFP_ATOMIC);
-+			if (!scontextp) {
-+				rc = -ENOMEM;
-+				goto out;
-+			}
- 			strcpy(scontextp, initial_sid_to_string[sid]);
- 			*scontext = scontextp;
- 			goto out;
-diff --git a/sound/isa/opti9xx/opti92x-ad1848.c b/sound/isa/opti9xx/opti92x-ad1848.c
-index 63d96be..65b28cb 100644
---- a/sound/isa/opti9xx/opti92x-ad1848.c
-+++ b/sound/isa/opti9xx/opti92x-ad1848.c
-@@ -2088,9 +2088,11 @@ static int __init alsa_card_opti9xx_init
- 	int error;
- 	struct platform_device *device;
- 
-+#ifdef CONFIG_PNP
- 	pnp_register_card_driver(&opti9xx_pnpc_driver);
- 	if (snd_opti9xx_pnp_is_probed)
- 		return 0;
-+#endif
- 	if (! is_isapnp_selected()) {
- 		error = platform_driver_register(&snd_opti9xx_driver);
- 		if (error < 0)
-@@ -2102,7 +2104,9 @@ static int __init alsa_card_opti9xx_init
- 		}
- 		platform_driver_unregister(&snd_opti9xx_driver);
- 	}
-+#ifdef CONFIG_PNP
- 	pnp_unregister_card_driver(&opti9xx_pnpc_driver);
-+#endif
- #ifdef MODULE
- 	printk(KERN_ERR "no OPTi " CHIP_NAME " soundcard found\n");
- #endif
-@@ -2115,7 +2119,9 @@ static void __exit alsa_card_opti9xx_exi
- 		platform_device_unregister(snd_opti9xx_platform_device);
- 		platform_driver_unregister(&snd_opti9xx_driver);
- 	}
-+#ifdef CONFIG_PNP
- 	pnp_unregister_card_driver(&opti9xx_pnpc_driver);
-+#endif
- }
- 
- module_init(alsa_card_opti9xx_init)
-diff --git a/sound/oss/dmasound/tas_common.c b/sound/oss/dmasound/tas_common.c
-index 8131599..882ae98 100644
---- a/sound/oss/dmasound/tas_common.c
-+++ b/sound/oss/dmasound/tas_common.c
-@@ -195,8 +195,8 @@ tas_init(int driver_id, const char *driv
- 
- 	printk(KERN_INFO "tas driver [%s])\n", driver_name);
- 
--#ifndef CONFIG_I2C_KEYWEST
--	request_module("i2c-keywest");
-+#ifndef CONFIG_I2C_POWERMAC
-+	request_module("i2c-powermac");
- #endif
- 	tas_node = find_devices("deq");
- 	if (tas_node == NULL)
-diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
-index b767552..d5cd3a1 100644
---- a/sound/pci/hda/patch_realtek.c
-+++ b/sound/pci/hda/patch_realtek.c
-@@ -2948,6 +2948,8 @@ static struct hda_board_config alc260_cf
- 	{ .modelname = "basic", .config = ALC260_BASIC },
- 	{ .pci_subvendor = 0x104d, .pci_subdevice = 0x81bb,
- 	  .config = ALC260_BASIC }, /* Sony VAIO */
-+	{ .pci_subvendor = 0x152d, .pci_subdevice = 0x0729,
-+	  .config = ALC260_BASIC }, /* CTL Travel Master U553W */
- 	{ .modelname = "hp", .config = ALC260_HP },
- 	{ .pci_subvendor = 0x103c, .pci_subdevice = 0x3010, .config = ALC260_HP },
- 	{ .pci_subvendor = 0x103c, .pci_subdevice = 0x3011, .config = ALC260_HP },
-diff --git a/sound/ppc/daca.c b/sound/ppc/daca.c
-index 08cde51..b96cd94 100644
---- a/sound/ppc/daca.c
-+++ b/sound/ppc/daca.c
-@@ -256,7 +256,7 @@ int __init snd_pmac_daca_init(struct snd
- 
- #ifdef CONFIG_KMOD
- 	if (current->fs->root)
--		request_module("i2c-keywest");
-+		request_module("i2c-powermac");
- #endif /* CONFIG_KMOD */	
- 
- 	mix = kmalloc(sizeof(*mix), GFP_KERNEL);
-diff --git a/sound/ppc/tumbler.c b/sound/ppc/tumbler.c
-index 838fc11..39d4cde 100644
---- a/sound/ppc/tumbler.c
-+++ b/sound/ppc/tumbler.c
-@@ -1314,7 +1314,7 @@ int __init snd_pmac_tumbler_init(struct 
- 
- #ifdef CONFIG_KMOD
- 	if (current->fs->root)
--		request_module("i2c-keywest");
-+		request_module("i2c-powermac");
- #endif /* CONFIG_KMOD */	
- 
- 	mix = kmalloc(sizeof(*mix), GFP_KERNEL);
diff --git a/target/device/AMD/DBAu1500/kernel-patches/004-correct-toolchain.patch b/target/device/AMD/DBAu1500/kernel-patches/004-correct-toolchain.patch
deleted file mode 100644
index 13c6610dc..000000000
--- a/target/device/AMD/DBAu1500/kernel-patches/004-correct-toolchain.patch
+++ /dev/null
@@ -1,46 +0,0 @@
---- linux/arch/mips/Makefile.orig	2006-01-02 20:21:10.000000000 -0700
-+++ linux/arch/mips/Makefile	2006-03-19 17:25:29.000000000 -0700
-@@ -22,15 +22,15 @@
- # Select the object file format to substitute into the linker script.
