[gentoo-commits] linux-patches r1329 - genpatches-2.6/trunk/2.6.26

[Daniel Drake (dsd)]

Author: dsd
Date: 2008-07-17 02:47:50 +0000 (Thu, 17 Jul 2008)
New Revision: 1329

Removed:
   genpatches-2.6/trunk/2.6.26/1000_linux-2.6.25.1.patch
   genpatches-2.6/trunk/2.6.26/1001_linux-2.6.25.2.patch
   genpatches-2.6/trunk/2.6.26/1002_linux-2.6.25.3.patch
   genpatches-2.6/trunk/2.6.26/1003_linux-2.6.25.4.patch
   genpatches-2.6/trunk/2.6.26/1004_linux-2.6.25.5.patch
   genpatches-2.6/trunk/2.6.26/1005_linux-2.6.25.6.patch
   genpatches-2.6/trunk/2.6.26/1006_linux-2.6.25.7.patch
   genpatches-2.6/trunk/2.6.26/1007_linux-2.6.25.8.patch
   genpatches-2.6/trunk/2.6.26/1008_linux-2.6.25.9.patch
   genpatches-2.6/trunk/2.6.26/2705_alsa-hda-fujitsu.patch
   genpatches-2.6/trunk/2.6.26/2710_ssa7134-tuner-type-setup.patch
Modified:
   genpatches-2.6/trunk/2.6.26/0000_README
Log:
remove merged patches

Modified: genpatches-2.6/trunk/2.6.26/0000_README
===================================================================
--- genpatches-2.6/trunk/2.6.26/0000_README	2008-07-17 02:44:10 UTC (rev 1328)
+++ genpatches-2.6/trunk/2.6.26/0000_README	2008-07-17 02:47:50 UTC (rev 1329)
@@ -39,54 +39,10 @@
 Individual Patch Descriptions:
 --------------------------------------------------------------------------
 
-Patch:	1000_linux-2.6.25.1.patch
-From:	http://www.kernel.org
-Desc:	Linux 2.6.25.1
-
-Patch:	1001_linux-2.6.25.2.patch
-From:	http://www.kernel.org
-Desc:	fcntl security fix
-
-Patch:	1002_linux-2.6.25.3.patch
-From:	http://www.kernel.org
-Desc:	Linux 2.6.25.3
-
-Patch:	1003_linux-2.6.25.4.patch
-From:	http://www.kernel.org
-Desc:	Linux 2.6.25.4
-
-Patch:	1004_linux-2.6.25.5.patch
-From:	http://www.kernel.org
-Desc:	Linux 2.6.25.5
-
-Patch:	1005_linux-2.6.25.6.patch
-From:	http://www.kernel.org
-Desc:	Linux 2.6.25.6
-
-Patch:	1006_linux-2.6.25.7.patch
-From:	http://www.kernel.org
-Desc:	Linux 2.6.25.7
-
-Patch:	1007_linux-2.6.25.8.patch
-From:	http://www.kernel.org
-Desc:	Linux 2.6.25.8
-
-Patch:	1008_linux-2.6.25.9.patch
-From:	http://www.kernel.org
-Desc:	Linux 2.6.25.9
-
 Patch:	2600_evdev-compat-ioctl-force-feedback.patch
 From:	http://bugs.gentoo.org/214700
 Desc:	Fix evdev force feedback in 32-bit compat mode
 
-Patch:	2705_alsa-hda-fujitsu.patch
-From:	Tony Vroon <chainsaw@g.o>
-Desc:	Fix docking station headphone port and PC speaker for Fujitsu ALC262
-
-Patch:	2710_ssa7134-tuner-type-setup.patch
-From:	http://bugs.gentoo.org/show_bug.cgi?id=231451
-Desc:	Removes tuner type setup from saa7134-i2c
-
 Patch:	4105_dm-bbr.patch
 From:	EVMS 2.5.2
 Desc:	Bad block relocation support for LiveCD users

Deleted: genpatches-2.6/trunk/2.6.26/1000_linux-2.6.25.1.patch
===================================================================
--- genpatches-2.6/trunk/2.6.26/1000_linux-2.6.25.1.patch	2008-07-17 02:44:10 UTC (rev 1328)
+++ genpatches-2.6/trunk/2.6.26/1000_linux-2.6.25.1.patch	2008-07-17 02:47:50 UTC (rev 1329)
@@ -1,1145 +0,0 @@
-diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
-index 8c71daf..9fee37e 100644
---- a/arch/alpha/kernel/osf_sys.c
-+++ b/arch/alpha/kernel/osf_sys.c
-@@ -75,6 +75,7 @@ osf_set_program_attributes(unsigned long text_start, unsigned long text_len,
- 	lock_kernel();
- 	mm = current->mm;
- 	mm->end_code = bss_start + bss_len;
-+	mm->start_brk = bss_start + bss_len;
- 	mm->brk = bss_start + bss_len;
- #if 0
- 	printk("set_program_attributes(%lx %lx %lx %lx)\n",
-diff --git a/arch/x86/kernel/io_apic_32.c b/arch/x86/kernel/io_apic_32.c
-index 4ca5486..f239b30 100644
---- a/arch/x86/kernel/io_apic_32.c
-+++ b/arch/x86/kernel/io_apic_32.c
-@@ -2477,6 +2477,7 @@ void destroy_irq(unsigned int irq)
- 	dynamic_irq_cleanup(irq);
- 
- 	spin_lock_irqsave(&vector_lock, flags);
-+	clear_bit(irq_vector[irq], used_vectors);
- 	irq_vector[irq] = 0;
- 	spin_unlock_irqrestore(&vector_lock, flags);
- }
-diff --git a/arch/x86/pci/irq.c b/arch/x86/pci/irq.c
-index a871586..579745c 100644
---- a/arch/x86/pci/irq.c
-+++ b/arch/x86/pci/irq.c
-@@ -200,7 +200,7 @@ static int pirq_ali_get(struct pci_dev *router, struct pci_dev *dev, int pirq)
- {
- 	static const unsigned char irqmap[16] = { 0, 9, 3, 10, 4, 5, 7, 6, 1, 11, 0, 12, 0, 14, 0, 15 };
- 
--	WARN_ON_ONCE(pirq >= 16);
-+	WARN_ON_ONCE(pirq > 16);
- 	return irqmap[read_config_nybble(router, 0x48, pirq-1)];
- }
- 
-@@ -209,7 +209,7 @@ static int pirq_ali_set(struct pci_dev *router, struct pci_dev *dev, int pirq, i
- 	static const unsigned char irqmap[16] = { 0, 8, 0, 2, 4, 5, 7, 6, 0, 1, 3, 9, 11, 0, 13, 15 };
- 	unsigned int val = irqmap[irq];
- 
--	WARN_ON_ONCE(pirq >= 16);
-+	WARN_ON_ONCE(pirq > 16);
- 	if (val) {
- 		write_config_nybble(router, 0x48, pirq-1, val);
- 		return 1;
-@@ -260,7 +260,7 @@ static int pirq_via586_get(struct pci_dev *router, struct pci_dev *dev, int pirq
- {
- 	static const unsigned int pirqmap[5] = { 3, 2, 5, 1, 1 };
- 
--	WARN_ON_ONCE(pirq >= 5);
-+	WARN_ON_ONCE(pirq > 5);
- 	return read_config_nybble(router, 0x55, pirqmap[pirq-1]);
- }
- 
-@@ -268,7 +268,7 @@ static int pirq_via586_set(struct pci_dev *router, struct pci_dev *dev, int pirq
- {
- 	static const unsigned int pirqmap[5] = { 3, 2, 5, 1, 1 };
- 
--	WARN_ON_ONCE(pirq >= 5);
-+	WARN_ON_ONCE(pirq > 5);
- 	write_config_nybble(router, 0x55, pirqmap[pirq-1], irq);
- 	return 1;
- }
-@@ -282,7 +282,7 @@ static int pirq_ite_get(struct pci_dev *router, struct pci_dev *dev, int pirq)
- {
- 	static const unsigned char pirqmap[4] = { 1, 0, 2, 3 };
- 
--	WARN_ON_ONCE(pirq >= 4);
-+	WARN_ON_ONCE(pirq > 4);
- 	return read_config_nybble(router,0x43, pirqmap[pirq-1]);
- }
- 
-@@ -290,7 +290,7 @@ static int pirq_ite_set(struct pci_dev *router, struct pci_dev *dev, int pirq, i
- {
- 	static const unsigned char pirqmap[4] = { 1, 0, 2, 3 };
- 
--	WARN_ON_ONCE(pirq >= 4);
-+	WARN_ON_ONCE(pirq > 4);
- 	write_config_nybble(router, 0x43, pirqmap[pirq-1], irq);
- 	return 1;
- }
-diff --git a/drivers/infiniband/hw/nes/nes.c b/drivers/infiniband/hw/nes/nes.c
-index b2112f5..a3b2374 100644
---- a/drivers/infiniband/hw/nes/nes.c
-+++ b/drivers/infiniband/hw/nes/nes.c
-@@ -751,13 +751,13 @@ static void __devexit nes_remove(struct pci_dev *pcidev)
- 
- 	list_del(&nesdev->list);
- 	nes_destroy_cqp(nesdev);
-+
-+	free_irq(pcidev->irq, nesdev);
- 	tasklet_kill(&nesdev->dpc_tasklet);
- 
- 	/* Deallocate the Adapter Structure */
- 	nes_destroy_adapter(nesdev->nesadapter);
- 
--	free_irq(pcidev->irq, nesdev);
--
- 	if (nesdev->msi_enabled) {
- 		pci_disable_msi(pcidev);
- 	}
-diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c
-index 0bef878..96b1a0e 100644
---- a/drivers/infiniband/hw/nes/nes_cm.c
-+++ b/drivers/infiniband/hw/nes/nes_cm.c
-@@ -1834,8 +1834,10 @@ int mini_cm_recv_pkt(struct nes_cm_core *cm_core, struct nes_vnic *nesvnic,
- 	nfo.rem_addr = ntohl(iph->saddr);
- 	nfo.rem_port = ntohs(tcph->source);
- 
--	nes_debug(NES_DBG_CM, "Received packet: dest=0x%08X:0x%04X src=0x%08X:0x%04X\n",
--			iph->daddr, tcph->dest, iph->saddr, tcph->source);
-+	nes_debug(NES_DBG_CM, "Received packet: dest=" NIPQUAD_FMT
-+		  ":0x%04X src=" NIPQUAD_FMT ":0x%04X\n",
-+		  NIPQUAD(iph->daddr), tcph->dest,
-+		  NIPQUAD(iph->saddr), tcph->source);
- 
- 	/* note: this call is going to increment cm_node ref count */
- 	cm_node = find_node(cm_core,
-diff --git a/drivers/infiniband/hw/nes/nes_hw.c b/drivers/infiniband/hw/nes/nes_hw.c
-index 49e53e4..496655e 100644
---- a/drivers/infiniband/hw/nes/nes_hw.c
-+++ b/drivers/infiniband/hw/nes/nes_hw.c
-@@ -625,6 +625,15 @@ unsigned int nes_reset_adapter_ne020(struct nes_device *nesdev, u8 *OneG_Mode)
- 			nes_debug(NES_DBG_INIT, "Did not see full soft reset done.\n");
- 			return 0;
- 		}
-+
-+		i = 0;
-+		while ((nes_read_indexed(nesdev, NES_IDX_INT_CPU_STATUS) != 0x80) && i++ < 10000)
-+			mdelay(1);
-+		if (i >= 10000) {
-+			printk(KERN_ERR PFX "Internal CPU not ready, status = %02X\n",
-+			       nes_read_indexed(nesdev, NES_IDX_INT_CPU_STATUS));
-+			return 0;
-+		}
- 	}
- 
- 	/* port reset */
-@@ -673,17 +682,6 @@ unsigned int nes_reset_adapter_ne020(struct nes_device *nesdev, u8 *OneG_Mode)
- 		}
- 	}
- 
--
--
--	i = 0;
--	while ((nes_read_indexed(nesdev, NES_IDX_INT_CPU_STATUS) != 0x80) && i++ < 10000)
--		mdelay(1);
--	if (i >= 10000) {
--		printk(KERN_ERR PFX "Internal CPU not ready, status = %02X\n",
--				nes_read_indexed(nesdev, NES_IDX_INT_CPU_STATUS));
--		return 0;
--	}
--
- 	return port_count;
- }
- 
-diff --git a/drivers/md/dm-exception-store.c b/drivers/md/dm-exception-store.c
-index 5bbce29..c7d305b 100644
---- a/drivers/md/dm-exception-store.c
-+++ b/drivers/md/dm-exception-store.c
-@@ -131,7 +131,7 @@ struct pstore {
- 
- static unsigned sectors_to_pages(unsigned sectors)
- {
--	return sectors / (PAGE_SIZE >> 9);
-+	return DIV_ROUND_UP(sectors, PAGE_SIZE >> 9);
- }
- 
- static int alloc_area(struct pstore *ps)
-diff --git a/drivers/media/video/cx88/cx88-cards.c b/drivers/media/video/cx88/cx88-cards.c
-index 8c9a8ad..8bf5596 100644
---- a/drivers/media/video/cx88/cx88-cards.c
-+++ b/drivers/media/video/cx88/cx88-cards.c
-@@ -1354,6 +1354,10 @@ static const struct cx88_board cx88_boards[] = {
- 		}},
- 		/* fixme: Add radio support */
- 		.mpeg           = CX88_MPEG_DVB | CX88_MPEG_BLACKBIRD,
-+		.radio = {
-+			.type   = CX88_RADIO,
-+			.gpio0	= 0xe780,
-+		},
- 	},
- 	[CX88_BOARD_ADSTECH_PTV_390] = {
- 		.name           = "ADS Tech Instant Video PCI",
-diff --git a/drivers/media/video/ivtv/ivtv-ioctl.c b/drivers/media/video/ivtv/ivtv-ioctl.c
-index edef2a5..1e6f36e 100644
---- a/drivers/media/video/ivtv/ivtv-ioctl.c
-+++ b/drivers/media/video/ivtv/ivtv-ioctl.c
-@@ -741,7 +741,8 @@ int ivtv_v4l2_ioctls(struct ivtv *itv, struct file *filp, unsigned int cmd, void
- 
- 		memset(vcap, 0, sizeof(*vcap));
- 		strcpy(vcap->driver, IVTV_DRIVER_NAME);     /* driver name */
--		strcpy(vcap->card, itv->card_name); 	    /* card type */
-+		strncpy(vcap->card, itv->card_name,
-+				sizeof(vcap->card)-1); 	    /* card type */
- 		strcpy(vcap->bus_info, pci_name(itv->dev)); /* bus info... */
- 		vcap->version = IVTV_DRIVER_VERSION; 	    /* version */
- 		vcap->capabilities = itv->v4l2_cap; 	    /* capabilities */
-diff --git a/drivers/media/video/tea5761.c b/drivers/media/video/tea5761.c
-index 5326eec..de7e060 100644
---- a/drivers/media/video/tea5761.c
-+++ b/drivers/media/video/tea5761.c
-@@ -249,14 +249,19 @@ int tea5761_autodetection(struct i2c_adapter* i2c_adap, u8 i2c_addr)
- 
- 	if (16 != (rc = tuner_i2c_xfer_recv(&i2c, buffer, 16))) {
- 		printk(KERN_WARNING "it is not a TEA5761. Received %i chars.\n", rc);
--		return EINVAL;
-+		return -EINVAL;
- 	}
- 
--	if (!((buffer[13] != 0x2b) || (buffer[14] != 0x57) || (buffer[15] != 0x061))) {
--		printk(KERN_WARNING "Manufacturer ID= 0x%02x, Chip ID = %02x%02x. It is not a TEA5761\n",buffer[13],buffer[14],buffer[15]);
--		return EINVAL;
-+	if ((buffer[13] != 0x2b) || (buffer[14] != 0x57) || (buffer[15] != 0x061)) {
-+		printk(KERN_WARNING "Manufacturer ID= 0x%02x, Chip ID = %02x%02x."
-+				    " It is not a TEA5761\n",
-+				    buffer[13], buffer[14], buffer[15]);
-+		return -EINVAL;
- 	}
--	printk(KERN_WARNING "TEA5761 detected.\n");
-+	printk(KERN_WARNING "tea5761: TEA%02x%02x detected. "
-+			    "Manufacturer ID= 0x%02x\n",
-+			    buffer[14], buffer[15], buffer[13]);
-+
- 	return 0;
- }
- 
-diff --git a/drivers/media/video/tuner-core.c b/drivers/media/video/tuner-core.c
-index 78a09a2..8cdbdd0 100644
---- a/drivers/media/video/tuner-core.c
-+++ b/drivers/media/video/tuner-core.c
-@@ -1112,8 +1112,8 @@ static int tuner_probe(struct i2c_client *client)
- 	if (!no_autodetect) {
- 		switch (client->addr) {
- 		case 0x10:
--			if (tea5761_autodetection(t->i2c->adapter, t->i2c->addr)
--					!= EINVAL) {
-+			if (tea5761_autodetection(t->i2c->adapter,
-+						  t->i2c->addr) >= 0) {
- 				t->type = TUNER_TEA5761;
- 				t->mode_mask = T_RADIO;
- 				t->mode = T_STANDBY;
-@@ -1125,7 +1125,7 @@ static int tuner_probe(struct i2c_client *client)
- 
- 				goto register_client;
- 			}
--			break;
-+			return -ENODEV;
- 		case 0x42:
- 		case 0x43:
- 		case 0x4a:
-diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c
-index c082cf0..de11039 100644
---- a/drivers/net/s2io.c
-+++ b/drivers/net/s2io.c
-@@ -84,7 +84,7 @@
- #include "s2io.h"
- #include "s2io-regs.h"
- 
--#define DRV_VERSION "2.0.26.20"
-+#define DRV_VERSION "2.0.26.22"
- 
- /* S2io Driver name & version. */
- static char s2io_driver_name[] = "Neterion";
-@@ -2339,7 +2339,7 @@ static void free_tx_buffers(struct s2io_nic *nic)
- 	for (i = 0; i < config->tx_fifo_num; i++) {
- 		unsigned long flags;
- 		spin_lock_irqsave(&mac_control->fifos[i].tx_lock, flags);
--		for (j = 0; j < config->tx_cfg[i].fifo_len - 1; j++) {
-+		for (j = 0; j < config->tx_cfg[i].fifo_len; j++) {
- 			txdp = (struct TxD *) \
- 			mac_control->fifos[i].list_info[j].list_virt_addr;
- 			skb = s2io_txdl_getskb(&mac_control->fifos[i], txdp, j);
-diff --git a/drivers/net/tehuti.c b/drivers/net/tehuti.c
-index 17585e5..432e837 100644
---- a/drivers/net/tehuti.c
-+++ b/drivers/net/tehuti.c
-@@ -625,6 +625,12 @@ static void __init bdx_firmware_endianess(void)
- 		s_firmLoad[i] = CPU_CHIP_SWAP32(s_firmLoad[i]);
- }
- 
-+static int bdx_range_check(struct bdx_priv *priv, u32 offset)
-+{
-+	return (offset > (u32) (BDX_REGS_SIZE / priv->nic->port_num)) ?
-+		-EINVAL : 0;
-+}
-+
- static int bdx_ioctl_priv(struct net_device *ndev, struct ifreq *ifr, int cmd)
- {
- 	struct bdx_priv *priv = ndev->priv;
-@@ -643,9 +649,15 @@ static int bdx_ioctl_priv(struct net_device *ndev, struct ifreq *ifr, int cmd)
- 		DBG("%d 0x%x 0x%x\n", data[0], data[1], data[2]);
- 	}
- 
-+	if (!capable(CAP_SYS_RAWIO))
-+		return -EPERM;
-+
- 	switch (data[0]) {
- 
- 	case BDX_OP_READ:
-+		error = bdx_range_check(priv, data[1]);
-+		if (error < 0)
-+			return error;
- 		data[2] = READ_REG(priv, data[1]);
- 		DBG("read_reg(0x%x)=0x%x (dec %d)\n", data[1], data[2],
- 		    data[2]);
-@@ -655,6 +667,9 @@ static int bdx_ioctl_priv(struct net_device *ndev, struct ifreq *ifr, int cmd)
- 		break;
- 
- 	case BDX_OP_WRITE:
-+		error = bdx_range_check(priv, data[1]);
-+		if (error < 0)
-+			return error;
- 		WRITE_REG(priv, data[1], data[2]);
- 		DBG("write_reg(0x%x, 0x%x)\n", data[1], data[2]);
- 		break;
-diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
-index 96043c5..bc4c62b 100644
---- a/drivers/net/tg3.c
-+++ b/drivers/net/tg3.c
-@@ -64,8 +64,8 @@
- 
- #define DRV_MODULE_NAME		"tg3"
- #define PFX DRV_MODULE_NAME	": "
--#define DRV_MODULE_VERSION	"3.90"
--#define DRV_MODULE_RELDATE	"April 12, 2008"
-+#define DRV_MODULE_VERSION	"3.91"
-+#define DRV_MODULE_RELDATE	"April 18, 2008"
- 
- #define TG3_DEF_MAC_MODE	0
- #define TG3_DEF_RX_MODE		0
-@@ -4135,11 +4135,21 @@ static int tigon3_dma_hwbug_workaround(struct tg3 *tp, struct sk_buff *skb,
- 				       u32 last_plus_one, u32 *start,
- 				       u32 base_flags, u32 mss)
- {
--	struct sk_buff *new_skb = skb_copy(skb, GFP_ATOMIC);
-+	struct sk_buff *new_skb;
- 	dma_addr_t new_addr = 0;
- 	u32 entry = *start;
- 	int i, ret = 0;
- 
-+	if (GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5701)
-+		new_skb = skb_copy(skb, GFP_ATOMIC);
-+	else {
-+		int more_headroom = 4 - ((unsigned long)skb->data & 3);
-+
-+		new_skb = skb_copy_expand(skb,
-+					  skb_headroom(skb) + more_headroom,
-+					  skb_tailroom(skb), GFP_ATOMIC);
-+	}
-+
- 	if (!new_skb) {
- 		ret = -1;
- 	} else {
-@@ -4462,7 +4472,9 @@ static int tg3_start_xmit_dma_bug(struct sk_buff *skb, struct net_device *dev)
- 
- 	would_hit_hwbug = 0;
- 
--	if (tg3_4g_overflow_test(mapping, len))
-+	if (tp->tg3_flags3 & TG3_FLG3_5701_DMA_BUG)
-+		would_hit_hwbug = 1;
-+	else if (tg3_4g_overflow_test(mapping, len))
- 		would_hit_hwbug = 1;
- 
- 	tg3_set_txd(tp, entry, mapping, len, base_flags,
-@@ -11339,6 +11351,38 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
- 		}
- 	}
- 
-+	if ((GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5701)) {
-+		static struct tg3_dev_id {
-+			u32	vendor;
-+			u32	device;
-+		} bridge_chipsets[] = {
-+			{ PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PXH_0 },
-+			{ PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PXH_1 },
-+			{ },
-+		};
-+		struct tg3_dev_id *pci_id = &bridge_chipsets[0];
-+		struct pci_dev *bridge = NULL;
-+
-+		while (pci_id->vendor != 0) {
-+			bridge = pci_get_device(pci_id->vendor,
-+						pci_id->device,
-+						bridge);
-+			if (!bridge) {
-+				pci_id++;
-+				continue;
-+			}
-+			if (bridge->subordinate &&
-+			    (bridge->subordinate->number <=
-+			     tp->pdev->bus->number) &&
-+			    (bridge->subordinate->subordinate >=
-+			     tp->pdev->bus->number)) {
-+				tp->tg3_flags3 |= TG3_FLG3_5701_DMA_BUG;
-+				pci_dev_put(bridge);
-+				break;
-+			}
-+		}
-+	}
-+
- 	/* The EPB bridge inside 5714, 5715, and 5780 cannot support
- 	 * DMA addresses > 40-bit. This bridge may have other additional
- 	 * 57xx devices behind it in some 4-port NIC designs for example.
-diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
-index c1075a7..c688c3a 100644
---- a/drivers/net/tg3.h
-+++ b/drivers/net/tg3.h
-@@ -2476,6 +2476,7 @@ struct tg3 {
- #define TG3_FLG3_NO_NVRAM_ADDR_TRANS	0x00000001
- #define TG3_FLG3_ENABLE_APE		0x00000002
- #define TG3_FLG3_5761_5784_AX_FIXES	0x00000004
-+#define TG3_FLG3_5701_DMA_BUG		0x00000008
- 
- 	struct timer_list		timer;
- 	u16				timer_counter;
-diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
-index 48e9124..4ec1915 100644
---- a/drivers/net/wireless/b43/dma.c
-+++ b/drivers/net/wireless/b43/dma.c
-@@ -822,6 +822,18 @@ static u64 supported_dma_mask(struct b43_wldev *dev)
- 	return DMA_30BIT_MASK;
- }
- 
-+static enum b43_dmatype dma_mask_to_engine_type(u64 dmamask)
-+{
-+	if (dmamask == DMA_30BIT_MASK)
-+		return B43_DMA_30BIT;
-+	if (dmamask == DMA_32BIT_MASK)
-+		return B43_DMA_32BIT;
-+	if (dmamask == DMA_64BIT_MASK)
-+		return B43_DMA_64BIT;
-+	B43_WARN_ON(1);
-+	return B43_DMA_30BIT;
-+}
-+
- /* Main initialization function. */
- static
- struct b43_dmaring *b43_setup_dmaring(struct b43_wldev *dev,
-@@ -982,6 +994,42 @@ void b43_dma_free(struct b43_wldev *dev)
- 	dma->tx_ring0 = NULL;
- }
- 
-+static int b43_dma_set_mask(struct b43_wldev *dev, u64 mask)
-+{
-+	u64 orig_mask = mask;
-+	bool fallback = 0;
-+	int err;
-+
-+	/* Try to set the DMA mask. If it fails, try falling back to a
-+	 * lower mask, as we can always also support a lower one. */
-+	while (1) {
-+		err = ssb_dma_set_mask(dev->dev, mask);
-+		if (!err)
-+			break;
-+		if (mask == DMA_64BIT_MASK) {
-+			mask = DMA_32BIT_MASK;
-+			fallback = 1;
-+			continue;
-+		}
-+		if (mask == DMA_32BIT_MASK) {
-+			mask = DMA_30BIT_MASK;
-+			fallback = 1;
-+			continue;
-+		}
-+		b43err(dev->wl, "The machine/kernel does not support "
-+		       "the required %u-bit DMA mask\n",
-+		       (unsigned int)dma_mask_to_engine_type(orig_mask));
-+		return -EOPNOTSUPP;
-+	}
-+	if (fallback) {
-+		b43info(dev->wl, "DMA mask fallback from %u-bit to %u-bit\n",
-+			(unsigned int)dma_mask_to_engine_type(orig_mask),
-+			(unsigned int)dma_mask_to_engine_type(mask));
-+	}
-+
-+	return 0;
-+}
-+
- int b43_dma_init(struct b43_wldev *dev)
- {
- 	struct b43_dma *dma = &dev->dma;
-@@ -991,27 +1039,10 @@ int b43_dma_init(struct b43_wldev *dev)
- 	enum b43_dmatype type;
- 
- 	dmamask = supported_dma_mask(dev);
--	switch (dmamask) {
--	default:
--		B43_WARN_ON(1);
--	case DMA_30BIT_MASK:
--		type = B43_DMA_30BIT;
--		break;
--	case DMA_32BIT_MASK:
--		type = B43_DMA_32BIT;
--		break;
--	case DMA_64BIT_MASK:
--		type = B43_DMA_64BIT;
--		break;
--	}
--	err = ssb_dma_set_mask(dev->dev, dmamask);
--	if (err) {
--		b43err(dev->wl, "The machine/kernel does not support "
--		       "the required DMA mask (0x%08X%08X)\n",
--		       (unsigned int)((dmamask & 0xFFFFFFFF00000000ULL) >> 32),
--		       (unsigned int)(dmamask & 0x00000000FFFFFFFFULL));
--		return -EOPNOTSUPP;
--	}
-+	type = dma_mask_to_engine_type(dmamask);
-+	err = b43_dma_set_mask(dev, dmamask);
-+	if (err)
-+		return err;
- 
- 	err = -ENOMEM;
- 	/* setup TX DMA channels. */
-diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
-index c73a75b..f23317e 100644
---- a/drivers/net/wireless/b43/main.c
-+++ b/drivers/net/wireless/b43/main.c
-@@ -78,6 +78,11 @@ static int modparam_nohwcrypt;
- module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
- MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
- 
-+static int modparam_btcoex = 1;
-+module_param_named(btcoex, modparam_btcoex, int, 0444);
-+MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistance (default on)");
-+
-+
- static const struct ssb_device_id b43_ssb_tbl[] = {
- 	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
- 	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
-@@ -3339,6 +3344,8 @@ static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
- 	struct ssb_sprom *sprom = &dev->dev->bus->sprom;
- 	u32 hf;
- 
-+	if (!modparam_btcoex)
-+		return;
- 	if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
- 		return;
- 	if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
-@@ -3350,11 +3357,13 @@ static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
- 	else
- 		hf |= B43_HF_BTCOEX;
- 	b43_hf_write(dev, hf);
--	//TODO
- }
- 
- static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
--{				//TODO
-+{
-+	if (!modparam_btcoex)
-+		return;
-+	//TODO
- }
- 
- static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
-@@ -4000,8 +4009,16 @@ static int b43_one_core_attach(struct ssb_device *dev, struct b43_wl *wl)
- 	return err;
- }
- 
-+#define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)		( \
-+	(pdev->vendor == PCI_VENDOR_ID_##_vendor) &&			\
-+	(pdev->device == _device) &&					\
-+	(pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&	\
-+	(pdev->subsystem_device == _subdevice)				)
-+
- static void b43_sprom_fixup(struct ssb_bus *bus)
- {
-+	struct pci_dev *pdev;
-+
- 	/* boardflags workarounds */
- 	if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
- 	    bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
-@@ -4009,6 +4026,13 @@ static void b43_sprom_fixup(struct ssb_bus *bus)
- 	if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
- 	    bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
- 		bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
-+	if (bus->bustype == SSB_BUSTYPE_PCI) {
-+		pdev = bus->host_pci;
-+		if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
-+		    IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
-+		    IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013))
-+			bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
-+	}
- }
- 
- static void b43_wireless_exit(struct ssb_device *dev, struct b43_wl *wl)
-diff --git a/drivers/rtc/rtc-pcf8583.c b/drivers/rtc/rtc-pcf8583.c
-index 8b39970..3d09d8f 100644
---- a/drivers/rtc/rtc-pcf8583.c
-+++ b/drivers/rtc/rtc-pcf8583.c
-@@ -15,7 +15,7 @@
- #include <linux/i2c.h>
- #include <linux/slab.h>
- #include <linux/string.h>
--#include <linux/mc146818rtc.h>
-+#include <linux/rtc.h>
- #include <linux/init.h>
- #include <linux/errno.h>
- #include <linux/bcd.h>
-diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
-index 3c1b433..0e8e092 100644
---- a/drivers/scsi/qla2xxx/qla_os.c
-+++ b/drivers/scsi/qla2xxx/qla_os.c
-@@ -2357,7 +2357,7 @@ qla2x00_do_dpc(void *data)
- 					} else {
- 						fcport->login_retry = 0;
- 					}
--					if (fcport->login_retry == 0)
-+					if (fcport->login_retry == 0 && status != QLA_SUCCESS)
- 						fcport->loop_id = FC_NO_LOOP_ID;
- 				}
- 				if (test_bit(LOOP_RESYNC_NEEDED, &ha->dpc_flags))
-diff --git a/drivers/serial/dz.c b/drivers/serial/dz.c
-index 116211f..0dddd68 100644
---- a/drivers/serial/dz.c
-+++ b/drivers/serial/dz.c
-@@ -819,7 +819,7 @@ static void dz_console_putchar(struct uart_port *uport, int ch)
- 		dz_out(dport, DZ_TCR, mask);
- 		iob();
- 		udelay(2);
--	} while (loops--);
-+	} while (--loops);
- 
- 	if (loops)				/* Cannot send otherwise. */
- 		dz_out(dport, DZ_TDR, ch);
-diff --git a/drivers/ssb/pci.c b/drivers/ssb/pci.c
-index b434df7..274a448 100644
---- a/drivers/ssb/pci.c
-+++ b/drivers/ssb/pci.c
-@@ -482,6 +482,11 @@ static int sprom_extract(struct ssb_bus *bus, struct ssb_sprom *out,
- 			goto unsupported;
- 	}
- 
-+	if (out->boardflags_lo == 0xFFFF)
-+		out->boardflags_lo = 0;  /* per specs */
-+	if (out->boardflags_hi == 0xFFFF)
-+		out->boardflags_hi = 0;  /* per specs */
-+
- 	return 0;
- unsupported:
- 	ssb_printk(KERN_WARNING PFX "Unsupported SPROM revision %d "
-diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
-index 68fc521..7f1bc97 100644
---- a/drivers/usb/core/hub.c
-+++ b/drivers/usb/core/hub.c
-@@ -2664,6 +2664,7 @@ loop:
- 		if ((status == -ENOTCONN) || (status == -ENOTSUPP))
- 			break;
- 	}
-+	dev_err(hub_dev, "unable to enumerate USB device on port %d\n", port1);
-  
- done:
- 	hub_port_disable(hub, port1, 1);
-diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c
-index d0360f6..b0e2275 100644
---- a/drivers/usb/host/ohci-pci.c
-+++ b/drivers/usb/host/ohci-pci.c
-@@ -312,11 +312,13 @@ static int ohci_pci_suspend (struct usb_hcd *hcd, pm_message_t message)
- 
- static int ohci_pci_resume (struct usb_hcd *hcd)
- {
-+	struct ohci_hcd	*ohci = hcd_to_ohci(hcd);
-+
- 	set_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
- 
- 	/* FIXME: we should try to detect loss of VBUS power here */
- 	prepare_for_handover(hcd);
--
-+	ohci_writel(ohci, OHCI_INTR_MIE, &ohci->regs->intrenable);
- 	return 0;
- }
- 
-diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
-index ed67881..7b02a4a 100644
---- a/drivers/usb/serial/sierra.c
-+++ b/drivers/usb/serial/sierra.c
-@@ -164,6 +164,7 @@ static struct usb_device_id id_table [] = {
- 	{ USB_DEVICE(0x1199, 0x6812) },	/* Sierra Wireless MC8775 & AC 875U */
- 	{ USB_DEVICE(0x1199, 0x6813) },	/* Sierra Wireless MC8775 (Thinkpad internal) */
- 	{ USB_DEVICE(0x1199, 0x6815) },	/* Sierra Wireless MC8775 */
-+	{ USB_DEVICE(0x03f0, 0x1e1d) },	/* HP hs2300 a.k.a MC8775 */
- 	{ USB_DEVICE(0x1199, 0x6820) },	/* Sierra Wireless AirCard 875 */
- 	{ USB_DEVICE(0x1199, 0x6832) },	/* Sierra Wireless MC8780*/
- 	{ USB_DEVICE(0x1199, 0x6833) },	/* Sierra Wireless MC8781*/
-diff --git a/fs/aio.c b/fs/aio.c
-index 2283686..ae94e1d 100644
---- a/fs/aio.c
-+++ b/fs/aio.c
-@@ -1166,7 +1166,10 @@ retry:
- 				break;
- 			if (min_nr <= i)
- 				break;
--			ret = 0;
-+			if (unlikely(ctx->dead)) {
-+				ret = -EINVAL;
-+				break;
-+			}
- 			if (to.timed_out)	/* Only check after read evt */
- 				break;
- 			/* Try to only show up in io wait if there are ops
-@@ -1231,6 +1234,13 @@ static void io_destroy(struct kioctx *ioctx)
- 
- 	aio_cancel_all(ioctx);
- 	wait_for_all_aios(ioctx);
-+
-+	/*
-+	 * Wake up any waiters.  The setting of ctx->dead must be seen
-+	 * by other CPUs at this point.  Right now, we rely on the
-+	 * locking done by the above calls to ensure this consistency.
-+	 */
-+	wake_up(&ioctx->wait);
- 	put_ioctx(ioctx);	/* once for the lookup */
- }
- 
-diff --git a/fs/dnotify.c b/fs/dnotify.c
-index 28d01ed..eaecc4c 100644
---- a/fs/dnotify.c
-+++ b/fs/dnotify.c
-@@ -20,6 +20,7 @@
- #include <linux/init.h>
- #include <linux/spinlock.h>
- #include <linux/slab.h>
-+#include <linux/file.h>
- 
- int dir_notify_enable __read_mostly = 1;
- 
-@@ -66,6 +67,7 @@ int fcntl_dirnotify(int fd, struct file *filp, unsigned long arg)
- 	struct dnotify_struct **prev;
- 	struct inode *inode;
- 	fl_owner_t id = current->files;
-+	struct file *f;
- 	int error = 0;
- 
- 	if ((arg & ~DN_MULTISHOT) == 0) {
-@@ -92,6 +94,15 @@ int fcntl_dirnotify(int fd, struct file *filp, unsigned long arg)
- 		prev = &odn->dn_next;
- 	}
- 
-+	rcu_read_lock();
-+	f = fcheck(fd);
-+	rcu_read_unlock();
-+	/* we'd lost the race with close(), sod off silently */
-+	/* note that inode->i_lock prevents reordering problems
-+	 * between accesses to descriptor table and ->i_dnotify */
-+	if (f != filp)
-+		goto out_free;
-+
- 	error = __f_setown(filp, task_pid(current), PIDTYPE_PID, 0);
- 	if (error)
- 		goto out_free;
-diff --git a/fs/jffs2/erase.c b/fs/jffs2/erase.c
-index a1db918..4c895f3 100644
---- a/fs/jffs2/erase.c
-+++ b/fs/jffs2/erase.c
-@@ -419,9 +419,6 @@ static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseb
- 			if (jffs2_write_nand_cleanmarker(c, jeb))
- 				goto filebad;
- 		}
--
--		/* Everything else got zeroed before the erase */
--		jeb->free_size = c->sector_size;
- 	} else {
- 
- 		struct kvec vecs[1];
-@@ -449,18 +446,19 @@ static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseb
- 
- 			goto filebad;
- 		}
--
--		/* Everything else got zeroed before the erase */
--		jeb->free_size = c->sector_size;
--		/* FIXME Special case for cleanmarker in empty block */
--		jffs2_link_node_ref(c, jeb, jeb->offset | REF_NORMAL, c->cleanmarker_size, NULL);
- 	}
-+	/* Everything else got zeroed before the erase */
-+	jeb->free_size = c->sector_size;
- 
- 	down(&c->erase_free_sem);
- 	spin_lock(&c->erase_completion_lock);
-+
- 	c->erasing_size -= c->sector_size;
--	c->free_size += jeb->free_size;
--	c->used_size += jeb->used_size;
-+	c->free_size += c->sector_size;
-+
-+	/* Account for cleanmarker now, if it's in-band */
-+	if (c->cleanmarker_size && !jffs2_cleanmarker_oob(c))
-+		jffs2_link_node_ref(c, jeb, jeb->offset | REF_NORMAL, c->cleanmarker_size, NULL);
- 
- 	jffs2_dbg_acct_sanity_check_nolock(c,jeb);
- 	jffs2_dbg_acct_paranoia_check_nolock(c, jeb);
-diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h
-index b9e1740..44c81c7 100644
---- a/include/linux/rtnetlink.h
-+++ b/include/linux/rtnetlink.h
-@@ -740,13 +740,13 @@ extern void rtmsg_ifinfo(int type, struct net_device *dev, unsigned change);
- extern void rtnl_lock(void);
- extern void rtnl_unlock(void);
- extern int rtnl_trylock(void);
-+extern int rtnl_is_locked(void);
- 
- extern void rtnetlink_init(void);
- extern void __rtnl_unlock(void);
- 
- #define ASSERT_RTNL() do { \
--	if (unlikely(rtnl_trylock())) { \
--		rtnl_unlock(); \
-+	if (unlikely(!rtnl_is_locked())) { \
- 		printk(KERN_ERR "RTNL: assertion failed at %s (%d)\n", \
- 		       __FILE__,  __LINE__); \
- 		dump_stack(); \
-diff --git a/include/net/tcp.h b/include/net/tcp.h
-index 4fd3eb2..d69d12e 100644
---- a/include/net/tcp.h
-+++ b/include/net/tcp.h
-@@ -776,11 +776,14 @@ extern void tcp_enter_cwr(struct sock *sk, const int set_ssthresh);
- extern __u32 tcp_init_cwnd(struct tcp_sock *tp, struct dst_entry *dst);
- 
- /* Slow start with delack produces 3 packets of burst, so that
-- * it is safe "de facto".
-+ * it is safe "de facto".  This will be the default - same as
-+ * the default reordering threshold - but if reordering increases,
-+ * we must be able to allow cwnd to burst at least this much in order
-+ * to not pull it back when holes are filled.
-  */
- static __inline__ __u32 tcp_max_burst(const struct tcp_sock *tp)
- {
--	return 3;
-+	return tp->reordering;
- }
- 
- /* Returns end sequence number of the receiver's advertised window */
-diff --git a/include/net/xfrm.h b/include/net/xfrm.h
-index 0d255ae..97577de 100644
---- a/include/net/xfrm.h
-+++ b/include/net/xfrm.h
-@@ -435,6 +435,9 @@ struct xfrm_tmpl
- /* May skip this transfomration if no SA is found */
- 	__u8			optional;
- 
-+/* Skip aalgos/ealgos/calgos checks. */
-+	__u8			allalgs;
-+
- /* Bit mask of algos allowed for acquisition */
- 	__u32			aalgos;
- 	__u32			ealgos;
-diff --git a/kernel/cgroup.c b/kernel/cgroup.c
-index 2727f92..6d8de05 100644
---- a/kernel/cgroup.c
-+++ b/kernel/cgroup.c
-@@ -1722,7 +1722,12 @@ void cgroup_enable_task_cg_lists(void)
- 	use_task_css_set_links = 1;
- 	do_each_thread(g, p) {
- 		task_lock(p);
--		if (list_empty(&p->cg_list))
-+		/*
-+		 * We should check if the process is exiting, otherwise
-+		 * it will race with cgroup_exit() in that the list
-+		 * entry won't be deleted though the process has exited.
-+		 */
-+		if (!(p->flags & PF_EXITING) && list_empty(&p->cg_list))
- 			list_add(&p->cg_list, &p->cgroups->tasks);
- 		task_unlock(p);
- 	} while_each_thread(g, p);
-diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
-index 98bee01..c15a359 100644
---- a/kernel/hrtimer.c
-+++ b/kernel/hrtimer.c
-@@ -590,7 +590,6 @@ static inline int hrtimer_enqueue_reprogram(struct hrtimer *timer,
- 			list_add_tail(&timer->cb_entry,
- 				      &base->cpu_base->cb_pending);
- 			timer->state = HRTIMER_STATE_PENDING;
--			raise_softirq(HRTIMER_SOFTIRQ);
- 			return 1;
- 		default:
- 			BUG();
-@@ -633,6 +632,11 @@ static int hrtimer_switch_to_hres(void)
- 	return 1;
- }
- 
-+static inline void hrtimer_raise_softirq(void)
-+{
-+	raise_softirq(HRTIMER_SOFTIRQ);
-+}
-+
- #else
- 
- static inline int hrtimer_hres_active(void) { return 0; }
-@@ -651,6 +655,7 @@ static inline int hrtimer_reprogram(struct hrtimer *timer,
- {
- 	return 0;
- }
-+static inline void hrtimer_raise_softirq(void) { }
- 
- #endif /* CONFIG_HIGH_RES_TIMERS */
- 
-@@ -850,7 +855,7 @@ hrtimer_start(struct hrtimer *timer, ktime_t tim, const enum hrtimer_mode mode)
- {
- 	struct hrtimer_clock_base *base, *new_base;
- 	unsigned long flags;
--	int ret;
-+	int ret, raise;
- 
- 	base = lock_hrtimer_base(timer, &flags);
- 
-@@ -884,8 +889,18 @@ hrtimer_start(struct hrtimer *timer, ktime_t tim, const enum hrtimer_mode mode)
- 	enqueue_hrtimer(timer, new_base,
- 			new_base->cpu_base == &__get_cpu_var(hrtimer_bases));
- 
-+	/*
-+	 * The timer may be expired and moved to the cb_pending
-+	 * list. We can not raise the softirq with base lock held due
-+	 * to a possible deadlock with runqueue lock.
-+	 */
-+	raise = timer->state == HRTIMER_STATE_PENDING;
-+
- 	unlock_hrtimer_base(timer, &flags);
- 
-+	if (raise)
-+		hrtimer_raise_softirq();
-+
- 	return ret;
- }
- EXPORT_SYMBOL_GPL(hrtimer_start);
-@@ -1080,8 +1095,19 @@ static void run_hrtimer_pending(struct hrtimer_cpu_base *cpu_base)
- 			 * If the timer was rearmed on another CPU, reprogram
- 			 * the event device.
- 			 */
--			if (timer->base->first == &timer->node)
--				hrtimer_reprogram(timer, timer->base);
-+			struct hrtimer_clock_base *base = timer->base;
-+
-+			if (base->first == &timer->node &&
-+			    hrtimer_reprogram(timer, base)) {
-+				/*
-+				 * Timer is expired. Thus move it from tree to
-+				 * pending list again.
-+				 */
-+				__remove_hrtimer(timer, base,
-+						 HRTIMER_STATE_PENDING, 0);
-+				list_add_tail(&timer->cb_entry,
-+					      &base->cpu_base->cb_pending);
-+			}
- 		}
- 	}
- 	spin_unlock_irq(&cpu_base->lock);
-diff --git a/mm/pagewalk.c b/mm/pagewalk.c
-index 1cf1417..0afd238 100644
---- a/mm/pagewalk.c
-+++ b/mm/pagewalk.c
-@@ -9,11 +9,15 @@ static int walk_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
- 	int err = 0;
- 
- 	pte = pte_offset_map(pmd, addr);
--	do {
-+	for (;;) {
- 		err = walk->pte_entry(pte, addr, addr + PAGE_SIZE, private);
- 		if (err)
- 		       break;
--	} while (pte++, addr += PAGE_SIZE, addr != end);
-+		addr += PAGE_SIZE;
-+		if (addr == end)
-+			break;
-+		pte++;
-+	}
- 
- 	pte_unmap(pte);
- 	return err;
-diff --git a/net/can/raw.c b/net/can/raw.c
-index 94cd7f2..c92cb8e 100644
---- a/net/can/raw.c
-+++ b/net/can/raw.c
-@@ -573,7 +573,8 @@ static int raw_getsockopt(struct socket *sock, int level, int optname,
- 			int fsize = ro->count * sizeof(struct can_filter);
- 			if (len > fsize)
- 				len = fsize;
--			err = copy_to_user(optval, ro->filter, len);
-+			if (copy_to_user(optval, ro->filter, len))
-+				err = -EFAULT;
- 		} else
- 			len = 0;
- 		release_sock(sk);
-diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
-index 2bd9c5f..0cb2772 100644
---- a/net/core/rtnetlink.c
-+++ b/net/core/rtnetlink.c
-@@ -82,6 +82,11 @@ int rtnl_trylock(void)
- 	return mutex_trylock(&rtnl_mutex);
- }
- 
-+int rtnl_is_locked(void)
-+{
-+	return mutex_is_locked(&rtnl_mutex);
-+}
-+
- static struct rtnl_link *rtnl_msg_handlers[NPROTO];
- 
- static inline int rtm_msgindex(int msgtype)
-@@ -1389,6 +1394,7 @@ EXPORT_SYMBOL(rtnetlink_put_metrics);
- EXPORT_SYMBOL(rtnl_lock);
- EXPORT_SYMBOL(rtnl_trylock);
- EXPORT_SYMBOL(rtnl_unlock);
-+EXPORT_SYMBOL(rtnl_is_locked);
- EXPORT_SYMBOL(rtnl_unicast);
- EXPORT_SYMBOL(rtnl_notify);
- EXPORT_SYMBOL(rtnl_set_sk_err);
-diff --git a/net/dccp/probe.c b/net/dccp/probe.c
-index 7053bb8..44eddcf 100644
---- a/net/dccp/probe.c
-+++ b/net/dccp/probe.c
-@@ -145,7 +145,7 @@ static ssize_t dccpprobe_read(struct file *file, char __user *buf,
- 		goto out_free;
- 
- 	cnt = kfifo_get(dccpw.fifo, tbuf, len);
--	error = copy_to_user(buf, tbuf, cnt);
-+	error = copy_to_user(buf, tbuf, cnt) ? -EFAULT : 0;
- 
- out_free:
- 	vfree(tbuf);
-diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
-index 87dd5bf..a79a547 100644
---- a/net/ipv4/tcp_probe.c
-+++ b/net/ipv4/tcp_probe.c
-@@ -190,19 +190,18 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf,
- 
- 		width = tcpprobe_sprint(tbuf, sizeof(tbuf));
- 
--		if (width < len)
-+		if (cnt + width < len)
- 			tcp_probe.tail = (tcp_probe.tail + 1) % bufsize;
- 
- 		spin_unlock_bh(&tcp_probe.lock);
- 
- 		/* if record greater than space available
- 		   return partial buffer (so far) */
--		if (width >= len)
-+		if (cnt + width >= len)
- 			break;
- 
--		error = copy_to_user(buf + cnt, tbuf, width);
--		if (error)
--			break;
-+		if (copy_to_user(buf + cnt, tbuf, width))
-+			return -EFAULT;
- 		cnt += width;
- 	}
- 
-diff --git a/net/key/af_key.c b/net/key/af_key.c
-index e9ef9af..5ceab25 100644
---- a/net/key/af_key.c
-+++ b/net/key/af_key.c
-@@ -1856,7 +1856,7 @@ parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_ipsecrequest *rq)
- 		t->encap_family = xp->family;
- 
- 	/* No way to set this via kame pfkey */
--	t->aalgos = t->ealgos = t->calgos = ~0;
-+	t->allalgs = 1;
- 	xp->xfrm_nr++;
- 	return 0;
- }
-diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
-index 063cbc5..f9293c7 100644
---- a/net/rose/af_rose.c
-+++ b/net/rose/af_rose.c
-@@ -760,8 +760,10 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le
- 
- 	rose->neighbour = rose_get_neigh(&addr->srose_addr, &cause,
- 					 &diagnostic);
--	if (!rose->neighbour)
--		return -ENETUNREACH;
-+	if (!rose->neighbour) {
-+		err = -ENETUNREACH;
-+		goto out_release;
-+	}
- 
- 	rose->lci = rose_new_lci(rose->neighbour);
- 	if (!rose->lci) {
-diff --git a/net/tipc/socket.c b/net/tipc/socket.c
-index 2290903..ac04733 100644
---- a/net/tipc/socket.c
-+++ b/net/tipc/socket.c
-@@ -1600,8 +1600,8 @@ static int getsockopt(struct socket *sock,
- 	else if (len < sizeof(value)) {
- 		res = -EINVAL;
- 	}
--	else if ((res = copy_to_user(ov, &value, sizeof(value)))) {
--		/* couldn't return value */
-+	else if (copy_to_user(ov, &value, sizeof(value))) {
-+		res = -EFAULT;
- 	}
- 	else {
- 		res = put_user(sizeof(value), ol);
-diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
-index 9fc4c31..c44076c 100644
---- a/net/xfrm/xfrm_policy.c
-+++ b/net/xfrm/xfrm_policy.c
-@@ -1772,7 +1772,7 @@ xfrm_state_ok(struct xfrm_tmpl *tmpl, struct xfrm_state *x,
- 		(x->id.spi == tmpl->id.spi || !tmpl->id.spi) &&
- 		(x->props.reqid == tmpl->reqid || !tmpl->reqid) &&
- 		x->props.mode == tmpl->mode &&
--		((tmpl->aalgos & (1<<x->props.aalgo)) ||
-+		(tmpl->allalgs || (tmpl->aalgos & (1<<x->props.aalgo)) ||
- 		 !(xfrm_id_proto_match(tmpl->id.proto, IPSEC_PROTO_ANY))) &&
- 		!(x->props.mode != XFRM_MODE_TRANSPORT &&
- 		  xfrm_state_addr_cmp(tmpl, x, family));
-diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
-index 019d21d..12f19be 100644
---- a/net/xfrm/xfrm_user.c
-+++ b/net/xfrm/xfrm_user.c
-@@ -975,6 +975,8 @@ static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut,
- 		t->aalgos = ut->aalgos;
- 		t->ealgos = ut->ealgos;
- 		t->calgos = ut->calgos;
-+		/* If all masks are ~0, then we allow all algorithms. */
-+		t->allalgs = !~(t->aalgos & t->ealgos & t->calgos);
- 		t->encap_family = ut->family;
- 	}
- }
-diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
-index d39b59c..f4fa982 100644
---- a/security/selinux/hooks.c
-+++ b/security/selinux/hooks.c
-@@ -756,9 +756,18 @@ static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
- 	int set_context =	(oldsbsec->flags & CONTEXT_MNT);
- 	int set_rootcontext =	(oldsbsec->flags & ROOTCONTEXT_MNT);
- 
--	/* we can't error, we can't save the info, this shouldn't get called
--	 * this early in the boot process. */
--	BUG_ON(!ss_initialized);
-+	/*
-+	 * if the parent was able to be mounted it clearly had no special lsm
-+	 * mount options.  thus we can safely put this sb on the list and deal
-+	 * with it later
-+	 */
-+	if (!ss_initialized) {
-+		spin_lock(&sb_security_lock);
-+		if (list_empty(&newsbsec->list))
-+			list_add(&newsbsec->list, &superblock_security_head);
-+		spin_unlock(&sb_security_lock);
-+		return;
-+	}
- 
- 	/* how can we clone if the old one wasn't set up?? */
- 	BUG_ON(!oldsbsec->initialized);

Deleted: genpatches-2.6/trunk/2.6.26/1001_linux-2.6.25.2.patch
===================================================================
--- genpatches-2.6/trunk/2.6.26/1001_linux-2.6.25.2.patch	2008-07-17 02:44:10 UTC (rev 1328)
+++ genpatches-2.6/trunk/2.6.26/1001_linux-2.6.25.2.patch	2008-07-17 02:47:50 UTC (rev 1329)
@@ -1,49 +0,0 @@
-diff --git a/fs/locks.c b/fs/locks.c
-index 43c0af2..159e0f6 100644
---- a/fs/locks.c
-+++ b/fs/locks.c
-@@ -1750,6 +1750,7 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd,
- 	struct file_lock *file_lock = locks_alloc_lock();
- 	struct flock flock;
- 	struct inode *inode;
-+	struct file *f;
- 	int error;
- 
- 	if (file_lock == NULL)
-@@ -1822,7 +1823,15 @@ again:
- 	 * Attempt to detect a close/fcntl race and recover by
- 	 * releasing the lock that was just acquired.
- 	 */
--	if (!error && fcheck(fd) != filp && flock.l_type != F_UNLCK) {
-+	/*
-+	 * we need that spin_lock here - it prevents reordering between
-+	 * update of inode->i_flock and check for it done in close().
-+	 * rcu_read_lock() wouldn't do.
-+	 */
-+	spin_lock(&current->files->file_lock);
-+	f = fcheck(fd);
-+	spin_unlock(&current->files->file_lock);
-+	if (!error && f != filp && flock.l_type != F_UNLCK) {
- 		flock.l_type = F_UNLCK;
- 		goto again;
- 	}
-@@ -1878,6 +1887,7 @@ int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd,
- 	struct file_lock *file_lock = locks_alloc_lock();
- 	struct flock64 flock;
- 	struct inode *inode;
-+	struct file *f;
- 	int error;
- 
- 	if (file_lock == NULL)
-@@ -1950,7 +1960,10 @@ again:
- 	 * Attempt to detect a close/fcntl race and recover by
- 	 * releasing the lock that was just acquired.
- 	 */
--	if (!error && fcheck(fd) != filp && flock.l_type != F_UNLCK) {
-+	spin_lock(&current->files->file_lock);
-+	f = fcheck(fd);
-+	spin_unlock(&current->files->file_lock);
-+	if (!error && f != filp && flock.l_type != F_UNLCK) {
- 		flock.l_type = F_UNLCK;
- 		goto again;
- 	}

Deleted: genpatches-2.6/trunk/2.6.26/1002_linux-2.6.25.3.patch
===================================================================
--- genpatches-2.6/trunk/2.6.26/1002_linux-2.6.25.3.patch	2008-07-17 02:44:10 UTC (rev 1328)
+++ genpatches-2.6/trunk/2.6.26/1002_linux-2.6.25.3.patch	2008-07-17 02:47:50 UTC (rev 1329)
@@ -1,617 +0,0 @@
-diff --git a/arch/arm/kernel/kprobes-decode.c b/arch/arm/kernel/kprobes-decode.c
-index d51bc8b..b4565bb 100644
---- a/arch/arm/kernel/kprobes-decode.c
-+++ b/arch/arm/kernel/kprobes-decode.c
-@@ -1176,7 +1176,7 @@ space_cccc_001x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
- 	 * *S (bit 20) updates condition codes
- 	 * ADC/SBC/RSC reads the C flag
- 	 */
--	insn &= 0xfff00ff0;	/* Rn = r0, Rd = r0 */
-+	insn &= 0xfff00fff;	/* Rn = r0, Rd = r0 */
- 	asi->insn[0] = insn;
- 	asi->insn_handler = (insn & (1 << 20)) ?  /* S-bit */
- 			emulate_alu_imm_rwflags : emulate_alu_imm_rflags;
-diff --git a/arch/arm/kernel/kprobes.c b/arch/arm/kernel/kprobes.c
-index 13e371a..5593dd2 100644
---- a/arch/arm/kernel/kprobes.c
-+++ b/arch/arm/kernel/kprobes.c
-@@ -66,7 +66,7 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p)
- 			return -ENOMEM;
- 		for (is = 0; is < MAX_INSN_SIZE; ++is)
- 			p->ainsn.insn[is] = tmp_insn[is];
--		flush_insns(&p->ainsn.insn, MAX_INSN_SIZE);
-+		flush_insns(p->ainsn.insn, MAX_INSN_SIZE);
- 		break;
- 
- 	case INSN_GOOD_NO_SLOT:	/* instruction doesn't need insn slot */
-diff --git a/arch/sparc/kernel/sys_sparc.c b/arch/sparc/kernel/sys_sparc.c
-index 42bf09d..9f8c8e1 100644
---- a/arch/sparc/kernel/sys_sparc.c
-+++ b/arch/sparc/kernel/sys_sparc.c
-@@ -224,8 +224,7 @@ int sparc_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
- {
- 	if (ARCH_SUN4C_SUN4 &&
- 	    (len > 0x20000000 ||
--	     ((flags & MAP_FIXED) &&
--	      addr < 0xe0000000 && addr + len > 0x20000000)))
-+	     (addr < 0xe0000000 && addr + len > 0x20000000)))
- 		return -EINVAL;
- 
- 	/* See asm-sparc/uaccess.h */
-diff --git a/arch/sparc64/kernel/sys_sparc.c b/arch/sparc64/kernel/sys_sparc.c
-index f952745..cc37936 100644
---- a/arch/sparc64/kernel/sys_sparc.c
-+++ b/arch/sparc64/kernel/sys_sparc.c
-@@ -549,13 +549,13 @@ int sparc64_mmap_check(unsigned long addr, unsigned long len,
- 		if (len >= STACK_TOP32)
- 			return -EINVAL;
- 
--		if ((flags & MAP_FIXED) && addr > STACK_TOP32 - len)
-+		if (addr > STACK_TOP32 - len)
- 			return -EINVAL;
- 	} else {
- 		if (len >= VA_EXCLUDE_START)
- 			return -EINVAL;
- 
--		if ((flags & MAP_FIXED) && invalid_64bit_range(addr, len))
-+		if (invalid_64bit_range(addr, len))
- 			return -EINVAL;
- 	}
- 
-diff --git a/arch/x86/pci/common.c b/arch/x86/pci/common.c
-index 7b6e3bb..05356ce 100644
---- a/arch/x86/pci/common.c
-+++ b/arch/x86/pci/common.c
-@@ -372,13 +372,16 @@ static struct dmi_system_id __devinitdata pciprobe_dmi_table[] = {
- 	{}
- };
- 
-+void __init dmi_check_pciprobe(void)
-+{
-+	dmi_check_system(pciprobe_dmi_table);
-+}
-+
- struct pci_bus * __devinit pcibios_scan_root(int busnum)
- {
- 	struct pci_bus *bus = NULL;
- 	struct pci_sysdata *sd;
- 
--	dmi_check_system(pciprobe_dmi_table);
--
- 	while ((bus = pci_find_next_bus(bus)) != NULL) {
- 		if (bus->number == busnum) {
- 			/* Already scanned */
-diff --git a/arch/x86/pci/init.c b/arch/x86/pci/init.c
-index 3de9f9b..f1bf4e5 100644
---- a/arch/x86/pci/init.c
-+++ b/arch/x86/pci/init.c
-@@ -32,6 +32,8 @@ static __init int pci_access_init(void)
- 		printk(KERN_ERR
- 		"PCI: Fatal: No config space access function found\n");
- 
-+ 	dmi_check_pciprobe();
-+
- 	return 0;
- }
- arch_initcall(pci_access_init);
-diff --git a/arch/x86/pci/pci.h b/arch/x86/pci/pci.h
-index 3431518..95e5675 100644
---- a/arch/x86/pci/pci.h
-+++ b/arch/x86/pci/pci.h
-@@ -39,6 +39,8 @@ enum pci_bf_sort_state {
- 	pci_dmi_bf,
- };
- 
-+extern void __init dmi_check_pciprobe(void);
-+
- /* pci-i386.c */
- 
- extern unsigned int pcibios_max_latency;
-diff --git a/crypto/authenc.c b/crypto/authenc.c
-index ed8ac5a..4b22676 100644
---- a/crypto/authenc.c
-+++ b/crypto/authenc.c
-@@ -217,9 +217,10 @@ static void crypto_authenc_givencrypt_done(struct crypto_async_request *req,
- 					   int err)
- {
- 	if (!err) {
--		struct aead_givcrypt_request *greq = req->data;
-+		struct aead_request *areq = req->data;
-+		struct skcipher_givcrypt_request *greq = aead_request_ctx(areq);
- 
--		err = crypto_authenc_genicv(&greq->areq, greq->giv, 0);
-+		err = crypto_authenc_genicv(areq, greq->giv, 0);
- 	}
- 
- 	aead_request_complete(req->data, err);
-diff --git a/crypto/cryptd.c b/crypto/cryptd.c
-index 2504252..b150de5 100644
---- a/crypto/cryptd.c
-+++ b/crypto/cryptd.c
-@@ -190,8 +190,10 @@ static struct crypto_instance *cryptd_alloc_instance(struct crypto_alg *alg,
- 	int err;
- 
- 	inst = kzalloc(sizeof(*inst) + sizeof(*ctx), GFP_KERNEL);
--	if (IS_ERR(inst))
-+	if (!inst) {
-+		inst = ERR_PTR(-ENOMEM);
- 		goto out;
-+	}
- 
- 	err = -ENAMETOOLONG;
- 	if (snprintf(inst->alg.cra_driver_name, CRYPTO_MAX_ALG_NAME,
-diff --git a/crypto/eseqiv.c b/crypto/eseqiv.c
-index b14f14e..881d309 100644
---- a/crypto/eseqiv.c
-+++ b/crypto/eseqiv.c
-@@ -136,7 +136,8 @@ static int eseqiv_givencrypt(struct skcipher_givcrypt_request *req)
- 	}
- 
- 	ablkcipher_request_set_crypt(subreq, reqctx->src, dst,
--				     req->creq.nbytes, req->creq.info);
-+				     req->creq.nbytes + ivsize,
-+				     req->creq.info);
- 
- 	memcpy(req->creq.info, ctx->salt, ivsize);
- 
-diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
-index 788da97..836362b 100644
---- a/drivers/acpi/processor_idle.c
-+++ b/drivers/acpi/processor_idle.c
-@@ -848,6 +848,7 @@ static int acpi_processor_get_power_info_default(struct acpi_processor *pr)
- 		/* all processors need to support C1 */
- 		pr->power.states[ACPI_STATE_C1].type = ACPI_STATE_C1;
- 		pr->power.states[ACPI_STATE_C1].valid = 1;
-+		pr->power.states[ACPI_STATE_C1].entry_method = ACPI_CSTATE_HALT;
- 	}
- 	/* the C0 state only exists as a filler in our array */
- 	pr->power.states[ACPI_STATE_C0].valid = 1;
-@@ -960,6 +961,9 @@ static int acpi_processor_get_power_info_cst(struct acpi_processor *pr)
- 				 cx.address);
- 		}
- 
-+		if (cx.type == ACPI_STATE_C1) {
-+			cx.valid = 1;
-+		}
- 
- 		obj = &(element->package.elements[2]);
- 		if (obj->type != ACPI_TYPE_INTEGER)
-diff --git a/drivers/md/md.c b/drivers/md/md.c
-index 61ccbd2..9f6d228 100644
---- a/drivers/md/md.c
-+++ b/drivers/md/md.c
-@@ -2096,7 +2096,7 @@ rdev_attr_store(struct kobject *kobj, struct attribute *attr,
- 			rv = -EBUSY;
- 		else
- 			rv = entry->store(rdev, page, length);
--		mddev_unlock(rdev->mddev);
-+		mddev_unlock(mddev);
- 	}
- 	return rv;
- }
-diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
-index f13346b..44ebdea 100644
---- a/drivers/net/wireless/b43/b43.h
-+++ b/drivers/net/wireless/b43/b43.h
-@@ -628,6 +628,10 @@ struct b43_wl {
- 
- 	struct mutex mutex;
- 	spinlock_t irq_lock;
-+	/* R/W lock for data transmission.
-+	 * Transmissions on 2+ queues can run concurrently, but somebody else
-+	 * might sync with TX by write_lock_irqsave()'ing. */
-+	rwlock_t tx_lock;
- 	/* Lock for LEDs access. */
- 	spinlock_t leds_lock;
- 	/* Lock for SHM access. */
-diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
-index f23317e..e0055d0 100644
---- a/drivers/net/wireless/b43/main.c
-+++ b/drivers/net/wireless/b43/main.c
-@@ -622,6 +622,7 @@ static void b43_synchronize_irq(struct b43_wldev *dev)
-  */
- void b43_dummy_transmission(struct b43_wldev *dev)
- {
-+	struct b43_wl *wl = dev->wl;
- 	struct b43_phy *phy = &dev->phy;
- 	unsigned int i, max_loop;
- 	u16 value;
-@@ -648,6 +649,9 @@ void b43_dummy_transmission(struct b43_wldev *dev)
- 		return;
- 	}
- 
-+	spin_lock_irq(&wl->irq_lock);
-+	write_lock(&wl->tx_lock);
-+
- 	for (i = 0; i < 5; i++)
- 		b43_ram_write(dev, i * 4, buffer[i]);
- 
-@@ -688,6 +692,9 @@ void b43_dummy_transmission(struct b43_wldev *dev)
- 	}
- 	if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
- 		b43_radio_write16(dev, 0x0051, 0x0037);
-+
-+	write_unlock(&wl->tx_lock);
-+	spin_unlock_irq(&wl->irq_lock);
- }
- 
- static void key_write(struct b43_wldev *dev,
-@@ -2592,15 +2599,21 @@ static int b43_op_tx(struct ieee80211_hw *hw,
- {
- 	struct b43_wl *wl = hw_to_b43_wl(hw);
- 	struct b43_wldev *dev = wl->current_dev;
--	int err = -ENODEV;
-+	unsigned long flags;
-+	int err;
- 
- 	if (unlikely(!dev))
--		goto out;
--	if (unlikely(b43_status(dev) < B43_STAT_STARTED))
--		goto out;
--	/* DMA-TX is done without a global lock. */
--	err = b43_dma_tx(dev, skb, ctl);
--out:
-+		return NETDEV_TX_BUSY;
-+
-+	/* Transmissions on seperate queues can run concurrently. */
-+	read_lock_irqsave(&wl->tx_lock, flags);
-+
-+	err = -ENODEV;
-+	if (likely(b43_status(dev) >= B43_STAT_STARTED))
-+		err = b43_dma_tx(dev, skb, ctl);
-+
-+	read_unlock_irqrestore(&wl->tx_lock, flags);
-+
- 	if (unlikely(err))
- 		return NETDEV_TX_BUSY;
- 	return NETDEV_TX_OK;
-@@ -3109,7 +3122,9 @@ static void b43_wireless_core_stop(struct b43_wldev *dev)
- 	spin_unlock_irqrestore(&wl->irq_lock, flags);
- 	b43_synchronize_irq(dev);
- 
-+	write_lock_irqsave(&wl->tx_lock, flags);
- 	b43_set_status(dev, B43_STAT_INITIALIZED);
-+	write_unlock_irqrestore(&wl->tx_lock, flags);
- 
- 	mutex_unlock(&wl->mutex);
- 	/* Must unlock as it would otherwise deadlock. No races here.
-@@ -3117,8 +3132,6 @@ static void b43_wireless_core_stop(struct b43_wldev *dev)
- 	cancel_delayed_work_sync(&dev->periodic_work);
- 	mutex_lock(&wl->mutex);
- 
--	ieee80211_stop_queues(wl->hw);	//FIXME this could cause a deadlock, as mac80211 seems buggy.
--
- 	b43_mac_suspend(dev);
- 	free_irq(dev->dev->irq, dev);
- 	b43dbg(wl, "Wireless interface stopped\n");
-@@ -3912,6 +3925,14 @@ static int b43_wireless_core_attach(struct b43_wldev *dev)
- 		err = -EOPNOTSUPP;
- 		goto err_powerdown;
- 	}
-+	if (1 /* disable A-PHY */) {
-+		/* FIXME: For now we disable the A-PHY on multi-PHY devices. */
-+		if (dev->phy.type != B43_PHYTYPE_N) {
-+			have_2ghz_phy = 1;
-+			have_5ghz_phy = 0;
-+		}
-+	}
-+
- 	dev->phy.gmode = have_2ghz_phy;
- 	tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
- 	b43_wireless_core_reset(dev, tmp);
-@@ -4076,6 +4097,7 @@ static int b43_wireless_init(struct ssb_device *dev)
- 	memset(wl, 0, sizeof(*wl));
- 	wl->hw = hw;
- 	spin_lock_init(&wl->irq_lock);
-+	rwlock_init(&wl->tx_lock);
- 	spin_lock_init(&wl->leds_lock);
- 	spin_lock_init(&wl->shm_lock);
- 	mutex_init(&wl->mutex);
-diff --git a/drivers/serial/mpc52xx_uart.c b/drivers/serial/mpc52xx_uart.c
-index d93b357..7a3625f 100644
---- a/drivers/serial/mpc52xx_uart.c
-+++ b/drivers/serial/mpc52xx_uart.c
-@@ -1221,8 +1221,8 @@ static struct of_device_id mpc52xx_uart_of_match[] = {
- #endif
- #ifdef CONFIG_PPC_MPC512x
- 	{ .compatible = "fsl,mpc5121-psc-uart", .data = &mpc512x_psc_ops, },
--	{},
- #endif
-+	{},
- };
- 
- static int __devinit
-diff --git a/fs/reiserfs/ioctl.c b/fs/reiserfs/ioctl.c
-index e0f0f09..9f877ab 100644
---- a/fs/reiserfs/ioctl.c
-+++ b/fs/reiserfs/ioctl.c
-@@ -11,8 +11,6 @@
- #include <linux/smp_lock.h>
- #include <linux/compat.h>
- 
--static int reiserfs_unpack(struct inode *inode, struct file *filp);
--
- /*
- ** reiserfs_ioctl - handler for ioctl for inode
- ** supported commands:
-@@ -140,7 +138,7 @@ int reiserfs_prepare_write(struct file *f, struct page *page,
- ** Function try to convert tail from direct item into indirect.
- ** It set up nopack attribute in the REISERFS_I(inode)->nopack
- */
--static int reiserfs_unpack(struct inode *inode, struct file *filp)
-+int reiserfs_unpack(struct inode *inode, struct file *filp)
- {
- 	int retval = 0;
- 	int index;
-diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
-index 393cc22..3302259 100644
---- a/fs/reiserfs/super.c
-+++ b/fs/reiserfs/super.c
-@@ -2019,6 +2019,7 @@ static int reiserfs_quota_on(struct super_block *sb, int type, int format_id,
- {
- 	int err;
- 	struct nameidata nd;
-+	struct inode *inode;
- 
- 	if (!(REISERFS_SB(sb)->s_mount_opt & (1 << REISERFS_QUOTA)))
- 		return -EINVAL;
-@@ -2030,12 +2031,18 @@ static int reiserfs_quota_on(struct super_block *sb, int type, int format_id,
- 		path_put(&nd.path);
- 		return -EXDEV;
- 	}
-+	inode = nd.path.dentry->d_inode;
- 	/* We must not pack tails for quota files on reiserfs for quota IO to work */
--	if (!(REISERFS_I(nd.path.dentry->d_inode)->i_flags & i_nopack_mask)) {
--		reiserfs_warning(sb,
--				 "reiserfs: Quota file must have tail packing disabled.");
--		path_put(&nd.path);
--		return -EINVAL;
-+	if (!(REISERFS_I(inode)->i_flags & i_nopack_mask)) {
-+		err = reiserfs_unpack(inode, NULL);
-+		if (err) {
-+			reiserfs_warning(sb,
-+				"reiserfs: Unpacking tail of quota file failed"
-+				" (%d). Cannot turn on quotas.", err);
-+			path_put(&nd.path);
-+			return -EINVAL;
-+		}
-+		mark_inode_dirty(inode);
- 	}
- 	/* Not journalling quota? No more tests needed... */
- 	if (!REISERFS_SB(sb)->s_qf_names[USRQUOTA] &&
-diff --git a/fs/utimes.c b/fs/utimes.c
-index b18da9c..80a481e 100644
---- a/fs/utimes.c
-+++ b/fs/utimes.c
-@@ -39,9 +39,14 @@ asmlinkage long sys_utime(char __user *filename, struct utimbuf __user *times)
- 
- #endif
- 
-+static bool nsec_special(long nsec)
-+{
-+	return nsec == UTIME_OMIT || nsec == UTIME_NOW;
-+}
-+
- static bool nsec_valid(long nsec)
- {
--	if (nsec == UTIME_OMIT || nsec == UTIME_NOW)
-+	if (nsec_special(nsec))
- 		return true;
- 
- 	return nsec >= 0 && nsec <= 999999999;
-@@ -115,7 +120,15 @@ long do_utimes(int dfd, char __user *filename, struct timespec *times, int flags
- 			newattrs.ia_mtime.tv_nsec = times[1].tv_nsec;
- 			newattrs.ia_valid |= ATTR_MTIME_SET;
- 		}
--	} else {
-+	}
-+
-+	/*
-+	 * If times is NULL or both times are either UTIME_OMIT or
-+	 * UTIME_NOW, then need to check permissions, because
-+	 * inode_change_ok() won't do it.
-+	 */
-+	if (!times || (nsec_special(times[0].tv_nsec) &&
-+		       nsec_special(times[1].tv_nsec))) {
- 		error = -EACCES;
-                 if (IS_IMMUTABLE(inode))
-                         goto dput_and_out;
-diff --git a/include/crypto/scatterwalk.h b/include/crypto/scatterwalk.h
-index 224658b..833d208 100644
---- a/include/crypto/scatterwalk.h
-+++ b/include/crypto/scatterwalk.h
-@@ -57,10 +57,14 @@ static inline void scatterwalk_sg_chain(struct scatterlist *sg1, int num,
- 					struct scatterlist *sg2)
- {
- 	sg_set_page(&sg1[num - 1], (void *)sg2, 0, 0);
-+	sg1[num - 1].page_link &= ~0x02;
- }
- 
- static inline struct scatterlist *scatterwalk_sg_next(struct scatterlist *sg)
- {
-+	if (sg_is_last(sg))
-+		return NULL;
-+
- 	return (++sg)->length ? sg : (void *)sg_page(sg);
- }
- 
-diff --git a/include/linux/reiserfs_fs.h b/include/linux/reiserfs_fs.h
-index 8e7eff2..4aacaee 100644
---- a/include/linux/reiserfs_fs.h
-+++ b/include/linux/reiserfs_fs.h
-@@ -2176,6 +2176,7 @@ int reiserfs_ioctl(struct inode *inode, struct file *filp,
- 		   unsigned int cmd, unsigned long arg);
- long reiserfs_compat_ioctl(struct file *filp,
- 		   unsigned int cmd, unsigned long arg);
-+int reiserfs_unpack(struct inode *inode, struct file *filp);
- 
- /* ioctl's command */
- #define REISERFS_IOC_UNPACK		_IOW(0xCD,1,long)
-diff --git a/kernel/sched.c b/kernel/sched.c
-index 8dcdec6..1e4596c 100644
---- a/kernel/sched.c
-+++ b/kernel/sched.c
-@@ -876,6 +876,7 @@ static inline void resched_rq(struct rq *rq)
- enum {
- 	HRTICK_SET,		/* re-programm hrtick_timer */
- 	HRTICK_RESET,		/* not a new slice */
-+	HRTICK_BLOCK,		/* stop hrtick operations */
- };
- 
- /*
-@@ -887,6 +888,8 @@ static inline int hrtick_enabled(struct rq *rq)
- {
- 	if (!sched_feat(HRTICK))
- 		return 0;
-+	if (unlikely(test_bit(HRTICK_BLOCK, &rq->hrtick_flags)))
-+		return 0;
- 	return hrtimer_is_hres_active(&rq->hrtick_timer);
- }
- 
-@@ -969,7 +972,63 @@ static enum hrtimer_restart hrtick(struct hrtimer *timer)
- 	return HRTIMER_NORESTART;
- }
- 
--static inline void init_rq_hrtick(struct rq *rq)
-+static void hotplug_hrtick_disable(int cpu)
-+{
-+	struct rq *rq = cpu_rq(cpu);
-+	unsigned long flags;
-+
-+	spin_lock_irqsave(&rq->lock, flags);
-+	rq->hrtick_flags = 0;
-+	__set_bit(HRTICK_BLOCK, &rq->hrtick_flags);
-+	spin_unlock_irqrestore(&rq->lock, flags);
-+
-+	hrtick_clear(rq);
-+}
-+
-+static void hotplug_hrtick_enable(int cpu)
-+{
-+	struct rq *rq = cpu_rq(cpu);
-+	unsigned long flags;
-+
-+	spin_lock_irqsave(&rq->lock, flags);
-+	__clear_bit(HRTICK_BLOCK, &rq->hrtick_flags);
-+	spin_unlock_irqrestore(&rq->lock, flags);
-+}
-+
-+static int
-+hotplug_hrtick(struct notifier_block *nfb, unsigned long action, void *hcpu)
-+{
-+	int cpu = (int)(long)hcpu;
-+
-+	switch (action) {
-+	case CPU_UP_CANCELED:
-+	case CPU_UP_CANCELED_FROZEN:
-+	case CPU_DOWN_PREPARE:
-+	case CPU_DOWN_PREPARE_FROZEN:
-+	case CPU_DEAD:
-+	case CPU_DEAD_FROZEN:
-+		hotplug_hrtick_disable(cpu);
-+		return NOTIFY_OK;
-+
-+	case CPU_UP_PREPARE:
-+	case CPU_UP_PREPARE_FROZEN:
-+	case CPU_DOWN_FAILED:
-+	case CPU_DOWN_FAILED_FROZEN:
-+	case CPU_ONLINE:
-+	case CPU_ONLINE_FROZEN:
-+		hotplug_hrtick_enable(cpu);
-+		return NOTIFY_OK;
-+	}
-+
-+	return NOTIFY_DONE;
-+}
-+
-+static void init_hrtick(void)
-+{
-+	hotcpu_notifier(hotplug_hrtick, 0);
-+}
-+
-+static void init_rq_hrtick(struct rq *rq)
- {
- 	rq->hrtick_flags = 0;
- 	hrtimer_init(&rq->hrtick_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
-@@ -1006,6 +1065,10 @@ static inline void init_rq_hrtick(struct rq *rq)
- void hrtick_resched(void)
- {
- }
-+
-+static inline void init_hrtick(void)
-+{
-+}
- #endif
- 
- /*
-@@ -7094,6 +7157,7 @@ void __init sched_init_smp(void)
- 	put_online_cpus();
- 	/* XXX: Theoretical race here - CPU may be hotplugged now */
- 	hotcpu_notifier(update_sched_domains, 0);
-+	init_hrtick();
- 
- 	/* Move init over to a non-isolated CPU */
- 	if (set_cpus_allowed(current, non_isolated_cpus) < 0)
-diff --git a/mm/page_alloc.c b/mm/page_alloc.c
-index 402a504..55443c2 100644
---- a/mm/page_alloc.c
-+++ b/mm/page_alloc.c
-@@ -2518,7 +2518,9 @@ void __meminit memmap_init_zone(unsigned long size, int nid, unsigned long zone,
- 	struct page *page;
- 	unsigned long end_pfn = start_pfn + size;
- 	unsigned long pfn;
-+	struct zone *z;
- 
-+	z = &NODE_DATA(nid)->node_zones[zone];
- 	for (pfn = start_pfn; pfn < end_pfn; pfn++) {
- 		/*
- 		 * There can be holes in boot-time mem_map[]s
-@@ -2536,7 +2538,6 @@ void __meminit memmap_init_zone(unsigned long size, int nid, unsigned long zone,
- 		init_page_count(page);
- 		reset_page_mapcount(page);
- 		SetPageReserved(page);
--
- 		/*
- 		 * Mark the block movable so that blocks are reserved for
- 		 * movable at startup. This will force kernel allocations
-@@ -2545,8 +2546,15 @@ void __meminit memmap_init_zone(unsigned long size, int nid, unsigned long zone,
- 		 * kernel allocations are made. Later some blocks near
- 		 * the start are marked MIGRATE_RESERVE by
- 		 * setup_zone_migrate_reserve()
-+		 *
-+		 * bitmap is created for zone's valid pfn range. but memmap
-+		 * can be created for invalid pages (for alignment)
-+		 * check here not to call set_pageblock_migratetype() against
-+		 * pfn out of zone.