- #
- ifdef CONFIG_CPU_LITTLE_ENDIAN
--32bit-tool-prefix	= mipsel-linux-
--64bit-tool-prefix	= mips64el-linux-
-+#32bit-tool-prefix	= mipsel-linux-
-+#64bit-tool-prefix	= mips64el-linux-
- 32bit-bfd		= elf32-tradlittlemips
- 64bit-bfd		= elf64-tradlittlemips
- 32bit-emul		= elf32ltsmip
- 64bit-emul		= elf64ltsmip
- else
--32bit-tool-prefix	= mips-linux-
--64bit-tool-prefix	= mips64-linux-
-+#32bit-tool-prefix	= mips-linux-
-+#64bit-tool-prefix	= mips64-linux-
- 32bit-bfd		= elf32-tradbigmips
- 64bit-bfd		= elf64-tradbigmips
- 32bit-emul		= elf32btsmip
-@@ -39,18 +39,18 @@
- 
- ifdef CONFIG_32BIT
- gcc-abi			= 32
--tool-prefix		= $(32bit-tool-prefix)
-+#tool-prefix		= $(32bit-tool-prefix)
- UTS_MACHINE		:= mips
- endif
- ifdef CONFIG_64BIT
- gcc-abi			= 64
--tool-prefix		= $(64bit-tool-prefix)
-+#tool-prefix		= $(64bit-tool-prefix)
- UTS_MACHINE		:= mips64
- endif
- 
--ifdef CONFIG_CROSSCOMPILE
--CROSS_COMPILE		:= $(tool-prefix)
--endif
-+#ifdef CONFIG_CROSSCOMPILE
-+#CROSS_COMPILE		:= $(tool-prefix)
-+#endif
- 
- CHECKFLAGS-y				+= -D__linux__ -D__mips__ \
- 					   -D_ABIO32=1 \
diff --git a/target/device/AMD/DBAu1500/kernel-patches/006_init_unshare.patch b/target/device/AMD/DBAu1500/kernel-patches/006_init_unshare.patch
deleted file mode 100644
index 8b756f8ad..000000000
--- a/target/device/AMD/DBAu1500/kernel-patches/006_init_unshare.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- orig/kernel/fork.c	2006-03-21 01:41:50.000000000 -0700
-+++ linux-2.6.16/kernel/fork.c	2006-03-21 01:41:50.000000000 -0700
-@@ -773,7 +773,7 @@
- 
- 	/* This can race but the race causes us to copy when we don't
- 	   need to and drop the copy */
--	if(atomic_read(&files->count) == 1)
-+	if(atomic_read(&files->count) == 1 || current->pid == 1)
- 	{
- 		atomic_inc(&files->count);
- 		return 0;
diff --git a/target/device/AMD/DBAu1500/kernel-patches/008-ieee1394-fix.patch b/target/device/AMD/DBAu1500/kernel-patches/008-ieee1394-fix.patch
deleted file mode 100644
index e87c99078..000000000
--- a/target/device/AMD/DBAu1500/kernel-patches/008-ieee1394-fix.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- orig/drivers/ieee1394/nodemgr.c	2006-03-21 01:41:51.000000000 -0700
-+++ linux-2.6.16/drivers/ieee1394/nodemgr.c	2006-03-21 01:41:51.000000000 -0700
-@@ -1487,7 +1487,7 @@
- 	/* If there is no bus manager then we should set the root node's
- 	 * force_root bit to promote bus stability per the 1394
- 	 * spec. (8.4.2.6) */
--	if (host->busmgr_id == 0xffff && host->node_count > 1)
-+	if (host->busmgr_id == 0x3f && host->node_count > 1)
- 	{
- 		u16 root_node = host->node_count - 1;
- 
diff --git a/target/device/AMD/DBAu1500/kernel-patches/009-sysfs-n.patch b/target/device/AMD/DBAu1500/kernel-patches/009-sysfs-n.patch
deleted file mode 100644
index 61359fc6b..000000000
--- a/target/device/AMD/DBAu1500/kernel-patches/009-sysfs-n.patch
+++ /dev/null