- 		 */
--		if ((pfn & (pageblock_nr_pages-1)))
-+		if ((z->zone_start_pfn <= pfn)
-+		    && (pfn < z->zone_start_pfn + z->spanned_pages)
-+		    && !(pfn & (pageblock_nr_pages - 1)))
- 			set_pageblock_migratetype(page, MIGRATE_MOVABLE);
- 
- 		INIT_LIST_HEAD(&page->lru);
-@@ -4460,6 +4468,8 @@ void set_pageblock_flags_group(struct page *page, unsigned long flags,
- 	pfn = page_to_pfn(page);
- 	bitmap = get_pageblock_bitmap(zone, pfn);
- 	bitidx = pfn_to_bitidx(zone, pfn);
-+	VM_BUG_ON(pfn < zone->zone_start_pfn);
-+	VM_BUG_ON(pfn >= zone->zone_start_pfn + zone->spanned_pages);
- 
- 	for (; start_bitidx <= end_bitidx; start_bitidx++, value <<= 1)
- 		if (flags & value)
-diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
-index 1656c00..4de86c4 100644
---- a/net/ipv6/sit.c
-+++ b/net/ipv6/sit.c
-@@ -446,9 +446,9 @@ static int ipip6_rcv(struct sk_buff *skb)
- 	}
- 
- 	icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
--	kfree_skb(skb);
- 	read_unlock(&ipip6_lock);
- out:
-+	kfree_skb(skb);
- 	return 0;
- }
- 

Deleted: genpatches-2.6/trunk/2.6.26/1003_linux-2.6.25.4.patch
===================================================================
--- genpatches-2.6/trunk/2.6.26/1003_linux-2.6.25.4.patch	2008-07-17 02:44:10 UTC (rev 1328)
+++ genpatches-2.6/trunk/2.6.26/1003_linux-2.6.25.4.patch	2008-07-17 02:47:50 UTC (rev 1329)
@@ -1,2909 +0,0 @@
-diff --git a/arch/sparc/kernel/entry.S b/arch/sparc/kernel/entry.S
-index c2eed8f..1ea92e7 100644
---- a/arch/sparc/kernel/entry.S
-+++ b/arch/sparc/kernel/entry.S
-@@ -1398,6 +1398,8 @@ ret_from_fork:
- 	.align	4
- 	.globl	linux_sparc_syscall
- linux_sparc_syscall:
-+	sethi	%hi(PSR_SYSCALL), %l4
-+	or	%l0, %l4, %l0
- 	/* Direct access to user regs, must faster. */
- 	cmp	%g1, NR_SYSCALLS
- 	bgeu	linux_sparc_ni_syscall
-diff --git a/arch/sparc/kernel/process.c b/arch/sparc/kernel/process.c
-index 70c0dd2..a65aed3 100644
---- a/arch/sparc/kernel/process.c
-+++ b/arch/sparc/kernel/process.c
-@@ -421,14 +421,26 @@ asmlinkage int sparc_do_fork(unsigned long clone_flags,
-                              unsigned long stack_size)
- {
- 	unsigned long parent_tid_ptr, child_tid_ptr;
-+	unsigned long orig_i1 = regs->u_regs[UREG_I1];
-+	long ret;
- 
- 	parent_tid_ptr = regs->u_regs[UREG_I2];
- 	child_tid_ptr = regs->u_regs[UREG_I4];
- 
--	return do_fork(clone_flags, stack_start,
--		       regs, stack_size,
--		       (int __user *) parent_tid_ptr,
--		       (int __user *) child_tid_ptr);
-+	ret = do_fork(clone_flags, stack_start,
-+		      regs, stack_size,
-+		      (int __user *) parent_tid_ptr,
-+		      (int __user *) child_tid_ptr);
-+
-+	/* If we get an error and potentially restart the system
-+	 * call, we're screwed because copy_thread() clobbered
-+	 * the parent's %o1.  So detect that case and restore it
-+	 * here.
-+	 */
-+	if ((unsigned long)ret >= -ERESTART_RESTARTBLOCK)
-+		regs->u_regs[UREG_I1] = orig_i1;
-+
-+	return ret;
- }
- 
- /* Copy a Sparc thread.  The fork() return value conventions
-@@ -628,11 +640,6 @@ asmlinkage int sparc_execve(struct pt_regs *regs)
- 			  (char __user * __user *)regs->u_regs[base + UREG_I2],
- 			  regs);
- 	putname(filename);
--	if (error == 0) {
--		task_lock(current);
--		current->ptrace &= ~PT_DTRACE;
--		task_unlock(current);
--	}
- out:
- 	return error;
- }
-diff --git a/arch/sparc/kernel/ptrace.c b/arch/sparc/kernel/ptrace.c
-index 7f44ae6..81f3b92 100644
---- a/arch/sparc/kernel/ptrace.c
-+++ b/arch/sparc/kernel/ptrace.c
-@@ -170,8 +170,8 @@ static int genregs32_set(struct task_struct *target,
- 		switch (pos) {
- 		case 32: /* PSR */
- 			psr = regs->psr;
--			psr &= ~PSR_ICC;
--			psr |= (reg & PSR_ICC);
-+			psr &= ~(PSR_ICC | PSR_SYSCALL);
-+			psr |= (reg & (PSR_ICC | PSR_SYSCALL));
- 			regs->psr = psr;
- 			break;
- 		case 33: /* PC */
-@@ -441,6 +441,8 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
- 		break;
- 
- 	default:
-+		if (request == PTRACE_SPARC_DETACH)
-+			request = PTRACE_DETACH;
- 		ret = ptrace_request(child, request, addr, data);
- 		break;
- 	}
-diff --git a/arch/sparc/kernel/rtrap.S b/arch/sparc/kernel/rtrap.S
-index 77ca6fd..ab818cd 100644
---- a/arch/sparc/kernel/rtrap.S
-+++ b/arch/sparc/kernel/rtrap.S
-@@ -50,8 +50,9 @@ rtrap_7win_patch5:	and	%g1, 0x7f, %g1
- ret_trap_entry:
- ret_trap_lockless_ipi:
- 	andcc	%t_psr, PSR_PS, %g0
-+	sethi	%hi(PSR_SYSCALL), %g1
- 	be	1f
--	 nop
-+	 andn	%t_psr, %g1, %t_psr
- 
- 	wr	%t_psr, 0x0, %psr
- 	b	ret_trap_kernel
-@@ -73,7 +74,6 @@ signal_p:
- 	 ld	[%sp + STACKFRAME_SZ + PT_PSR], %t_psr
- 
- 	mov	%l5, %o1
--	mov	%l6, %o2
- 	call	do_signal
- 	 add	%sp, STACKFRAME_SZ, %o0	! pt_regs ptr
- 
-@@ -81,6 +81,8 @@ signal_p:
- 	ld	[%sp + STACKFRAME_SZ + PT_PSR], %t_psr
- 	clr	%l6
- ret_trap_continue:
-+	sethi	%hi(PSR_SYSCALL), %g1
-+	andn	%t_psr, %g1, %t_psr
- 	wr	%t_psr, 0x0, %psr
- 	WRITE_PAUSE
- 
-@@ -137,8 +139,9 @@ ret_trap_userwins_ok:
- 	LOAD_PT_PRIV(sp, t_psr, t_pc, t_npc)
- 	or	%t_pc, %t_npc, %g2
- 	andcc	%g2, 0x3, %g0
-+	sethi	%hi(PSR_SYSCALL), %g2
- 	be	1f
--	 nop
-+	 andn	%t_psr, %g2, %t_psr
- 
- 	b	ret_trap_unaligned_pc
- 	 add	%sp, STACKFRAME_SZ, %o0
-@@ -201,6 +204,8 @@ rtrap_patch5:	and	%g1, 0xff, %g1
- 1:
- 	LOAD_PT_ALL(sp, t_psr, t_pc, t_npc, g1)
- 2:
-+	sethi	%hi(PSR_SYSCALL), %twin_tmp1
-+	andn	%t_psr, %twin_tmp1, %t_psr
- 	wr	%t_psr, 0x0, %psr
- 	WRITE_PAUSE
- 
-diff --git a/arch/sparc/kernel/signal.c b/arch/sparc/kernel/signal.c
-index 9994cac..e85023b 100644
---- a/arch/sparc/kernel/signal.c
-+++ b/arch/sparc/kernel/signal.c
-@@ -178,6 +178,9 @@ static inline void do_new_sigreturn (struct pt_regs *regs)
- 	regs->psr = (up_psr & ~(PSR_ICC | PSR_EF))
- 		  | (regs->psr & (PSR_ICC | PSR_EF));
- 
-+	/* Prevent syscall restart.  */
-+	pt_regs_clear_syscall(regs);
-+
- 	err |= __get_user(fpu_save, &sf->fpu_save);
- 
- 	if (fpu_save)
-@@ -299,6 +302,9 @@ asmlinkage void do_rt_sigreturn(struct pt_regs *regs)
- 
- 	regs->psr = (regs->psr & ~PSR_ICC) | (psr & PSR_ICC);
- 
-+	/* Prevent syscall restart.  */
-+	pt_regs_clear_syscall(regs);
-+
- 	err |= __get_user(fpu_save, &sf->fpu_save);
- 
- 	if (fpu_save)
-@@ -345,15 +351,29 @@ static inline int invalid_frame_pointer(void __user *fp, int fplen)
- 
- static inline void __user *get_sigframe(struct sigaction *sa, struct pt_regs *regs, unsigned long framesize)
- {
--	unsigned long sp;
-+	unsigned long sp = regs->u_regs[UREG_FP];
- 
--	sp = regs->u_regs[UREG_FP];
-+	/*
-+	 * If we are on the alternate signal stack and would overflow it, don't.
-+	 * Return an always-bogus address instead so we will die with SIGSEGV.
-+	 */
-+	if (on_sig_stack(sp) && !likely(on_sig_stack(sp - framesize)))
-+		return (void __user *) -1L;
- 
- 	/* This is the X/Open sanctioned signal stack switching.  */
- 	if (sa->sa_flags & SA_ONSTACK) {
--		if (!on_sig_stack(sp) && !((current->sas_ss_sp + current->sas_ss_size) & 7))
-+		if (sas_ss_flags(sp) == 0)
- 			sp = current->sas_ss_sp + current->sas_ss_size;
- 	}
-+
-+	/* Always align the stack frame.  This handles two cases.  First,
-+	 * sigaltstack need not be mindful of platform specific stack
-+	 * alignment.  Second, if we took this signal because the stack
-+	 * is not aligned properly, we'd like to take the signal cleanly
-+	 * and report that.
-+	 */
-+	sp &= ~7UL;
-+
- 	return (void __user *)(sp - framesize);
- }
- 
-@@ -994,13 +1014,13 @@ static inline void syscall_restart(unsigned long orig_i0, struct pt_regs *regs,
-  * want to handle. Thus you cannot kill init even with a SIGKILL even by
-  * mistake.
-  */
--asmlinkage void do_signal(struct pt_regs * regs, unsigned long orig_i0, int restart_syscall)
-+asmlinkage void do_signal(struct pt_regs * regs, unsigned long orig_i0)
- {
--	siginfo_t info;
--	struct sparc_deliver_cookie cookie;
- 	struct k_sigaction ka;
--	int signr;
-+	int restart_syscall;
- 	sigset_t *oldset;
-+	siginfo_t info;
-+	int signr;
- 
- 	/*
- 	 * XXX Disable svr4 signal handling until solaris emulation works.
-@@ -1013,18 +1033,28 @@ asmlinkage void do_signal(struct pt_regs * regs, unsigned long orig_i0, int rest
- 	int svr4_signal = current->personality == PER_SVR4;
- #endif
- 
--	cookie.restart_syscall = restart_syscall;
--	cookie.orig_i0 = orig_i0;
-+ 	if (pt_regs_is_syscall(regs) && (regs->psr & PSR_C))
-+ 		restart_syscall = 1;
-+ 	else
-+ 		restart_syscall = 0;
- 
- 	if (test_thread_flag(TIF_RESTORE_SIGMASK))
- 		oldset = &current->saved_sigmask;
- 	else
- 		oldset = &current->blocked;
- 
--	signr = get_signal_to_deliver(&info, &ka, regs, &cookie);
-+ 	signr = get_signal_to_deliver(&info, &ka, regs, NULL);
-+
-+ 	/* If the debugger messes with the program counter, it clears
-+ 	 * the software "in syscall" bit, directing us to not perform
-+ 	 * a syscall restart.
-+ 	 */
-+ 	if (restart_syscall && !pt_regs_is_syscall(regs))
-+ 		restart_syscall = 0;
-+
- 	if (signr > 0) {
--		if (cookie.restart_syscall)
--			syscall_restart(cookie.orig_i0, regs, &ka.sa);
-+		if (restart_syscall)
-+			syscall_restart(orig_i0, regs, &ka.sa);
- 		handle_signal(signr, &ka, &info, oldset,
- 			      regs, svr4_signal);
- 		/* a signal was successfully delivered; the saved
-@@ -1036,16 +1066,16 @@ asmlinkage void do_signal(struct pt_regs * regs, unsigned long orig_i0, int rest
- 			clear_thread_flag(TIF_RESTORE_SIGMASK);
- 		return;
- 	}
--	if (cookie.restart_syscall &&
-+	if (restart_syscall &&
- 	    (regs->u_regs[UREG_I0] == ERESTARTNOHAND ||
- 	     regs->u_regs[UREG_I0] == ERESTARTSYS ||
- 	     regs->u_regs[UREG_I0] == ERESTARTNOINTR)) {
- 		/* replay the system call when we are done */
--		regs->u_regs[UREG_I0] = cookie.orig_i0;
-+		regs->u_regs[UREG_I0] = orig_i0;
- 		regs->pc -= 4;
- 		regs->npc -= 4;
- 	}
--	if (cookie.restart_syscall &&
-+	if (restart_syscall &&
- 	    regs->u_regs[UREG_I0] == ERESTART_RESTARTBLOCK) {
- 		regs->u_regs[UREG_G1] = __NR_restart_syscall;
- 		regs->pc -= 4;
-@@ -1097,27 +1127,3 @@ do_sys_sigstack(struct sigstack __user *ssptr, struct sigstack __user *ossptr,
- out:
- 	return ret;
- }
--
--void ptrace_signal_deliver(struct pt_regs *regs, void *cookie)
--{
--	struct sparc_deliver_cookie *cp = cookie;
--
--	if (cp->restart_syscall &&
--	    (regs->u_regs[UREG_I0] == ERESTARTNOHAND ||
--	     regs->u_regs[UREG_I0] == ERESTARTSYS ||
--	     regs->u_regs[UREG_I0] == ERESTARTNOINTR)) {
--		/* replay the system call when we are done */
--		regs->u_regs[UREG_I0] = cp->orig_i0;
--		regs->pc -= 4;
--		regs->npc -= 4;
--		cp->restart_syscall = 0;
--	}
--
--	if (cp->restart_syscall &&
--	    regs->u_regs[UREG_I0] == ERESTART_RESTARTBLOCK) {
--		regs->u_regs[UREG_G1] = __NR_restart_syscall;
--		regs->pc -= 4;
--		regs->npc -= 4;
--		cp->restart_syscall = 0;
--	}
--}
-diff --git a/arch/sparc/kernel/sys_sparc.c b/arch/sparc/kernel/sys_sparc.c
-index 9f8c8e1..3423d07 100644
---- a/arch/sparc/kernel/sys_sparc.c
-+++ b/arch/sparc/kernel/sys_sparc.c
-@@ -220,7 +220,7 @@ out:
- 	return err;
- }
- 
--int sparc_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
-+int sparc_mmap_check(unsigned long addr, unsigned long len)
- {
- 	if (ARCH_SUN4C_SUN4 &&
- 	    (len > 0x20000000 ||
-@@ -296,52 +296,14 @@ asmlinkage unsigned long sparc_mremap(unsigned long addr,
- 	unsigned long old_len, unsigned long new_len,
- 	unsigned long flags, unsigned long new_addr)
- {
--	struct vm_area_struct *vma;
- 	unsigned long ret = -EINVAL;
--	if (ARCH_SUN4C_SUN4) {
--		if (old_len > 0x20000000 || new_len > 0x20000000)
--			goto out;
--		if (addr < 0xe0000000 && addr + old_len > 0x20000000)
--			goto out;
--	}
--	if (old_len > TASK_SIZE - PAGE_SIZE ||
--	    new_len > TASK_SIZE - PAGE_SIZE)
-+
-+	if (unlikely(sparc_mmap_check(addr, old_len)))
-+		goto out;
-+	if (unlikely(sparc_mmap_check(new_addr, new_len)))
- 		goto out;
- 	down_write(&current->mm->mmap_sem);
--	if (flags & MREMAP_FIXED) {
--		if (ARCH_SUN4C_SUN4 &&
--		    new_addr < 0xe0000000 &&
--		    new_addr + new_len > 0x20000000)
--			goto out_sem;
--		if (new_addr + new_len > TASK_SIZE - PAGE_SIZE)
--			goto out_sem;
--	} else if ((ARCH_SUN4C_SUN4 && addr < 0xe0000000 &&
--		    addr + new_len > 0x20000000) ||
--		   addr + new_len > TASK_SIZE - PAGE_SIZE) {
--		unsigned long map_flags = 0;
--		struct file *file = NULL;
--
--		ret = -ENOMEM;
--		if (!(flags & MREMAP_MAYMOVE))
--			goto out_sem;
--
--		vma = find_vma(current->mm, addr);
--		if (vma) {
--			if (vma->vm_flags & VM_SHARED)
--				map_flags |= MAP_SHARED;
--			file = vma->vm_file;
--		}
--
--		new_addr = get_unmapped_area(file, addr, new_len,
--				     vma ? vma->vm_pgoff : 0,
--				     map_flags);
--		ret = new_addr;
--		if (new_addr & ~PAGE_MASK)
--			goto out_sem;
--		flags |= MREMAP_FIXED;
--	}
- 	ret = do_mremap(addr, old_len, new_len, flags, new_addr);
--out_sem:
- 	up_write(&current->mm->mmap_sem);
- out:
- 	return ret;       
-diff --git a/arch/sparc64/kernel/etrap.S b/arch/sparc64/kernel/etrap.S
-index 4b2bf9e..b087e97 100644
---- a/arch/sparc64/kernel/etrap.S
-+++ b/arch/sparc64/kernel/etrap.S
-@@ -27,11 +27,12 @@
- 
- 		.text		
- 		.align	64
--		.globl	etrap, etrap_irq, etraptl1
-+		.globl	etrap_syscall, etrap, etrap_irq, etraptl1
- etrap:		rdpr	%pil, %g2
--etrap_irq:
--		TRAP_LOAD_THREAD_REG(%g6, %g1)
-+etrap_irq:	clr	%g3
-+etrap_syscall:	TRAP_LOAD_THREAD_REG(%g6, %g1)
- 		rdpr	%tstate, %g1
-+		or	%g1, %g3, %g1
- 		sllx	%g2, 20, %g3
- 		andcc	%g1, TSTATE_PRIV, %g0
- 		or	%g1, %g3, %g1
-diff --git a/arch/sparc64/kernel/irq.c b/arch/sparc64/kernel/irq.c
-index eb88bd6..b441a26 100644
---- a/arch/sparc64/kernel/irq.c
-+++ b/arch/sparc64/kernel/irq.c
-@@ -1,6 +1,6 @@
- /* irq.c: UltraSparc IRQ handling/init/registry.
-  *
-- * Copyright (C) 1997, 2007  David S. Miller  (davem@×××××××××.net)
-+ * Copyright (C) 1997, 2007, 2008 David S. Miller (davem@×××××××××.net)
-  * Copyright (C) 1998  Eddie C. Dost    (ecd@××××××.be)
-  * Copyright (C) 1998  Jakub Jelinek    (jj@×××××××××××.cz)
-  */
-@@ -308,6 +308,7 @@ static void sun4u_irq_enable(unsigned int virt_irq)
- 			 IMAP_AID_SAFARI | IMAP_NID_SAFARI);
- 		val |= tid | IMAP_VALID;
- 		upa_writeq(val, imap);
-+		upa_writeq(ICLR_IDLE, data->iclr);
- 	}
- }
- 
-diff --git a/arch/sparc64/kernel/pci.c b/arch/sparc64/kernel/pci.c
-index 545356b..39f0c46 100644
---- a/arch/sparc64/kernel/pci.c
-+++ b/arch/sparc64/kernel/pci.c
-@@ -351,8 +351,7 @@ static void pci_parse_of_addrs(struct of_device *op,
- 
- struct pci_dev *of_create_pci_dev(struct pci_pbm_info *pbm,
- 				  struct device_node *node,
--				  struct pci_bus *bus, int devfn,
--				  int host_controller)
-+				  struct pci_bus *bus, int devfn)
- {
- 	struct dev_archdata *sd;
- 	struct pci_dev *dev;
-@@ -389,43 +388,28 @@ struct pci_dev *of_create_pci_dev(struct pci_pbm_info *pbm,
- 	dev->devfn = devfn;
- 	dev->multifunction = 0;		/* maybe a lie? */
- 
--	if (host_controller) {
--		if (tlb_type != hypervisor) {
--			pci_read_config_word(dev, PCI_VENDOR_ID,
--					     &dev->vendor);
--			pci_read_config_word(dev, PCI_DEVICE_ID,
--					     &dev->device);
--		} else {
--			dev->vendor = PCI_VENDOR_ID_SUN;
--			dev->device = 0x80f0;
--		}
--		dev->cfg_size = 256;
--		dev->class = PCI_CLASS_BRIDGE_HOST << 8;
--		sprintf(pci_name(dev), "%04x:%02x:%02x.%d", pci_domain_nr(bus),
--			0x00, PCI_SLOT(devfn), PCI_FUNC(devfn));
--	} else {
--		dev->vendor = of_getintprop_default(node, "vendor-id", 0xffff);
--		dev->device = of_getintprop_default(node, "device-id", 0xffff);
--		dev->subsystem_vendor =
--			of_getintprop_default(node, "subsystem-vendor-id", 0);
--		dev->subsystem_device =
--			of_getintprop_default(node, "subsystem-id", 0);
--
--		dev->cfg_size = pci_cfg_space_size(dev);
--
--		/* We can't actually use the firmware value, we have
--		 * to read what is in the register right now.  One
--		 * reason is that in the case of IDE interfaces the
--		 * firmware can sample the value before the the IDE
--		 * interface is programmed into native mode.
--		 */
--		pci_read_config_dword(dev, PCI_CLASS_REVISION, &class);
--		dev->class = class >> 8;
--		dev->revision = class & 0xff;
-+	dev->vendor = of_getintprop_default(node, "vendor-id", 0xffff);
-+	dev->device = of_getintprop_default(node, "device-id", 0xffff);
-+	dev->subsystem_vendor =
-+		of_getintprop_default(node, "subsystem-vendor-id", 0);
-+	dev->subsystem_device =
-+		of_getintprop_default(node, "subsystem-id", 0);
-+
-+	dev->cfg_size = pci_cfg_space_size(dev);
-+
-+	/* We can't actually use the firmware value, we have
-+	 * to read what is in the register right now.  One
-+	 * reason is that in the case of IDE interfaces the
-+	 * firmware can sample the value before the the IDE
-+	 * interface is programmed into native mode.
-+	 */
-+	pci_read_config_dword(dev, PCI_CLASS_REVISION, &class);
-+	dev->class = class >> 8;
-+	dev->revision = class & 0xff;
-+
-+	sprintf(pci_name(dev), "%04x:%02x:%02x.%d", pci_domain_nr(bus),
-+		dev->bus->number, PCI_SLOT(devfn), PCI_FUNC(devfn));
- 
--		sprintf(pci_name(dev), "%04x:%02x:%02x.%d", pci_domain_nr(bus),
--			dev->bus->number, PCI_SLOT(devfn), PCI_FUNC(devfn));
--	}
- 	if (ofpci_verbose)
- 		printk("    class: 0x%x device name: %s\n",
- 		       dev->class, pci_name(dev));
-@@ -440,26 +424,21 @@ struct pci_dev *of_create_pci_dev(struct pci_pbm_info *pbm,
- 	dev->current_state = 4;		/* unknown power state */
- 	dev->error_state = pci_channel_io_normal;
- 
--	if (host_controller) {
-+	if (!strcmp(type, "pci") || !strcmp(type, "pciex")) {
-+		/* a PCI-PCI bridge */
- 		dev->hdr_type = PCI_HEADER_TYPE_BRIDGE;
- 		dev->rom_base_reg = PCI_ROM_ADDRESS1;
--		dev->irq = PCI_IRQ_NONE;
-+	} else if (!strcmp(type, "cardbus")) {
-+		dev->hdr_type = PCI_HEADER_TYPE_CARDBUS;
- 	} else {
--		if (!strcmp(type, "pci") || !strcmp(type, "pciex")) {
--			/* a PCI-PCI bridge */
--			dev->hdr_type = PCI_HEADER_TYPE_BRIDGE;
--			dev->rom_base_reg = PCI_ROM_ADDRESS1;
--		} else if (!strcmp(type, "cardbus")) {
--			dev->hdr_type = PCI_HEADER_TYPE_CARDBUS;
--		} else {
--			dev->hdr_type = PCI_HEADER_TYPE_NORMAL;
--			dev->rom_base_reg = PCI_ROM_ADDRESS;
-+		dev->hdr_type = PCI_HEADER_TYPE_NORMAL;
-+		dev->rom_base_reg = PCI_ROM_ADDRESS;
- 
--			dev->irq = sd->op->irqs[0];
--			if (dev->irq == 0xffffffff)
--				dev->irq = PCI_IRQ_NONE;
--		}
-+		dev->irq = sd->op->irqs[0];
-+		if (dev->irq == 0xffffffff)
-+			dev->irq = PCI_IRQ_NONE;
- 	}
-+
- 	pci_parse_of_addrs(sd->op, node, dev);
- 
- 	if (ofpci_verbose)
-@@ -748,7 +727,7 @@ static void __devinit pci_of_scan_bus(struct pci_pbm_info *pbm,
- 		prev_devfn = devfn;
- 
- 		/* create a new pci_dev for this device */
--		dev = of_create_pci_dev(pbm, child, bus, devfn, 0);
-+		dev = of_create_pci_dev(pbm, child, bus, devfn);
- 		if (!dev)
- 			continue;
- 		if (ofpci_verbose)
-@@ -795,48 +774,9 @@ static void __devinit pci_bus_register_of_sysfs(struct pci_bus *bus)
- 		pci_bus_register_of_sysfs(child_bus);
- }
- 
--int pci_host_bridge_read_pci_cfg(struct pci_bus *bus_dev,
--				 unsigned int devfn,
--				 int where, int size,
--				 u32 *value)
--{
--	static u8 fake_pci_config[] = {
--		0x8e, 0x10, /* Vendor: 0x108e (Sun) */
--		0xf0, 0x80, /* Device: 0x80f0 (Fire) */
--		0x46, 0x01, /* Command: 0x0146 (SERR, PARITY, MASTER, MEM) */
--		0xa0, 0x22, /* Status: 0x02a0 (DEVSEL_MED, FB2B, 66MHZ) */
--		0x00, 0x00, 0x00, 0x06, /* Class: 0x06000000 host bridge */
--		0x00, /* Cacheline: 0x00 */
--		0x40, /* Latency: 0x40 */
--		0x00, /* Header-Type: 0x00 normal */
--	};
--
--	*value = 0;
--	if (where >= 0 && where < sizeof(fake_pci_config) &&
--	    (where + size) >= 0 &&
--	    (where + size) < sizeof(fake_pci_config) &&
--	    size <= sizeof(u32)) {
--		while (size--) {
--			*value <<= 8;
--			*value |= fake_pci_config[where + size];
--		}
--	}
--
--	return PCIBIOS_SUCCESSFUL;
--}
--
--int pci_host_bridge_write_pci_cfg(struct pci_bus *bus_dev,
--				  unsigned int devfn,
--				  int where, int size,
--				  u32 value)
--{
--	return PCIBIOS_SUCCESSFUL;
--}
--
- struct pci_bus * __devinit pci_scan_one_pbm(struct pci_pbm_info *pbm)
- {
- 	struct device_node *node = pbm->prom_node;
--	struct pci_dev *host_pdev;
- 	struct pci_bus *bus;
- 
- 	printk("PCI: Scanning PBM %s\n", node->full_name);
-@@ -854,10 +794,6 @@ struct pci_bus * __devinit pci_scan_one_pbm(struct pci_pbm_info *pbm)
- 	bus->resource[0] = &pbm->io_space;
- 	bus->resource[1] = &pbm->mem_space;
- 
--	/* Create the dummy host bridge and link it in.  */
--	host_pdev = of_create_pci_dev(pbm, node, bus, 0x00, 1);
--	bus->self = host_pdev;
--
- 	pci_of_scan_bus(pbm, node, bus);
- 	pci_bus_add_devices(bus);
- 	pci_bus_register_of_sysfs(bus);
-diff --git a/arch/sparc64/kernel/pci_common.c b/arch/sparc64/kernel/pci_common.c
-index 923e0bc..19fa621 100644
---- a/arch/sparc64/kernel/pci_common.c
-+++ b/arch/sparc64/kernel/pci_common.c
-@@ -264,9 +264,6 @@ static int sun4v_read_pci_cfg(struct pci_bus *bus_dev, unsigned int devfn,
- 	unsigned int func = PCI_FUNC(devfn);
- 	unsigned long ret;
- 
--	if (!bus && devfn == 0x00)
--		return pci_host_bridge_read_pci_cfg(bus_dev, devfn, where,
--						    size, value);
- 	if (config_out_of_range(pbm, bus, devfn, where)) {
- 		ret = ~0UL;
- 	} else {
-@@ -300,9 +297,6 @@ static int sun4v_write_pci_cfg(struct pci_bus *bus_dev, unsigned int devfn,
- 	unsigned int func = PCI_FUNC(devfn);
- 	unsigned long ret;
- 
--	if (!bus && devfn == 0x00)
--		return pci_host_bridge_write_pci_cfg(bus_dev, devfn, where,
--						     size, value);
- 	if (config_out_of_range(pbm, bus, devfn, where)) {
- 		/* Do nothing. */
- 	} else {
-diff --git a/arch/sparc64/kernel/pci_impl.h b/arch/sparc64/kernel/pci_impl.h
-index 4a50da1..37b4403 100644
---- a/arch/sparc64/kernel/pci_impl.h
-+++ b/arch/sparc64/kernel/pci_impl.h
-@@ -167,15 +167,6 @@ extern void pci_get_pbm_props(struct pci_pbm_info *pbm);
- extern struct pci_bus *pci_scan_one_pbm(struct pci_pbm_info *pbm);
- extern void pci_determine_mem_io_space(struct pci_pbm_info *pbm);
- 
--extern int pci_host_bridge_read_pci_cfg(struct pci_bus *bus_dev,
--					unsigned int devfn,
--					int where, int size,
--					u32 *value);
--extern int pci_host_bridge_write_pci_cfg(struct pci_bus *bus_dev,
--					 unsigned int devfn,
--					 int where, int size,
--					 u32 value);
--
- /* Error reporting support. */
- extern void pci_scan_for_target_abort(struct pci_pbm_info *, struct pci_bus *);
- extern void pci_scan_for_master_abort(struct pci_pbm_info *, struct pci_bus *);
-diff --git a/arch/sparc64/kernel/process.c b/arch/sparc64/kernel/process.c
-index acf8c52..334e64c 100644
---- a/arch/sparc64/kernel/process.c
-+++ b/arch/sparc64/kernel/process.c
-@@ -507,6 +507,8 @@ asmlinkage long sparc_do_fork(unsigned long clone_flags,
- 			      unsigned long stack_size)
- {
- 	int __user *parent_tid_ptr, *child_tid_ptr;
-+	unsigned long orig_i1 = regs->u_regs[UREG_I1];
-+	long ret;
- 
- #ifdef CONFIG_COMPAT
- 	if (test_thread_flag(TIF_32BIT)) {
-@@ -519,9 +521,19 @@ asmlinkage long sparc_do_fork(unsigned long clone_flags,
- 		child_tid_ptr = (int __user *) regs->u_regs[UREG_I4];
- 	}
- 
--	return do_fork(clone_flags, stack_start,
--		       regs, stack_size,
--		       parent_tid_ptr, child_tid_ptr);
-+	ret = do_fork(clone_flags, stack_start,
-+		      regs, stack_size,
-+		      parent_tid_ptr, child_tid_ptr);
-+
-+	/* If we get an error and potentially restart the system
-+	 * call, we're screwed because copy_thread() clobbered
-+	 * the parent's %o1.  So detect that case and restore it
-+	 * here.
-+	 */
-+	if ((unsigned long)ret >= -ERESTART_RESTARTBLOCK)
-+		regs->u_regs[UREG_I1] = orig_i1;
-+
-+	return ret;
- }
- 
- /* Copy a Sparc thread.  The fork() return value conventions
-diff --git a/arch/sparc64/kernel/ptrace.c b/arch/sparc64/kernel/ptrace.c
-index e9fc0aa..f6c9fc9 100644
---- a/arch/sparc64/kernel/ptrace.c
-+++ b/arch/sparc64/kernel/ptrace.c
-@@ -287,11 +287,11 @@ static int genregs64_set(struct task_struct *target,
- 					 32 * sizeof(u64),
- 					 33 * sizeof(u64));
- 		if (!ret) {
--			/* Only the condition codes can be modified
--			 * in the %tstate register.
-+			/* Only the condition codes and the "in syscall"
-+			 * state can be modified in the %tstate register.
- 			 */
--			tstate &= (TSTATE_ICC | TSTATE_XCC);
--			regs->tstate &= ~(TSTATE_ICC | TSTATE_XCC);
-+			tstate &= (TSTATE_ICC | TSTATE_XCC | TSTATE_SYSCALL);
-+			regs->tstate &= ~(TSTATE_ICC | TSTATE_XCC | TSTATE_SYSCALL);
- 			regs->tstate |= tstate;
- 		}
- 	}
-@@ -657,8 +657,10 @@ static int genregs32_set(struct task_struct *target,
- 		switch (pos) {
- 		case 32: /* PSR */
- 			tstate = regs->tstate;
--			tstate &= ~(TSTATE_ICC | TSTATE_XCC);
-+			tstate &= ~(TSTATE_ICC | TSTATE_XCC | TSTATE_SYSCALL);
- 			tstate |= psr_to_tstate_icc(reg);
-+			if (reg & PSR_SYSCALL)
-+				tstate |= TSTATE_SYSCALL;
- 			regs->tstate = tstate;
- 			break;
- 		case 33: /* PC */
-@@ -944,6 +946,8 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
- 		break;
- 
- 	default:
-+		if (request == PTRACE_SPARC_DETACH)
-+			request = PTRACE_DETACH;
- 		ret = compat_ptrace_request(child, request, addr, data);
- 		break;
- 	}
-@@ -1036,6 +1040,8 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
- 		break;
- 
- 	default:
-+		if (request == PTRACE_SPARC_DETACH)
-+			request = PTRACE_DETACH;
- 		ret = ptrace_request(child, request, addr, data);
- 		break;
- 	}
-diff --git a/arch/sparc64/kernel/rtrap.S b/arch/sparc64/kernel/rtrap.S
-index 079d18a..5bfa79d 100644
---- a/arch/sparc64/kernel/rtrap.S
-+++ b/arch/sparc64/kernel/rtrap.S
-@@ -270,6 +270,7 @@ rt_continue:	ldx			[%sp + PTREGS_OFF + PT_V9_G1], %g1
- 		wr			%o3, %g0, %y
- 		wrpr			%l4, 0x0, %pil
- 		wrpr			%g0, 0x1, %tl
-+		andn			%l1, TSTATE_SYSCALL, %l1
- 		wrpr			%l1, %g0, %tstate
- 		wrpr			%l2, %g0, %tpc
- 		wrpr			%o2, %g0, %tnpc
-diff --git a/arch/sparc64/kernel/signal.c b/arch/sparc64/kernel/signal.c
-index 9d51956..ec016cb 100644
---- a/arch/sparc64/kernel/signal.c
-+++ b/arch/sparc64/kernel/signal.c
-@@ -336,6 +336,9 @@ void do_rt_sigreturn(struct pt_regs *regs)
- 	regs->tpc = tpc;
- 	regs->tnpc = tnpc;
- 
-+	/* Prevent syscall restart.  */
-+	pt_regs_clear_syscall(regs);
-+
- 	sigdelsetmask(&set, ~_BLOCKABLE);
- 	spin_lock_irq(&current->sighand->siglock);
- 	current->blocked = set;
-@@ -377,16 +380,29 @@ save_fpu_state(struct pt_regs *regs, __siginfo_fpu_t __user *fpu)
- 
- static inline void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, unsigned long framesize)
- {
--	unsigned long sp;
-+	unsigned long sp = regs->u_regs[UREG_FP] + STACK_BIAS;
- 
--	sp = regs->u_regs[UREG_FP] + STACK_BIAS;
-+	/*
-+	 * If we are on the alternate signal stack and would overflow it, don't.
-+	 * Return an always-bogus address instead so we will die with SIGSEGV.
-+	 */
-+	if (on_sig_stack(sp) && !likely(on_sig_stack(sp - framesize)))
-+		return (void __user *) -1L;
- 
- 	/* This is the X/Open sanctioned signal stack switching.  */
- 	if (ka->sa.sa_flags & SA_ONSTACK) {
--		if (!on_sig_stack(sp) &&
--		    !((current->sas_ss_sp + current->sas_ss_size) & 7))
-+		if (sas_ss_flags(sp) == 0)
- 			sp = current->sas_ss_sp + current->sas_ss_size;
- 	}
-+
-+	/* Always align the stack frame.  This handles two cases.  First,
-+	 * sigaltstack need not be mindful of platform specific stack
-+	 * alignment.  Second, if we took this signal because the stack
-+	 * is not aligned properly, we'd like to take the signal cleanly
-+	 * and report that.
-+	 */
-+	sp &= ~7UL;
-+
- 	return (void __user *)(sp - framesize);
- }
- 
-@@ -487,7 +503,7 @@ static inline void handle_signal(unsigned long signr, struct k_sigaction *ka,
- }
- 
- static inline void syscall_restart(unsigned long orig_i0, struct pt_regs *regs,
--				     struct sigaction *sa)
-+				   struct sigaction *sa)
- {
- 	switch (regs->u_regs[UREG_I0]) {
- 	case ERESTART_RESTARTBLOCK:
-@@ -511,16 +527,19 @@ static inline void syscall_restart(unsigned long orig_i0, struct pt_regs *regs,
-  * want to handle. Thus you cannot kill init even with a SIGKILL even by
-  * mistake.
-  */
--static void do_signal(struct pt_regs *regs, unsigned long orig_i0, int restart_syscall)
-+static void do_signal(struct pt_regs *regs, unsigned long orig_i0, int __ignored)
- {
--	siginfo_t info;
--	struct signal_deliver_cookie cookie;
- 	struct k_sigaction ka;
--	int signr;
-+	int restart_syscall;
- 	sigset_t *oldset;
-+	siginfo_t info;
-+	int signr;
- 	
--	cookie.restart_syscall = restart_syscall;
--	cookie.orig_i0 = orig_i0;
-+ 	if (pt_regs_is_syscall(regs) &&
-+ 	    (regs->tstate & (TSTATE_XCARRY | TSTATE_ICARRY))) {
-+ 		restart_syscall = 1;
-+ 	} else
-+ 		restart_syscall = 0;
- 
- 	if (test_thread_flag(TIF_RESTORE_SIGMASK))
- 		oldset = &current->saved_sigmask;
-@@ -530,16 +549,24 @@ static void do_signal(struct pt_regs *regs, unsigned long orig_i0, int restart_s
- #ifdef CONFIG_SPARC32_COMPAT
- 	if (test_thread_flag(TIF_32BIT)) {
- 		extern void do_signal32(sigset_t *, struct pt_regs *,
--					unsigned long, int);
--		do_signal32(oldset, regs, orig_i0,
--			    cookie.restart_syscall);
-+					int restart_syscall,
-+					unsigned long orig_i0);
-+		do_signal32(oldset, regs, restart_syscall, orig_i0);
- 		return;
- 	}
- #endif	
- 
--	signr = get_signal_to_deliver(&info, &ka, regs, &cookie);
-+	signr = get_signal_to_deliver(&info, &ka, regs, NULL);
-+
-+	/* If the debugger messes with the program counter, it clears
-+	 * the software "in syscall" bit, directing us to not perform
-+	 * a syscall restart.
-+	 */
-+	if (restart_syscall && !pt_regs_is_syscall(regs))
-+		restart_syscall = 0;
-+
- 	if (signr > 0) {
--		if (cookie.restart_syscall)
-+		if (restart_syscall)
- 			syscall_restart(orig_i0, regs, &ka.sa);
- 		handle_signal(signr, &ka, &info, oldset, regs);
- 
-@@ -552,16 +579,16 @@ static void do_signal(struct pt_regs *regs, unsigned long orig_i0, int restart_s
- 			clear_thread_flag(TIF_RESTORE_SIGMASK);
- 		return;
- 	}
--	if (cookie.restart_syscall &&
-+	if (restart_syscall &&
- 	    (regs->u_regs[UREG_I0] == ERESTARTNOHAND ||
- 	     regs->u_regs[UREG_I0] == ERESTARTSYS ||
- 	     regs->u_regs[UREG_I0] == ERESTARTNOINTR)) {
- 		/* replay the system call when we are done */
--		regs->u_regs[UREG_I0] = cookie.orig_i0;
-+		regs->u_regs[UREG_I0] = orig_i0;
- 		regs->tpc -= 4;
- 		regs->tnpc -= 4;
- 	}
--	if (cookie.restart_syscall &&
-+	if (restart_syscall &&
- 	    regs->u_regs[UREG_I0] == ERESTART_RESTARTBLOCK) {
- 		regs->u_regs[UREG_G1] = __NR_restart_syscall;
- 		regs->tpc -= 4;
-@@ -583,26 +610,3 @@ void do_notify_resume(struct pt_regs *regs, unsigned long orig_i0, int restart_s
- 	if (thread_info_flags & (_TIF_SIGPENDING | _TIF_RESTORE_SIGMASK))
- 		do_signal(regs, orig_i0, restart_syscall);
- }
--
--void ptrace_signal_deliver(struct pt_regs *regs, void *cookie)
--{
--	struct signal_deliver_cookie *cp = cookie;
--
--	if (cp->restart_syscall &&
--	    (regs->u_regs[UREG_I0] == ERESTARTNOHAND ||
--	     regs->u_regs[UREG_I0] == ERESTARTSYS ||
--	     regs->u_regs[UREG_I0] == ERESTARTNOINTR)) {
--		/* replay the system call when we are done */
--		regs->u_regs[UREG_I0] = cp->orig_i0;
--		regs->tpc -= 4;
--		regs->tnpc -= 4;
--		cp->restart_syscall = 0;
--	}
--	if (cp->restart_syscall &&
--	    regs->u_regs[UREG_I0] == ERESTART_RESTARTBLOCK) {
--		regs->u_regs[UREG_G1] = __NR_restart_syscall;
--		regs->tpc -= 4;
--		regs->tnpc -= 4;
--		cp->restart_syscall = 0;
--	}
--}
-diff --git a/arch/sparc64/kernel/signal32.c b/arch/sparc64/kernel/signal32.c
-index 8c1c121..c1b06e2 100644
---- a/arch/sparc64/kernel/signal32.c
-+++ b/arch/sparc64/kernel/signal32.c
-@@ -295,6 +295,9 @@ void do_new_sigreturn32(struct pt_regs *regs)
- 	regs->tstate &= ~(TSTATE_ICC|TSTATE_XCC);
- 	regs->tstate |= psr_to_tstate_icc(psr);
- 
-+ 	/* Prevent syscall restart.  */
-+ 	pt_regs_clear_syscall(regs);
-+
- 	err |= __get_user(fpu_save, &sf->fpu_save);
- 	if (fpu_save)
- 		err |= restore_fpu_state32(regs, &sf->fpu_state);
-@@ -448,6 +451,9 @@ asmlinkage void do_rt_sigreturn32(struct pt_regs *regs)
- 	regs->tstate &= ~(TSTATE_ICC|TSTATE_XCC);
- 	regs->tstate |= psr_to_tstate_icc(psr);
- 
-+ 	/* Prevent syscall restart.  */
-+ 	pt_regs_clear_syscall(regs);
-+
- 	err |= __get_user(fpu_save, &sf->fpu_save);
- 	if (fpu_save)
- 		err |= restore_fpu_state32(regs, &sf->fpu_state);
-@@ -497,11 +503,27 @@ static void __user *get_sigframe(struct sigaction *sa, struct pt_regs *regs, uns
- 	regs->u_regs[UREG_FP] &= 0x00000000ffffffffUL;
- 	sp = regs->u_regs[UREG_FP];
- 	
-+	/*
-+	 * If we are on the alternate signal stack and would overflow it, don't.
-+	 * Return an always-bogus address instead so we will die with SIGSEGV.
-+	 */
-+	if (on_sig_stack(sp) && !likely(on_sig_stack(sp - framesize)))
-+		return (void __user *) -1L;
-+
- 	/* This is the X/Open sanctioned signal stack switching.  */
- 	if (sa->sa_flags & SA_ONSTACK) {
--		if (!on_sig_stack(sp) && !((current->sas_ss_sp + current->sas_ss_size) & 7))
-+		if (sas_ss_flags(sp) == 0)
- 			sp = current->sas_ss_sp + current->sas_ss_size;
- 	}
-+
-+	/* Always align the stack frame.  This handles two cases.  First,
-+	 * sigaltstack need not be mindful of platform specific stack
-+	 * alignment.  Second, if we took this signal because the stack
-+	 * is not aligned properly, we'd like to take the signal cleanly
-+	 * and report that.
-+	 */
-+	sp &= ~7UL;
-+
- 	return (void __user *)(sp - framesize);
- }
- 
-@@ -1264,20 +1286,24 @@ static inline void syscall_restart32(unsigned long orig_i0, struct pt_regs *regs
-  * mistake.
-  */
- void do_signal32(sigset_t *oldset, struct pt_regs * regs,
--		 unsigned long orig_i0, int restart_syscall)
-+		 int restart_syscall, unsigned long orig_i0)
- {
--	siginfo_t info;
--	struct signal_deliver_cookie cookie;
- 	struct k_sigaction ka;
-+	siginfo_t info;
- 	int signr;
- 	int svr4_signal = current->personality == PER_SVR4;
- 	
--	cookie.restart_syscall = restart_syscall;
--	cookie.orig_i0 = orig_i0;
-+	signr = get_signal_to_deliver(&info, &ka, regs, NULL);
-+
-+	/* If the debugger messes with the program counter, it clears
-+	 * the "in syscall" bit, directing us to not perform a syscall
-+	 * restart.
-+	 */
-+	if (restart_syscall && !pt_regs_is_syscall(regs))
-+		restart_syscall = 0;
- 
--	signr = get_signal_to_deliver(&info, &ka, regs, &cookie);
- 	if (signr > 0) {
--		if (cookie.restart_syscall)
-+		if (restart_syscall)
- 			syscall_restart32(orig_i0, regs, &ka.sa);
- 		handle_signal32(signr, &ka, &info, oldset,
- 				regs, svr4_signal);
-@@ -1291,16 +1317,16 @@ void do_signal32(sigset_t *oldset, struct pt_regs * regs,
- 			clear_thread_flag(TIF_RESTORE_SIGMASK);
- 		return;
- 	}
--	if (cookie.restart_syscall &&
-+	if (restart_syscall &&
- 	    (regs->u_regs[UREG_I0] == ERESTARTNOHAND ||
- 	     regs->u_regs[UREG_I0] == ERESTARTSYS ||
- 	     regs->u_regs[UREG_I0] == ERESTARTNOINTR)) {
- 		/* replay the system call when we are done */
--		regs->u_regs[UREG_I0] = cookie.orig_i0;
-+		regs->u_regs[UREG_I0] = orig_i0;
- 		regs->tpc -= 4;
- 		regs->tnpc -= 4;
- 	}
--	if (cookie.restart_syscall &&
-+	if (restart_syscall &&
- 	    regs->u_regs[UREG_I0] == ERESTART_RESTARTBLOCK) {
- 		regs->u_regs[UREG_G1] = __NR_restart_syscall;
- 		regs->tpc -= 4;
-diff --git a/arch/sparc64/kernel/sys_sparc.c b/arch/sparc64/kernel/sys_sparc.c
-index cc37936..4b495fe 100644
---- a/arch/sparc64/kernel/sys_sparc.c
-+++ b/arch/sparc64/kernel/sys_sparc.c
-@@ -454,8 +454,8 @@ asmlinkage long sys_ipc(unsigned int call, int first, unsigned long second,
- 			err = sys_semget(first, (int)second, (int)third);
- 			goto out;
- 		case SEMCTL: {
--			err = sys_semctl(first, third,
--					 (int)second | IPC_64,
-+			err = sys_semctl(first, second,
-+					 (int)third | IPC_64,
- 					 (union semun) ptr);
- 			goto out;
- 		}
-@@ -542,8 +542,7 @@ asmlinkage long sparc64_personality(unsigned long personality)
- 	return ret;
- }
- 
--int sparc64_mmap_check(unsigned long addr, unsigned long len,
--		unsigned long flags)
-+int sparc64_mmap_check(unsigned long addr, unsigned long len)
- {
- 	if (test_thread_flag(TIF_32BIT)) {
- 		if (len >= STACK_TOP32)
-@@ -609,46 +608,19 @@ asmlinkage unsigned long sys64_mremap(unsigned long addr,
- 	unsigned long old_len, unsigned long new_len,
- 	unsigned long flags, unsigned long new_addr)
- {
--	struct vm_area_struct *vma;
- 	unsigned long ret = -EINVAL;
- 
- 	if (test_thread_flag(TIF_32BIT))
- 		goto out;
- 	if (unlikely(new_len >= VA_EXCLUDE_START))
- 		goto out;
--	if (unlikely(invalid_64bit_range(addr, old_len)))
-+	if (unlikely(sparc64_mmap_check(addr, old_len)))
-+		goto out;
-+	if (unlikely(sparc64_mmap_check(new_addr, new_len)))
- 		goto out;
- 
- 	down_write(&current->mm->mmap_sem);
--	if (flags & MREMAP_FIXED) {
--		if (invalid_64bit_range(new_addr, new_len))
--			goto out_sem;
--	} else if (invalid_64bit_range(addr, new_len)) {
--		unsigned long map_flags = 0;
--		struct file *file = NULL;
--
--		ret = -ENOMEM;
--		if (!(flags & MREMAP_MAYMOVE))
--			goto out_sem;
--
--		vma = find_vma(current->mm, addr);
--		if (vma) {
--			if (vma->vm_flags & VM_SHARED)
--				map_flags |= MAP_SHARED;
--			file = vma->vm_file;
--		}
--
--		/* MREMAP_FIXED checked above. */
--		new_addr = get_unmapped_area(file, addr, new_len,
--				    vma ? vma->vm_pgoff : 0,
--				    map_flags);
--		ret = new_addr;
--		if (new_addr & ~PAGE_MASK)
--			goto out_sem;
--		flags |= MREMAP_FIXED;
--	}
- 	ret = do_mremap(addr, old_len, new_len, flags, new_addr);
--out_sem:
- 	up_write(&current->mm->mmap_sem);
- out:
- 	return ret;       
-diff --git a/arch/sparc64/kernel/sys_sparc32.c b/arch/sparc64/kernel/sys_sparc32.c
-index 2455fa4..54df31a 100644
---- a/arch/sparc64/kernel/sys_sparc32.c
-+++ b/arch/sparc64/kernel/sys_sparc32.c
-@@ -906,44 +906,15 @@ asmlinkage unsigned long sys32_mremap(unsigned long addr,
- 	unsigned long old_len, unsigned long new_len,
- 	unsigned long flags, u32 __new_addr)
- {
--	struct vm_area_struct *vma;
- 	unsigned long ret = -EINVAL;
- 	unsigned long new_addr = __new_addr;
- 
--	if (old_len > STACK_TOP32 || new_len > STACK_TOP32)
-+	if (unlikely(sparc64_mmap_check(addr, old_len)))
- 		goto out;
--	if (addr > STACK_TOP32 - old_len)
-+	if (unlikely(sparc64_mmap_check(new_addr, new_len)))
- 		goto out;
- 	down_write(&current->mm->mmap_sem);
--	if (flags & MREMAP_FIXED) {
--		if (new_addr > STACK_TOP32 - new_len)
--			goto out_sem;
--	} else if (addr > STACK_TOP32 - new_len) {
--		unsigned long map_flags = 0;
--		struct file *file = NULL;
--
--		ret = -ENOMEM;
--		if (!(flags & MREMAP_MAYMOVE))
--			goto out_sem;
--
--		vma = find_vma(current->mm, addr);
--		if (vma) {
--			if (vma->vm_flags & VM_SHARED)
--				map_flags |= MAP_SHARED;
--			file = vma->vm_file;
--		}
--
--		/* MREMAP_FIXED checked above. */
--		new_addr = get_unmapped_area(file, addr, new_len,
--				    vma ? vma->vm_pgoff : 0,
--				    map_flags);
--		ret = new_addr;
--		if (new_addr & ~PAGE_MASK)
--			goto out_sem;
--		flags |= MREMAP_FIXED;
--	}
- 	ret = do_mremap(addr, old_len, new_len, flags, new_addr);
--out_sem:
- 	up_write(&current->mm->mmap_sem);
- out:
- 	return ret;       
-diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
-index 6c70fed..99a4ed3 100644
---- a/arch/x86/Kconfig
-+++ b/arch/x86/Kconfig
-@@ -24,6 +24,18 @@ config X86
- 	select HAVE_KRETPROBES
- 	select HAVE_KVM if ((X86_32 && !X86_VOYAGER && !X86_VISWS && !X86_NUMAQ) || X86_64)
- 
-+config DEFCONFIG_LIST
-+	string
-+	depends on X86_32
-+	option defconfig_list
-+	default "arch/x86/configs/i386_defconfig"
-+
-+config DEFCONFIG_LIST
-+	string
-+	depends on X86_64
-+	option defconfig_list
-+	default "arch/x86/configs/x86_64_defconfig"
-+
- 
- config GENERIC_LOCKBREAK
- 	def_bool n
-diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
-index fae8404..815b8c3 100644
---- a/drivers/ata/ata_piix.c
-+++ b/drivers/ata/ata_piix.c
-@@ -1531,6 +1531,8 @@ static void __devinit piix_init_sidpr(struct ata_host *host)
- {
- 	struct pci_dev *pdev = to_pci_dev(host->dev);
- 	struct piix_host_priv *hpriv = host->private_data;
-+	struct ata_device *dev0 = &host->ports[0]->link.device[0];
-+	u32 scontrol;
- 	int i;
- 
- 	/* check for availability */
-@@ -1549,6 +1551,29 @@ static void __devinit piix_init_sidpr(struct ata_host *host)
- 		return;
- 
- 	hpriv->sidpr = pcim_iomap_table(pdev)[PIIX_SIDPR_BAR];
-+
-+	/* SCR access via SIDPR doesn't work on some configurations.
-+	 * Give it a test drive by inhibiting power save modes which
-+	 * we'll do anyway.
-+	 */
-+	scontrol = piix_sidpr_read(dev0, SCR_CONTROL);
-+
-+	/* if IPM is already 3, SCR access is probably working.  Don't
-+	 * un-inhibit power save modes as BIOS might have inhibited
-+	 * them for a reason.
-+	 */
-+	if ((scontrol & 0xf00) != 0x300) {
-+		scontrol |= 0x300;
-+		piix_sidpr_write(dev0, SCR_CONTROL, scontrol);
-+		scontrol = piix_sidpr_read(dev0, SCR_CONTROL);
-+
-+		if ((scontrol & 0xf00) != 0x300) {
-+			dev_printk(KERN_INFO, host->dev, "SCR access via "
-+				   "SIDPR is available but doesn't work\n");
-+			return;
-+		}
-+	}
-+
- 	host->ports[0]->ops = &piix_sidpr_sata_ops;
- 	host->ports[1]->ops = &piix_sidpr_sata_ops;
- }
-diff --git a/drivers/char/vt.c b/drivers/char/vt.c
-index 9b58b89..c2e1a83 100644
---- a/drivers/char/vt.c
-+++ b/drivers/char/vt.c
-@@ -2723,6 +2723,10 @@ static int con_open(struct tty_struct *tty, struct file *filp)
- 				tty->winsize.ws_row = vc_cons[currcons].d->vc_rows;
- 				tty->winsize.ws_col = vc_cons[currcons].d->vc_cols;
- 			}
-+			if (vc->vc_utf)
-+				tty->termios->c_iflag |= IUTF8;
-+			else
-+				tty->termios->c_iflag &= ~IUTF8;
- 			release_console_sem();
- 			vcs_make_sysfs(tty);
- 			return ret;
-@@ -2899,6 +2903,8 @@ int __init vty_init(void)
- 	console_driver->minor_start = 1;
- 	console_driver->type = TTY_DRIVER_TYPE_CONSOLE;
- 	console_driver->init_termios = tty_std_termios;
-+	if (default_utf8)
-+		console_driver->init_termios.c_iflag |= IUTF8;
- 	console_driver->flags = TTY_DRIVER_REAL_RAW | TTY_DRIVER_RESET_TERMIOS;
- 	tty_set_operations(console_driver, &con_ops);
- 	if (tty_register_driver(console_driver))
-diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c
-index 9bbe96c..f0b4073 100644
---- a/drivers/i2c/busses/i2c-piix4.c
-+++ b/drivers/i2c/busses/i2c-piix4.c
-@@ -108,7 +108,27 @@ static unsigned short piix4_smba;
- static struct pci_driver piix4_driver;
- static struct i2c_adapter piix4_adapter;
- 
--static struct dmi_system_id __devinitdata piix4_dmi_table[] = {
-+static struct dmi_system_id __devinitdata piix4_dmi_blacklist[] = {
-+	{
-+		.ident = "Sapphire AM2RD790",
-+		.matches = {
-+			DMI_MATCH(DMI_BOARD_VENDOR, "SAPPHIRE Inc."),
-+			DMI_MATCH(DMI_BOARD_NAME, "PC-AM2RD790"),
-+		},
-+	},
-+	{
-+		.ident = "DFI Lanparty UT 790FX",
-+		.matches = {
-+			DMI_MATCH(DMI_BOARD_VENDOR, "DFI Inc."),
-+			DMI_MATCH(DMI_BOARD_NAME, "LP UT 790FX"),
-+		},
-+	},
-+	{ }
-+};
-+
-+/* The IBM entry is in a separate table because we only check it
-+   on Intel-based systems */
-+static struct dmi_system_id __devinitdata piix4_dmi_ibm[] = {
- 	{
- 		.ident = "IBM",
- 		.matches = { DMI_MATCH(DMI_SYS_VENDOR, "IBM"), },
-@@ -123,8 +143,16 @@ static int __devinit piix4_setup(struct pci_dev *PIIX4_dev,
- 
- 	dev_info(&PIIX4_dev->dev, "Found %s device\n", pci_name(PIIX4_dev));
- 
-+	/* On some motherboards, it was reported that accessing the SMBus
-+	   caused severe hardware problems */
-+	if (dmi_check_system(piix4_dmi_blacklist)) {
-+		dev_err(&PIIX4_dev->dev,
-+			"Accessing the SMBus on this system is unsafe!\n");
-+		return -EPERM;
-+	}
-+
- 	/* Don't access SMBus on IBM systems which get corrupted eeproms */
--	if (dmi_check_system(piix4_dmi_table) &&
-+	if (dmi_check_system(piix4_dmi_ibm) &&
- 			PIIX4_dev->vendor == PCI_VENDOR_ID_INTEL) {
- 		dev_err(&PIIX4_dev->dev, "IBM system detected; this module "
- 			"may corrupt your serial eeprom! Refusing to load "
-diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
-index b162b83..18a1379 100644
---- a/drivers/md/raid5.c
-+++ b/drivers/md/raid5.c
-@@ -2354,8 +2354,8 @@ static void handle_parity_checks5(raid5_conf_t *conf, struct stripe_head *sh,
- 
- 	/* complete a check operation */
- 	if (test_and_clear_bit(STRIPE_OP_CHECK, &sh->ops.complete)) {
--	    clear_bit(STRIPE_OP_CHECK, &sh->ops.ack);
--	    clear_bit(STRIPE_OP_CHECK, &sh->ops.pending);
-+		clear_bit(STRIPE_OP_CHECK, &sh->ops.ack);
-+		clear_bit(STRIPE_OP_CHECK, &sh->ops.pending);
- 		if (s->failed == 0) {
- 			if (sh->ops.zero_sum_result == 0)
- 				/* parity is correct (on disc,
-@@ -2385,16 +2385,6 @@ static void handle_parity_checks5(raid5_conf_t *conf, struct stripe_head *sh,
- 			canceled_check = 1; /* STRIPE_INSYNC is not set */
- 	}
- 
--	/* check if we can clear a parity disk reconstruct */
--	if (test_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.complete) &&
--		test_bit(STRIPE_OP_MOD_REPAIR_PD, &sh->ops.pending)) {
--
--		clear_bit(STRIPE_OP_MOD_REPAIR_PD, &sh->ops.pending);
--		clear_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.complete);
--		clear_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.ack);
--		clear_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.pending);
--	}
--
- 	/* start a new check operation if there are no failures, the stripe is
- 	 * not insync, and a repair is not in flight
- 	 */
-@@ -2409,6 +2399,17 @@ static void handle_parity_checks5(raid5_conf_t *conf, struct stripe_head *sh,
- 		}
- 	}
- 
-+	/* check if we can clear a parity disk reconstruct */
-+	if (test_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.complete) &&
-+	    test_bit(STRIPE_OP_MOD_REPAIR_PD, &sh->ops.pending)) {
-+
-+		clear_bit(STRIPE_OP_MOD_REPAIR_PD, &sh->ops.pending);
-+		clear_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.complete);
-+		clear_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.ack);
-+		clear_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.pending);
-+	}
-+
-+
- 	/* Wait for check parity and compute block operations to complete
- 	 * before write-back.  If a failure occurred while the check operation
- 	 * was in flight we need to cycle this stripe through handle_stripe
-diff --git a/drivers/media/dvb/dvb-usb/dib0700_devices.c b/drivers/media/dvb/dvb-usb/dib0700_devices.c
-index e709382..9fd8399 100644
---- a/drivers/media/dvb/dvb-usb/dib0700_devices.c
-+++ b/drivers/media/dvb/dvb-usb/dib0700_devices.c
-@@ -13,6 +13,7 @@
- #include "dib7000p.h"
- #include "mt2060.h"
- #include "mt2266.h"
-+#include "tuner-xc2028.h"
- #include "dib0070.h"
- 
- static int force_lna_activation;
-@@ -297,6 +298,149 @@ static int stk7700d_tuner_attach(struct dvb_usb_adapter *adap)
- 		&stk7700d_mt2266_config[adap->id]) == NULL ? -ENODEV : 0;;
- }
- 
-+/* STK7700-PH: Digital/Analog Hybrid Tuner, e.h. Cinergy HT USB HE */
-+struct dibx000_agc_config xc3028_agc_config = {
-+	BAND_VHF | BAND_UHF,       /* band_caps */
-+
-+	/* P_agc_use_sd_mod1=0, P_agc_use_sd_mod2=0, P_agc_freq_pwm_div=0,
-+	 * P_agc_inv_pwm1=0, P_agc_inv_pwm2=0, P_agc_inh_dc_rv_est=0,
-+	 * P_agc_time_est=3, P_agc_freeze=0, P_agc_nb_est=2, P_agc_write=0 */
-+	(0 << 15) | (0 << 14) | (0 << 11) | (0 << 10) | (0 << 9) | (0 << 8) |
-+	(3 << 5) | (0 << 4) | (2 << 1) | (0 << 0), /* setup */
-+
-+	712,	/* inv_gain */
-+	21,	/* time_stabiliz */
-+
-+	0,	/* alpha_level */
-+	118,	/* thlock */
-+
-+	0,	/* wbd_inv */
-+	2867,	/* wbd_ref */
-+	0,	/* wbd_sel */
-+	2,	/* wbd_alpha */
-+
-+	0,	/* agc1_max */
-+	0,	/* agc1_min */
-+	39718,	/* agc2_max */
-+	9930,	/* agc2_min */
-+	0,	/* agc1_pt1 */
-+	0,	/* agc1_pt2 */
-+	0,	/* agc1_pt3 */
-+	0,	/* agc1_slope1 */
-+	0,	/* agc1_slope2 */
-+	0,	/* agc2_pt1 */
-+	128,	/* agc2_pt2 */
-+	29,	/* agc2_slope1 */
-+	29,	/* agc2_slope2 */
-+
-+	17,	/* alpha_mant */
-+	27,	/* alpha_exp */
-+	23,	/* beta_mant */
-+	51,	/* beta_exp */
-+
-+	1,	/* perform_agc_softsplit */
-+};
-+
-+/* PLL Configuration for COFDM BW_MHz = 8.00 with external clock = 30.00 */
-+struct dibx000_bandwidth_config xc3028_bw_config = {
-+	60000, 30000, /* internal, sampling */
-+	1, 8, 3, 1, 0, /* pll_cfg: prediv, ratio, range, reset, bypass */
-+	0, 0, 1, 1, 0, /* misc: refdiv, bypclk_div, IO_CLK_en_core, ADClkSrc,
-+			  modulo */
-+	(3 << 14) | (1 << 12) | (524 << 0), /* sad_cfg: refsel, sel, freq_15k */
-+	(1 << 25) | 5816102, /* ifreq = 5.200000 MHz */
-+	20452225, /* timf */
-+	30000000, /* xtal_hz */
-+};
-+
-+static struct dib7000p_config stk7700ph_dib7700_xc3028_config = {
-+	.output_mpeg2_in_188_bytes = 1,
-+	.tuner_is_baseband = 1,
-+
-+	.agc_config_count = 1,
-+	.agc = &xc3028_agc_config,
-+	.bw  = &xc3028_bw_config,
-+
-+	.gpio_dir = DIB7000P_GPIO_DEFAULT_DIRECTIONS,
-+	.gpio_val = DIB7000P_GPIO_DEFAULT_VALUES,
-+	.gpio_pwm_pos = DIB7000P_GPIO_DEFAULT_PWM_POS,
-+};
-+
-+static int stk7700ph_xc3028_callback(void *ptr, int command, int arg)
-+{
-+	struct dvb_usb_adapter *adap = ptr;
-+
-+	switch (command) {
-+	case XC2028_TUNER_RESET:
-+		/* Send the tuner in then out of reset */
-+		dib7000p_set_gpio(adap->fe, 8, 0, 0); msleep(10);
-+		dib7000p_set_gpio(adap->fe, 8, 0, 1);
-+		break;
-+	case XC2028_RESET_CLK:
-+		break;
-+	default:
-+		err("%s: unknown command %d, arg %d\n", __func__,
-+			command, arg);
-+		return -EINVAL;
-+	}
-+	return 0;
-+}
-+
-+static struct xc2028_ctrl stk7700ph_xc3028_ctrl = {
-+	.fname = XC2028_DEFAULT_FIRMWARE,
-+	.max_len = 64,
-+	.demod = XC3028_FE_DIBCOM52,
-+};
-+
-+static struct xc2028_config stk7700ph_xc3028_config = {
-+	.i2c_addr = 0x61,
-+	.callback = stk7700ph_xc3028_callback,
-+	.ctrl = &stk7700ph_xc3028_ctrl,
-+};
-+
-+static int stk7700ph_frontend_attach(struct dvb_usb_adapter *adap)
-+{
-+	struct usb_device_descriptor *desc = &adap->dev->udev->descriptor;
-+
-+	if (desc->idVendor  == USB_VID_PINNACLE &&
-+	    desc->idProduct == USB_PID_PINNACLE_EXPRESSCARD_320CX)
-+	dib0700_set_gpio(adap->dev, GPIO6, GPIO_OUT, 0);
-+	else
-+	dib0700_set_gpio(adap->dev, GPIO6, GPIO_OUT, 1);
-+	msleep(20);
-+	dib0700_set_gpio(adap->dev, GPIO9, GPIO_OUT, 1);
-+	dib0700_set_gpio(adap->dev, GPIO4, GPIO_OUT, 1);
-+	dib0700_set_gpio(adap->dev, GPIO7, GPIO_OUT, 1);
-+	dib0700_set_gpio(adap->dev, GPIO10, GPIO_OUT, 0);
-+	msleep(10);
-+	dib0700_set_gpio(adap->dev, GPIO10, GPIO_OUT, 1);
-+	msleep(20);
-+	dib0700_set_gpio(adap->dev, GPIO0, GPIO_OUT, 1);
-+	msleep(10);
-+
-+	dib7000p_i2c_enumeration(&adap->dev->i2c_adap, 1, 18,
-+		&stk7700ph_dib7700_xc3028_config);
-+
-+	adap->fe = dvb_attach(dib7000p_attach, &adap->dev->i2c_adap, 0x80,
-+		&stk7700ph_dib7700_xc3028_config);
-+
-+	return adap->fe == NULL ? -ENODEV : 0;
-+}
-+
-+static int stk7700ph_tuner_attach(struct dvb_usb_adapter *adap)
-+{
-+	struct i2c_adapter *tun_i2c;
-+
-+	tun_i2c = dib7000p_get_i2c_master(adap->fe,
-+		DIBX000_I2C_INTERFACE_TUNER, 1);
-+
-+	stk7700ph_xc3028_config.i2c_adap = tun_i2c;
-+	stk7700ph_xc3028_config.video_dev = adap;
-+
-+	return dvb_attach(xc2028_attach, adap->fe, &stk7700ph_xc3028_config)
-+		== NULL ? -ENODEV : 0;
-+}
-+
- #define DEFAULT_RC_INTERVAL 150
- 
- static u8 rc_request[] = { REQUEST_POLL_RC, 0 };
-@@ -794,6 +938,10 @@ static struct dib7000p_config dib7070p_dib7000p_config = {
- /* STK7070P */
- static int stk7070p_frontend_attach(struct dvb_usb_adapter *adap)
- {
-+	if (adap->dev->udev->descriptor.idVendor  == USB_VID_PINNACLE &&
-+	adap->dev->udev->descriptor.idProduct == USB_PID_PINNACLE_PCTV72E)
-+	dib0700_set_gpio(adap->dev, GPIO6, GPIO_OUT, 0);
-+	else
- 	dib0700_set_gpio(adap->dev, GPIO6, GPIO_OUT, 1);
- 	msleep(10);
- 	dib0700_set_gpio(adap->dev, GPIO9, GPIO_OUT, 1);
-@@ -808,9 +956,11 @@ static int stk7070p_frontend_attach(struct dvb_usb_adapter *adap)
- 	msleep(10);
- 	dib0700_set_gpio(adap->dev, GPIO0, GPIO_OUT, 1);
- 
--	dib7000p_i2c_enumeration(&adap->dev->i2c_adap, 1, 18, &dib7070p_dib7000p_config);
-+	dib7000p_i2c_enumeration(&adap->dev->i2c_adap, 1, 18,
-+		&dib7070p_dib7000p_config);
- 
--	adap->fe = dvb_attach(dib7000p_attach, &adap->dev->i2c_adap, 0x80, &dib7070p_dib7000p_config);
-+	adap->fe = dvb_attach(dib7000p_attach, &adap->dev->i2c_adap, 0x80,
-+		&dib7070p_dib7000p_config);
- 	return adap->fe == NULL ? -ENODEV : 0;
- }
- 
-@@ -878,34 +1028,41 @@ static int stk7070pd_frontend_attach1(struct dvb_usb_adapter *adap)
- /* DVB-USB and USB stuff follows */
- struct usb_device_id dib0700_usb_id_table[] = {
- /* 0 */	{ USB_DEVICE(USB_VID_DIBCOM,    USB_PID_DIBCOM_STK7700P) },
--		{ USB_DEVICE(USB_VID_DIBCOM,    USB_PID_DIBCOM_STK7700P_PC) },
--
--		{ USB_DEVICE(USB_VID_HAUPPAUGE, USB_PID_HAUPPAUGE_NOVA_T_500) },
--		{ USB_DEVICE(USB_VID_HAUPPAUGE, USB_PID_HAUPPAUGE_NOVA_T_500_2) },
--		{ USB_DEVICE(USB_VID_HAUPPAUGE, USB_PID_HAUPPAUGE_NOVA_T_STICK) },
-+	{ USB_DEVICE(USB_VID_DIBCOM,    USB_PID_DIBCOM_STK7700P_PC) },
-+	{ USB_DEVICE(USB_VID_HAUPPAUGE, USB_PID_HAUPPAUGE_NOVA_T_500) },
-+	{ USB_DEVICE(USB_VID_HAUPPAUGE, USB_PID_HAUPPAUGE_NOVA_T_500_2) },
-+	{ USB_DEVICE(USB_VID_HAUPPAUGE, USB_PID_HAUPPAUGE_NOVA_T_STICK) },
- /* 5 */	{ USB_DEVICE(USB_VID_AVERMEDIA, USB_PID_AVERMEDIA_VOLAR) },
--		{ USB_DEVICE(USB_VID_COMPRO,    USB_PID_COMPRO_VIDEOMATE_U500) },
--		{ USB_DEVICE(USB_VID_UNIWILL,   USB_PID_UNIWILL_STK7700P) },
--		{ USB_DEVICE(USB_VID_LEADTEK,   USB_PID_WINFAST_DTV_DONGLE_STK7700P) },
--		{ USB_DEVICE(USB_VID_HAUPPAUGE, USB_PID_HAUPPAUGE_NOVA_T_STICK_2) },
-+	{ USB_DEVICE(USB_VID_COMPRO,    USB_PID_COMPRO_VIDEOMATE_U500) },
-+	{ USB_DEVICE(USB_VID_UNIWILL,   USB_PID_UNIWILL_STK7700P) },
-+	{ USB_DEVICE(USB_VID_LEADTEK,   USB_PID_WINFAST_DTV_DONGLE_STK7700P) },
-+	{ USB_DEVICE(USB_VID_HAUPPAUGE, USB_PID_HAUPPAUGE_NOVA_T_STICK_2) },
- /* 10 */{ USB_DEVICE(USB_VID_AVERMEDIA, USB_PID_AVERMEDIA_VOLAR_2) },
--		{ USB_DEVICE(USB_VID_PINNACLE,  USB_PID_PINNACLE_PCTV2000E) },
--		{ USB_DEVICE(USB_VID_TERRATEC,  USB_PID_TERRATEC_CINERGY_DT_XS_DIVERSITY) },
--		{ USB_DEVICE(USB_VID_HAUPPAUGE, USB_PID_HAUPPAUGE_NOVA_TD_STICK) },
--		{ USB_DEVICE(USB_VID_DIBCOM,    USB_PID_DIBCOM_STK7700D) },
-+	{ USB_DEVICE(USB_VID_PINNACLE,  USB_PID_PINNACLE_PCTV2000E) },
-+	{ USB_DEVICE(USB_VID_TERRATEC,
-+			USB_PID_TERRATEC_CINERGY_DT_XS_DIVERSITY) },
-+	{ USB_DEVICE(USB_VID_HAUPPAUGE, USB_PID_HAUPPAUGE_NOVA_TD_STICK) },
-+	{ USB_DEVICE(USB_VID_DIBCOM,    USB_PID_DIBCOM_STK7700D) },
- /* 15 */{ USB_DEVICE(USB_VID_DIBCOM,    USB_PID_DIBCOM_STK7070P) },
--		{ USB_DEVICE(USB_VID_PINNACLE,  USB_PID_PINNACLE_PCTV_DVB_T_FLASH) },
--		{ USB_DEVICE(USB_VID_DIBCOM,    USB_PID_DIBCOM_STK7070PD) },
--		{ USB_DEVICE(USB_VID_PINNACLE,  USB_PID_PINNACLE_PCTV_DUAL_DIVERSITY_DVB_T) },
--		{ USB_DEVICE(USB_VID_COMPRO,    USB_PID_COMPRO_VIDEOMATE_U500_PC) },
-+	{ USB_DEVICE(USB_VID_PINNACLE,  USB_PID_PINNACLE_PCTV_DVB_T_FLASH) },
-+	{ USB_DEVICE(USB_VID_DIBCOM,    USB_PID_DIBCOM_STK7070PD) },
-+	{ USB_DEVICE(USB_VID_PINNACLE,
-+			USB_PID_PINNACLE_PCTV_DUAL_DIVERSITY_DVB_T) },
-+	{ USB_DEVICE(USB_VID_COMPRO,    USB_PID_COMPRO_VIDEOMATE_U500_PC) },
- /* 20 */{ USB_DEVICE(USB_VID_AVERMEDIA, USB_PID_AVERMEDIA_EXPRESS) },
--		{ USB_DEVICE(USB_VID_GIGABYTE,  USB_PID_GIGABYTE_U7000) },
--		{ USB_DEVICE(USB_VID_ULTIMA_ELECTRONIC, USB_PID_ARTEC_T14BR) },
--		{ USB_DEVICE(USB_VID_ASUS,      USB_PID_ASUS_U3000) },
--		{ USB_DEVICE(USB_VID_ASUS,      USB_PID_ASUS_U3100) },
--/* 25 */	{ USB_DEVICE(USB_VID_HAUPPAUGE, USB_PID_HAUPPAUGE_NOVA_T_STICK_3) },
--		{ USB_DEVICE(USB_VID_HAUPPAUGE, USB_PID_HAUPPAUGE_MYTV_T) },
--		{ 0 }		/* Terminating entry */
-+	{ USB_DEVICE(USB_VID_GIGABYTE,  USB_PID_GIGABYTE_U7000) },
-+	{ USB_DEVICE(USB_VID_ULTIMA_ELECTRONIC, USB_PID_ARTEC_T14BR) },
-+	{ USB_DEVICE(USB_VID_ASUS,      USB_PID_ASUS_U3000) },
-+	{ USB_DEVICE(USB_VID_ASUS,      USB_PID_ASUS_U3100) },
-+/* 25 */{ USB_DEVICE(USB_VID_HAUPPAUGE, USB_PID_HAUPPAUGE_NOVA_T_STICK_3) },
-+	{ USB_DEVICE(USB_VID_HAUPPAUGE, USB_PID_HAUPPAUGE_MYTV_T) },
-+	{ USB_DEVICE(USB_VID_TERRATEC,  USB_PID_TERRATEC_CINERGY_HT_USB_XE) },
-+	{ USB_DEVICE(USB_VID_PINNACLE,	USB_PID_PINNACLE_EXPRESSCARD_320CX) },
-+	{ USB_DEVICE(USB_VID_PINNACLE,	USB_PID_PINNACLE_PCTV72E) },
-+/* 30 */{ USB_DEVICE(USB_VID_PINNACLE,	USB_PID_PINNACLE_PCTV73E) },
-+	{ USB_DEVICE(USB_VID_YUAN,	USB_PID_YUAN_EC372S) },
-+	{ USB_DEVICE(USB_VID_TERRATEC,	USB_PID_TERRATEC_CINERGY_HT_EXPRESS) },
-+	{ 0 }		/* Terminating entry */
- };
- MODULE_DEVICE_TABLE(usb, dib0700_usb_id_table);
- 
-@@ -1069,12 +1226,16 @@ struct dvb_usb_device_properties dib0700_devices[] = {
- 			},
- 		},
- 
--		.num_device_descs = 1,
-+		.num_device_descs = 2,
- 		.devices = {
- 			{   "ASUS My Cinema U3000 Mini DVBT Tuner",
- 				{ &dib0700_usb_id_table[23], NULL },
- 				{ NULL },
- 			},
-+			{   "Yuan EC372S",
-+				{ &dib0700_usb_id_table[31], NULL },
-+				{ NULL },
-+			}
- 		}
- 	}, { DIB0700_DEFAULT_DEVICE_PROPERTIES,
- 
-@@ -1090,7 +1251,7 @@ struct dvb_usb_device_properties dib0700_devices[] = {
- 			},
- 		},
- 
--		.num_device_descs = 6,
-+		.num_device_descs = 8,
- 		.devices = {
- 			{   "DiBcom STK7070P reference design",
- 				{ &dib0700_usb_id_table[15], NULL },
-@@ -1116,6 +1277,14 @@ struct dvb_usb_device_properties dib0700_devices[] = {
- 				{ &dib0700_usb_id_table[26], NULL },
- 				{ NULL },
- 			},
-+			{   "Pinnacle PCTV 72e",
-+				{ &dib0700_usb_id_table[29], NULL },
-+				{ NULL },
-+			},
-+			{   "Pinnacle PCTV 73e",
-+				{ &dib0700_usb_id_table[30], NULL },
-+				{ NULL },
-+			},
- 		},
- 
- 		.rc_interval      = DEFAULT_RC_INTERVAL,
-@@ -1155,6 +1324,40 @@ struct dvb_usb_device_properties dib0700_devices[] = {
- 				{ NULL },
- 			}
- 		}
-+	}, { DIB0700_DEFAULT_DEVICE_PROPERTIES,
-+
-+		.num_adapters = 1,
-+		.adapter = {
-+			{
-+				.frontend_attach  = stk7700ph_frontend_attach,
-+				.tuner_attach     = stk7700ph_tuner_attach,
-+
-+				DIB0700_DEFAULT_STREAMING_CONFIG(0x02),
-+
-+				.size_of_priv = sizeof(struct
-+						dib0700_adapter_state),
-+			},
-+		},
-+
-+		.num_device_descs = 3,
-+		.devices = {
-+			{   "Terratec Cinergy HT USB XE",
-+				{ &dib0700_usb_id_table[27], NULL },
-+				{ NULL },
-+			},
-+			{   "Pinnacle Expresscard 320cx",
-+				{ &dib0700_usb_id_table[28], NULL },
-+				{ NULL },
-+			},
-+			{   "Terratec Cinergy HT Express",
-+				{ &dib0700_usb_id_table[32], NULL },
-+				{ NULL },
-+			},
-+		},
-+		.rc_interval      = DEFAULT_RC_INTERVAL,
-+		.rc_key_map       = dib0700_rc_keys,
-+		.rc_key_map_size  = ARRAY_SIZE(dib0700_rc_keys),
-+		.rc_query         = dib0700_rc_query
- 	},
- };
- 
-diff --git a/drivers/media/dvb/dvb-usb/dvb-usb-ids.h b/drivers/media/dvb/dvb-usb/dvb-usb-ids.h
-index aa4844e..49a44f2 100644
---- a/drivers/media/dvb/dvb-usb/dvb-usb-ids.h
-+++ b/drivers/media/dvb/dvb-usb/dvb-usb-ids.h
-@@ -46,8 +46,8 @@
- #define USB_VID_ULTIMA_ELECTRONIC		0x05d8
- #define USB_VID_UNIWILL				0x1584
- #define USB_VID_WIDEVIEW			0x14aa