@@ -1,27 +0,0 @@
---- linux-2.6.16-rc6-mm1.orig/lib/kobject_uevent.c	2006-03-14 22:57:23.000000000 +0900
-+++ linux-2.6.16-rc6-mm1/lib/kobject_uevent.c	2006-03-15 08:39:33.000000000 +0900
-@@ -25,6 +25,11 @@
- #define BUFFER_SIZE	2048	/* buffer for the variables */
- #define NUM_ENVP	32	/* number of env pointers */
- 
-+#ifdef CONFIG_HOTPLUG
-+u64 uevent_seqnum;
-+char uevent_helper[UEVENT_HELPER_PATH_LEN] = "/sbin/hotplug";
-+#endif
-+
- #if defined(CONFIG_HOTPLUG) && defined(CONFIG_NET)
- static DEFINE_SPINLOCK(sequence_lock);
- static struct sock *uevent_sock;
---- linux-2.6.16-rc6-mm1.orig/kernel/ksysfs.c	2006-03-14 22:57:31.000000000 +0900
-+++ linux-2.6.16-rc6-mm1/kernel/ksysfs.c	2006-03-15 08:41:11.000000000 +0900
-@@ -15,9 +15,6 @@
- #include <linux/module.h>
- #include <linux/init.h>
- 
--u64 uevent_seqnum;
--char uevent_helper[UEVENT_HELPER_PATH_LEN] = "/sbin/hotplug";
--
- #define KERNEL_ATTR_RO(_name) \
- static struct subsys_attribute _name##_attr = __ATTR_RO(_name)
-
-
diff --git a/target/device/AMD/DBAu1500/kernel-patches/028-cdrom_oexcl.patch b/target/device/AMD/DBAu1500/kernel-patches/028-cdrom_oexcl.patch
deleted file mode 100644
index 577cdb0b4..000000000
--- a/target/device/AMD/DBAu1500/kernel-patches/028-cdrom_oexcl.patch
+++ /dev/null
@@ -1,13 +0,0 @@
---- orig/drivers/cdrom/cdrom.c	2004-12-07 22:55:38.000000000 -0700
-+++ linux-2.6.10-rc3/drivers/cdrom/cdrom.c	2004-12-07 22:55:38.000000000 -0700
-@@ -997,6 +997,10 @@
- 
- 	cdinfo(CD_OPEN, "entering cdrom_open\n"); 
- 
-+	/* If the device is opened O_EXCL but there are other openers, return busy */
-+	if ( (fp->f_flags & O_EXCL) && (cdi->use_count>0) )
-+		return -EBUSY;
-+
- 	/* if this was a O_NONBLOCK open and we should honor the flags,
- 	 * do a quick open without drive/disc integrity checks. */
- 	cdi->use_count++;
diff --git a/target/device/AMD/DBAu1500/kernel-patches/029-cdrom_blocksize.patch b/target/device/AMD/DBAu1500/kernel-patches/029-cdrom_blocksize.patch
deleted file mode 100644
index 90c2961ba..000000000
--- a/target/device/AMD/DBAu1500/kernel-patches/029-cdrom_blocksize.patch
+++ /dev/null
@@ -1,109 +0,0 @@
---- orig/include/linux/cdrom.h	2005-10-28 10:14:52.000000000 -0600
-+++ linux-2.6.14/include/linux/cdrom.h	2005-10-28 10:14:52.000000000 -0600
-@@ -946,7 +946,8 @@
-     	char name[20];                  /* name of the device type */
- /* per-device flags */
-         __u8 sanyo_slot		: 2;	/* Sanyo 3 CD changer support */
--        __u8 reserved		: 6;	/* not used yet */
-+	__u8 use_read10		: 1;	/* Use READ10 instead of READCD */
-+	__u8 reserved		: 5;	/* not used yet */
- 	int cdda_method;		/* see flags */
- 	__u8 last_sense;
- 	__u8 media_written;		/* dirty flag, DVD+RW bookkeeping */
---- orig/drivers/cdrom/cdrom.c	2005-10-28 10:14:52.000000000 -0600
-+++ linux-2.6.14/drivers/cdrom/cdrom.c	2005-10-28 10:14:52.000000000 -0600
-@@ -1982,6 +1982,8 @@
- 	return 0;
- }
- 
-+static int cdrom_switch_blocksize(struct cdrom_device_info *cdi, int size);
-+
- /*
-  * Specific READ_10 interface
-  */
-@@ -1990,6 +1992,7 @@
- 			 int blocksize, int nblocks)
- {
- 	struct cdrom_device_ops *cdo = cdi->ops;
-+	int ret = 0;
- 
- 	memset(&cgc->cmd, 0, sizeof(cgc->cmd));
- 	cgc->cmd[0] = GPCMD_READ_10;
-@@ -2001,7 +2004,22 @@
- 	cgc->cmd[7] = (nblocks >>  8) & 0xff;
- 	cgc->cmd[8] = nblocks & 0xff;
- 	cgc->buflen = blocksize * nblocks;
--	return cdo->generic_packet(cdi, cgc);
-+
-+	if (blocksize != CD_FRAMESIZE) {
-+		ret = cdrom_switch_blocksize(cdi, blocksize);
-+		ret |= cdo->generic_packet(cdi, cgc);
-+		ret |= cdrom_switch_blocksize(cdi, CD_FRAMESIZE);
-+	} else ret = cdo->generic_packet(cdi, cgc);
-+
-+	/*
-+	 * Switch cdrom_read_block back to default behaviour
-+	 * if we get an error.
-+	 * FIXME: Maybe this should not be done on all errors.
-+	 */
-+	if (ret != 0)
-+		cdi->use_read10 = 0;
-+
-+	return ret;
- }
- 
- /* very generic interface for reading the various types of blocks */
-@@ -2010,8 +2028,15 @@
- 			    int lba, int nblocks, int format, int blksize)
- {
- 	struct cdrom_device_ops *cdo = cdi->ops;
-+	int ret;
-+
-+	if (cdi->use_read10)
-+		return cdrom_read_cd(cdi, cgc, lba, blksize, nblocks);
- 
- 	memset(&cgc->cmd, 0, sizeof(cgc->cmd));
-+	/*
-+	 * SCSI-II devices are not required to support READ_CD.
-+	 */
- 	cgc->cmd[0] = GPCMD_READ_CD;
- 	/* expected sector size - cdda,mode1,etc. */
- 	cgc->cmd[1] = format << 2;
-@@ -2034,7 +2059,15 @@
- 	default			: cgc->cmd[9] = 0x10;
- 	}
- 	
--	return cdo->generic_packet(cdi, cgc);
-+	ret = cdo->generic_packet(cdi, cgc);
-+	if (ret && cgc->sense && cgc->sense->sense_key==0x05 && cgc->sense->asc==0x20 && cgc->sense->ascq==0x00) {
-+		ret = cdrom_read_cd(cdi, cgc, lba, blksize, nblocks);
-+		if (ret == 0) {
-+			cdi->use_read10 = 1;
-+			printk(KERN_INFO "cdrom.c: drive does not like READ_CD for blksize=%d, switching to READ_10.\n", blksize);
-+		}
-+	}
-+	return ret;
- }
- 
- static int cdrom_read_cdda_old(struct cdrom_device_info *cdi, __u8 __user *ubuf,
-@@ -2671,20 +2704,6 @@
- 		cgc.sense = &sense;
- 		cgc.data_direction = CGC_DATA_READ;
- 		ret = cdrom_read_block(cdi, &cgc, lba, 1, format, blocksize);
--		if (ret && sense.sense_key==0x05 && sense.asc==0x20 && sense.ascq==0x00) {
--			/*
--			 * SCSI-II devices are not required to support
--			 * READ_CD, so let's try switching block size
--			 */
--			/* FIXME: switch back again... */
--			if ((ret = cdrom_switch_blocksize(cdi, blocksize))) {
--				kfree(cgc.buffer);
--				return ret;
--			}
--			cgc.sense = NULL;
--			ret = cdrom_read_cd(cdi, &cgc, lba, blocksize, 1);
--			ret |= cdrom_switch_blocksize(cdi, blocksize);
--		}
- 		if (!ret && copy_to_user((char __user *)arg, cgc.buffer, blocksize))
- 			ret = -EFAULT;
- 		kfree(cgc.buffer);