--/* dom : pour gigabyte u7000 */
- #define USB_VID_GIGABYTE			0x1044
-+#define USB_VID_YUAN				0x1164
- 
- 
- /* Product IDs */
-@@ -135,9 +135,14 @@
- #define USB_PID_AVERMEDIA_VOLAR				0xa807
- #define USB_PID_AVERMEDIA_VOLAR_2			0xb808
- #define USB_PID_TERRATEC_CINERGY_DT_XS_DIVERSITY	0x005a
-+#define USB_PID_TERRATEC_CINERGY_HT_USB_XE		0x0058
-+#define USB_PID_TERRATEC_CINERGY_HT_EXPRESS		0x0060
-+#define USB_PID_PINNACLE_EXPRESSCARD_320CX		0x022e
- #define USB_PID_PINNACLE_PCTV2000E			0x022c
- #define USB_PID_PINNACLE_PCTV_DVB_T_FLASH		0x0228
- #define USB_PID_PINNACLE_PCTV_DUAL_DIVERSITY_DVB_T	0x0229
-+#define USB_PID_PINNACLE_PCTV72E			0x0236
-+#define USB_PID_PINNACLE_PCTV73E			0x0237
- #define USB_PID_PCTV_200E				0x020e
- #define USB_PID_PCTV_400E				0x020f
- #define USB_PID_PCTV_450E				0x0222
-@@ -183,9 +188,9 @@
- #define USB_PID_OPERA1_WARM				0x3829
- #define USB_PID_LIFEVIEW_TV_WALKER_TWIN_COLD		0x0514
- #define USB_PID_LIFEVIEW_TV_WALKER_TWIN_WARM		0x0513
--/* dom pour gigabyte u7000 */
- #define USB_PID_GIGABYTE_U7000				0x7001
- #define USB_PID_ASUS_U3000				0x171f
- #define USB_PID_ASUS_U3100				0x173f
-+#define  USB_PID_YUAN_EC372S				0x1edc
- 
- #endif
-diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
-index f651a81..34c2b98 100644
---- a/drivers/net/macvlan.c
-+++ b/drivers/net/macvlan.c
-@@ -450,7 +450,7 @@ static void macvlan_dellink(struct net_device *dev)
- 	unregister_netdevice(dev);
- 
- 	if (list_empty(&port->vlans))
--		macvlan_port_destroy(dev);
-+		macvlan_port_destroy(port->dev);
- }
- 
- static struct rtnl_link_ops macvlan_link_ops __read_mostly = {
-diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
-index 3acfeea..6572425 100644
---- a/drivers/net/r8169.c
-+++ b/drivers/net/r8169.c
-@@ -1617,6 +1617,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
- 	SET_NETDEV_DEV(dev, &pdev->dev);
- 	tp = netdev_priv(dev);
- 	tp->dev = dev;
-+	tp->pci_dev = pdev;
- 	tp->msg_enable = netif_msg_init(debug.msg_enable, R8169_MSG_DEFAULT);
- 
- 	/* enable device (incl. PCI PM wakeup and hotplug setup) */
-@@ -1705,18 +1706,18 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
- 
- 	rtl8169_print_mac_version(tp);
- 
--	for (i = ARRAY_SIZE(rtl_chip_info) - 1; i >= 0; i--) {
-+	for (i = 0; i < ARRAY_SIZE(rtl_chip_info); i++) {
- 		if (tp->mac_version == rtl_chip_info[i].mac_version)
- 			break;
- 	}
--	if (i < 0) {
-+	if (i == ARRAY_SIZE(rtl_chip_info)) {
- 		/* Unknown chip: assume array element #0, original RTL-8169 */
- 		if (netif_msg_probe(tp)) {
- 			dev_printk(KERN_DEBUG, &pdev->dev,
- 				"unknown chip version, assuming %s\n",
- 				rtl_chip_info[0].name);
- 		}
--		i++;
-+		i = 0;
- 	}
- 	tp->chipset = i;
- 
-@@ -1777,7 +1778,6 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
- #endif
- 
- 	tp->intr_mask = 0xffff;
--	tp->pci_dev = pdev;
- 	tp->mmio_addr = ioaddr;
- 	tp->align = cfg->align;
- 	tp->hw_start = cfg->hw_start;
-diff --git a/drivers/rtc/rtc-lib.c b/drivers/rtc/rtc-lib.c
-index ba795a4..9f996ec 100644
---- a/drivers/rtc/rtc-lib.c
-+++ b/drivers/rtc/rtc-lib.c
-@@ -51,7 +51,7 @@ EXPORT_SYMBOL(rtc_year_days);
-  */
- void rtc_time_to_tm(unsigned long time, struct rtc_time *tm)
- {
--	register int days, month, year;
-+	unsigned int days, month, year;
- 
- 	days = time / 86400;
- 	time -= days * 86400;
-diff --git a/drivers/scsi/aha152x.c b/drivers/scsi/aha152x.c
-index 6ccdc96..d9bc859 100644
---- a/drivers/scsi/aha152x.c
-+++ b/drivers/scsi/aha152x.c
-@@ -3835,7 +3835,7 @@ static int __init aha152x_init(void)
- 			iounmap(p);
- 		}
- 		if (!ok && setup_count == 0)
--			return 0;
-+			return -ENODEV;
- 
- 		printk(KERN_INFO "aha152x: BIOS test: passed, ");
- #else
-@@ -3914,14 +3914,14 @@ static int __init aha152x_init(void)
- #endif
- 	}
- 
--	return 1;
-+	return 0;
- }
- 
- static void __exit aha152x_exit(void)
- {
--	struct aha152x_hostdata *hd;
-+	struct aha152x_hostdata *hd, *tmp;
- 
--	list_for_each_entry(hd, &aha152x_host_list, host_list) {
-+	list_for_each_entry_safe(hd, tmp, &aha152x_host_list, host_list) {
- 		struct Scsi_Host *shost = container_of((void *)hd, struct Scsi_Host, hostdata);
- 
- 		aha152x_release(shost);
-diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
-index bdd7de7..9975095 100644
---- a/drivers/scsi/libiscsi.c
-+++ b/drivers/scsi/libiscsi.c
-@@ -635,7 +635,9 @@ static int __iscsi_complete_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
- 				if (iscsi_recv_pdu(conn->cls_conn, hdr, data,
- 						   datalen))
- 					rc = ISCSI_ERR_CONN_FAILED;
--			}
-+			} else
-+				mod_timer(&conn->transport_timer,
-+					  jiffies + conn->recv_timeout);
- 			iscsi_free_mgmt_task(conn, mtask);
- 			break;
- 		default:
-@@ -1353,19 +1355,20 @@ static void iscsi_check_transport_timeouts(unsigned long data)
- {
- 	struct iscsi_conn *conn = (struct iscsi_conn *)data;
- 	struct iscsi_session *session = conn->session;
--	unsigned long timeout, next_timeout = 0, last_recv;
-+	unsigned long recv_timeout, next_timeout = 0, last_recv;
- 
- 	spin_lock(&session->lock);
- 	if (session->state != ISCSI_STATE_LOGGED_IN)
- 		goto done;
- 
--	timeout = conn->recv_timeout;
--	if (!timeout)
-+	recv_timeout = conn->recv_timeout;
-+	if (!recv_timeout)
- 		goto done;
- 
--	timeout *= HZ;
-+	recv_timeout *= HZ;
- 	last_recv = conn->last_recv;
--	if (time_before_eq(last_recv + timeout + (conn->ping_timeout * HZ),
-+	if (conn->ping_mtask &&
-+	    time_before_eq(conn->last_ping + (conn->ping_timeout * HZ),
- 			   jiffies)) {
- 		iscsi_conn_printk(KERN_ERR, conn, "ping timeout of %d secs "
- 				  "expired, last rx %lu, last ping %lu, "
-@@ -1376,15 +1379,13 @@ static void iscsi_check_transport_timeouts(unsigned long data)
- 		return;
- 	}
- 
--	if (time_before_eq(last_recv + timeout, jiffies)) {
--		if (time_before_eq(conn->last_ping, last_recv)) {
--			/* send a ping to try to provoke some traffic */
--			debug_scsi("Sending nopout as ping on conn %p\n", conn);
--			iscsi_send_nopout(conn, NULL);
--		}
--		next_timeout = last_recv + timeout + (conn->ping_timeout * HZ);
-+	if (time_before_eq(last_recv + recv_timeout, jiffies)) {
-+		/* send a ping to try to provoke some traffic */
-+		debug_scsi("Sending nopout as ping on conn %p\n", conn);
-+		iscsi_send_nopout(conn, NULL);
-+		next_timeout = conn->last_ping + (conn->ping_timeout * HZ);
- 	} else
--		next_timeout = last_recv + timeout;
-+		next_timeout = last_recv + recv_timeout;
- 
- 	debug_scsi("Setting next tmo %lu\n", next_timeout);
- 	mod_timer(&conn->transport_timer, next_timeout);
-diff --git a/drivers/scsi/qla1280.c b/drivers/scsi/qla1280.c
-index 68c0d09..624e616 100644
---- a/drivers/scsi/qla1280.c
-+++ b/drivers/scsi/qla1280.c
-@@ -2012,7 +2012,7 @@ qla1280_set_defaults(struct scsi_qla_host *ha)
- 		nv->bus[bus].config_2.req_ack_active_negation = 1;
- 		nv->bus[bus].config_2.data_line_active_negation = 1;
- 		nv->bus[bus].selection_timeout = 250;
--		nv->bus[bus].max_queue_depth = 256;
-+		nv->bus[bus].max_queue_depth = 32;
- 
- 		if (IS_ISP1040(ha)) {
- 			nv->bus[bus].bus_reset_delay = 3;
-@@ -2056,7 +2056,7 @@ qla1280_config_target(struct scsi_qla_host *ha, int bus, int target)
- 	status = qla1280_mailbox_command(ha, 0x0f, mb);
- 
- 	/* Save Tag queuing enable flag. */
--	flag = (BIT_0 << target) & mb[0];
-+	flag = (BIT_0 << target);
- 	if (nv->bus[bus].target[target].parameter.tag_queuing)
- 		ha->bus_settings[bus].qtag_enables |= flag;
- 
-diff --git a/drivers/serial/serial_core.c b/drivers/serial/serial_core.c
-index 0f5a179..3bf9294 100644
---- a/drivers/serial/serial_core.c
-+++ b/drivers/serial/serial_core.c
-@@ -535,7 +535,7 @@ static int uart_chars_in_buffer(struct tty_struct *tty)
- static void uart_flush_buffer(struct tty_struct *tty)
- {
- 	struct uart_state *state = tty->driver_data;
--	struct uart_port *port = state->port;
-+	struct uart_port *port;
- 	unsigned long flags;
- 
- 	/*
-@@ -547,6 +547,7 @@ static void uart_flush_buffer(struct tty_struct *tty)
- 		return;
- 	}
- 
-+	port = state->port;
- 	pr_debug("uart_flush_buffer(%d) called\n", tty->index);
- 
- 	spin_lock_irqsave(&port->lock, flags);
-diff --git a/drivers/serial/sunhv.c b/drivers/serial/sunhv.c
-index be0fe15..145c028 100644
---- a/drivers/serial/sunhv.c
-+++ b/drivers/serial/sunhv.c
-@@ -392,7 +392,7 @@ static struct uart_ops sunhv_pops = {
- 
- static struct uart_driver sunhv_reg = {
- 	.owner			= THIS_MODULE,
--	.driver_name		= "serial",
-+	.driver_name		= "sunhv",
- 	.dev_name		= "ttyS",
- 	.major			= TTY_MAJOR,
- };
-diff --git a/drivers/serial/sunsab.c b/drivers/serial/sunsab.c
-index 543f937..9ff5b38 100644
---- a/drivers/serial/sunsab.c
-+++ b/drivers/serial/sunsab.c
-@@ -826,7 +826,7 @@ static struct uart_ops sunsab_pops = {
- 
- static struct uart_driver sunsab_reg = {
- 	.owner			= THIS_MODULE,
--	.driver_name		= "serial",
-+	.driver_name		= "sunsab",
- 	.dev_name		= "ttyS",
- 	.major			= TTY_MAJOR,
- };
-diff --git a/drivers/serial/sunsu.c b/drivers/serial/sunsu.c
-index 4e2302d..03806a9 100644
---- a/drivers/serial/sunsu.c
-+++ b/drivers/serial/sunsu.c
-@@ -1173,7 +1173,7 @@ out:
- 
- static struct uart_driver sunsu_reg = {
- 	.owner			= THIS_MODULE,
--	.driver_name		= "serial",
-+	.driver_name		= "sunsu",
- 	.dev_name		= "ttyS",
- 	.major			= TTY_MAJOR,
- };
-diff --git a/drivers/serial/sunzilog.c b/drivers/serial/sunzilog.c
-index cb2e405..87210c0 100644
---- a/drivers/serial/sunzilog.c
-+++ b/drivers/serial/sunzilog.c
-@@ -1015,6 +1015,7 @@ static struct uart_ops sunzilog_pops = {
- 	.verify_port	=	sunzilog_verify_port,
- };
- 
-+static int uart_chip_count;
- static struct uart_sunzilog_port *sunzilog_port_table;
- static struct zilog_layout __iomem **sunzilog_chip_regs;
- 
-@@ -1022,7 +1023,7 @@ static struct uart_sunzilog_port *sunzilog_irq_chain;
- 
- static struct uart_driver sunzilog_reg = {
- 	.owner		=	THIS_MODULE,
--	.driver_name	=	"ttyS",
-+	.driver_name	=	"sunzilog",
- 	.dev_name	=	"ttyS",
- 	.major		=	TTY_MAJOR,
- };
-@@ -1350,16 +1351,22 @@ static int zilog_irq = -1;
- 
- static int __devinit zs_probe(struct of_device *op, const struct of_device_id *match)
- {
--	static int inst;
-+	static int kbm_inst, uart_inst;
-+	int inst;
- 	struct uart_sunzilog_port *up;
- 	struct zilog_layout __iomem *rp;
--	int keyboard_mouse;
-+	int keyboard_mouse = 0;
- 	int err;
- 
--	keyboard_mouse = 0;
- 	if (of_find_property(op->node, "keyboard", NULL))
- 		keyboard_mouse = 1;
- 
-+	/* uarts must come before keyboards/mice */
-+	if (keyboard_mouse)
-+		inst = uart_chip_count + kbm_inst;
-+	else
-+		inst = uart_inst;
-+
- 	sunzilog_chip_regs[inst] = of_ioremap(&op->resource[0], 0,
- 					      sizeof(struct zilog_layout),
- 					      "zs");
-@@ -1427,6 +1434,7 @@ static int __devinit zs_probe(struct of_device *op, const struct of_device_id *m
- 				   rp, sizeof(struct zilog_layout));
- 			return err;
- 		}
-+		uart_inst++;
- 	} else {
- 		printk(KERN_INFO "%s: Keyboard at MMIO 0x%llx (irq = %d) "
- 		       "is a %s\n",
-@@ -1438,12 +1446,11 @@ static int __devinit zs_probe(struct of_device *op, const struct of_device_id *m
- 		       op->dev.bus_id,
- 		       (unsigned long long) up[1].port.mapbase,
- 		       op->irqs[0], sunzilog_type(&up[1].port));
-+		kbm_inst++;
- 	}
- 
- 	dev_set_drvdata(&op->dev, &up[0]);
- 
--	inst++;
--
- 	return 0;
- }
- 
-@@ -1491,28 +1498,25 @@ static struct of_platform_driver zs_driver = {
- static int __init sunzilog_init(void)
- {
- 	struct device_node *dp;
--	int err, uart_count;
--	int num_keybms;
-+	int err;
-+	int num_keybms = 0;
- 	int num_sunzilog = 0;
- 
--	num_keybms = 0;
- 	for_each_node_by_name(dp, "zs") {
- 		num_sunzilog++;
- 		if (of_find_property(dp, "keyboard", NULL))
- 			num_keybms++;
- 	}
- 
--	uart_count = 0;
- 	if (num_sunzilog) {
--		int uart_count;
--
- 		err = sunzilog_alloc_tables(num_sunzilog);
- 		if (err)
- 			goto out;
- 
--		uart_count = (num_sunzilog * 2) - (2 * num_keybms);
-+		uart_chip_count = num_sunzilog - num_keybms;
- 
--		err = sunserial_register_minors(&sunzilog_reg, uart_count);
-+		err = sunserial_register_minors(&sunzilog_reg,
-+						uart_chip_count * 2);
- 		if (err)
- 			goto out_free_tables;
- 	}
-diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
-index d72dc07..e534f9d 100644
---- a/drivers/usb/host/ohci-at91.c
-+++ b/drivers/usb/host/ohci-at91.c
-@@ -348,6 +348,7 @@ static int ohci_hcd_at91_drv_resume(struct platform_device *pdev)
- 	if (!clocked)
- 		at91_start_clock();
- 
-+	ohci_finish_controller_resume(hcd);
- 	return 0;
- }
- #else
-diff --git a/drivers/usb/host/ohci-ep93xx.c b/drivers/usb/host/ohci-ep93xx.c
-index 156e93a..963ed60 100644
---- a/drivers/usb/host/ohci-ep93xx.c
-+++ b/drivers/usb/host/ohci-ep93xx.c
-@@ -194,8 +194,8 @@ static int ohci_hcd_ep93xx_drv_resume(struct platform_device *pdev)
- 
- 	ep93xx_start_hc(&pdev->dev);
- 	pdev->dev.power.power_state = PMSG_ON;
--	usb_hcd_resume_root_hub(hcd);
- 
-+	ohci_finish_controller_resume(hcd);
- 	return 0;
- }
- #endif
-diff --git a/drivers/usb/host/ohci-hub.c b/drivers/usb/host/ohci-hub.c
-index 48e4b11..9eff2de 100644
---- a/drivers/usb/host/ohci-hub.c
-+++ b/drivers/usb/host/ohci-hub.c
-@@ -326,6 +326,49 @@ static int ohci_bus_resume (struct usb_hcd *hcd)
- 	return rc;
- }
- 
-+/* Carry out the final steps of resuming the controller device */
-+static void ohci_finish_controller_resume(struct usb_hcd *hcd)
-+{
-+	struct ohci_hcd		*ohci = hcd_to_ohci(hcd);
-+	int			port;
-+	bool			need_reinit = false;
-+
-+	/* See if the controller is already running or has been reset */
-+	ohci->hc_control = ohci_readl(ohci, &ohci->regs->control);
-+	if (ohci->hc_control & (OHCI_CTRL_IR | OHCI_SCHED_ENABLES)) {
-+		need_reinit = true;
-+	} else {
-+		switch (ohci->hc_control & OHCI_CTRL_HCFS) {
-+		case OHCI_USB_OPER:
-+		case OHCI_USB_RESET:
-+			need_reinit = true;
-+		}
-+	}
-+
-+	/* If needed, reinitialize and suspend the root hub */
-+	if (need_reinit) {
-+		spin_lock_irq(&ohci->lock);
-+		hcd->state = HC_STATE_RESUMING;
-+		ohci_rh_resume(ohci);
-+		hcd->state = HC_STATE_QUIESCING;
-+		ohci_rh_suspend(ohci, 0);
-+		hcd->state = HC_STATE_SUSPENDED;
-+		spin_unlock_irq(&ohci->lock);
-+	}
-+
-+	/* Normally just turn on port power and enable interrupts */
-+	else {
-+		ohci_dbg(ohci, "powerup ports\n");
-+		for (port = 0; port < ohci->num_ports; port++)
-+			ohci_writel(ohci, RH_PS_PPS,
-+					&ohci->regs->roothub.portstatus[port]);
-+
-+		ohci_writel(ohci, OHCI_INTR_MIE, &ohci->regs->intrenable);
-+		ohci_readl(ohci, &ohci->regs->intrenable);
-+		msleep(20);
-+	}
-+}
-+
- /* Carry out polling-, autostop-, and autoresume-related state changes */
- static int ohci_root_hub_state_changes(struct ohci_hcd *ohci, int changed,
- 		int any_connected)
-diff --git a/drivers/usb/host/ohci-omap.c b/drivers/usb/host/ohci-omap.c
-index 7bfca1e..611bc9f 100644
---- a/drivers/usb/host/ohci-omap.c
-+++ b/drivers/usb/host/ohci-omap.c
-@@ -519,7 +519,7 @@ static int ohci_omap_resume(struct platform_device *dev)
- 
- 	omap_ohci_clock_power(1);
- 	dev->dev.power.power_state = PMSG_ON;
--	usb_hcd_resume_root_hub(platform_get_drvdata(dev));
-+	ohci_finish_controller_resume(hcd);
- 	return 0;
- }
- 
-diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c
-index b0e2275..b4886e1 100644
---- a/drivers/usb/host/ohci-pci.c
-+++ b/drivers/usb/host/ohci-pci.c
-@@ -238,42 +238,6 @@ static int __devinit ohci_pci_start (struct usb_hcd *hcd)
- 	return ret;
- }
- 
--#if	defined(CONFIG_USB_PERSIST) && (defined(CONFIG_USB_EHCI_HCD) || \
--		defined(CONFIG_USB_EHCI_HCD_MODULE))
--
--/* Following a power loss, we must prepare to regain control of the ports
-- * we used to own.  This means turning on the port power before ehci-hcd
-- * tries to switch ownership.
-- *
-- * This isn't a 100% perfect solution.  On most systems the OHCI controllers
-- * lie at lower PCI addresses than the EHCI controller, so they will be
-- * discovered (and hence resumed) first.  But there is no guarantee things
-- * will always work this way.  If the EHCI controller is resumed first and
-- * the OHCI ports are unpowered, then the handover will fail.
-- */
--static void prepare_for_handover(struct usb_hcd *hcd)
--{
--	struct ohci_hcd	*ohci = hcd_to_ohci(hcd);
--	int		port;
--
--	/* Here we "know" root ports should always stay powered */
--	ohci_dbg(ohci, "powerup ports\n");
--	for (port = 0; port < ohci->num_ports; port++)
--		ohci_writel(ohci, RH_PS_PPS,
--				&ohci->regs->roothub.portstatus[port]);
--
--	/* Flush those writes */
--	ohci_readl(ohci, &ohci->regs->control);
--	msleep(20);
--}
--
--#else
--
--static inline void prepare_for_handover(struct usb_hcd *hcd)
--{ }
--
--#endif	/* CONFIG_USB_PERSIST etc. */
--
- #ifdef	CONFIG_PM
- 
- static int ohci_pci_suspend (struct usb_hcd *hcd, pm_message_t message)
-@@ -312,13 +276,8 @@ static int ohci_pci_suspend (struct usb_hcd *hcd, pm_message_t message)
- 
- static int ohci_pci_resume (struct usb_hcd *hcd)
- {
--	struct ohci_hcd	*ohci = hcd_to_ohci(hcd);
--
- 	set_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
--
--	/* FIXME: we should try to detect loss of VBUS power here */
--	prepare_for_handover(hcd);
--	ohci_writel(ohci, OHCI_INTR_MIE, &ohci->regs->intrenable);
-+	ohci_finish_controller_resume(hcd);
- 	return 0;
- }
- 
-diff --git a/drivers/usb/host/ohci-pxa27x.c b/drivers/usb/host/ohci-pxa27x.c
-index 8ad9b3b..3de3b00 100644
---- a/drivers/usb/host/ohci-pxa27x.c
-+++ b/drivers/usb/host/ohci-pxa27x.c
-@@ -358,8 +358,7 @@ static int ohci_hcd_pxa27x_drv_resume(struct platform_device *pdev)
- 		return status;
- 
- 	pdev->dev.power.power_state = PMSG_ON;
--	usb_hcd_resume_root_hub(hcd);
--
-+	ohci_finish_controller_resume(hcd);
- 	return 0;
- }
- #endif
-diff --git a/drivers/usb/host/ohci-sm501.c b/drivers/usb/host/ohci-sm501.c
-index 4ea9276..c852f03 100644
---- a/drivers/usb/host/ohci-sm501.c
-+++ b/drivers/usb/host/ohci-sm501.c
-@@ -239,7 +239,7 @@ static int ohci_sm501_resume(struct platform_device *pdev)
- 
- 	sm501_unit_power(dev->parent, SM501_GATE_USB_HOST, 1);
- 	dev->power.power_state = PMSG_ON;
--	usb_hcd_resume_root_hub(platform_get_drvdata(pdev));
-+	ohci_finish_controller_resume(hcd);
- 	return 0;
- }
- #endif
-diff --git a/drivers/usb/host/ohci-ssb.c b/drivers/usb/host/ohci-ssb.c
-index 6e9c2d6..1c0867a 100644
---- a/drivers/usb/host/ohci-ssb.c
-+++ b/drivers/usb/host/ohci-ssb.c
-@@ -224,6 +224,7 @@ static int ssb_ohci_resume(struct ssb_device *dev)
- 
- 	ssb_device_enable(dev, ohcidev->enable_flags);
- 
-+	ohci_finish_controller_resume(hcd);
- 	return 0;
- }
- 
-diff --git a/drivers/usb/serial/airprime.c b/drivers/usb/serial/airprime.c
-index f156dba..a3482fc 100644
---- a/drivers/usb/serial/airprime.c
-+++ b/drivers/usb/serial/airprime.c
-@@ -220,7 +220,7 @@ static void airprime_close(struct usb_serial_port *port, struct file * filp)
- 	mutex_lock(&port->serial->disc_mutex);
- 	if (!port->serial->disconnected)
- 		airprime_send_setup(port);
--	mutex_lock(&port->serial->disc_mutex);
-+	mutex_unlock(&port->serial->disc_mutex);
- 
- 	for (i = 0; i < NUM_READ_URBS; ++i) {
- 		usb_kill_urb (priv->read_urbp[i]);
-diff --git a/include/asm-sparc/mman.h b/include/asm-sparc/mman.h
-index b7dc40b..632cd8a 100644
---- a/include/asm-sparc/mman.h
-+++ b/include/asm-sparc/mman.h
-@@ -37,9 +37,8 @@
- 
- #ifdef __KERNEL__
- #ifndef __ASSEMBLY__
--#define arch_mmap_check	sparc_mmap_check
--int sparc_mmap_check(unsigned long addr, unsigned long len,
--		unsigned long flags);
-+#define arch_mmap_check(addr,len,flags)	sparc_mmap_check(addr,len)
-+int sparc_mmap_check(unsigned long addr, unsigned long len);
- #endif
- #endif
- 
-diff --git a/include/asm-sparc/psr.h b/include/asm-sparc/psr.h
-index 19c9780..2139704 100644
---- a/include/asm-sparc/psr.h
-+++ b/include/asm-sparc/psr.h
-@@ -25,6 +25,7 @@
- #define PSR_PIL     0x00000f00         /* processor interrupt level  */
- #define PSR_EF      0x00001000         /* enable floating point      */
- #define PSR_EC      0x00002000         /* enable co-processor        */
-+#define PSR_SYSCALL 0x00004000         /* inside of a syscall        */
- #define PSR_LE      0x00008000         /* SuperSparcII little-endian */
- #define PSR_ICC     0x00f00000         /* integer condition codes    */
- #define PSR_C       0x00100000         /* carry bit                  */
-diff --git a/include/asm-sparc/ptrace.h b/include/asm-sparc/ptrace.h
-index 8201a7b..0afb867 100644
---- a/include/asm-sparc/ptrace.h
-+++ b/include/asm-sparc/ptrace.h
-@@ -10,6 +10,8 @@
- 
- #ifndef __ASSEMBLY__
- 
-+#include <linux/types.h>
-+
- struct pt_regs {
- 	unsigned long psr;
- 	unsigned long pc;
-@@ -39,6 +41,16 @@ struct pt_regs {
- #define UREG_FP        UREG_I6
- #define UREG_RETPC     UREG_I7
- 
-+static inline bool pt_regs_is_syscall(struct pt_regs *regs)
-+{
-+	return (regs->psr & PSR_SYSCALL);
-+}
-+
-+static inline bool pt_regs_clear_syscall(struct pt_regs *regs)
-+{
-+	return (regs->psr &= ~PSR_SYSCALL);
-+}
-+
- /* A register window */
- struct reg_window {
- 	unsigned long locals[8];
-@@ -149,6 +161,7 @@ extern void show_regs(struct pt_regs *);
- #define SF_XXARG  0x5c
- 
- /* Stuff for the ptrace system call */
-+#define PTRACE_SPARC_DETACH       11
- #define PTRACE_GETREGS            12
- #define PTRACE_SETREGS            13
- #define PTRACE_GETFPREGS          14
-diff --git a/include/asm-sparc/signal.h b/include/asm-sparc/signal.h
-index d03a21c..94071c7 100644
---- a/include/asm-sparc/signal.h
-+++ b/include/asm-sparc/signal.h
-@@ -199,13 +199,7 @@ typedef struct sigaltstack {
- 	size_t		ss_size;
- } stack_t;
- 
--struct sparc_deliver_cookie {
--	int restart_syscall;
--	unsigned long orig_i0;
--};
--
--struct pt_regs;
--extern void ptrace_signal_deliver(struct pt_regs *regs, void *cookie);
-+#define ptrace_signal_deliver(regs, cookie) do { } while (0)
- 
- #endif /* !(__KERNEL__) */
- 
-diff --git a/include/asm-sparc64/mman.h b/include/asm-sparc64/mman.h
-index 8cc1860..e0fcfca 100644
---- a/include/asm-sparc64/mman.h
-+++ b/include/asm-sparc64/mman.h
-@@ -37,9 +37,8 @@
- 
- #ifdef __KERNEL__
- #ifndef __ASSEMBLY__
--#define arch_mmap_check	sparc64_mmap_check
--int sparc64_mmap_check(unsigned long addr, unsigned long len,
--		unsigned long flags);
-+#define arch_mmap_check(addr,len,flags)	sparc64_mmap_check(addr,len)
-+int sparc64_mmap_check(unsigned long addr, unsigned long len);
- #endif
- #endif
- 
-diff --git a/include/asm-sparc64/psrcompat.h b/include/asm-sparc64/psrcompat.h
-index 5590ce6..3614ca0 100644
---- a/include/asm-sparc64/psrcompat.h
-+++ b/include/asm-sparc64/psrcompat.h
-@@ -12,6 +12,7 @@
- #define PSR_PIL     0x00000f00         /* processor interrupt level  */
- #define PSR_EF      0x00001000         /* enable floating point      */
- #define PSR_EC      0x00002000         /* enable co-processor        */
-+#define PSR_SYSCALL 0x00004000         /* inside of a syscall        */
- #define PSR_LE      0x00008000         /* SuperSparcII little-endian */
- #define PSR_ICC     0x00f00000         /* integer condition codes    */
- #define PSR_C       0x00100000         /* carry bit                  */
-@@ -30,6 +31,7 @@ static inline unsigned int tstate_to_psr(unsigned long tstate)
- 		PSR_S					|
- 		((tstate & TSTATE_ICC) >> 12)		|
- 		((tstate & TSTATE_XCC) >> 20)		|
-+		((tstate & TSTATE_SYSCALL) ? PSR_SYSCALL : 0) |
- 		PSR_V8PLUS);
- }
- 
-diff --git a/include/asm-sparc64/pstate.h b/include/asm-sparc64/pstate.h
-index f3c4548..949aeba 100644
---- a/include/asm-sparc64/pstate.h
-+++ b/include/asm-sparc64/pstate.h
-@@ -62,6 +62,7 @@
- #define TSTATE_PRIV	_AC(0x0000000000000400,UL) /* Privilege.	*/
- #define TSTATE_IE	_AC(0x0000000000000200,UL) /* Interrupt Enable.	*/
- #define TSTATE_AG	_AC(0x0000000000000100,UL) /* Alternate Globals.*/
-+#define TSTATE_SYSCALL	_AC(0x0000000000000020,UL) /* in syscall trap   */
- #define TSTATE_CWP	_AC(0x000000000000001f,UL) /* Curr Win-Pointer.	*/
- 
- /* Floating-Point Registers State Register.
-diff --git a/include/asm-sparc64/ptrace.h b/include/asm-sparc64/ptrace.h
-index 6da1978..0093f60 100644
---- a/include/asm-sparc64/ptrace.h
-+++ b/include/asm-sparc64/ptrace.h
-@@ -10,6 +10,8 @@
- 
- #ifndef __ASSEMBLY__
- 
-+#include <linux/types.h>
-+
- struct pt_regs {
- 	unsigned long u_regs[16]; /* globals and ins */
- 	unsigned long tstate;
-@@ -27,6 +29,16 @@ struct pt_regs32 {
- 	unsigned int u_regs[16]; /* globals and ins */
- };
- 
-+static inline bool pt_regs_is_syscall(struct pt_regs *regs)
-+{
-+	return (regs->tstate & TSTATE_SYSCALL);
-+}
-+
-+static inline bool pt_regs_clear_syscall(struct pt_regs *regs)
-+{
-+	return (regs->tstate &= ~TSTATE_SYSCALL);
-+}
-+
- #define UREG_G0        0
- #define UREG_G1        1
- #define UREG_G2        2
-@@ -263,6 +275,7 @@ extern void __show_regs(struct pt_regs *);
- #define SF_XXARG  0x5c
- 
- /* Stuff for the ptrace system call */
-+#define PTRACE_SPARC_DETACH       11
- #define PTRACE_GETREGS            12
- #define PTRACE_SETREGS            13
- #define PTRACE_GETFPREGS          14
-diff --git a/include/asm-sparc64/signal.h b/include/asm-sparc64/signal.h
-index fa6f467..c49f32d 100644
---- a/include/asm-sparc64/signal.h
-+++ b/include/asm-sparc64/signal.h
-@@ -186,13 +186,7 @@ struct k_sigaction {
- 	void __user		*ka_restorer;
- };
- 
--struct signal_deliver_cookie {
--	int restart_syscall;
--	unsigned long orig_i0;
--};
--
--struct pt_regs;
--extern void ptrace_signal_deliver(struct pt_regs *regs, void *cookie);
-+#define ptrace_signal_deliver(regs, cookie) do { } while (0)
- 
- #endif /* !(__KERNEL__) */
- 
-diff --git a/include/asm-sparc64/ttable.h b/include/asm-sparc64/ttable.h
-index bbb9c8f..6ef3d3b 100644
---- a/include/asm-sparc64/ttable.h
-+++ b/include/asm-sparc64/ttable.h
-@@ -91,13 +91,14 @@
- 	 clr	%l6;
- 	
- #define SYSCALL_TRAP(routine, systbl)			\
-+	rdpr	%pil, %g2;				\
-+	mov	TSTATE_SYSCALL, %g3;			\
- 	sethi	%hi(109f), %g7;				\
--	ba,pt	%xcc, etrap;				\
-+	ba,pt	%xcc, etrap_syscall;			\
- 109:	 or	%g7, %lo(109b), %g7;			\
- 	sethi	%hi(systbl), %l7;			\
- 	ba,pt	%xcc, routine;				\
--	 or	%l7, %lo(systbl), %l7;			\
--	nop; nop;
-+	 or	%l7, %lo(systbl), %l7;
- 	
- #define INDIRECT_SOLARIS_SYSCALL(num)			\
- 	sethi	%hi(109f), %g7;				\
-diff --git a/include/asm-x86/topology.h b/include/asm-x86/topology.h
-index 8af05a9..db684e1 100644
---- a/include/asm-x86/topology.h
-+++ b/include/asm-x86/topology.h
-@@ -25,6 +25,16 @@
- #ifndef _ASM_X86_TOPOLOGY_H
- #define _ASM_X86_TOPOLOGY_H
- 
-+#ifdef CONFIG_X86_32
-+# ifdef CONFIG_X86_HT
-+#  define ENABLE_TOPO_DEFINES
-+# endif
-+#else
-+# ifdef CONFIG_SMP
-+#  define ENABLE_TOPO_DEFINES
-+# endif
-+#endif
-+
- #ifdef CONFIG_NUMA
- #include <linux/cpumask.h>
- #include <asm/mpspec.h>
-@@ -112,10 +122,6 @@ extern unsigned long node_end_pfn[];
- extern unsigned long node_remap_size[];
- #define node_has_online_mem(nid) (node_start_pfn[nid] != node_end_pfn[nid])
- 
--# ifdef CONFIG_X86_HT
--#  define ENABLE_TOPO_DEFINES
--# endif
--
- # define SD_CACHE_NICE_TRIES	1
- # define SD_IDLE_IDX		1
- # define SD_NEWIDLE_IDX		2
-@@ -123,10 +129,6 @@ extern unsigned long node_remap_size[];
- 
- #else
- 
--# ifdef CONFIG_SMP
--#  define ENABLE_TOPO_DEFINES
--# endif
--
- # define SD_CACHE_NICE_TRIES	2
- # define SD_IDLE_IDX		2
- # define SD_NEWIDLE_IDX		0
-diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
-index 56f3c94..9a51eba 100644
---- a/include/net/ip_vs.h
-+++ b/include/net/ip_vs.h
-@@ -405,7 +405,8 @@ struct sk_buff;
- struct ip_vs_protocol {
- 	struct ip_vs_protocol	*next;
- 	char			*name;
--	__u16			protocol;
-+	u16			protocol;
-+	u16			num_states;
- 	int			dont_defrag;
- 	atomic_t		appcnt;		/* counter of proto app incs */
- 	int			*timeout_table;	/* protocol timeout table */
-diff --git a/include/net/netfilter/nf_conntrack_tuple.h b/include/net/netfilter/nf_conntrack_tuple.h
-index e69ab2e..d9a4f7f 100644
---- a/include/net/netfilter/nf_conntrack_tuple.h
-+++ b/include/net/netfilter/nf_conntrack_tuple.h
-@@ -101,16 +101,6 @@ struct nf_conntrack_tuple_mask
- 	} src;
- };
- 
--/* This is optimized opposed to a memset of the whole structure.  Everything we
-- * really care about is the  source/destination unions */
--#define NF_CT_TUPLE_U_BLANK(tuple)                              	\
--        do {                                                    	\
--                (tuple)->src.u.all = 0;                         	\
--                (tuple)->dst.u.all = 0;                         	\
--		memset(&(tuple)->src.u3, 0, sizeof((tuple)->src.u3));	\
--		memset(&(tuple)->dst.u3, 0, sizeof((tuple)->dst.u3));	\
--        } while (0)
--
- #ifdef __KERNEL__
- 
- #define NF_CT_DUMP_TUPLE(tp)						     \
-diff --git a/net/can/af_can.c b/net/can/af_can.c
-index 36b9f22..6b956f5 100644
---- a/net/can/af_can.c
-+++ b/net/can/af_can.c
-@@ -208,6 +208,7 @@ static int can_create(struct net *net, struct socket *sock, int protocol)
-  */
- int can_send(struct sk_buff *skb, int loop)
- {
-+	struct sk_buff *newskb = NULL;
- 	int err;
- 
- 	if (skb->dev->type != ARPHRD_CAN) {
-@@ -244,8 +245,7 @@ int can_send(struct sk_buff *skb, int loop)
- 			 * If the interface is not capable to do loopback
- 			 * itself, we do it here.