diff --git a/target/device/AMD/DBAu1500/kernel-patches/064-shutup-md.patch b/target/device/AMD/DBAu1500/kernel-patches/064-shutup-md.patch
deleted file mode 100644
index 018c4bc1b..000000000
--- a/target/device/AMD/DBAu1500/kernel-patches/064-shutup-md.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- orig/drivers/md/md.c	2006-03-21 01:43:49.000000000 -0700
-+++ linux-2.6.16/drivers/md/md.c	2006-03-21 01:43:49.000000000 -0700
-@@ -4860,7 +4860,7 @@
- 
- 	if ((code == SYS_DOWN) || (code == SYS_HALT) || (code == SYS_POWER_OFF)) {
- 
--		printk(KERN_INFO "md: stopping all md devices.\n");
-+		//printk(KERN_INFO "md: stopping all md devices.\n");
- 
- 		ITERATE_MDDEV(mddev,tmp)
- 			if (mddev_trylock(mddev)==0)
diff --git a/target/device/AMD/DBAu1500/kernel-patches/098_scsi-warnings.patch b/target/device/AMD/DBAu1500/kernel-patches/098_scsi-warnings.patch
deleted file mode 100644
index 6a88d2e74..000000000
--- a/target/device/AMD/DBAu1500/kernel-patches/098_scsi-warnings.patch
+++ /dev/null
@@ -1,18 +0,0 @@
---- orig/drivers/scsi/scsi_ioctl.c	2005-12-03 02:10:27.000000000 -0700
-+++ linux-2.6.14/drivers/scsi/scsi_ioctl.c	2005-12-03 02:10:27.000000000 -0700
-@@ -374,6 +374,7 @@
- 	if (!scsi_block_when_processing_errors(sdev))
- 		return -ENODEV;
- 
-+#if 0
- 	/* Check for deprecated ioctls ... all the ioctls which don't
- 	 * follow the new unique numbering scheme are deprecated */
- 	switch (cmd) {
-@@ -389,6 +390,7 @@
- 	default:
- 		break;
- 	}
-+#endif
- 
- 	switch (cmd) {
- 	case SCSI_IOCTL_GET_IDLUN:
diff --git a/target/device/AMD/DBAu1500/kernel-patches/100_VERSION.patch b/target/device/AMD/DBAu1500/kernel-patches/100_VERSION.patch
deleted file mode 100644
index 26ab03a48..000000000
--- a/target/device/AMD/DBAu1500/kernel-patches/100_VERSION.patch
+++ /dev/null
@@ -1,12 +0,0 @@
---- orig/Makefile	2005-12-03 09:22:07 +0000
-+++ linux-2.6.14/Makefile	2005-12-03 09:22:07 +0000
-@@ -1,7 +1,7 @@
- VERSION = 2
- PATCHLEVEL = 6
--SUBLEVEL = 16
--EXTRAVERSION = .20
-+SUBLEVEL = 16
-+EXTRAVERSION = .20-erik
- NAME=Sliding Snow Leopard
- 
- # *DOCUMENTATION*
diff --git a/target/device/AMD/DBAu1500/linux.mk b/target/device/AMD/DBAu1500/linux.mk
deleted file mode 100644
index 423191c0d..000000000
--- a/target/device/AMD/DBAu1500/linux.mk
+++ /dev/null
@@ -1,128 +0,0 @@
-#############################################################
-#
-# Linux kernel targets
-#
-# Note:  If you have any patches to apply, create the directory
-# sources/kernel-patches and put your patches in there and number
-# them in the order you wish to apply them...  i.e.
-#
-#   sources/kernel-patches/001-my-special-stuff.bz2
-#   sources/kernel-patches/003-gcc-Os.bz2
-#   sources/kernel-patches/004_no-warnings.bz2
-#   sources/kernel-patches/030-lowlatency-mini.bz2
-#   sources/kernel-patches/031-lowlatency-fixes-5.bz2
-#   sources/kernel-patches/099-shutup.bz2
-#   etc...