- 			 */
--			struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC);
--
-+			newskb = skb_clone(skb, GFP_ATOMIC);
- 			if (!newskb) {
- 				kfree_skb(skb);
- 				return -ENOMEM;
-@@ -254,7 +254,6 @@ int can_send(struct sk_buff *skb, int loop)
- 			newskb->sk = skb->sk;
- 			newskb->ip_summed = CHECKSUM_UNNECESSARY;
- 			newskb->pkt_type = PACKET_BROADCAST;
--			netif_rx(newskb);
- 		}
- 	} else {
- 		/* indication for the CAN driver: no loopback required */
-@@ -266,11 +265,20 @@ int can_send(struct sk_buff *skb, int loop)
- 	if (err > 0)
- 		err = net_xmit_errno(err);
- 
-+	if (err) {
-+		if (newskb)
-+			kfree_skb(newskb);
-+		return err;
-+	}
-+
-+	if (newskb)
-+		netif_rx(newskb);
-+
- 	/* update statistics */
- 	can_stats.tx_frames++;
- 	can_stats.tx_frames_delta++;
- 
--	return err;
-+	return 0;
- }
- EXPORT_SYMBOL(can_send);
- 
-diff --git a/net/dccp/feat.c b/net/dccp/feat.c
-index 4a4f6ce..933a0ec 100644
---- a/net/dccp/feat.c
-+++ b/net/dccp/feat.c
-@@ -32,7 +32,7 @@ int dccp_feat_change(struct dccp_minisock *dmsk, u8 type, u8 feature,
- 
- 	if (len > 3) {
- 		DCCP_WARN("invalid length %d\n", len);
--		return 1;
-+		return -EINVAL;
- 	}
- 	/* XXX add further sanity checks */
- 
-diff --git a/net/ipv4/ipvs/ip_vs_proto.c b/net/ipv4/ipvs/ip_vs_proto.c
-index dde28a2..4b1c16c 100644
---- a/net/ipv4/ipvs/ip_vs_proto.c
-+++ b/net/ipv4/ipvs/ip_vs_proto.c
-@@ -148,7 +148,7 @@ const char * ip_vs_state_name(__u16 proto, int state)
- 	struct ip_vs_protocol *pp = ip_vs_proto_get(proto);
- 
- 	if (pp == NULL || pp->state_name == NULL)
--		return "ERR!";
-+		return (IPPROTO_IP == proto) ? "NONE" : "ERR!";
- 	return pp->state_name(state);
- }
- 
-diff --git a/net/ipv4/ipvs/ip_vs_proto_ah.c b/net/ipv4/ipvs/ip_vs_proto_ah.c
-index a842676..4bf835e 100644
---- a/net/ipv4/ipvs/ip_vs_proto_ah.c
-+++ b/net/ipv4/ipvs/ip_vs_proto_ah.c
-@@ -160,6 +160,7 @@ static void ah_exit(struct ip_vs_protocol *pp)
- struct ip_vs_protocol ip_vs_protocol_ah = {
- 	.name =			"AH",
- 	.protocol =		IPPROTO_AH,
-+	.num_states =		1,
- 	.dont_defrag =		1,
- 	.init =			ah_init,
- 	.exit =			ah_exit,
-diff --git a/net/ipv4/ipvs/ip_vs_proto_esp.c b/net/ipv4/ipvs/ip_vs_proto_esp.c
-index aef0d3e..db6a6b7 100644
---- a/net/ipv4/ipvs/ip_vs_proto_esp.c
-+++ b/net/ipv4/ipvs/ip_vs_proto_esp.c
-@@ -159,6 +159,7 @@ static void esp_exit(struct ip_vs_protocol *pp)
- struct ip_vs_protocol ip_vs_protocol_esp = {
- 	.name =			"ESP",
- 	.protocol =		IPPROTO_ESP,
-+	.num_states =		1,
- 	.dont_defrag =		1,
- 	.init =			esp_init,
- 	.exit =			esp_exit,
-diff --git a/net/ipv4/ipvs/ip_vs_proto_tcp.c b/net/ipv4/ipvs/ip_vs_proto_tcp.c
-index 12dc0d6..480f876 100644
---- a/net/ipv4/ipvs/ip_vs_proto_tcp.c
-+++ b/net/ipv4/ipvs/ip_vs_proto_tcp.c
-@@ -594,6 +594,7 @@ static void ip_vs_tcp_exit(struct ip_vs_protocol *pp)
- struct ip_vs_protocol ip_vs_protocol_tcp = {
- 	.name =			"TCP",
- 	.protocol =		IPPROTO_TCP,
-+	.num_states =		IP_VS_TCP_S_LAST,
- 	.dont_defrag =		0,
- 	.appcnt =		ATOMIC_INIT(0),
- 	.init =			ip_vs_tcp_init,
-diff --git a/net/ipv4/ipvs/ip_vs_proto_udp.c b/net/ipv4/ipvs/ip_vs_proto_udp.c
-index 1fa7b33..8e3b059 100644
---- a/net/ipv4/ipvs/ip_vs_proto_udp.c
-+++ b/net/ipv4/ipvs/ip_vs_proto_udp.c
-@@ -409,6 +409,7 @@ static void udp_exit(struct ip_vs_protocol *pp)
- struct ip_vs_protocol ip_vs_protocol_udp = {
- 	.name =			"UDP",
- 	.protocol =		IPPROTO_UDP,
-+	.num_states =		IP_VS_UDP_S_LAST,
- 	.dont_defrag =		0,
- 	.init =			udp_init,
- 	.exit =			udp_exit,
-diff --git a/net/ipv4/ipvs/ip_vs_sync.c b/net/ipv4/ipvs/ip_vs_sync.c
-index 948378d..a392d6e 100644
---- a/net/ipv4/ipvs/ip_vs_sync.c
-+++ b/net/ipv4/ipvs/ip_vs_sync.c
-@@ -288,11 +288,16 @@ static void ip_vs_process_message(const char *buffer, const size_t buflen)
- 	char *p;
- 	int i;
- 
-+	if (buflen < sizeof(struct ip_vs_sync_mesg)) {
-+		IP_VS_ERR_RL("sync message header too short\n");
-+		return;
-+	}
-+
- 	/* Convert size back to host byte order */
- 	m->size = ntohs(m->size);
- 
- 	if (buflen != m->size) {
--		IP_VS_ERR("bogus message\n");
-+		IP_VS_ERR_RL("bogus sync message size\n");
- 		return;
- 	}
- 
-@@ -307,9 +312,48 @@ static void ip_vs_process_message(const char *buffer, const size_t buflen)
- 	for (i=0; i<m->nr_conns; i++) {
- 		unsigned flags, state;
- 
--		s = (struct ip_vs_sync_conn *)p;
-+		if (p + SIMPLE_CONN_SIZE > buffer+buflen) {
-+			IP_VS_ERR_RL("bogus conn in sync message\n");
-+			return;
-+		}
-+		s = (struct ip_vs_sync_conn *) p;
- 		flags = ntohs(s->flags) | IP_VS_CONN_F_SYNC;
-+		flags &= ~IP_VS_CONN_F_HASHED;
-+		if (flags & IP_VS_CONN_F_SEQ_MASK) {
-+			opt = (struct ip_vs_sync_conn_options *)&s[1];
-+			p += FULL_CONN_SIZE;
-+			if (p > buffer+buflen) {
-+				IP_VS_ERR_RL("bogus conn options in sync message\n");
-+				return;
-+			}
-+		} else {
-+			opt = NULL;
-+			p += SIMPLE_CONN_SIZE;
-+		}
-+
- 		state = ntohs(s->state);
-+		if (!(flags & IP_VS_CONN_F_TEMPLATE)) {
-+			pp = ip_vs_proto_get(s->protocol);
-+			if (!pp) {
-+				IP_VS_ERR_RL("Unsupported protocol %u in sync msg\n",
-+					s->protocol);
-+				continue;
-+			}
-+			if (state >= pp->num_states) {
-+				IP_VS_DBG(2, "Invalid %s state %u in sync msg\n",
-+					pp->name, state);
-+				continue;
-+			}
-+		} else {
-+			/* protocol in templates is not used for state/timeout */
-+			pp = NULL;
-+			if (state > 0) {
-+				IP_VS_DBG(2, "Invalid template state %u in sync msg\n",
-+					state);
-+				state = 0;
-+			}
-+		}
-+
- 		if (!(flags & IP_VS_CONN_F_TEMPLATE))
- 			cp = ip_vs_conn_in_get(s->protocol,
- 					       s->caddr, s->cport,
-@@ -345,14 +389,9 @@ static void ip_vs_process_message(const char *buffer, const size_t buflen)
- 				IP_VS_ERR("ip_vs_conn_new failed\n");
- 				return;
- 			}
--			cp->state = state;
- 		} else if (!cp->dest) {
- 			dest = ip_vs_try_bind_dest(cp);
--			if (!dest) {
--				/* it is an unbound entry created by
--				 * synchronization */
--				cp->flags = flags | IP_VS_CONN_F_HASHED;
--			} else
-+			if (dest)
- 				atomic_dec(&dest->refcnt);
- 		} else if ((cp->dest) && (cp->protocol == IPPROTO_TCP) &&
- 			   (cp->state != state)) {
-@@ -371,23 +410,22 @@ static void ip_vs_process_message(const char *buffer, const size_t buflen)
- 			}
- 		}
- 
--		if (flags & IP_VS_CONN_F_SEQ_MASK) {
--			opt = (struct ip_vs_sync_conn_options *)&s[1];
-+		if (opt)
- 			memcpy(&cp->in_seq, opt, sizeof(*opt));
--			p += FULL_CONN_SIZE;
--		} else
--			p += SIMPLE_CONN_SIZE;
--
- 		atomic_set(&cp->in_pkts, sysctl_ip_vs_sync_threshold[0]);
- 		cp->state = state;
--		pp = ip_vs_proto_get(s->protocol);
--		cp->timeout = pp->timeout_table[cp->state];
-+		cp->old_state = cp->state;
-+		/*
-+		 * We can not recover the right timeout for templates
-+		 * in all cases, we can not find the right fwmark
-+		 * virtual service. If needed, we can do it for
-+		 * non-fwmark persistent services.
-+		 */
-+		if (!(flags & IP_VS_CONN_F_TEMPLATE) && pp->timeout_table)
-+			cp->timeout = pp->timeout_table[state];
-+		else
-+			cp->timeout = (3*60*HZ);
- 		ip_vs_conn_put(cp);
--
--		if (p > buffer+buflen) {
--			IP_VS_ERR("bogus message\n");
--			return;
--		}
- 	}
- }
- 
-diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
-index 4dc1628..e46d8fa 100644
---- a/net/ipv4/netfilter/ip_queue.c
-+++ b/net/ipv4/netfilter/ip_queue.c
-@@ -296,9 +296,8 @@ ipq_mangle_ipv4(ipq_verdict_msg_t *v, struct nf_queue_entry *e)
- 		if (v->data_len > 0xFFFF)
- 			return -EINVAL;
- 		if (diff > skb_tailroom(e->skb)) {
--			nskb = skb_copy_expand(e->skb, 0,
--					       diff - skb_tailroom(e->skb),
--					       GFP_ATOMIC);
-+			nskb = skb_copy_expand(e->skb, skb_headroom(e->skb),
-+					       diff, GFP_ATOMIC);
- 			if (!nskb) {
- 				printk(KERN_WARNING "ip_queue: error "
- 				      "in mangle, dropping packet\n");
-diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
-index a65b845..50ad6ef 100644
---- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
-+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
-@@ -305,7 +305,7 @@ getorigdst(struct sock *sk, int optval, void __user *user, int *len)
- 	const struct nf_conntrack_tuple_hash *h;
- 	struct nf_conntrack_tuple tuple;
- 
--	NF_CT_TUPLE_U_BLANK(&tuple);
-+	memset(&tuple, 0, sizeof(tuple));
- 	tuple.src.u3.ip = inet->rcv_saddr;
- 	tuple.src.u.tcp.port = inet->sport;
- 	tuple.dst.u3.ip = inet->daddr;
-diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
-index 8d366f7..12b4dc5 100644
---- a/net/ipv6/netfilter/ip6_queue.c
-+++ b/net/ipv6/netfilter/ip6_queue.c
-@@ -298,9 +298,8 @@ ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct nf_queue_entry *e)
- 		if (v->data_len > 0xFFFF)
- 			return -EINVAL;
- 		if (diff > skb_tailroom(e->skb)) {
--			nskb = skb_copy_expand(e->skb, 0,
--					       diff - skb_tailroom(e->skb),
--					       GFP_ATOMIC);
-+			nskb = skb_copy_expand(e->skb, skb_headroom(e->skb),
-+					       diff, GFP_ATOMIC);
- 			if (!nskb) {
- 				printk(KERN_WARNING "ip6_queue: OOM "
- 				      "in mangle, dropping packet\n");
-diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
-index b77eb56..4147de6 100644
---- a/net/netfilter/nf_conntrack_core.c
-+++ b/net/netfilter/nf_conntrack_core.c
-@@ -104,7 +104,7 @@ nf_ct_get_tuple(const struct sk_buff *skb,
- 		const struct nf_conntrack_l3proto *l3proto,
- 		const struct nf_conntrack_l4proto *l4proto)
- {
--	NF_CT_TUPLE_U_BLANK(tuple);
-+	memset(tuple, 0, sizeof(*tuple));
- 
- 	tuple->src.l3num = l3num;
- 	if (l3proto->pkt_to_tuple(skb, nhoff, tuple) == 0)
-@@ -153,7 +153,7 @@ nf_ct_invert_tuple(struct nf_conntrack_tuple *inverse,
- 		   const struct nf_conntrack_l3proto *l3proto,
- 		   const struct nf_conntrack_l4proto *l4proto)
- {
--	NF_CT_TUPLE_U_BLANK(inverse);
-+	memset(inverse, 0, sizeof(*inverse));
- 
- 	inverse->src.l3num = orig->src.l3num;
- 	if (l3proto->invert_tuple(inverse, orig) == 0)
-diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
-index 10522c0..bcaf967 100644
---- a/net/netfilter/nfnetlink_queue.c
-+++ b/net/netfilter/nfnetlink_queue.c
-@@ -454,9 +454,8 @@ nfqnl_mangle(void *data, int data_len, struct nf_queue_entry *e)
- 		if (data_len > 0xFFFF)
- 			return -EINVAL;
- 		if (diff > skb_tailroom(e->skb)) {
--			nskb = skb_copy_expand(e->skb, 0,
--					       diff - skb_tailroom(e->skb),
--					       GFP_ATOMIC);
-+			nskb = skb_copy_expand(e->skb, skb_headroom(e->skb),
-+					       diff, GFP_ATOMIC);
- 			if (!nskb) {
- 				printk(KERN_WARNING "nf_queue: OOM "
- 				      "in mangle, dropping packet\n");
-diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
-index 66148cc..5bc1ed4 100644
---- a/net/sched/sch_htb.c
-+++ b/net/sched/sch_htb.c
-@@ -1197,12 +1197,16 @@ static inline int htb_parent_last_child(struct htb_class *cl)
- 	return 1;
- }
- 
--static void htb_parent_to_leaf(struct htb_class *cl, struct Qdisc *new_q)
-+static void htb_parent_to_leaf(struct htb_sched *q, struct htb_class *cl,
-+			       struct Qdisc *new_q)
- {
- 	struct htb_class *parent = cl->parent;
- 
- 	BUG_TRAP(!cl->level && cl->un.leaf.q && !cl->prio_activity);
- 
-+	if (parent->cmode != HTB_CAN_SEND)
-+		htb_safe_rb_erase(&parent->pq_node, q->wait_pq + parent->level);
-+
- 	parent->level = 0;
- 	memset(&parent->un.inner, 0, sizeof(parent->un.inner));
- 	INIT_LIST_HEAD(&parent->un.leaf.drop_list);
-@@ -1300,7 +1304,7 @@ static int htb_delete(struct Qdisc *sch, unsigned long arg)
- 		htb_deactivate(q, cl);
- 
- 	if (last_child)
--		htb_parent_to_leaf(cl, new_q);
-+		htb_parent_to_leaf(q, cl, new_q);
- 
- 	if (--cl->refcnt == 0)
- 		htb_destroy_class(sch, cl);
-diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
-index 58f1f93..413885c 100644
---- a/net/xfrm/xfrm_state.c
-+++ b/net/xfrm/xfrm_state.c
-@@ -2093,7 +2093,7 @@ static void xfrm_audit_helper_pktinfo(struct sk_buff *skb, u16 family,
- 		iph6 = ipv6_hdr(skb);
- 		audit_log_format(audit_buf,
- 				 " src=" NIP6_FMT " dst=" NIP6_FMT
--				 " flowlbl=0x%x%x%x",
-+				 " flowlbl=0x%x%02x%02x",
- 				 NIP6(iph6->saddr),
- 				 NIP6(iph6->daddr),
- 				 iph6->flow_lbl[0] & 0x0f,

Deleted: genpatches-2.6/trunk/2.6.26/1004_linux-2.6.25.5.patch
===================================================================
--- genpatches-2.6/trunk/2.6.26/1004_linux-2.6.25.5.patch	2008-07-17 02:44:10 UTC (rev 1328)
+++ genpatches-2.6/trunk/2.6.26/1004_linux-2.6.25.5.patch	2008-07-17 02:47:50 UTC (rev 1329)
@@ -1,78 +0,0 @@
-diff --git a/fs/cifs/asn1.c b/fs/cifs/asn1.c
-index bcda2c6..5dbba89 100644
---- a/fs/cifs/asn1.c
-+++ b/fs/cifs/asn1.c
-@@ -186,6 +186,11 @@ asn1_length_decode(struct asn1_ctx *ctx, unsigned int *def, unsigned int *len)
- 			}
- 		}
- 	}
-+
-+	/* don't trust len bigger than ctx buffer */
-+	if (*len > ctx->end - ctx->pointer)
-+		return 0;
-+
- 	return 1;
- }
- 
-@@ -203,6 +208,10 @@ asn1_header_decode(struct asn1_ctx *ctx,
- 	if (!asn1_length_decode(ctx, &def, &len))
- 		return 0;
- 
-+	/* primitive shall be definite, indefinite shall be constructed */
-+	if (*con == ASN1_PRI && !def)
-+		return 0;
-+
- 	if (def)
- 		*eoc = ctx->pointer + len;
- 	else
-@@ -389,6 +398,11 @@ asn1_oid_decode(struct asn1_ctx *ctx,
- 	unsigned long *optr;
- 
- 	size = eoc - ctx->pointer + 1;
-+
-+	/* first subid actually encodes first two subids */
-+	if (size < 2 || size > ULONG_MAX/sizeof(unsigned long))
-+		return 0;
-+
- 	*oid = kmalloc(size * sizeof(unsigned long), GFP_ATOMIC);
- 	if (*oid == NULL)
- 		return 0;
-diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c b/net/ipv4/netfilter/nf_nat_snmp_basic.c
-index 540ce6a..5f35f0b 100644
---- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
-+++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
-@@ -231,6 +231,11 @@ static unsigned char asn1_length_decode(struct asn1_ctx *ctx,
- 			}
- 		}
- 	}
-+
-+	/* don't trust len bigger than ctx buffer */
-+	if (*len > ctx->end - ctx->pointer)
-+		return 0;
-+
- 	return 1;
- }
- 
-@@ -249,6 +254,10 @@ static unsigned char asn1_header_decode(struct asn1_ctx *ctx,
- 	if (!asn1_length_decode(ctx, &def, &len))
- 		return 0;
- 
-+	/* primitive shall be definite, indefinite shall be constructed */
-+	if (*con == ASN1_PRI && !def)
-+		return 0;
-+
- 	if (def)
- 		*eoc = ctx->pointer + len;
- 	else
-@@ -433,6 +442,11 @@ static unsigned char asn1_oid_decode(struct asn1_ctx *ctx,
- 	unsigned long *optr;
- 
- 	size = eoc - ctx->pointer + 1;
-+
-+	/* first subid actually encodes first two subids */
-+	if (size < 2 || size > ULONG_MAX/sizeof(unsigned long))
-+		return 0;
-+
- 	*oid = kmalloc(size * sizeof(unsigned long), GFP_ATOMIC);
- 	if (*oid == NULL) {
- 		if (net_ratelimit())

Deleted: genpatches-2.6/trunk/2.6.26/1005_linux-2.6.25.6.patch
===================================================================
--- genpatches-2.6/trunk/2.6.26/1005_linux-2.6.25.6.patch	2008-07-17 02:44:10 UTC (rev 1328)
+++ genpatches-2.6/trunk/2.6.26/1005_linux-2.6.25.6.patch	2008-07-17 02:47:50 UTC (rev 1329)
@@ -1,1803 +0,0 @@
-diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
-index be35ffa..1457aa0 100644
---- a/arch/powerpc/kernel/smp.c
-+++ b/arch/powerpc/kernel/smp.c
-@@ -386,6 +386,8 @@ static void __init smp_create_idle(unsigned int cpu)
- 		panic("failed fork for CPU %u: %li", cpu, PTR_ERR(p));
- #ifdef CONFIG_PPC64
- 	paca[cpu].__current = p;
-+	paca[cpu].kstack = (unsigned long) task_thread_info(p)
-+		+ THREAD_SIZE - STACK_FRAME_OVERHEAD;
- #endif
- 	current_set[cpu] = task_thread_info(p);
- 	task_thread_info(p)->cpu = cpu;
-diff --git a/arch/powerpc/mm/slb.c b/arch/powerpc/mm/slb.c
-index 906daed..a9626d6 100644
---- a/arch/powerpc/mm/slb.c
-+++ b/arch/powerpc/mm/slb.c
-@@ -44,13 +44,13 @@ static void slb_allocate(unsigned long ea)
- 	slb_allocate_realmode(ea);
- }
- 
-+#define slb_esid_mask(ssize)	\
-+	(((ssize) == MMU_SEGSIZE_256M)? ESID_MASK: ESID_MASK_1T)
-+
- static inline unsigned long mk_esid_data(unsigned long ea, int ssize,
- 					 unsigned long slot)
- {
--	unsigned long mask;
--
--	mask = (ssize == MMU_SEGSIZE_256M)? ESID_MASK: ESID_MASK_1T;
--	return (ea & mask) | SLB_ESID_V | slot;
-+	return (ea & slb_esid_mask(ssize)) | SLB_ESID_V | slot;
- }
- 
- #define slb_vsid_shift(ssize)	\
-@@ -301,11 +301,16 @@ void slb_initialize(void)
- 
- 	create_shadowed_slbe(VMALLOC_START, mmu_kernel_ssize, vflags, 1);
- 
-+	/* For the boot cpu, we're running on the stack in init_thread_union,
-+	 * which is in the first segment of the linear mapping, and also
-+	 * get_paca()->kstack hasn't been initialized yet.
-+	 * For secondary cpus, we need to bolt the kernel stack entry now.
-+	 */
- 	slb_shadow_clear(2);
-+	if (raw_smp_processor_id() != boot_cpuid &&
-+	    (get_paca()->kstack & slb_esid_mask(mmu_kernel_ssize)) > PAGE_OFFSET)
-+		create_shadowed_slbe(get_paca()->kstack,
-+				     mmu_kernel_ssize, lflags, 2);
- 
--	/* We don't bolt the stack for the time being - we're in boot,
--	 * so the stack is in the bolted segment.  By the time it goes
--	 * elsewhere, we'll call _switch() which will bolt in the new
--	 * one. */
- 	asm volatile("isync":::"memory");
- }
-diff --git a/arch/x86/kernel/apic_64.c b/arch/x86/kernel/apic_64.c
-index d8d03e0..9629434 100644
---- a/arch/x86/kernel/apic_64.c
-+++ b/arch/x86/kernel/apic_64.c
-@@ -524,7 +524,7 @@ int setup_profiling_timer(unsigned int multiplier)
-  */
- void clear_local_APIC(void)
- {
--	int maxlvt = lapic_get_maxlvt();
-+	int maxlvt;
- 	u32 v;
- 
- 	/* APIC hasn't been mapped yet */
-diff --git a/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c b/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c
-index a962dcb..404ff26 100644
---- a/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c
-+++ b/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c
-@@ -339,6 +339,7 @@ static unsigned int get_cur_freq_on_cpu(unsigned int cpu)
- {
- 	struct acpi_cpufreq_data *data = per_cpu(drv_data, cpu);
- 	unsigned int freq;
-+	unsigned int cached_freq;
- 
- 	dprintk("get_cur_freq_on_cpu (%d)\n", cpu);
- 
-@@ -347,7 +348,16 @@ static unsigned int get_cur_freq_on_cpu(unsigned int cpu)
- 		return 0;
- 	}
- 
-+	cached_freq = data->freq_table[data->acpi_data->state].frequency;
- 	freq = extract_freq(get_cur_val(cpumask_of_cpu(cpu)), data);
-+	if (freq != cached_freq) {
-+		/*
-+		 * The dreaded BIOS frequency change behind our back.
-+		 * Force set the frequency on next target call.
-+		 */
-+		data->resume = 1;
-+	}
-+
- 	dprintk("cur freq = %u\n", freq);
- 
- 	return freq;
-diff --git a/arch/x86/kernel/irq_32.c b/arch/x86/kernel/irq_32.c
-index cef054b..89bb5ee 100644
---- a/arch/x86/kernel/irq_32.c
-+++ b/arch/x86/kernel/irq_32.c
-@@ -134,7 +134,7 @@ unsigned int do_IRQ(struct pt_regs *regs)
- 			: "=a" (arg1), "=d" (arg2), "=b" (bx)
- 			:  "0" (irq),   "1" (desc),  "2" (isp),
- 			   "D" (desc->handle_irq)
--			: "memory", "cc"
-+			: "memory", "cc", "ecx"
- 		);
- 	} else
- #endif
-diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
-index 43930e7..c8890b8 100644
---- a/arch/x86/kernel/process_32.c
-+++ b/arch/x86/kernel/process_32.c
-@@ -710,8 +710,11 @@ struct task_struct * __switch_to(struct task_struct *prev_p, struct task_struct
- 	/* If the task has used fpu the last 5 timeslices, just do a full
- 	 * restore of the math state immediately to avoid the trap; the
- 	 * chances of needing FPU soon are obviously high now
-+	 *
-+	 * tsk_used_math() checks prevent calling math_state_restore(),
-+	 * which can sleep in the case of !tsk_used_math()
- 	 */
--	if (next_p->fpu_counter > 5)
-+	if (tsk_used_math(next_p) && next_p->fpu_counter > 5)
- 		math_state_restore();
- 
- 	/*
-diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
-index 46c4c54..1316f1c 100644
---- a/arch/x86/kernel/process_64.c
-+++ b/arch/x86/kernel/process_64.c
-@@ -696,8 +696,11 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
- 	/* If the task has used fpu the last 5 timeslices, just do a full
- 	 * restore of the math state immediately to avoid the trap; the
- 	 * chances of needing FPU soon are obviously high now
-+	 *
-+	 * tsk_used_math() checks prevent calling math_state_restore(),
-+	 * which can sleep in the case of !tsk_used_math()
- 	 */
--	if (next_p->fpu_counter>5)
-+	if (tsk_used_math(next_p) && next_p->fpu_counter > 5)
- 		math_state_restore();
- 	return prev_p;
- }
-diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
-index eb92ccb..9003e0b 100644
---- a/arch/x86/kernel/ptrace.c
-+++ b/arch/x86/kernel/ptrace.c
-@@ -1382,6 +1382,9 @@ static const struct user_regset_view user_x86_64_view = {
- #define genregs32_get		genregs_get
- #define genregs32_set		genregs_set
- 
-+#define user_i387_ia32_struct	user_i387_struct
-+#define user32_fxsr_struct	user_fxsr_struct
-+
- #endif	/* CONFIG_X86_64 */
- 
- #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
-@@ -1394,13 +1397,13 @@ static const struct user_regset x86_32_regsets[] = {
- 	},
- 	[REGSET_FP] = {
- 		.core_note_type = NT_PRFPREG,
--		.n = sizeof(struct user_i387_struct) / sizeof(u32),
-+		.n = sizeof(struct user_i387_ia32_struct) / sizeof(u32),
- 		.size = sizeof(u32), .align = sizeof(u32),
- 		.active = fpregs_active, .get = fpregs_get, .set = fpregs_set
- 	},
- 	[REGSET_XFP] = {
- 		.core_note_type = NT_PRXFPREG,
--		.n = sizeof(struct user_i387_struct) / sizeof(u32),
-+		.n = sizeof(struct user32_fxsr_struct) / sizeof(u32),
- 		.size = sizeof(u32), .align = sizeof(u32),
- 		.active = xfpregs_active, .get = xfpregs_get, .set = xfpregs_set
- 	},
-diff --git a/arch/x86/kernel/tsc_32.c b/arch/x86/kernel/tsc_32.c
-index c2241e0..01e4f8b 100644
---- a/arch/x86/kernel/tsc_32.c
-+++ b/arch/x86/kernel/tsc_32.c
-@@ -14,7 +14,7 @@
- 
- #include "mach_timer.h"
- 
--static int tsc_enabled;
-+static int tsc_disabled;
- 
- /*
-  * On some systems the TSC frequency does not
-@@ -28,8 +28,8 @@ EXPORT_SYMBOL_GPL(tsc_khz);
- static int __init tsc_setup(char *str)
- {
- 	printk(KERN_WARNING "notsc: Kernel compiled with CONFIG_X86_TSC, "
--				"cannot disable TSC completely.\n");
--	mark_tsc_unstable("user disabled TSC");
-+	       "cannot disable TSC completely.\n");
-+	tsc_disabled = 1;
- 	return 1;
- }
- #else
-@@ -121,7 +121,7 @@ unsigned long long native_sched_clock(void)
- 	 *   very important for it to be as fast as the platform
- 	 *   can achive it. )
- 	 */
--	if (unlikely(!tsc_enabled && !tsc_unstable))
-+	if (unlikely(tsc_disabled))
- 		/* No locking but a rare wrong value is not a big deal: */
- 		return (jiffies_64 - INITIAL_JIFFIES) * (1000000000 / HZ);
- 
-@@ -310,7 +310,6 @@ void mark_tsc_unstable(char *reason)
- {
- 	if (!tsc_unstable) {
- 		tsc_unstable = 1;
--		tsc_enabled = 0;
- 		printk("Marking TSC unstable due to: %s.\n", reason);
- 		/* Can be called before registration */
- 		if (clocksource_tsc.mult)
-@@ -324,7 +323,7 @@ EXPORT_SYMBOL_GPL(mark_tsc_unstable);
- static int __init dmi_mark_tsc_unstable(const struct dmi_system_id *d)
- {
- 	printk(KERN_NOTICE "%s detected: marking TSC unstable.\n",
--		       d->ident);
-+	       d->ident);
- 	tsc_unstable = 1;
- 	return 0;
- }
-@@ -391,14 +390,24 @@ void __init tsc_init(void)
- {
- 	int cpu;
- 
--	if (!cpu_has_tsc)
--		goto out_no_tsc;
-+	if (!cpu_has_tsc || tsc_disabled) {
-+		/* Disable the TSC in case of !cpu_has_tsc */
-+		tsc_disabled = 1;
-+		return;
-+	}
- 
- 	cpu_khz = calculate_cpu_khz();
- 	tsc_khz = cpu_khz;
- 
--	if (!cpu_khz)
--		goto out_no_tsc;
-+	if (!cpu_khz) {
-+		mark_tsc_unstable("could not calculate TSC khz");
-+		/*
-+		 * We need to disable the TSC completely in this case
-+		 * to prevent sched_clock() from using it.
-+		 */
-+		tsc_disabled = 1;
-+		return;
-+	}
- 
- 	printk("Detected %lu.%03lu MHz processor.\n",
- 				(unsigned long)cpu_khz / 1000,
-@@ -427,13 +436,6 @@ void __init tsc_init(void)
- 	if (check_tsc_unstable()) {
- 		clocksource_tsc.rating = 0;
- 		clocksource_tsc.flags &= ~CLOCK_SOURCE_IS_CONTINUOUS;
--	} else
--		tsc_enabled = 1;
--
-+	}
- 	clocksource_register(&clocksource_tsc);
--
--	return;
--
--out_no_tsc:
--	setup_clear_cpu_cap(X86_FEATURE_TSC);
- }
-diff --git a/arch/x86/kernel/tsc_64.c b/arch/x86/kernel/tsc_64.c
-index d3bebaa..5153afc 100644
---- a/arch/x86/kernel/tsc_64.c
-+++ b/arch/x86/kernel/tsc_64.c
-@@ -227,14 +227,14 @@ void __init tsc_calibrate(void)
- 	/* hpet or pmtimer available ? */
- 	if (!hpet && !pm1 && !pm2) {
- 		printk(KERN_INFO "TSC calibrated against PIT\n");
--		return;
-+		goto out;
- 	}
- 
- 	/* Check, whether the sampling was disturbed by an SMI */
- 	if (tsc1 == ULONG_MAX || tsc2 == ULONG_MAX) {
- 		printk(KERN_WARNING "TSC calibration disturbed by SMI, "
- 		       "using PIT calibration result\n");
--		return;
-+		goto out;
- 	}
- 
- 	tsc2 = (tsc2 - tsc1) * 1000000L;
-@@ -255,6 +255,7 @@ void __init tsc_calibrate(void)
- 
- 	tsc_khz = tsc2 / tsc1;
- 
-+out:
- 	for_each_possible_cpu(cpu)
- 		set_cyc2ns_scale(tsc_khz, cpu);
- }
-diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
-index a02a14f..b2c5231 100644
---- a/arch/x86/mm/init_64.c
-+++ b/arch/x86/mm/init_64.c
-@@ -192,7 +192,7 @@ void __init cleanup_highmap(void)
- 	pmd_t *last_pmd = pmd + PTRS_PER_PMD;
- 
- 	for (; pmd < last_pmd; pmd++, vaddr += PMD_SIZE) {
--		if (!pmd_present(*pmd))
-+		if (pmd_none(*pmd))
- 			continue;
- 		if (vaddr < (unsigned long) _text || vaddr > end)
- 			set_pmd(pmd, __pmd(0));
-diff --git a/arch/x86/pci/common.c b/arch/x86/pci/common.c
-index 05356ce..c7e2a44 100644
---- a/arch/x86/pci/common.c
-+++ b/arch/x86/pci/common.c
-@@ -130,19 +130,6 @@ static void __devinit pcibios_fixup_ghosts(struct pci_bus *b)
- 	}
- }
- 
--static void __devinit pcibios_fixup_device_resources(struct pci_dev *dev)
--{
--	struct resource *rom_r = &dev->resource[PCI_ROM_RESOURCE];
--
--	if (rom_r->parent)
--		return;
--	if (rom_r->start)
--		/* we deal with BIOS assigned ROM later */
--		return;
--	if (!(pci_probe & PCI_ASSIGN_ROMS))
--		rom_r->start = rom_r->end = rom_r->flags = 0;
--}
--
- /*
-  *  Called after each bus is probed, but before its children
-  *  are examined.
-@@ -150,12 +137,8 @@ static void __devinit pcibios_fixup_device_resources(struct pci_dev *dev)
- 
- void __devinit  pcibios_fixup_bus(struct pci_bus *b)
- {
--	struct pci_dev *dev;
--
- 	pcibios_fixup_ghosts(b);
- 	pci_read_bridge_bases(b);
--	list_for_each_entry(dev, &b->devices, bus_list)
--		pcibios_fixup_device_resources(dev);
- }
- 
- /*
-diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
-index be95fdb..92da864 100644
---- a/drivers/ata/libata-core.c
-+++ b/drivers/ata/libata-core.c
-@@ -3947,6 +3947,7 @@ int ata_std_prereset(struct ata_link *link, unsigned long deadline)
- 	struct ata_port *ap = link->ap;
- 	struct ata_eh_context *ehc = &link->eh_context;
- 	const unsigned long *timing = sata_ehc_deb_timing(ehc);
-+	u32 sstatus;
- 	int rc;
- 
- 	/* handle link resume */
-@@ -3960,6 +3961,17 @@ int ata_std_prereset(struct ata_link *link, unsigned long deadline)
- 	if (ap->flags & ATA_FLAG_PMP)
- 		ehc->i.action |= ATA_EH_HARDRESET;
- 
-+	/* if link powersave is on, force hardreset */
-+	if (sata_scr_read(link, SCR_STATUS, &sstatus) == 0) {
-+		u8 ipm = sstatus >> 8;
-+
-+		if (ipm == 2 || ipm == 6) {
-+			ata_link_printk(link, KERN_INFO, "link in powersave "
-+				"mode (ipm=%d), forcing hardreset\n", ipm);
-+			ehc->i.action |= ATA_EH_HARDRESET;
-+		}
-+	}
-+
- 	/* if we're about to do hardreset, nothing more to do */
- 	if (ehc->i.action & ATA_EH_HARDRESET)
- 		return 0;
-diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
-index 35a26a3..99aa5f5 100644
---- a/drivers/cpufreq/cpufreq.c
-+++ b/drivers/cpufreq/cpufreq.c
-@@ -607,7 +607,7 @@ static ssize_t store_scaling_setspeed(struct cpufreq_policy *policy,
- 	unsigned int freq = 0;
- 	unsigned int ret;
- 
--	if (!policy->governor->store_setspeed)
-+	if (!policy->governor || !policy->governor->store_setspeed)
- 		return -EINVAL;
- 
- 	ret = sscanf(buf, "%u", &freq);
-@@ -621,7 +621,7 @@ static ssize_t store_scaling_setspeed(struct cpufreq_policy *policy,
- 
- static ssize_t show_scaling_setspeed(struct cpufreq_policy *policy, char *buf)
- {
--	if (!policy->governor->show_setspeed)
-+	if (!policy->governor || !policy->governor->show_setspeed)
- 		return sprintf(buf, "<unsupported>\n");
- 
- 	return policy->governor->show_setspeed(policy, buf);
-diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
-index c3eb3f1..452b94d 100644
---- a/drivers/hid/hid-input.c
-+++ b/drivers/hid/hid-input.c
-@@ -218,8 +218,9 @@ int hidinput_apple_event(struct hid_device *hid, struct input_dev *input,
- 			}
- 		}
- 
--		if (test_bit(usage->code, hid->pb_pressed_numlock) ||
--				test_bit(LED_NUML, input->led)) {
-+		if (hid->quirks & HID_QUIRK_APPLE_NUMLOCK_EMULATION && (
-+				test_bit(usage->code, hid->pb_pressed_numlock) ||
-+				test_bit(LED_NUML, input->led))) {
- 			trans = find_translation(powerbook_numlock_keys, usage->code);
- 
- 			if (trans) {
-diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
-index e29a057..7fbe08c 100644
---- a/drivers/hid/usbhid/hid-quirks.c
-+++ b/drivers/hid/usbhid/hid-quirks.c
-@@ -613,28 +613,28 @@ static const struct hid_blacklist {
- 
- 	{ USB_VENDOR_ID_WISEGROUP_LTD, USB_DEVICE_ID_SMARTJOY_DUAL_PLUS, HID_QUIRK_NOGET | HID_QUIRK_MULTI_INPUT },
- 
--	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_ANSI, HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_IGNORE_MOUSE },
--	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_ISO, HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_IGNORE_MOUSE },
--	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER_ANSI, HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_IGNORE_MOUSE },
--	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER_ISO, HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_IGNORE_MOUSE | HID_QUIRK_APPLE_ISO_KEYBOARD},
--	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER_JIS, HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_IGNORE_MOUSE },
--	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER3_ANSI, HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_IGNORE_MOUSE },
--	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER3_ISO, HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_IGNORE_MOUSE | HID_QUIRK_APPLE_ISO_KEYBOARD},
--	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER3_JIS, HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_IGNORE_MOUSE },
--	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER4_ANSI, HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_IGNORE_MOUSE },
--	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER4_ISO, HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_IGNORE_MOUSE | HID_QUIRK_APPLE_ISO_KEYBOARD},
--	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER4_JIS, HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_IGNORE_MOUSE },
-+	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_ANSI, HID_QUIRK_APPLE_NUMLOCK_EMULATION | HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_IGNORE_MOUSE },
-+	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_ISO, HID_QUIRK_APPLE_NUMLOCK_EMULATION | HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_IGNORE_MOUSE },
-+	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER_ANSI, HID_QUIRK_APPLE_NUMLOCK_EMULATION | HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_IGNORE_MOUSE },
-+	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER_ISO, HID_QUIRK_APPLE_NUMLOCK_EMULATION | HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_IGNORE_MOUSE | HID_QUIRK_APPLE_ISO_KEYBOARD},
-+	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER_JIS, HID_QUIRK_APPLE_NUMLOCK_EMULATION | HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_IGNORE_MOUSE },
-+	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER3_ANSI, HID_QUIRK_APPLE_NUMLOCK_EMULATION | HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_IGNORE_MOUSE },
-+	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER3_ISO, HID_QUIRK_APPLE_NUMLOCK_EMULATION | HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_IGNORE_MOUSE | HID_QUIRK_APPLE_ISO_KEYBOARD},
-+	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER3_JIS, HID_QUIRK_APPLE_NUMLOCK_EMULATION | HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_IGNORE_MOUSE },
-+	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER4_ANSI, HID_QUIRK_APPLE_NUMLOCK_EMULATION | HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_IGNORE_MOUSE },
-+	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER4_ISO, HID_QUIRK_APPLE_NUMLOCK_EMULATION | HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_IGNORE_MOUSE | HID_QUIRK_APPLE_ISO_KEYBOARD},
-+	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER4_JIS, HID_QUIRK_APPLE_NUMLOCK_EMULATION | HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_IGNORE_MOUSE },
- 	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_ANSI, HID_QUIRK_APPLE_HAS_FN },
- 	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_ISO, HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_APPLE_ISO_KEYBOARD },
- 	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_JIS, HID_QUIRK_APPLE_HAS_FN },
--	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER4_HF_ANSI, HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_IGNORE_MOUSE },
--	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER4_HF_ISO, HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_IGNORE_MOUSE },
--	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER4_HF_JIS, HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_IGNORE_MOUSE },
--	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_ANSI, HID_QUIRK_APPLE_HAS_FN },
--	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_ISO, HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_APPLE_ISO_KEYBOARD },
--	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_JIS, HID_QUIRK_APPLE_HAS_FN },
--	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY, HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_IGNORE_MOUSE },
--	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY, HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_IGNORE_MOUSE },
-+	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER4_HF_ANSI, HID_QUIRK_APPLE_NUMLOCK_EMULATION | HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_IGNORE_MOUSE },
-+	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER4_HF_ISO, HID_QUIRK_APPLE_NUMLOCK_EMULATION | HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_IGNORE_MOUSE },
-+	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER4_HF_JIS, HID_QUIRK_APPLE_NUMLOCK_EMULATION | HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_IGNORE_MOUSE },
-+	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_ANSI, HID_QUIRK_APPLE_NUMLOCK_EMULATION | HID_QUIRK_APPLE_HAS_FN },
-+	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_ISO, HID_QUIRK_APPLE_NUMLOCK_EMULATION | HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_APPLE_ISO_KEYBOARD },
-+	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_JIS, HID_QUIRK_APPLE_NUMLOCK_EMULATION | HID_QUIRK_APPLE_HAS_FN },
-+	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY, HID_QUIRK_APPLE_NUMLOCK_EMULATION | HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_IGNORE_MOUSE },
-+	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY, HID_QUIRK_APPLE_NUMLOCK_EMULATION | HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_IGNORE_MOUSE },
- 
- 	{ USB_VENDOR_ID_DELL, USB_DEVICE_ID_DELL_W7658, HID_QUIRK_RESET_LEDS },
- 	{ USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_KBD, HID_QUIRK_RESET_LEDS },
-diff --git a/drivers/i2c/busses/i2c-nforce2.c b/drivers/i2c/busses/i2c-nforce2.c
-index 3dac920..43c9f8d 100644
---- a/drivers/i2c/busses/i2c-nforce2.c
-+++ b/drivers/i2c/busses/i2c-nforce2.c
-@@ -50,6 +50,7 @@
- #include <linux/init.h>
- #include <linux/i2c.h>
- #include <linux/delay.h>
-+#include <linux/dmi.h>
- #include <asm/io.h>
- 
- MODULE_LICENSE("GPL");
-@@ -109,6 +110,18 @@ struct nforce2_smbus {
- /* Misc definitions */
- #define MAX_TIMEOUT	100
- 
-+/* We disable the second SMBus channel on these boards */
-+static struct dmi_system_id __devinitdata nforce2_dmi_blacklist2[] = {
-+	{
-+		.ident = "DFI Lanparty NF4 Expert",
-+		.matches = {
-+			DMI_MATCH(DMI_BOARD_VENDOR, "DFI Corp,LTD"),
-+			DMI_MATCH(DMI_BOARD_NAME, "LP UT NF4 Expert"),
-+		},
-+	},
-+	{ }
-+};
-+
- static struct pci_driver nforce2_driver;
- 
- static void nforce2_abort(struct i2c_adapter *adap)
-@@ -367,10 +380,17 @@ static int __devinit nforce2_probe(struct pci_dev *dev, const struct pci_device_
- 		smbuses[0].base = 0;	/* to have a check value */
- 	}
- 	/* SMBus adapter 2 */
--	res2 = nforce2_probe_smb(dev, 5, NFORCE_PCI_SMB2, &smbuses[1], "SMB2");
--	if (res2 < 0) {
--		dev_err(&dev->dev, "Error probing SMB2.\n");
--		smbuses[1].base = 0;	/* to have a check value */
-+	if (dmi_check_system(nforce2_dmi_blacklist2)) {
-+		dev_err(&dev->dev, "Disabling SMB2 for safety reasons.\n");
-+		res2 = -EPERM;
-+		smbuses[1].base = 0;
-+	} else {
-+		res2 = nforce2_probe_smb(dev, 5, NFORCE_PCI_SMB2, &smbuses[1],
-+					 "SMB2");
-+		if (res2 < 0) {
-+			dev_err(&dev->dev, "Error probing SMB2.\n");
-+			smbuses[1].base = 0;	/* to have a check value */
-+		}
- 	}
- 	if ((res1 < 0) && (res2 < 0)) {
- 		/* we did not find even one of the SMBuses, so we give up */
-diff --git a/drivers/i2c/chips/max6875.c b/drivers/i2c/chips/max6875.c
-index fb7ea56..cf507b3 100644
---- a/drivers/i2c/chips/max6875.c
-+++ b/drivers/i2c/chips/max6875.c
-@@ -207,9 +207,6 @@ static int max6875_detect(struct i2c_adapter *adapter, int address, int kind)
- 	fake_client->flags = 0;
- 	strlcpy(fake_client->name, "max6875 subclient", I2C_NAME_SIZE);
- 
--	/* Prevent 24RF08 corruption (in case of user error) */
--	i2c_smbus_write_quick(real_client, 0);
--
- 	if ((err = i2c_attach_client(real_client)) != 0)
- 		goto exit_kfree2;
- 
-diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
-index 31a53c5..ae7e6e7 100644
---- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
-+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
-@@ -194,7 +194,13 @@ static int ipoib_mcast_join_finish(struct ipoib_mcast *mcast,
- 	/* Set the cached Q_Key before we attach if it's the broadcast group */
- 	if (!memcmp(mcast->mcmember.mgid.raw, priv->dev->broadcast + 4,
- 		    sizeof (union ib_gid))) {
-+		spin_lock_irq(&priv->lock);
-+		if (!priv->broadcast) {
-+			spin_unlock_irq(&priv->lock);
-+			return -EAGAIN;
-+		}
- 		priv->qkey = be32_to_cpu(priv->broadcast->mcmember.qkey);
-+		spin_unlock_irq(&priv->lock);
- 		priv->tx_wr.wr.ud.remote_qkey = priv->qkey;
- 	}
- 
-diff --git a/drivers/md/md.c b/drivers/md/md.c
-index 9f6d228..ba34990 100644
---- a/drivers/md/md.c
-+++ b/drivers/md/md.c
-@@ -274,6 +274,7 @@ static mddev_t * mddev_find(dev_t unit)
- 	atomic_set(&new->active, 1);
- 	spin_lock_init(&new->write_lock);
- 	init_waitqueue_head(&new->sb_wait);
-+	init_waitqueue_head(&new->recovery_wait);
- 	new->reshape_position = MaxSector;
- 	new->resync_max = MaxSector;
- 
-@@ -5559,7 +5560,6 @@ void md_do_sync(mddev_t *mddev)
- 		window/2,(unsigned long long) max_sectors/2);
- 
- 	atomic_set(&mddev->recovery_active, 0);
--	init_waitqueue_head(&mddev->recovery_wait);
- 	last_check = 0;
- 
- 	if (j>2) {
-diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
-index 18a1379..705fe47 100644
---- a/drivers/md/raid5.c
-+++ b/drivers/md/raid5.c
-@@ -1984,6 +1984,7 @@ static int __handle_issuing_new_read_requests5(struct stripe_head *sh,
- 		 * have quiesced.