-#
-# these patches will all be applied by the patch-kernel.sh
-# script (which will also abort the build if it finds rejects)
-#  -Erik
-#
-#############################################################
-ifneq ($(filter $(TARGETS),linux),)
-
-# Base version of Linux kernel that we need to download
-DOWNLOAD_LINUX_VERSION=2.6.16
-# Version of Linux kernel AFTER applying all patches
-LINUX_VERSION=2.6.16.20-erik
-
-
-# File name for the Linux kernel binary
-LINUX_KERNEL=linux-kernel-$(LINUX_VERSION)-$(ARCH).srec
-
-
-# Linux kernel configuration file
-LINUX_KCONFIG=$(ALCHEMY_DBAU1500_PATH)/linux.config
-
-# kernel patches
-LINUX_PATCH_DIR=target/device/AMD/DBAu1500/kernel-patches/
-
-
-
-
-LINUX_FORMAT=vmlinux
-LINUX_KARCH:=$(shell echo $(ARCH) | sed -e 's/i[3-9]86/i386/' \
-	-e 's/mipsel/mips/' \
-	-e 's/powerpc/ppc/' \
-	-e 's/sh[234]/sh/' \
-	)
-LINUX_BINLOC=$(LINUX_FORMAT)
-LINUX_DIR=$(BUILD_DIR)/linux-$(LINUX_VERSION)
-LINUX_SOURCE=linux-$(DOWNLOAD_LINUX_VERSION).tar.bz2
-LINUX_CAT:=$(BZCAT)
-LINUX_SITE=http://www.kernel.org/pub/linux/kernel/v2.6
-# Used by pcmcia-cs and others
-LINUX_SOURCE_DIR=$(LINUX_DIR)
-
-
-$(DL_DIR)/$(LINUX_SOURCE):
-	-mkdir -p $(DL_DIR)
-	$(WGET) -P $(DL_DIR) $(LINUX_SITE)/$(LINUX_SOURCE)
-
-$(LINUX_DIR)/.unpacked: $(DL_DIR)/$(LINUX_SOURCE)
-	-mkdir -p $(TOOL_BUILD_DIR)
-	-(cd $(TOOL_BUILD_DIR); ln -snf $(LINUX_DIR) linux)
-	$(LINUX_CAT) $(DL_DIR)/$(LINUX_SOURCE) | tar -C $(BUILD_DIR) $(TAR_OPTIONS) -
-ifneq ($(DOWNLOAD_LINUX_VERSION),$(LINUX_VERSION))
-	# Rename the dir from the downloaded version to the AFTER patch version
-	mv -f $(BUILD_DIR)/linux-$(DOWNLOAD_LINUX_VERSION) $(BUILD_DIR)/linux-$(LINUX_VERSION)
-endif
-	toolchain/patch-kernel.sh $(LINUX_DIR) $(LINUX_PATCH_DIR)
-	touch $(LINUX_DIR)/.unpacked
-
-$(LINUX_KCONFIG):
-	@if [ ! -f "$(LINUX_KCONFIG)" ] ; then \
-		echo ""; \
-		echo "You should create a .config for your kernel"; \
-		echo "and install it as $(LINUX_KCONFIG)"; \
-		echo ""; \
-		sleep 5; \
-	fi;
-
-$(LINUX_DIR)/.configured $(BUILD_DIR)/linux/.configured:  $(LINUX_DIR)/.unpacked  $(LINUX_KCONFIG)
-	$(SED) "s,^ARCH.*,ARCH=$(LINUX_KARCH),g;" $(LINUX_DIR)/Makefile
-	$(SED) "s,^CROSS_COMPILE.*,CROSS_COMPILE=$(KERNEL_CROSS),g;" $(LINUX_DIR)/Makefile
-	-cp $(LINUX_KCONFIG) $(LINUX_DIR)/.config
-ifeq ($(strip $(BR2_mips)),y)
-	$(SED) "s,CONFIG_CPU_LITTLE_ENDIAN=y,# CONFIG_CPU_LITTLE_ENDIAN is not set\n# CONFIG_BINFMT_IRIX is not set," $(LINUX_DIR)/.config
-endif
-	$(MAKE) PATH=$(TARGET_PATH) -C $(LINUX_DIR) oldconfig include/linux/version.h
-	touch $(LINUX_DIR)/.configured
-
-$(LINUX_DIR)/.depend_done:  $(LINUX_DIR)/.configured