- 		 */
- 		if ((s->uptodate == disks - 1) &&
-+		    (s->failed && disk_idx == s->failed_num) &&
- 		    !test_bit(STRIPE_OP_CHECK, &sh->ops.pending)) {
- 			set_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.pending);
- 			set_bit(R5_Wantcompute, &dev->flags);
-@@ -2069,7 +2070,9 @@ static void handle_issuing_new_read_requests6(struct stripe_head *sh,
- 			/* we would like to get this block, possibly
- 			 * by computing it, but we might not be able to
- 			 */
--			if (s->uptodate == disks-1) {
-+			if ((s->uptodate == disks - 1) &&
-+			    (s->failed && (i == r6s->failed_num[0] ||
-+					   i == r6s->failed_num[1]))) {
- 				pr_debug("Computing stripe %llu block %d\n",
- 				       (unsigned long long)sh->sector, i);
- 				compute_block_1(sh, i, 0);
-@@ -2618,6 +2621,7 @@ static void handle_stripe5(struct stripe_head *sh)
- 	struct stripe_head_state s;
- 	struct r5dev *dev;
- 	unsigned long pending = 0;
-+	int prexor;
- 
- 	memset(&s, 0, sizeof(s));
- 	pr_debug("handling stripe %llu, state=%#lx cnt=%d, pd_idx=%d "
-@@ -2737,9 +2741,11 @@ static void handle_stripe5(struct stripe_head *sh)
- 	/* leave prexor set until postxor is done, allows us to distinguish
- 	 * a rmw from a rcw during biodrain
- 	 */
-+	prexor = 0;
- 	if (test_bit(STRIPE_OP_PREXOR, &sh->ops.complete) &&
- 		test_bit(STRIPE_OP_POSTXOR, &sh->ops.complete)) {
- 
-+		prexor = 1;
- 		clear_bit(STRIPE_OP_PREXOR, &sh->ops.complete);
- 		clear_bit(STRIPE_OP_PREXOR, &sh->ops.ack);
- 		clear_bit(STRIPE_OP_PREXOR, &sh->ops.pending);
-@@ -2773,6 +2779,8 @@ static void handle_stripe5(struct stripe_head *sh)
- 				if (!test_and_set_bit(
- 				    STRIPE_OP_IO, &sh->ops.pending))
- 					sh->ops.count++;
-+				if (prexor)
-+					continue;
- 				if (!test_bit(R5_Insync, &dev->flags) ||
- 				    (i == sh->pd_idx && s.failed == 0))
- 					set_bit(STRIPE_INSYNC, &sh->state);
-diff --git a/drivers/net/atl1/atl1_main.c b/drivers/net/atl1/atl1_main.c
-index 129b8b3..68be4e1 100644
---- a/drivers/net/atl1/atl1_main.c
-+++ b/drivers/net/atl1/atl1_main.c
-@@ -1334,6 +1334,7 @@ rrd_ok:
- 		/* Good Receive */
- 		pci_unmap_page(adapter->pdev, buffer_info->dma,
- 			       buffer_info->length, PCI_DMA_FROMDEVICE);
-+		buffer_info->dma = 0;
- 		skb = buffer_info->skb;
- 		length = le16_to_cpu(rrd->xsz.xsum_sz.pkt_size);
- 
-diff --git a/drivers/net/ps3_gelic_wireless.c b/drivers/net/ps3_gelic_wireless.c
-index c16de51..42daf85 100644
---- a/drivers/net/ps3_gelic_wireless.c
-+++ b/drivers/net/ps3_gelic_wireless.c
-@@ -2474,6 +2474,8 @@ static void gelic_wl_free(struct gelic_wl_info *wl)
- 
- 	pr_debug("%s: <-\n", __func__);
- 
-+	free_page((unsigned long)wl->buf);
-+
- 	pr_debug("%s: destroy queues\n", __func__);
- 	destroy_workqueue(wl->eurus_cmd_queue);
- 	destroy_workqueue(wl->event_queue);
-diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
-index 0147ea3..d8160fa 100644
---- a/drivers/usb/class/cdc-acm.c
-+++ b/drivers/usb/class/cdc-acm.c
-@@ -1242,6 +1242,9 @@ static struct usb_device_id acm_ids[] = {
- 	{ USB_DEVICE(0x22b8, 0x7000), /* Motorola Q Phone */
- 	.driver_info = NO_UNION_NORMAL, /* has no union descriptor */
- 	},
-+	{ USB_DEVICE(0x0803, 0x3095), /* Zoom Telephonics Model 3095F USB MODEM */
-+	.driver_info = NO_UNION_NORMAL, /* has no union descriptor */
-+	},
- 
- 	/* control interfaces with various AT-command sets */
- 	{ USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
-diff --git a/drivers/usb/host/ohci-omap.c b/drivers/usb/host/ohci-omap.c
-index 611bc9f..d05375d 100644
---- a/drivers/usb/host/ohci-omap.c
-+++ b/drivers/usb/host/ohci-omap.c
-@@ -511,7 +511,8 @@ static int ohci_omap_suspend(struct platform_device *dev, pm_message_t message)
- 
- static int ohci_omap_resume(struct platform_device *dev)
- {
--	struct ohci_hcd	*ohci = hcd_to_ohci(platform_get_drvdata(dev));
-+	struct usb_hcd	*hcd = platform_get_drvdata(dev);
-+	struct ohci_hcd	*ohci = hcd_to_ohci(hcd);
- 
- 	if (time_before(jiffies, ohci->next_statechange))
- 		msleep(5);
-diff --git a/drivers/usb/host/ohci-sm501.c b/drivers/usb/host/ohci-sm501.c
-index c852f03..dd1a067 100644
---- a/drivers/usb/host/ohci-sm501.c
-+++ b/drivers/usb/host/ohci-sm501.c
-@@ -231,7 +231,8 @@ static int ohci_sm501_suspend(struct platform_device *pdev, pm_message_t msg)
- static int ohci_sm501_resume(struct platform_device *pdev)
- {
- 	struct device *dev = &pdev->dev;
--	struct ohci_hcd	*ohci = hcd_to_ohci(platform_get_drvdata(pdev));
-+	struct usb_hcd	*hcd = platform_get_drvdata(pdev);
-+	struct ohci_hcd	*ohci = hcd_to_ohci(hcd);
- 
- 	if (time_before(jiffies, ohci->next_statechange))
- 		msleep(5);
-diff --git a/drivers/usb/misc/ldusb.c b/drivers/usb/misc/ldusb.c
-index c730d20..7eb5f30 100644
---- a/drivers/usb/misc/ldusb.c
-+++ b/drivers/usb/misc/ldusb.c
-@@ -63,9 +63,6 @@
- #define USB_DEVICE_ID_VERNIER_CYCLOPS	0x0004
- #define USB_DEVICE_ID_VERNIER_LCSPEC	0x0006
- 
--#define USB_VENDOR_ID_MICROCHIP		0x04d8
--#define USB_DEVICE_ID_PICDEM		0x000c
--
- #ifdef CONFIG_USB_DYNAMIC_MINORS
- #define USB_LD_MINOR_BASE	0
- #else
-@@ -92,7 +89,6 @@ static struct usb_device_id ld_usb_table [] = {
- 	{ USB_DEVICE(USB_VENDOR_ID_VERNIER, USB_DEVICE_ID_VERNIER_GOTEMP) },
- 	{ USB_DEVICE(USB_VENDOR_ID_VERNIER, USB_DEVICE_ID_VERNIER_SKIP) },
- 	{ USB_DEVICE(USB_VENDOR_ID_VERNIER, USB_DEVICE_ID_VERNIER_CYCLOPS) },
--	{ USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_PICDEM) },
- 	{ USB_DEVICE(USB_VENDOR_ID_VERNIER, USB_DEVICE_ID_VERNIER_LCSPEC) },
- 	{ }					/* Terminating entry */
- };
-diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
-index 3abb3c8..af2bd47 100644
---- a/drivers/usb/serial/ftdi_sio.c
-+++ b/drivers/usb/serial/ftdi_sio.c
-@@ -366,6 +366,7 @@ static struct usb_device_id id_table_combined [] = {
- 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
- 	{ USB_DEVICE(FTDI_VID, FTDI_OOCDLINK_PID),
- 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-+	{ USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_USB60F) },
- 	{ },					/* Optional parameter entry */
- 	{ }					/* Terminating entry */
- };
-diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
-index 6da539e..0e1c569 100644
---- a/drivers/usb/serial/ftdi_sio.h
-+++ b/drivers/usb/serial/ftdi_sio.h
-@@ -581,6 +581,12 @@
- #define	FIC_NEO1973_DEBUG_PID	0x5118
- 
- /*
-+ * RATOC REX-USB60F
-+ */
-+#define RATOC_VENDOR_ID		0x0584
-+#define RATOC_PRODUCT_ID_USB60F	0xb020
-+
-+/*
-  *   BmRequestType:  1100 0000b
-  *   bRequest:       FTDI_E2_READ
-  *   wValue:         0
-diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
-index d101025..4d7f357 100644
---- a/drivers/usb/serial/option.c
-+++ b/drivers/usb/serial/option.c
-@@ -154,8 +154,6 @@ static int  option_send_setup(struct usb_serial_port *port);
- #define NOVATELWIRELESS_PRODUCT_MC727		0x4100
- #define NOVATELWIRELESS_PRODUCT_MC950D		0x4400
- 
--#define NOVATELWIRELESS_PRODUCT_U727		0x5010
--
- /* FUTURE NOVATEL PRODUCTS */
- #define NOVATELWIRELESS_PRODUCT_EVDO_1		0x6000
- #define NOVATELWIRELESS_PRODUCT_HSPA_1		0x7000
-@@ -195,6 +193,9 @@ static int  option_send_setup(struct usb_serial_port *port);
- 
- #define MAXON_VENDOR_ID				0x16d8
- 
-+#define TELIT_VENDOR_ID				0x1bc7
-+#define TELIT_PRODUCT_UC864E			0x1003
-+
- static struct usb_device_id option_ids[] = {
- 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
- 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
-@@ -269,7 +270,6 @@ static struct usb_device_id option_ids[] = {
- 	{ USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EU870D) }, /* Novatel EU850D/EU860D/EU870D */
- 	{ USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC950D) }, /* Novatel MC930D/MC950D */
- 	{ USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC727) }, /* Novatel MC727/U727/USB727 */
--	{ USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_U727) }, /* Novatel U727 */
- 	{ USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EVDO_1) }, /* Novatel EVDO product */
- 	{ USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_HSPA_1) }, /* Novatel HSPA product */
- 	{ USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EMBEDDED_1) }, /* Novatel Embedded product */
-@@ -293,6 +293,7 @@ static struct usb_device_id option_ids[] = {
- 	{ USB_DEVICE(DELL_VENDOR_ID, 0x8133) }, /* Dell Wireless 5720 == Novatel EV620 CDMA/EV-DO */
- 	{ USB_DEVICE(DELL_VENDOR_ID, 0x8136) },	/* Dell Wireless HSDPA 5520 == Novatel Expedite EU860D */
- 	{ USB_DEVICE(DELL_VENDOR_ID, 0x8137) },	/* Dell Wireless HSDPA 5520 */
-+	{ USB_DEVICE(DELL_VENDOR_ID, 0x8138) },	/* Dell Wireless 5520 Voda I Mobile Broadband (3G HSDPA) Minicard */
- 	{ USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_E100A) },
- 	{ USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_500A) },
- 	{ USB_DEVICE(AXESSTEL_VENDOR_ID, AXESSTEL_PRODUCT_MV110H) },
-@@ -301,6 +302,8 @@ static struct usb_device_id option_ids[] = {
- 	{ USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC680) },
- 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
- 	{ USB_DEVICE(MAXON_VENDOR_ID, 0x6280) }, /* BP3-USB & BP3-EXT HSDPA */
-+	{ USB_DEVICE(0x19d2, 0x0001) }, 	/* Telstra NextG CDMA */
-+	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864E) },
- 	{ } /* Terminating entry */
- };
- MODULE_DEVICE_TABLE(usb, option_ids);
-diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
-index 2af7785..4c1a70a 100644
---- a/drivers/usb/serial/pl2303.c
-+++ b/drivers/usb/serial/pl2303.c
-@@ -66,7 +66,6 @@ static struct usb_device_id id_table [] = {
- 	{ USB_DEVICE(ITEGNO_VENDOR_ID, ITEGNO_PRODUCT_ID_2080) },
- 	{ USB_DEVICE(MA620_VENDOR_ID, MA620_PRODUCT_ID) },
- 	{ USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID) },
--	{ USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_USB60F) },
- 	{ USB_DEVICE(TRIPP_VENDOR_ID, TRIPP_PRODUCT_ID) },
- 	{ USB_DEVICE(RADIOSHACK_VENDOR_ID, RADIOSHACK_PRODUCT_ID) },
- 	{ USB_DEVICE(DCU10_VENDOR_ID, DCU10_PRODUCT_ID) },
-diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
-index 10cf872..3bdefe0 100644
---- a/drivers/usb/serial/pl2303.h
-+++ b/drivers/usb/serial/pl2303.h
-@@ -36,7 +36,6 @@
- 
- #define RATOC_VENDOR_ID		0x0584
- #define RATOC_PRODUCT_ID	0xb000
--#define RATOC_PRODUCT_ID_USB60F	0xb020
- 
- #define TRIPP_VENDOR_ID		0x2478
- #define TRIPP_PRODUCT_ID	0x2008
-diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
-index 9125207..f1d14c9 100644
---- a/drivers/usb/storage/unusual_devs.h
-+++ b/drivers/usb/storage/unusual_devs.h
-@@ -1285,6 +1285,16 @@ UNUSUAL_DEV( 0x0ace, 0x20ff, 0x0101, 0x0101,
- 		US_SC_DEVICE, US_PR_DEVICE, NULL,
- 		US_FL_IGNORE_DEVICE ),
- 
-+/* Reported by F. Aben <f.aben@××××××.com>
-+ * This device (wrongly) has a vendor-specific device descriptor.
-+ * The entry is needed so usb-storage can bind to it's mass-storage
-+ * interface as an interface driver */
-+UNUSUAL_DEV( 0x0af0, 0x7401, 0x0000, 0x0000,
-+		"Option",
-+		"GI 0401 SD-Card",
-+		US_SC_DEVICE, US_PR_DEVICE, NULL,
-+		0 ),
-+
- #ifdef CONFIG_USB_STORAGE_ISD200
- UNUSUAL_DEV(  0x0bf6, 0xa001, 0x0100, 0x0110,
- 		"ATI",
-diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
-index bc673c8..e1031b9 100644
---- a/fs/cifs/inode.c
-+++ b/fs/cifs/inode.c
-@@ -161,12 +161,14 @@ static void cifs_unix_info_to_inode(struct inode *inode,
- 	spin_unlock(&inode->i_lock);
- }
- 
--static const unsigned char *cifs_get_search_path(struct cifsTconInfo *pTcon,
--					const char *search_path)
-+static const unsigned char *cifs_get_search_path(struct cifs_sb_info *cifs_sb,
-+						const char *search_path)
- {
- 	int tree_len;
- 	int path_len;
-+	int i;
- 	char *tmp_path;
-+	struct cifsTconInfo *pTcon = cifs_sb->tcon;
- 
- 	if (!(pTcon->Flags & SMB_SHARE_IS_IN_DFS))
- 		return search_path;
-@@ -180,6 +182,11 @@ static const unsigned char *cifs_get_search_path(struct cifsTconInfo *pTcon,
- 		return search_path;
- 
- 	strncpy(tmp_path, pTcon->treeName, tree_len);
-+	if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS)
-+		for (i = 0; i < tree_len; i++) {
-+			if (tmp_path[i] == '\\')
-+				tmp_path[i] = '/';
-+		}
- 	strncpy(tmp_path+tree_len, search_path, path_len);
- 	tmp_path[tree_len+path_len] = 0;
- 	return tmp_path;
-@@ -199,7 +206,7 @@ int cifs_get_inode_info_unix(struct inode **pinode,
- 	pTcon = cifs_sb->tcon;
- 	cFYI(1, ("Getting info on %s", search_path));
- 
--	full_path = cifs_get_search_path(pTcon, search_path);
-+	full_path = cifs_get_search_path(cifs_sb, search_path);
- 
- try_again_CIFSSMBUnixQPathInfo:
- 	/* could have done a find first instead but this returns more info */
-@@ -402,7 +409,7 @@ int cifs_get_inode_info(struct inode **pinode,
- 			return -ENOMEM;
- 		pfindData = (FILE_ALL_INFO *)buf;
- 
--		full_path = cifs_get_search_path(pTcon, search_path);
-+		full_path = cifs_get_search_path(cifs_sb, search_path);
- 
- try_again_CIFSSMBQPathInfo:
- 		/* could do find first instead but this returns more info */
-diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h
-index 5007f78..7c607af 100644
---- a/fs/ecryptfs/ecryptfs_kernel.h
-+++ b/fs/ecryptfs/ecryptfs_kernel.h
-@@ -626,8 +626,6 @@ int ecryptfs_get_tfm_and_mutex_for_cipher_name(struct crypto_blkcipher **tfm,
- int ecryptfs_keyring_auth_tok_for_sig(struct key **auth_tok_key,
- 				      struct ecryptfs_auth_tok **auth_tok,
- 				      char *sig);
--int ecryptfs_write_zeros(struct file *file, pgoff_t index, int start,
--			 int num_zeros);
- int ecryptfs_write_lower(struct inode *ecryptfs_inode, char *data,
- 			 loff_t offset, size_t size);
- int ecryptfs_write_lower_page_segment(struct inode *ecryptfs_inode,
-diff --git a/fs/ecryptfs/read_write.c b/fs/ecryptfs/read_write.c
-index 0c49286..7cafdbc 100644
---- a/fs/ecryptfs/read_write.c
-+++ b/fs/ecryptfs/read_write.c
-@@ -157,20 +157,6 @@ int ecryptfs_write(struct file *ecryptfs_file, char *data, loff_t offset,
- 			       ecryptfs_page_idx, rc);
- 			goto out;
- 		}
--		if (start_offset_in_page) {
--			/* Read in the page from the lower
--			 * into the eCryptfs inode page cache,
--			 * decrypting */
--			rc = ecryptfs_decrypt_page(ecryptfs_page);
--			if (rc) {
--				printk(KERN_ERR "%s: Error decrypting "
--				       "page; rc = [%d]\n",
--				       __FUNCTION__, rc);
--				ClearPageUptodate(ecryptfs_page);
--				page_cache_release(ecryptfs_page);
--				goto out;
--			}
--		}
- 		ecryptfs_page_virt = kmap_atomic(ecryptfs_page, KM_USER0);
- 
- 		/*
-@@ -349,14 +335,6 @@ int ecryptfs_read(char *data, loff_t offset, size_t size,
- 			       ecryptfs_page_idx, rc);
- 			goto out;
- 		}
--		rc = ecryptfs_decrypt_page(ecryptfs_page);
--		if (rc) {
--			printk(KERN_ERR "%s: Error decrypting "
--			       "page; rc = [%d]\n", __FUNCTION__, rc);
--			ClearPageUptodate(ecryptfs_page);
--			page_cache_release(ecryptfs_page);
--			goto out;
--		}
- 		ecryptfs_page_virt = kmap_atomic(ecryptfs_page, KM_USER0);
- 		memcpy((data + data_offset),
- 		       ((char *)ecryptfs_page_virt + start_offset_in_page),
-diff --git a/fs/ext3/xattr.c b/fs/ext3/xattr.c
-index 4285654..84119af 100644
---- a/fs/ext3/xattr.c
-+++ b/fs/ext3/xattr.c
-@@ -1000,6 +1000,11 @@ ext3_xattr_set_handle(handle_t *handle, struct inode *inode, int name_index,
- 			i.value = NULL;
- 			error = ext3_xattr_block_set(handle, inode, &i, &bs);
- 		} else if (error == -ENOSPC) {
-+			if (EXT3_I(inode)->i_file_acl && !bs.s.base) {
-+				error = ext3_xattr_block_find(inode, &i, &bs);
-+				if (error)
-+					goto cleanup;
-+			}
- 			error = ext3_xattr_block_set(handle, inode, &i, &bs);
- 			if (error)
- 				goto cleanup;
-diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
-index e9054c1..70d856b 100644
---- a/fs/ext4/xattr.c
-+++ b/fs/ext4/xattr.c
-@@ -1011,6 +1011,11 @@ ext4_xattr_set_handle(handle_t *handle, struct inode *inode, int name_index,
- 			i.value = NULL;
- 			error = ext4_xattr_block_set(handle, inode, &i, &bs);
- 		} else if (error == -ENOSPC) {
-+			if (EXT4_I(inode)->i_file_acl && !bs.s.base) {
-+				error = ext4_xattr_block_find(inode, &i, &bs);
-+				if (error)
-+					goto cleanup;
-+			}
- 			error = ext4_xattr_block_set(handle, inode, &i, &bs);
- 			if (error)
- 				goto cleanup;
-diff --git a/fs/proc/array.c b/fs/proc/array.c
-index 07d6c48..6b1c67a 100644
---- a/fs/proc/array.c
-+++ b/fs/proc/array.c
-@@ -287,7 +287,7 @@ static void render_cap_t(struct seq_file *m, const char *header,
- 	seq_printf(m, "%s", header);
- 	CAP_FOR_EACH_U32(__capi) {
- 		seq_printf(m, "%08x",
--			   a->cap[(_LINUX_CAPABILITY_U32S-1) - __capi]);
-+			   a->cap[(_KERNEL_CAPABILITY_U32S-1) - __capi]);
- 	}
- 	seq_printf(m, "\n");
- }
-diff --git a/fs/proc/base.c b/fs/proc/base.c
-index 81d7d14..d6f21bd 100644
---- a/fs/proc/base.c
-+++ b/fs/proc/base.c
-@@ -126,6 +126,25 @@ struct pid_entry {
- 		NULL, &proc_single_file_operations,	\
- 		{ .proc_show = &proc_##OTYPE } )
- 
-+/*
-+ * Count the number of hardlinks for the pid_entry table, excluding the .
-+ * and .. links.
-+ */
-+static unsigned int pid_entry_count_dirs(const struct pid_entry *entries,
-+	unsigned int n)
-+{
-+	unsigned int i;
-+	unsigned int count;
-+
-+	count = 0;
-+	for (i = 0; i < n; ++i) {
-+		if (S_ISDIR(entries[i].mode))
-+			++count;
-+	}
-+
-+	return count;
-+}
-+
- int maps_protect;
- EXPORT_SYMBOL(maps_protect);
- 
-@@ -2483,10 +2502,9 @@ static struct dentry *proc_pid_instantiate(struct inode *dir,
- 	inode->i_op = &proc_tgid_base_inode_operations;
- 	inode->i_fop = &proc_tgid_base_operations;
- 	inode->i_flags|=S_IMMUTABLE;
--	inode->i_nlink = 5;
--#ifdef CONFIG_SECURITY
--	inode->i_nlink += 1;
--#endif
-+
-+	inode->i_nlink = 2 + pid_entry_count_dirs(tgid_base_stuff,
-+		ARRAY_SIZE(tgid_base_stuff));
- 
- 	dentry->d_op = &pid_dentry_operations;
- 
-@@ -2713,10 +2731,9 @@ static struct dentry *proc_task_instantiate(struct inode *dir,
- 	inode->i_op = &proc_tid_base_inode_operations;
- 	inode->i_fop = &proc_tid_base_operations;
- 	inode->i_flags|=S_IMMUTABLE;
--	inode->i_nlink = 4;
--#ifdef CONFIG_SECURITY
--	inode->i_nlink += 1;
--#endif
-+
-+	inode->i_nlink = 2 + pid_entry_count_dirs(tid_base_stuff,
-+		ARRAY_SIZE(tid_base_stuff));
- 
- 	dentry->d_op = &pid_dentry_operations;
- 
-diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
-index 9dfb5ff..dca9b46 100644
---- a/fs/proc/task_mmu.c
-+++ b/fs/proc/task_mmu.c
-@@ -524,7 +524,7 @@ const struct file_operations proc_clear_refs_operations = {
- };
- 
- struct pagemapread {
--	char __user *out, *end;
-+	u64 __user *out, *end;
- };
- 
- #define PM_ENTRY_BYTES      sizeof(u64)
-@@ -547,21 +547,11 @@ struct pagemapread {
- static int add_to_pagemap(unsigned long addr, u64 pfn,
- 			  struct pagemapread *pm)
- {
--	/*
--	 * Make sure there's room in the buffer for an
--	 * entire entry.  Otherwise, only copy part of
--	 * the pfn.
--	 */
--	if (pm->out + PM_ENTRY_BYTES >= pm->end) {
--		if (copy_to_user(pm->out, &pfn, pm->end - pm->out))
--			return -EFAULT;
--		pm->out = pm->end;
--		return PM_END_OF_BUFFER;
--	}
--
- 	if (put_user(pfn, pm->out))
- 		return -EFAULT;
--	pm->out += PM_ENTRY_BYTES;
-+	pm->out++;
-+	if (pm->out >= pm->end)
-+		return PM_END_OF_BUFFER;
- 	return 0;
- }
- 
-@@ -662,7 +652,7 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
- 
- 	ret = -EINVAL;
- 	/* file position must be aligned */
--	if (*ppos % PM_ENTRY_BYTES)
-+	if ((*ppos % PM_ENTRY_BYTES) || (count % PM_ENTRY_BYTES))
- 		goto out_task;
- 
- 	ret = 0;
-@@ -692,8 +682,8 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
- 		goto out_pages;
- 	}
- 
--	pm.out = buf;
--	pm.end = buf + count;
-+	pm.out = (u64 *)buf;
-+	pm.end = (u64 *)(buf + count);
- 
- 	if (!ptrace_may_attach(task)) {
- 		ret = -EIO;
-@@ -718,9 +708,9 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
- 		if (ret == PM_END_OF_BUFFER)
- 			ret = 0;
- 		/* don't need mmap_sem for these, but this looks cleaner */
--		*ppos += pm.out - buf;
-+		*ppos += (char *)pm.out - buf;
- 		if (!ret)
--			ret = pm.out - buf;
-+			ret = (char *)pm.out - buf;
- 	}
- 
- out_pages:
-diff --git a/fs/xfs/linux-2.6/xfs_buf.c b/fs/xfs/linux-2.6/xfs_buf.c
-index e347bfd..9831c90 100644
---- a/fs/xfs/linux-2.6/xfs_buf.c
-+++ b/fs/xfs/linux-2.6/xfs_buf.c
-@@ -387,6 +387,8 @@ _xfs_buf_lookup_pages(
- 		if (unlikely(page == NULL)) {
- 			if (flags & XBF_READ_AHEAD) {
- 				bp->b_page_count = i;
-+				for (i = 0; i < bp->b_page_count; i++)
-+					unlock_page(bp->b_pages[i]);
- 				return -ENOMEM;
- 			}
- 
-@@ -416,17 +418,24 @@ _xfs_buf_lookup_pages(
- 		ASSERT(!PagePrivate(page));
- 		if (!PageUptodate(page)) {
- 			page_count--;
--			if (blocksize < PAGE_CACHE_SIZE && !PagePrivate(page)) {
-+			if (blocksize >= PAGE_CACHE_SIZE) {
-+				if (flags & XBF_READ)
-+					bp->b_flags |= _XBF_PAGE_LOCKED;
-+			} else if (!PagePrivate(page)) {
- 				if (test_page_region(page, offset, nbytes))
- 					page_count++;
- 			}
- 		}
- 
--		unlock_page(page);
- 		bp->b_pages[i] = page;
- 		offset = 0;
- 	}
- 
-+	if (!(bp->b_flags & _XBF_PAGE_LOCKED)) {
-+		for (i = 0; i < bp->b_page_count; i++)
-+			unlock_page(bp->b_pages[i]);
-+	}
-+
- 	if (page_count == bp->b_page_count)
- 		bp->b_flags |= XBF_DONE;
- 
-@@ -746,6 +755,7 @@ xfs_buf_associate_memory(
- 	bp->b_count_desired = len;
- 	bp->b_buffer_length = buflen;
- 	bp->b_flags |= XBF_MAPPED;
-+	bp->b_flags &= ~_XBF_PAGE_LOCKED;
- 
- 	return 0;
- }
-@@ -1093,8 +1103,10 @@ _xfs_buf_ioend(
- 	xfs_buf_t		*bp,
- 	int			schedule)
- {
--	if (atomic_dec_and_test(&bp->b_io_remaining) == 1)
-+	if (atomic_dec_and_test(&bp->b_io_remaining) == 1) {
-+		bp->b_flags &= ~_XBF_PAGE_LOCKED;
- 		xfs_buf_ioend(bp, schedule);
-+	}
- }
- 
- STATIC void
-@@ -1125,6 +1137,9 @@ xfs_buf_bio_end_io(
- 
- 		if (--bvec >= bio->bi_io_vec)
- 			prefetchw(&bvec->bv_page->flags);
-+
-+		if (bp->b_flags & _XBF_PAGE_LOCKED)
-+			unlock_page(page);
- 	} while (bvec >= bio->bi_io_vec);
- 
- 	_xfs_buf_ioend(bp, 1);
-@@ -1163,7 +1178,8 @@ _xfs_buf_ioapply(
- 	 * filesystem block size is not smaller than the page size.
- 	 */
- 	if ((bp->b_buffer_length < PAGE_CACHE_SIZE) &&
--	    (bp->b_flags & XBF_READ) &&
-+	    ((bp->b_flags & (XBF_READ|_XBF_PAGE_LOCKED)) ==
-+	      (XBF_READ|_XBF_PAGE_LOCKED)) &&
- 	    (blocksize >= PAGE_CACHE_SIZE)) {
- 		bio = bio_alloc(GFP_NOIO, 1);
- 
-diff --git a/fs/xfs/linux-2.6/xfs_buf.h b/fs/xfs/linux-2.6/xfs_buf.h
-index a3d207d..441f7c3 100644
---- a/fs/xfs/linux-2.6/xfs_buf.h
-+++ b/fs/xfs/linux-2.6/xfs_buf.h
-@@ -66,6 +66,25 @@ typedef enum {
- 	_XBF_PAGES = (1 << 18),	    /* backed by refcounted pages	   */
- 	_XBF_RUN_QUEUES = (1 << 19),/* run block device task queue	   */
- 	_XBF_DELWRI_Q = (1 << 21),   /* buffer on delwri queue		   */
-+
-+	/*
-+	 * Special flag for supporting metadata blocks smaller than a FSB.
-+	 *
-+	 * In this case we can have multiple xfs_buf_t on a single page and
-+	 * need to lock out concurrent xfs_buf_t readers as they only
-+	 * serialise access to the buffer.
-+	 *
-+	 * If the FSB size >= PAGE_CACHE_SIZE case, we have no serialisation
-+	 * between reads of the page. Hence we can have one thread read the
-+	 * page and modify it, but then race with another thread that thinks
-+	 * the page is not up-to-date and hence reads it again.
-+	 *
-+	 * The result is that the first modifcation to the page is lost.
-+	 * This sort of AGF/AGI reading race can happen when unlinking inodes
-+	 * that require truncation and results in the AGI unlinked list
-+	 * modifications being lost.
-+	 */
-+	_XBF_PAGE_LOCKED = (1 << 22),
- } xfs_buf_flags_t;
- 
- typedef enum {
-diff --git a/include/asm-x86/tlbflush.h b/include/asm-x86/tlbflush.h
-index 3998709..b7a6a08 100644
---- a/include/asm-x86/tlbflush.h
-+++ b/include/asm-x86/tlbflush.h
-@@ -22,12 +22,23 @@ static inline void __native_flush_tlb(void)
- 
- static inline void __native_flush_tlb_global(void)
- {
--	unsigned long cr4 = read_cr4();
-+	unsigned long flags;
-+	unsigned long cr4;
- 
-+	/*
-+	 * Read-modify-write to CR4 - protect it from preemption and
-+	 * from interrupts. (Use the raw variant because this code can
-+	 * be called from deep inside debugging code.)
-+	 */
-+	raw_local_irq_save(flags);
-+
-+	cr4 = read_cr4();
- 	/* clear PGE */
- 	write_cr4(cr4 & ~X86_CR4_PGE);
- 	/* write old PGE again and flush TLBs */
- 	write_cr4(cr4);
-+
-+	raw_local_irq_restore(flags);
- }
- 
- static inline void __native_flush_tlb_single(unsigned long addr)
-diff --git a/include/linux/capability.h b/include/linux/capability.h
-index 7d50ff6..bb8d915 100644
---- a/include/linux/capability.h
-+++ b/include/linux/capability.h
-@@ -31,11 +31,11 @@ struct task_struct;
- #define _LINUX_CAPABILITY_VERSION_1  0x19980330
- #define _LINUX_CAPABILITY_U32S_1     1
- 
--#define _LINUX_CAPABILITY_VERSION_2  0x20071026
-+#define _LINUX_CAPABILITY_VERSION_2  0x20071026  /* deprecated - use v3 */
- #define _LINUX_CAPABILITY_U32S_2     2
- 
--#define _LINUX_CAPABILITY_VERSION    _LINUX_CAPABILITY_VERSION_2
--#define _LINUX_CAPABILITY_U32S       _LINUX_CAPABILITY_U32S_2
-+#define _LINUX_CAPABILITY_VERSION_3  0x20080522
-+#define _LINUX_CAPABILITY_U32S_3     2
- 
- typedef struct __user_cap_header_struct {
- 	__u32 version;
-@@ -77,10 +77,23 @@ struct vfs_cap_data {
- 	} data[VFS_CAP_U32];
- };
- 
--#ifdef __KERNEL__
-+#ifndef __KERNEL__
-+
-+/*
-+ * Backwardly compatible definition for source code - trapped in a
-+ * 32-bit world. If you find you need this, please consider using
-+ * libcap to untrap yourself...
-+ */
-+#define _LINUX_CAPABILITY_VERSION  _LINUX_CAPABILITY_VERSION_1
-+#define _LINUX_CAPABILITY_U32S     _LINUX_CAPABILITY_U32S_1
-+
-+#else
-+
-+#define _KERNEL_CAPABILITY_VERSION _LINUX_CAPABILITY_VERSION_3
-+#define _KERNEL_CAPABILITY_U32S    _LINUX_CAPABILITY_U32S_3
- 
- typedef struct kernel_cap_struct {
--	__u32 cap[_LINUX_CAPABILITY_U32S];
-+	__u32 cap[_KERNEL_CAPABILITY_U32S];
- } kernel_cap_t;
- 
- #define _USER_CAP_HEADER_SIZE  (sizeof(struct __user_cap_header_struct))
-@@ -350,7 +363,7 @@ typedef struct kernel_cap_struct {
-  */
- 
- #define CAP_FOR_EACH_U32(__capi)  \
--	for (__capi = 0; __capi < _LINUX_CAPABILITY_U32S; ++__capi)
-+	for (__capi = 0; __capi < _KERNEL_CAPABILITY_U32S; ++__capi)
- 
- # define CAP_FS_MASK_B0     (CAP_TO_MASK(CAP_CHOWN)		\
- 			    | CAP_TO_MASK(CAP_DAC_OVERRIDE)	\
-@@ -360,7 +373,7 @@ typedef struct kernel_cap_struct {
- 
- # define CAP_FS_MASK_B1     (CAP_TO_MASK(CAP_MAC_OVERRIDE))
- 
--#if _LINUX_CAPABILITY_U32S != 2
-+#if _KERNEL_CAPABILITY_U32S != 2
- # error Fix up hand-coded capability macro initializers
- #else /* HAND-CODED capability initializers */
- 
-@@ -371,7 +384,7 @@ typedef struct kernel_cap_struct {
- # define CAP_NFSD_SET     {{ CAP_FS_MASK_B0|CAP_TO_MASK(CAP_SYS_RESOURCE), \
- 			     CAP_FS_MASK_B1 } }
- 
--#endif /* _LINUX_CAPABILITY_U32S != 2 */
-+#endif /* _KERNEL_CAPABILITY_U32S != 2 */
- 
- #define CAP_INIT_INH_SET    CAP_EMPTY_SET
- 
-diff --git a/include/linux/hid.h b/include/linux/hid.h
-index 74ff575..02e70b7 100644
---- a/include/linux/hid.h
-+++ b/include/linux/hid.h
-@@ -284,6 +284,7 @@ struct hid_item {
- #define HID_QUIRK_2WHEEL_MOUSE_HACK_B8		0x02000000
- #define HID_QUIRK_HWHEEL_WHEEL_INVERT		0x04000000
- #define HID_QUIRK_MICROSOFT_KEYS		0x08000000
-+#define HID_QUIRK_APPLE_NUMLOCK_EMULATION	0x10000000
- 
- /*
-  * Separate quirks for runtime report descriptor fixup
-diff --git a/include/linux/types.h b/include/linux/types.h
-index 9dc2346..d4a9ce6 100644
---- a/include/linux/types.h
-+++ b/include/linux/types.h
-@@ -197,8 +197,6 @@ typedef u64 resource_size_t;
- typedef u32 resource_size_t;
- #endif
- 
--#endif	/* __KERNEL__ */
--
- struct ustat {
- 	__kernel_daddr_t	f_tfree;
- 	__kernel_ino_t		f_tinode;
-@@ -206,4 +204,6 @@ struct ustat {
- 	char			f_fpack[6];
- };
- 
-+#endif	/* __KERNEL__ */
-+
- #endif /* _LINUX_TYPES_H */
-diff --git a/kernel/capability.c b/kernel/capability.c
-index 39e8193..cfbe442 100644
---- a/kernel/capability.c
-+++ b/kernel/capability.c
-@@ -53,6 +53,69 @@ static void warn_legacy_capability_use(void)
- }
- 
- /*
-+ * Version 2 capabilities worked fine, but the linux/capability.h file
-+ * that accompanied their introduction encouraged their use without
-+ * the necessary user-space source code changes. As such, we have
-+ * created a version 3 with equivalent functionality to version 2, but
-+ * with a header change to protect legacy source code from using
-+ * version 2 when it wanted to use version 1. If your system has code
-+ * that trips the following warning, it is using version 2 specific
-+ * capabilities and may be doing so insecurely.