-	$(MAKE) PATH=$(TARGET_PATH) -C $(LINUX_DIR) dep
-	touch $(LINUX_DIR)/.depend_done
-
-$(LINUX_DIR)/$(LINUX_BINLOC): $(LINUX_DIR)/.depend_done
-	$(MAKE) PATH=$(TARGET_PATH) -C $(LINUX_DIR) $(LINUX_FORMAT)
-	$(MAKE) PATH=$(TARGET_PATH) -C $(LINUX_DIR) modules
-
-$(LINUX_KERNEL): $(LINUX_DIR)/$(LINUX_BINLOC)
-	$(KERNEL_CROSS)objcopy -O srec $(LINUX_DIR)/$(LINUX_BINLOC) $(LINUX_KERNEL)
-	touch -c $(LINUX_KERNEL)
-
-$(TARGET_DIR)/lib/modules/$(LINUX_VERSION)/modules.dep: $(LINUX_KERNEL) cross-depmod
-	rm -rf $(TARGET_DIR)/lib/modules
-	rm -f $(TARGET_DIR)/sbin/cardmgr
-	$(MAKE) PATH=$(TARGET_PATH) -C $(LINUX_DIR) \
-		DEPMOD=$(STAGING_DIR)/usr/bin/$(GNU_TARGET_NAME)-depmod \
-		INSTALL_MOD_PATH=$(TARGET_DIR) modules_install
-
-$(STAGING_DIR)/include/linux/version.h: $(LINUX_DIR)/.configured
-	mkdir -p $(STAGING_DIR)/include
-	tar -ch -C $(LINUX_DIR)/include -f - linux | tar -xf - -C $(STAGING_DIR)/include/
-	tar -ch -C $(LINUX_DIR)/include -f - asm | tar -xf - -C $(STAGING_DIR)/include/
-
-linux: $(STAGING_DIR)/include/linux/version.h $(TARGET_DIR)/lib/modules/$(LINUX_VERSION)/modules.dep
-
-linux-source: $(DL_DIR)/$(LINUX_SOURCE)
-
-# This has been renamed so we do _NOT_ by default run this on 'make clean'
-linuxclean: clean
-	rm -f $(LINUX_KERNEL)
-	-$(MAKE) PATH=$(TARGET_PATH) -C $(LINUX_DIR) clean
-
-linux-dirclean:
-	rm -rf $(LINUX_DIR)
-
-endif
diff --git a/target/device/AMD/DBAu1500/linux26.mk b/target/device/AMD/DBAu1500/linux26.mk
new file mode 100644
index 000000000..15678c0cb
--- /dev/null
+++ b/target/device/AMD/DBAu1500/linux26.mk
@@ -0,0 +1,107 @@
+#############################################################
+#
+# Linux kernel 2.6 target
+#
+#############################################################
+ifneq ($(filter $(TARGETS),linux26),)
+
+
+# Version of Linux to download and then apply patches to
+DOWNLOAD_LINUX26_VERSION=2.6.19.1
+# Version of Linux after applying any patches
+LINUX26_VERSION=2.6.19.1
+
+
+
+LINUX26_SOURCE=linux-$(DOWNLOAD_LINUX26_VERSION).tar.bz2
+LINUX26_SITE=http://ftp.kernel.org/pub/linux/kernel/v2.6
+
+LINUX26_FORMAT=vmlinux
+LINUX26_BINLOC=$(LINUX26_FORMAT)
+
+# Linux kernel configuration file
+LINUX26_KCONFIG=$(ALCHEMY_DBAU1500_PATH)/linux26.config
+
+# File name for the Linux kernel binary
+LINUX26_KERNEL=linux-kernel-$(LINUX26_VERSION)-$(KERNEL_ARCH).srec
+
+# Version of Linux AFTER patches
+LINUX26_DIR=$(BUILD_DIR)/linux-$(LINUX26_VERSION)
+
+# kernel patches
+LINUX26_PATCH_DIR=target/device/AMD/DBAu1500/kernel-patches/
+
+LINUX26_MAKE_FLAGS = $(TARGET_CONFIGURE_OPTS) ARCH=$(KERNEL_ARCH) \
+	PATH=$(TARGET_PATH) INSTALL_MOD_PATH=$(TARGET_DIR) \
+	CROSS_COMPILE=$(KERNEL_CROSS)
+
+
+
+
+$(DL_DIR)/$(LINUX26_SOURCE):
+	 $(WGET) -P $(DL_DIR) $(LINUX26_SITE)/$(LINUX26_SOURCE)
+
+$(LINUX26_DIR)/.unpacked: $(DL_DIR)/$(LINUX26_SOURCE)
+	rm -rf $(LINUX26_DIR)
+	bzcat $(DL_DIR)/$(LINUX26_SOURCE) | tar -C $(BUILD_DIR) -xvf -
+ifneq ($(DOWNLOAD_LINUX26_VERSION),$(LINUX26_VERSION))
+	# Rename the dir from the downloaded version to the AFTER patch version
+	mv -f $(BUILD_DIR)/linux-$(DOWNLOAD_LINUX26_VERSION) $(BUILD_DIR)/linux-$(LINUX26_VERSION)
+endif
+	touch $(LINUX26_DIR)/.unpacked
+
+$(LINUX26_KCONFIG):
+	@if [ ! -f "$(LINUX26_KCONFIG)" ] ; then \
+		echo ""; \
+		echo "You should create a .config for your kernel"; \
+		echo "and install it as $(LINUX26_KCONFIG)"; \
+		echo ""; \
+		sleep 5; \
+	fi;
+
+$(LINUX26_DIR)/.patched: $(LINUX26_DIR)/.unpacked
+	#toolchain/patch-kernel.sh $(LINUX26_DIR) $(LINUX26_PATCH_DIR)
+	touch $(LINUX26_DIR)/.patched
+
+$(LINUX26_DIR)/.configured:  $(LINUX26_DIR)/.patched  $(LINUX26_KCONFIG)
+	-cp $(LINUX26_KCONFIG) $(LINUX26_DIR)/.config
+	$(MAKE) $(LINUX26_MAKE_FLAGS) -C $(LINUX26_DIR) oldconfig
+	touch $(LINUX26_DIR)/.configured
+
+linux26-menuconfig: $(LINUX26_DIR)/.patched
+	[ -f $(LINUX26_DIR)/.config ] || cp $(LINUX26_KCONFIG) $(LINUX26_DIR)/.config
+	$(MAKE) $(LINUX26_MAKE_FLAGS) -C $(LINUX26_DIR) menuconfig
+	-[ -f $(LINUX26_DIR)/.config ] && touch $(LINUX26_DIR)/.configured
+
+$(LINUX26_DIR)/.depend_done:  $(LINUX26_DIR)/.configured
+	$(MAKE) $(LINUX26_MAKE_FLAGS) -C $(LINUX26_DIR) prepare
+	touch $(LINUX26_DIR)/.depend_done
+
+$(LINUX26_KERNEL): $(LINUX26_DIR)/.depend_done
+	$(MAKE) $(LINUX26_MAKE_FLAGS) -C $(LINUX26_DIR) $(LINUX26_FORMAT) bzImage
+	$(MAKE) $(LINUX26_MAKE_FLAGS) -C $(LINUX26_DIR) modules
+	$(KERNEL_CROSS)objcopy -O srec $(LINUX26_DIR)/$(LINUX26_BINLOC) $(LINUX26_KERNEL)
+	touch -c $(LINUX26_KERNEL)
+
+$(TARGET_DIR)/lib/modules/$(LINUX26_VERSION)/modules.dep: $(LINUX26_KERNEL)
+	rm -rf $(TARGET_DIR)/lib/modules/$(LINUX26_VERSION)
+	rm -f $(TARGET_DIR)/sbin/cardmgr
+	$(MAKE) $(LINUX26_MAKE_FLAGS) -C $(LINUX26_DIR) \
+		DEPMOD=$(STAGING_DIR)/bin/$(GNU_TARGET_NAME)-depmod26 \
+		INSTALL_MOD_PATH=$(TARGET_DIR) modules_install
+	rm -f $(TARGET_DIR)/lib/modules/$(LINUX26_VERSION)/build
+	touch -c $(TARGET_DIR)/lib/modules/$(LINUX26_VERSION)/modules.dep
+
+linux26: cross-depmod26 $(TARGET_DIR)/lib/modules/$(LINUX26_VERSION)/modules.dep
+
+linux26-source: $(DL_DIR)/$(LINUX26_SOURCE)
+
+# This has been renamed so we do _NOT_ by default run this on 'make clean'
+linux26clean:
+	rm -f $(LINUX26_KERNEL)
+	-$(MAKE) PATH=$(TARGET_PATH) -C $(LINUX26_DIR) clean
+
+linux26-dirclean:
+	rm -rf $(LINUX26_DIR)
+
+endif