-+ *
-+ * The remedy is to either upgrade your version of libcap (to 2.10+,
-+ * if the application is linked against it), or recompile your
-+ * application with modern kernel headers and this warning will go
-+ * away.
-+ */
-+
-+static void warn_deprecated_v2(void)
-+{
-+	static int warned;
-+
-+	if (!warned) {
-+		char name[sizeof(current->comm)];
-+
-+		printk(KERN_INFO "warning: `%s' uses deprecated v2"
-+		       " capabilities in a way that may be insecure.\n",
-+		       get_task_comm(name, current));
-+		warned = 1;
-+	}
-+}
-+
-+/*
-+ * Version check. Return the number of u32s in each capability flag
-+ * array, or a negative value on error.
-+ */
-+static int cap_validate_magic(cap_user_header_t header, unsigned *tocopy)
-+{
-+	__u32 version;
-+
-+	if (get_user(version, &header->version))
-+		return -EFAULT;
-+
-+	switch (version) {
-+	case _LINUX_CAPABILITY_VERSION_1:
-+		warn_legacy_capability_use();
-+		*tocopy = _LINUX_CAPABILITY_U32S_1;
-+		break;
-+	case _LINUX_CAPABILITY_VERSION_2:
-+		warn_deprecated_v2();
-+		/*
-+		 * fall through - v3 is otherwise equivalent to v2.
-+		 */
-+	case _LINUX_CAPABILITY_VERSION_3:
-+		*tocopy = _LINUX_CAPABILITY_U32S_3;
-+		break;
-+	default:
-+		if (put_user((u32)_KERNEL_CAPABILITY_VERSION, &header->version))
-+			return -EFAULT;
-+		return -EINVAL;
-+	}
-+
-+	return 0;
-+}
-+
-+/*
-  * For sys_getproccap() and sys_setproccap(), any of the three
-  * capability set pointers may be NULL -- indicating that that set is
-  * uninteresting and/or not to be changed.
-@@ -71,27 +134,13 @@ asmlinkage long sys_capget(cap_user_header_t header, cap_user_data_t dataptr)
- {
- 	int ret = 0;
- 	pid_t pid;
--	__u32 version;
- 	struct task_struct *target;
- 	unsigned tocopy;
- 	kernel_cap_t pE, pI, pP;
- 
--	if (get_user(version, &header->version))
--		return -EFAULT;
--
--	switch (version) {
--	case _LINUX_CAPABILITY_VERSION_1:
--		warn_legacy_capability_use();
--		tocopy = _LINUX_CAPABILITY_U32S_1;
--		break;
--	case _LINUX_CAPABILITY_VERSION_2:
--		tocopy = _LINUX_CAPABILITY_U32S_2;
--		break;
--	default:
--		if (put_user(_LINUX_CAPABILITY_VERSION, &header->version))
--			return -EFAULT;
--		return -EINVAL;
--	}
-+	ret = cap_validate_magic(header, &tocopy);
-+	if (ret != 0)
-+		return ret;
- 
- 	if (get_user(pid, &header->pid))
- 		return -EFAULT;
-@@ -118,7 +167,7 @@ out:
- 	spin_unlock(&task_capability_lock);
- 
- 	if (!ret) {
--		struct __user_cap_data_struct kdata[_LINUX_CAPABILITY_U32S];
-+		struct __user_cap_data_struct kdata[_KERNEL_CAPABILITY_U32S];
- 		unsigned i;
- 
- 		for (i = 0; i < tocopy; i++) {
-@@ -128,7 +177,7 @@ out:
- 		}
- 
- 		/*
--		 * Note, in the case, tocopy < _LINUX_CAPABILITY_U32S,
-+		 * Note, in the case, tocopy < _KERNEL_CAPABILITY_U32S,
- 		 * we silently drop the upper capabilities here. This
- 		 * has the effect of making older libcap
- 		 * implementations implicitly drop upper capability
-@@ -240,30 +289,16 @@ static inline int cap_set_all(kernel_cap_t *effective,
-  */
- asmlinkage long sys_capset(cap_user_header_t header, const cap_user_data_t data)
- {
--	struct __user_cap_data_struct kdata[_LINUX_CAPABILITY_U32S];
-+	struct __user_cap_data_struct kdata[_KERNEL_CAPABILITY_U32S];
- 	unsigned i, tocopy;
- 	kernel_cap_t inheritable, permitted, effective;
--	__u32 version;
- 	struct task_struct *target;
- 	int ret;
- 	pid_t pid;
- 
--	if (get_user(version, &header->version))
--		return -EFAULT;
--
--	switch (version) {
--	case _LINUX_CAPABILITY_VERSION_1:
--		warn_legacy_capability_use();
--		tocopy = _LINUX_CAPABILITY_U32S_1;
--		break;
--	case _LINUX_CAPABILITY_VERSION_2:
--		tocopy = _LINUX_CAPABILITY_U32S_2;
--		break;
--	default:
--		if (put_user(_LINUX_CAPABILITY_VERSION, &header->version))
--			return -EFAULT;
--		return -EINVAL;
--	}
-+	ret = cap_validate_magic(header, &tocopy);
-+	if (ret != 0)
-+		return ret;
- 
- 	if (get_user(pid, &header->pid))
- 		return -EFAULT;
-@@ -281,7 +316,7 @@ asmlinkage long sys_capset(cap_user_header_t header, const cap_user_data_t data)
- 		permitted.cap[i] = kdata[i].permitted;
- 		inheritable.cap[i] = kdata[i].inheritable;
- 	}
--	while (i < _LINUX_CAPABILITY_U32S) {
-+	while (i < _KERNEL_CAPABILITY_U32S) {
- 		effective.cap[i] = 0;
- 		permitted.cap[i] = 0;
- 		inheritable.cap[i] = 0;
-diff --git a/kernel/cgroup.c b/kernel/cgroup.c
-index 6d8de05..4484139 100644
---- a/kernel/cgroup.c
-+++ b/kernel/cgroup.c
-@@ -2808,7 +2808,7 @@ int cgroup_clone(struct task_struct *tsk, struct cgroup_subsys *subsys)
- 	cg = tsk->cgroups;
- 	parent = task_cgroup(tsk, subsys->subsys_id);
- 
--	snprintf(nodename, MAX_CGROUP_TYPE_NAMELEN, "node_%d", tsk->pid);
-+	snprintf(nodename, MAX_CGROUP_TYPE_NAMELEN, "%d", tsk->pid);
- 
- 	/* Pin the hierarchy */
- 	atomic_inc(&parent->root->sb->s_active);
-diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
-index 7469c50..4d1e8c7 100644
---- a/mm/memory_hotplug.c
-+++ b/mm/memory_hotplug.c
-@@ -58,23 +58,59 @@ static void release_memory_resource(struct resource *res)
- 	return;
- }
- 
--
- #ifdef CONFIG_MEMORY_HOTPLUG_SPARSE
-+static void grow_zone_span(struct zone *zone, unsigned long start_pfn,
-+			   unsigned long end_pfn)
-+{
-+	unsigned long old_zone_end_pfn;
-+
-+	zone_span_writelock(zone);
-+
-+	old_zone_end_pfn = zone->zone_start_pfn + zone->spanned_pages;
-+	if (start_pfn < zone->zone_start_pfn)
-+		zone->zone_start_pfn = start_pfn;
-+
-+	zone->spanned_pages = max(old_zone_end_pfn, end_pfn) -
-+				zone->zone_start_pfn;
-+
-+	zone_span_writeunlock(zone);
-+}
-+
-+static void grow_pgdat_span(struct pglist_data *pgdat, unsigned long start_pfn,
-+			    unsigned long end_pfn)
-+{
-+	unsigned long old_pgdat_end_pfn =
-+		pgdat->node_start_pfn + pgdat->node_spanned_pages;
-+
-+	if (start_pfn < pgdat->node_start_pfn)
-+		pgdat->node_start_pfn = start_pfn;
-+
-+	pgdat->node_spanned_pages = max(old_pgdat_end_pfn, end_pfn) -
-+					pgdat->node_start_pfn;
-+}
-+
- static int __add_zone(struct zone *zone, unsigned long phys_start_pfn)
- {
- 	struct pglist_data *pgdat = zone->zone_pgdat;
- 	int nr_pages = PAGES_PER_SECTION;
- 	int nid = pgdat->node_id;
- 	int zone_type;
-+	unsigned long flags;
- 
- 	zone_type = zone - pgdat->node_zones;
- 	if (!zone->wait_table) {
--		int ret = 0;
-+		int ret;
-+
- 		ret = init_currently_empty_zone(zone, phys_start_pfn,
- 						nr_pages, MEMMAP_HOTPLUG);
--		if (ret < 0)
-+		if (ret)
- 			return ret;
- 	}
-+	pgdat_resize_lock(zone->zone_pgdat, &flags);
-+	grow_zone_span(zone, phys_start_pfn, phys_start_pfn + nr_pages);
-+	grow_pgdat_span(zone->zone_pgdat, phys_start_pfn,
-+			phys_start_pfn + nr_pages);
-+	pgdat_resize_unlock(zone->zone_pgdat, &flags);
- 	memmap_init_zone(nr_pages, nid, zone_type,
- 			 phys_start_pfn, MEMMAP_HOTPLUG);
- 	return 0;
-@@ -134,36 +170,6 @@ int __add_pages(struct zone *zone, unsigned long phys_start_pfn,
- }
- EXPORT_SYMBOL_GPL(__add_pages);
- 
--static void grow_zone_span(struct zone *zone,
--		unsigned long start_pfn, unsigned long end_pfn)
--{
--	unsigned long old_zone_end_pfn;
--
--	zone_span_writelock(zone);
--
--	old_zone_end_pfn = zone->zone_start_pfn + zone->spanned_pages;
--	if (start_pfn < zone->zone_start_pfn)
--		zone->zone_start_pfn = start_pfn;
--
--	zone->spanned_pages = max(old_zone_end_pfn, end_pfn) -
--				zone->zone_start_pfn;
--
--	zone_span_writeunlock(zone);
--}
--
--static void grow_pgdat_span(struct pglist_data *pgdat,
--		unsigned long start_pfn, unsigned long end_pfn)
--{
--	unsigned long old_pgdat_end_pfn =
--		pgdat->node_start_pfn + pgdat->node_spanned_pages;
--
--	if (start_pfn < pgdat->node_start_pfn)
--		pgdat->node_start_pfn = start_pfn;
--
--	pgdat->node_spanned_pages = max(old_pgdat_end_pfn, end_pfn) -
--					pgdat->node_start_pfn;
--}
--
- static int online_pages_range(unsigned long start_pfn, unsigned long nr_pages,
- 			void *arg)
- {
-@@ -183,7 +189,6 @@ static int online_pages_range(unsigned long start_pfn, unsigned long nr_pages,
- 
- int online_pages(unsigned long pfn, unsigned long nr_pages)
- {
--	unsigned long flags;
- 	unsigned long onlined_pages = 0;
- 	struct zone *zone;
- 	int need_zonelists_rebuild = 0;
-@@ -211,11 +216,6 @@ int online_pages(unsigned long pfn, unsigned long nr_pages)
- 	 * memory_block->state_sem.
- 	 */
- 	zone = page_zone(pfn_to_page(pfn));
--	pgdat_resize_lock(zone->zone_pgdat, &flags);
--	grow_zone_span(zone, pfn, pfn + nr_pages);
--	grow_pgdat_span(zone->zone_pgdat, pfn, pfn + nr_pages);
--	pgdat_resize_unlock(zone->zone_pgdat, &flags);
--
- 	/*
- 	 * If this zone is not populated, then it is not in zonelist.
- 	 * This means the page allocator ignores this zone.
-diff --git a/mm/mmap.c b/mm/mmap.c
-index a32d28c..96bdd73 100644
---- a/mm/mmap.c
-+++ b/mm/mmap.c
-@@ -242,10 +242,16 @@ asmlinkage unsigned long sys_brk(unsigned long brk)
- 	unsigned long rlim, retval;
- 	unsigned long newbrk, oldbrk;
- 	struct mm_struct *mm = current->mm;
-+	unsigned long min_brk;
- 
- 	down_write(&mm->mmap_sem);
- 
--	if (brk < mm->start_brk)
-+#ifdef CONFIG_COMPAT_BRK
-+	min_brk = mm->end_code;
-+#else
-+	min_brk = mm->start_brk;
-+#endif
-+	if (brk < min_brk)
- 		goto out;
- 
- 	/*
-diff --git a/mm/page_alloc.c b/mm/page_alloc.c
-index 55443c2..f7082af 100644
---- a/mm/page_alloc.c
-+++ b/mm/page_alloc.c
-@@ -2837,8 +2837,6 @@ __meminit int init_currently_empty_zone(struct zone *zone,
- 
- 	zone->zone_start_pfn = zone_start_pfn;
- 
--	memmap_init(size, pgdat->node_id, zone_idx(zone), zone_start_pfn);
--
- 	zone_init_free_lists(zone);
- 
- 	return 0;
-@@ -3408,6 +3406,7 @@ static void __paginginit free_area_init_core(struct pglist_data *pgdat,
- 		ret = init_currently_empty_zone(zone, zone_start_pfn,
- 						size, MEMMAP_EARLY);
- 		BUG_ON(ret);
-+		memmap_init(size, nid, j, zone_start_pfn);
- 		zone_start_pfn += size;
- 	}
- }
-diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
-index 24c0d03..b8a917b 100644
---- a/net/ipv6/netfilter/nf_conntrack_reasm.c
-+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
-@@ -209,7 +209,9 @@ fq_find(__be32 id, struct in6_addr *src, struct in6_addr *dst)
- 	arg.dst = dst;
- 	hash = ip6qhashfn(id, src, dst);
- 
-+	local_bh_disable();
- 	q = inet_frag_find(&nf_init_frags, &nf_frags, &arg, hash);
-+	local_bh_enable();
- 	if (q == NULL)
- 		goto oom;
- 
-@@ -638,10 +640,10 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb)
- 		goto ret_orig;
- 	}
- 
--	spin_lock(&fq->q.lock);
-+	spin_lock_bh(&fq->q.lock);
- 
- 	if (nf_ct_frag6_queue(fq, clone, fhdr, nhoff) < 0) {
--		spin_unlock(&fq->q.lock);
-+		spin_unlock_bh(&fq->q.lock);
- 		pr_debug("Can't insert skb to queue\n");
- 		fq_put(fq);
- 		goto ret_orig;
-@@ -652,7 +654,7 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb)
- 		if (ret_skb == NULL)
- 			pr_debug("Can't reassemble fragmented packets\n");
- 	}
--	spin_unlock(&fq->q.lock);
-+	spin_unlock_bh(&fq->q.lock);
- 
- 	fq_put(fq);
- 	return ret_skb;
-diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
-index 684ec9c..d15d70f 100644
---- a/net/netfilter/nf_conntrack_expect.c
-+++ b/net/netfilter/nf_conntrack_expect.c
-@@ -550,10 +550,10 @@ int __init nf_conntrack_expect_init(void)
- 	return 0;
- 
- err3:
-+	kmem_cache_destroy(nf_ct_expect_cachep);
-+err2:
- 	nf_ct_free_hashtable(nf_ct_expect_hash, nf_ct_expect_vmalloc,
- 			     nf_ct_expect_hsize);
--err2:
--	kmem_cache_destroy(nf_ct_expect_cachep);
- err1:
- 	return err;
- }
-diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
-index 3b01119..1692338 100644
---- a/net/netfilter/xt_connlimit.c
-+++ b/net/netfilter/xt_connlimit.c
-@@ -75,7 +75,8 @@ static inline bool already_closed(const struct nf_conn *conn)
- 	u_int16_t proto = conn->tuplehash[0].tuple.dst.protonum;
- 
- 	if (proto == IPPROTO_TCP)
--		return conn->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT;
-+		return conn->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT ||
-+		       conn->proto.tcp.state == TCP_CONNTRACK_CLOSE;
- 	else
- 		return 0;
- }
-diff --git a/net/netfilter/xt_iprange.c b/net/netfilter/xt_iprange.c
-index 500528d..c63e933 100644
---- a/net/netfilter/xt_iprange.c
-+++ b/net/netfilter/xt_iprange.c
-@@ -179,3 +179,5 @@ module_exit(iprange_mt_exit);
- MODULE_LICENSE("GPL");
- MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@××××××××××××××.hu>, Jan Engelhardt <jengelh@××××××××××××.de>");
- MODULE_DESCRIPTION("Xtables: arbitrary IPv4 range matching");
-+MODULE_ALIAS("ipt_iprange");
-+MODULE_ALIAS("ip6t_iprange");
-diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
-index 732ba27..62d77ff 100644
---- a/security/smack/smack_lsm.c
-+++ b/security/smack/smack_lsm.c
-@@ -1865,6 +1865,18 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
- 	final = sbsp->smk_default;
- 
- 	/*
-+	 * If this is the root inode the superblock
-+	 * may be in the process of initialization.
-+	 * If that is the case use the root value out
-+	 * of the superblock.
-+	 */
-+	if (opt_dentry->d_parent == opt_dentry) {
-+		isp->smk_inode = sbsp->smk_root;
-+		isp->smk_flags |= SMK_INODE_INSTANT;
-+		goto unlockandout;
-+	}
-+
-+	/*
- 	 * This is pretty hackish.
- 	 * Casey says that we shouldn't have to do
- 	 * file system specific code, but it does help

Deleted: genpatches-2.6/trunk/2.6.26/1006_linux-2.6.25.7.patch
===================================================================
--- genpatches-2.6/trunk/2.6.26/1006_linux-2.6.25.7.patch	2008-07-17 02:44:10 UTC (rev 1328)
+++ genpatches-2.6/trunk/2.6.26/1006_linux-2.6.25.7.patch	2008-07-17 02:47:50 UTC (rev 1329)
@@ -1,1669 +0,0 @@
-diff --git a/Documentation/cciss.txt b/Documentation/cciss.txt
-index e65736c..63e59b8 100644
---- a/Documentation/cciss.txt
-+++ b/Documentation/cciss.txt
-@@ -21,6 +21,11 @@ This driver is known to work with the following cards:
- 	* SA E200
- 	* SA E200i
- 	* SA E500
-+	* SA P212
-+	* SA P410
-+	* SA P410i
-+	* SA P411
-+	* SA P812
- 
- Detecting drive failures:
- -------------------------
-diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
-index 99a4ed3..6342a07 100644
---- a/arch/x86/Kconfig
-+++ b/arch/x86/Kconfig
-@@ -24,17 +24,10 @@ config X86
- 	select HAVE_KRETPROBES
- 	select HAVE_KVM if ((X86_32 && !X86_VOYAGER && !X86_VISWS && !X86_NUMAQ) || X86_64)
- 
--config DEFCONFIG_LIST
-+config ARCH_DEFCONFIG
- 	string
--	depends on X86_32
--	option defconfig_list
--	default "arch/x86/configs/i386_defconfig"
--
--config DEFCONFIG_LIST
--	string
--	depends on X86_64
--	option defconfig_list
--	default "arch/x86/configs/x86_64_defconfig"
-+	default "arch/x86/configs/i386_defconfig" if X86_32
-+	default "arch/x86/configs/x86_64_defconfig" if X86_64
- 
- 
- config GENERIC_LOCKBREAK
-@@ -253,8 +246,7 @@ config X86_ELAN
- 
- config X86_VOYAGER
- 	bool "Voyager (NCR)"
--	depends on X86_32
--	select SMP if !BROKEN
-+	depends on X86_32 && (SMP || BROKEN)
- 	help
- 	  Voyager is an MCA-based 32-way capable SMP architecture proprietary
- 	  to NCR Corp.  Machine classes 345x/35xx/4100/51xx are Voyager-based.
-@@ -266,9 +258,8 @@ config X86_VOYAGER
- 
- config X86_NUMAQ
- 	bool "NUMAQ (IBM/Sequent)"
--	select SMP
-+	depends on SMP && X86_32
- 	select NUMA
--	depends on X86_32
- 	help
- 	  This option is used for getting Linux to run on a (IBM/Sequent) NUMA
- 	  multiquad box. This changes the way that processors are bootstrapped,
-@@ -339,7 +330,7 @@ config X86_RDC321X
- 
- config X86_VSMP
- 	bool "Support for ScaleMP vSMP"
--	depends on X86_64 && PCI
-+	depends on X86_64
- 	 help
- 	  Support for ScaleMP vSMP systems.  Say 'Y' here if this kernel is
- 	  supposed to run on these EM64T-based machines.  Only choose this option
-@@ -1391,7 +1382,7 @@ endmenu
- menu "Bus options (PCI etc.)"
- 
- config PCI
--	bool "PCI support" if !X86_VISWS
-+	bool "PCI support" if !X86_VISWS && !X86_VSMP
- 	depends on !X86_VOYAGER
- 	default y
- 	select ARCH_SUPPORTS_MSI if (X86_LOCAL_APIC && X86_IO_APIC)
-diff --git a/drivers/block/brd.c b/drivers/block/brd.c
-index 8536480..37560a0 100644
---- a/drivers/block/brd.c
-+++ b/drivers/block/brd.c
-@@ -392,6 +392,7 @@ module_param(rd_size, int, 0);
- MODULE_PARM_DESC(rd_size, "Size of each RAM disk in kbytes.");
- MODULE_LICENSE("GPL");
- MODULE_ALIAS_BLOCKDEV_MAJOR(RAMDISK_MAJOR);
-+MODULE_ALIAS("rd");
- 
- #ifndef MODULE
- /* Legacy boot options - nonmodular */
-diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
-index 9c9627e..41636b8 100644
---- a/drivers/block/cciss.c
-+++ b/drivers/block/cciss.c
-@@ -53,15 +53,16 @@
- #include <linux/scatterlist.h>
- 
- #define CCISS_DRIVER_VERSION(maj,min,submin) ((maj<<16)|(min<<8)|(submin))
--#define DRIVER_NAME "HP CISS Driver (v 3.6.14)"
--#define DRIVER_VERSION CCISS_DRIVER_VERSION(3,6,14)
-+#define DRIVER_NAME "HP CISS Driver (v 3.6.20)"
-+#define DRIVER_VERSION CCISS_DRIVER_VERSION(3, 6, 20)
- 
- /* Embedded module documentation macros - see modules.h */
- MODULE_AUTHOR("Hewlett-Packard Company");
--MODULE_DESCRIPTION("Driver for HP Controller SA5xxx SA6xxx version 3.6.14");
-+MODULE_DESCRIPTION("Driver for HP Smart Array Controllers");
- MODULE_SUPPORTED_DEVICE("HP SA5i SA5i+ SA532 SA5300 SA5312 SA641 SA642 SA6400"
--			" SA6i P600 P800 P400 P400i E200 E200i E500");
--MODULE_VERSION("3.6.14");
-+			" SA6i P600 P800 P400 P400i E200 E200i E500 P700m"
-+			" Smart Array G2 Series SAS/SATA Controllers");
-+MODULE_VERSION("3.6.20");
- MODULE_LICENSE("GPL");
- 
- #include "cciss_cmd.h"
-@@ -90,6 +91,11 @@ static const struct pci_device_id cciss_pci_device_id[] = {
- 	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3215},
- 	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x3237},
- 	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x323D},
-+	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3241},
-+	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3243},
-+	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3245},
-+	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3247},
-+	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3249},
- 	{PCI_VENDOR_ID_HP,     PCI_ANY_ID,	PCI_ANY_ID, PCI_ANY_ID,
- 		PCI_CLASS_STORAGE_RAID << 8, 0xffff << 8, 0},
- 	{0,}
-@@ -123,6 +129,11 @@ static struct board_type products[] = {
- 	{0x3215103C, "Smart Array E200i", &SA5_access, 120},
- 	{0x3237103C, "Smart Array E500", &SA5_access, 512},
- 	{0x323D103C, "Smart Array P700m", &SA5_access, 512},
-+	{0x3241103C, "Smart Array P212", &SA5_access, 384},
-+	{0x3243103C, "Smart Array P410", &SA5_access, 384},
-+	{0x3245103C, "Smart Array P410i", &SA5_access, 384},
-+	{0x3247103C, "Smart Array P411", &SA5_access, 384},
-+	{0x3249103C, "Smart Array P812", &SA5_access, 384},
- 	{0xFFFF103C, "Unknown Smart Array", &SA5_access, 120},
- };
- 
-diff --git a/drivers/char/pcmcia/ipwireless/hardware.c b/drivers/char/pcmcia/ipwireless/hardware.c
-index 1f978ff..d353866 100644
---- a/drivers/char/pcmcia/ipwireless/hardware.c
-+++ b/drivers/char/pcmcia/ipwireless/hardware.c
-@@ -251,10 +251,11 @@ struct ipw_hardware {
- 	int init_loops;
- 	struct timer_list setup_timer;
- 
-+	/* Flag if hw is ready to send next packet */
- 	int tx_ready;
--	struct list_head tx_queue[NL_NUM_OF_PRIORITIES];
--	/* True if any packets are queued for transmission */
-+	/* Count of pending packets to be sent */
- 	int tx_queued;
-+	struct list_head tx_queue[NL_NUM_OF_PRIORITIES];
- 
- 	int rx_bytes_queued;
- 	struct list_head rx_queue;
-@@ -430,6 +431,8 @@ static int do_send_fragment(struct ipw_hardware *hw, const unsigned char *data,
- 
- 	spin_lock_irqsave(&hw->spinlock, flags);
- 
-+	hw->tx_ready = 0;
-+
- 	if (hw->hw_version == HW_VERSION_1) {
- 		outw((unsigned short) length, hw->base_port + IODWR);
- 
-@@ -518,6 +521,7 @@ static int do_send_packet(struct ipw_hardware *hw, struct ipw_tx_packet *packet)
- 
- 		spin_lock_irqsave(&hw->spinlock, flags);
- 		list_add(&packet->queue, &hw->tx_queue[0]);
-+		hw->tx_queued++;
- 		spin_unlock_irqrestore(&hw->spinlock, flags);
- 	} else {
- 		if (packet->packet_callback)
-@@ -975,12 +979,10 @@ static int send_pending_packet(struct ipw_hardware *hw, int priority_limit)
- 	unsigned long flags;
- 
- 	spin_lock_irqsave(&hw->spinlock, flags);
--	if (hw->tx_queued && hw->tx_ready != 0) {
-+	if (hw->tx_queued && hw->tx_ready) {
- 		int priority;
- 		struct ipw_tx_packet *packet = NULL;
- 
--		hw->tx_ready--;
--
- 		/* Pick a packet */
- 		for (priority = 0; priority < priority_limit; priority++) {
- 			if (!list_empty(&hw->tx_queue[priority])) {
-@@ -989,6 +991,7 @@ static int send_pending_packet(struct ipw_hardware *hw, int priority_limit)
- 						struct ipw_tx_packet,
- 						queue);
- 
-+				hw->tx_queued--;
- 				list_del(&packet->queue);
- 
- 				break;
-@@ -999,6 +1002,7 @@ static int send_pending_packet(struct ipw_hardware *hw, int priority_limit)
- 			spin_unlock_irqrestore(&hw->spinlock, flags);
- 			return 0;
- 		}
-+
- 		spin_unlock_irqrestore(&hw->spinlock, flags);
- 
- 		/* Send */
-@@ -1089,7 +1093,7 @@ static irqreturn_t ipwireless_handle_v1_interrupt(int irq,
- 		if (irqn & IR_TXINTR) {
- 			ack |= IR_TXINTR;
- 			spin_lock_irqsave(&hw->spinlock, flags);
--			hw->tx_ready++;
-+			hw->tx_ready = 1;
- 			spin_unlock_irqrestore(&hw->spinlock, flags);
- 		}
- 		/* Received data */
-@@ -1196,7 +1200,7 @@ static irqreturn_t ipwireless_handle_v2_v3_interrupt(int irq,
- 	if (memrxdone & MEMRX_RX_DONE) {
- 		writew(0, &hw->memory_info_regs->memreg_rx_done);
- 		spin_lock_irqsave(&hw->spinlock, flags);
--		hw->tx_ready++;
-+		hw->tx_ready = 1;
- 		spin_unlock_irqrestore(&hw->spinlock, flags);
- 		tx = 1;
- 	}
-@@ -1260,7 +1264,7 @@ static void send_packet(struct ipw_hardware *hw, int priority,
- 
- 	spin_lock_irqsave(&hw->spinlock, flags);
- 	list_add_tail(&packet->queue, &hw->tx_queue[priority]);
--	hw->tx_queued = 1;
-+	hw->tx_queued++;
- 	spin_unlock_irqrestore(&hw->spinlock, flags);
- 
- 	flush_packets_to_hw(hw);
-diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
-index 99aa5f5..ebd68c1 100644
---- a/drivers/cpufreq/cpufreq.c
-+++ b/drivers/cpufreq/cpufreq.c
-@@ -410,7 +410,7 @@ static int cpufreq_parse_governor (char *str_governor, unsigned int *policy,
- 				int ret;
- 
- 				mutex_unlock(&cpufreq_governor_mutex);
--				ret = request_module(name);
-+				ret = request_module("%s", name);
- 				mutex_lock(&cpufreq_governor_mutex);
- 
- 				if (ret == 0)
-diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
-index 4e3128f..9d5b86c 100644
---- a/drivers/infiniband/core/umem.c
-+++ b/drivers/infiniband/core/umem.c
-@@ -144,7 +144,7 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
- 	ret = 0;
- 	while (npages) {
- 		ret = get_user_pages(current, current->mm, cur_base,
--				     min_t(int, npages,
-+				     min_t(unsigned long, npages,
- 					   PAGE_SIZE / sizeof (struct page *)),
- 				     1, !umem->writable, page_list, vma_list);
- 
-diff --git a/drivers/media/video/bt8xx/bttv-driver.c b/drivers/media/video/bt8xx/bttv-driver.c
-index fcf8f2d..594522a 100644
---- a/drivers/media/video/bt8xx/bttv-driver.c
-+++ b/drivers/media/video/bt8xx/bttv-driver.c
-@@ -2613,7 +2613,7 @@ static int vidiocgmbuf(struct file *file, void *priv, struct video_mbuf *mbuf)
- 	struct bttv_fh *fh = priv;
- 
- 	mutex_lock(&fh->cap.vb_lock);
--	retval = videobuf_mmap_setup(&fh->cap, gbuffers, gbufsize,
-+	retval = __videobuf_mmap_setup(&fh->cap, gbuffers, gbufsize,
- 				     V4L2_MEMORY_MMAP);
- 	if (retval < 0) {
- 		mutex_unlock(&fh->cap.vb_lock);
-diff --git a/drivers/media/video/videobuf-core.c b/drivers/media/video/videobuf-core.c
-index eab79ff..57a9de4 100644
---- a/drivers/media/video/videobuf-core.c
-+++ b/drivers/media/video/videobuf-core.c
-@@ -335,7 +335,7 @@ int videobuf_mmap_free(struct videobuf_queue *q)
- }
- 
- /* Locking: Caller holds q->vb_lock */
--static int __videobuf_mmap_setup(struct videobuf_queue *q,
-+int __videobuf_mmap_setup(struct videobuf_queue *q,
- 			unsigned int bcount, unsigned int bsize,
- 			enum v4l2_memory memory)
- {
-@@ -1093,6 +1093,7 @@ EXPORT_SYMBOL_GPL(videobuf_read_stream);
- EXPORT_SYMBOL_GPL(videobuf_read_one);
- EXPORT_SYMBOL_GPL(videobuf_poll_stream);
- 
-+EXPORT_SYMBOL_GPL(__videobuf_mmap_setup);
- EXPORT_SYMBOL_GPL(videobuf_mmap_setup);
- EXPORT_SYMBOL_GPL(videobuf_mmap_free);
- EXPORT_SYMBOL_GPL(videobuf_mmap_mapper);
-diff --git a/drivers/mmc/host/wbsd.c b/drivers/mmc/host/wbsd.c
-index be624a0..c303e7f 100644
---- a/drivers/mmc/host/wbsd.c
-+++ b/drivers/mmc/host/wbsd.c
-@@ -1457,17 +1457,7 @@ static int __devinit wbsd_request_irq(struct wbsd_host *host, int irq)
- 	int ret;
- 
- 	/*
--	 * Allocate interrupt.
--	 */
--
--	ret = request_irq(irq, wbsd_irq, IRQF_SHARED, DRIVER_NAME, host);
--	if (ret)
--		return ret;
--
--	host->irq = irq;
--
--	/*
--	 * Set up tasklets.
-+	 * Set up tasklets. Must be done before requesting interrupt.
- 	 */
- 	tasklet_init(&host->card_tasklet, wbsd_tasklet_card,
- 			(unsigned long)host);
-@@ -1480,6 +1470,15 @@ static int __devinit wbsd_request_irq(struct wbsd_host *host, int irq)
- 	tasklet_init(&host->finish_tasklet, wbsd_tasklet_finish,
- 			(unsigned long)host);
- 
-+	/*
-+	 * Allocate interrupt.
-+	 */
-+	ret = request_irq(irq, wbsd_irq, IRQF_SHARED, DRIVER_NAME, host);
-+	if (ret)
-+		return ret;
-+
-+	host->irq = irq;
-+
- 	return 0;
- }
- 
-diff --git a/drivers/net/cassini.c b/drivers/net/cassini.c
-index 14299f8..863d7f3 100644
---- a/drivers/net/cassini.c
-+++ b/drivers/net/cassini.c
-@@ -142,8 +142,8 @@
- 
- #define DRV_MODULE_NAME		"cassini"
- #define PFX DRV_MODULE_NAME	": "
--#define DRV_MODULE_VERSION	"1.5"
--#define DRV_MODULE_RELDATE	"4 Jan 2008"
-+#define DRV_MODULE_VERSION	"1.6"
-+#define DRV_MODULE_RELDATE	"21 May 2008"
- 
- #define CAS_DEF_MSG_ENABLE	  \
- 	(NETIF_MSG_DRV		| \
-@@ -2140,9 +2140,12 @@ end_copy_pkt:
- 		if (addr)
- 			cas_page_unmap(addr);
- 	}
--	skb->csum = csum_unfold(~csum);
--	skb->ip_summed = CHECKSUM_COMPLETE;
- 	skb->protocol = eth_type_trans(skb, cp->dev);
-+	if (skb->protocol == htons(ETH_P_IP)) {
-+		skb->csum = csum_unfold(~csum);
-+		skb->ip_summed = CHECKSUM_COMPLETE;
-+	} else
-+		skb->ip_summed = CHECKSUM_NONE;
- 	return len;
- }
- 
-diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
-index 9f088a4..8e877e7 100644
---- a/drivers/net/forcedeth.c
-+++ b/drivers/net/forcedeth.c
-@@ -3111,6 +3111,20 @@ static void nv_link_irq(struct net_device *dev)
- 	dprintk(KERN_DEBUG "%s: link change notification done.\n", dev->name);
- }
- 
-+static void nv_msi_workaround(struct fe_priv *np)
-+{
-+
-+	/* Need to toggle the msi irq mask within the ethernet device,
-+	 * otherwise, future interrupts will not be detected.
-+	 */
-+	if (np->msi_flags & NV_MSI_ENABLED) {
-+		u8 __iomem *base = np->base;
-+
-+		writel(0, base + NvRegMSIIrqMask);
-+		writel(NVREG_MSI_VECTOR_0_ENABLED, base + NvRegMSIIrqMask);
-+	}
-+}
-+
- static irqreturn_t nv_nic_irq(int foo, void *data)
- {
- 	struct net_device *dev = (struct net_device *) data;
-@@ -3133,6 +3147,8 @@ static irqreturn_t nv_nic_irq(int foo, void *data)
- 		if (!(events & np->irqmask))
- 			break;
- 
-+		nv_msi_workaround(np);
-+
- 		spin_lock(&np->lock);
- 		nv_tx_done(dev);
- 		spin_unlock(&np->lock);
-@@ -3248,6 +3264,8 @@ static irqreturn_t nv_nic_irq_optimized(int foo, void *data)
- 		if (!(events & np->irqmask))
- 			break;
- 
-+		nv_msi_workaround(np);
-+
- 		spin_lock(&np->lock);
- 		nv_tx_done_optimized(dev, TX_WORK_PER_LOOP);
- 		spin_unlock(&np->lock);
-@@ -3588,6 +3606,8 @@ static irqreturn_t nv_nic_irq_test(int foo, void *data)
- 	if (!(events & NVREG_IRQ_TIMER))
- 		return IRQ_RETVAL(0);
- 
-+	nv_msi_workaround(np);
-+
- 	spin_lock(&np->lock);
- 	np->intr_test = 1;
- 	spin_unlock(&np->lock);
-diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c
-index 3d10ca0..a629355 100644
---- a/drivers/net/pppol2tp.c
-+++ b/drivers/net/pppol2tp.c
-@@ -240,12 +240,15 @@ static inline struct pppol2tp_session *pppol2tp_sock_to_session(struct sock *sk)
- 	if (sk == NULL)
- 		return NULL;
- 
-+	sock_hold(sk);
- 	session = (struct pppol2tp_session *)(sk->sk_user_data);
--	if (session == NULL)
--		return NULL;
-+	if (session == NULL) {
-+		sock_put(sk);
-+		goto out;
-+	}
- 
- 	BUG_ON(session->magic != L2TP_SESSION_MAGIC);
--
-+out:
- 	return session;
- }
- 
-@@ -256,12 +259,15 @@ static inline struct pppol2tp_tunnel *pppol2tp_sock_to_tunnel(struct sock *sk)
- 	if (sk == NULL)
- 		return NULL;
- 
-+	sock_hold(sk);
- 	tunnel = (struct pppol2tp_tunnel *)(sk->sk_user_data);
--	if (tunnel == NULL)
--		return NULL;
-+	if (tunnel == NULL) {
-+		sock_put(sk);
-+		goto out;
-+	}
- 
- 	BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);
--
-+out:
- 	return tunnel;
- }
- 
-@@ -716,12 +722,14 @@ discard:
- 	session->stats.rx_errors++;
- 	kfree_skb(skb);
- 	sock_put(session->sock);
-+	sock_put(sock);
- 
- 	return 0;
- 
- error:
- 	/* Put UDP header back */
- 	__skb_push(skb, sizeof(struct udphdr));
-+	sock_put(sock);
- 
- no_tunnel:
- 	return 1;
-@@ -745,10 +753,13 @@ static int pppol2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
- 	       "%s: received %d bytes\n", tunnel->name, skb->len);
- 
- 	if (pppol2tp_recv_core(sk, skb))
--		goto pass_up;
-+		goto pass_up_put;
- 
-+	sock_put(sk);
- 	return 0;
- 
-+pass_up_put:
-+	sock_put(sk);
- pass_up:
- 	return 1;
- }
-@@ -858,7 +869,7 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
- 
- 	tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);
- 	if (tunnel == NULL)
--		goto error;
-+		goto error_put_sess;
- 
- 	/* What header length is configured for this session? */
- 	hdr_len = pppol2tp_l2tp_header_len(session);
-@@ -870,7 +881,7 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
- 			   sizeof(ppph) + total_len,
- 			   0, GFP_KERNEL);
- 	if (!skb)
--		goto error;
-+		goto error_put_sess_tun;
- 
- 	/* Reserve space for headers. */
- 	skb_reserve(skb, NET_SKB_PAD);
-@@ -900,7 +911,7 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
- 	error = memcpy_fromiovec(skb->data, m->msg_iov, total_len);
- 	if (error < 0) {
- 		kfree_skb(skb);
--		goto error;
-+		goto error_put_sess_tun;
- 	}
- 	skb_put(skb, total_len);
- 
-@@ -947,10 +958,33 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
- 		session->stats.tx_errors++;
- 	}
- 
-+	return error;
-+
-+error_put_sess_tun:
-+	sock_put(session->tunnel_sock);
-+error_put_sess:
-+	sock_put(sk);
- error:
- 	return error;
- }
- 
-+/* Automatically called when the skb is freed.
-+ */
-+static void pppol2tp_sock_wfree(struct sk_buff *skb)
-+{
-+	sock_put(skb->sk);
-+}
-+
-+/* For data skbs that we transmit, we associate with the tunnel socket
-+ * but don't do accounting.
-+ */
-+static inline void pppol2tp_skb_set_owner_w(struct sk_buff *skb, struct sock *sk)
-+{
-+	sock_hold(sk);
-+	skb->sk = sk;
-+	skb->destructor = pppol2tp_sock_wfree;
-+}
-+
- /* Transmit function called by generic PPP driver.  Sends PPP frame
-  * over PPPoL2TP socket.
-  *
-@@ -980,6 +1014,8 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
- 	__wsum csum = 0;
- 	struct udphdr *uh;
- 	unsigned int len;
-+	int old_headroom;
-+	int new_headroom;
- 
- 	if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
- 		goto abort;
-@@ -991,25 +1027,27 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
- 
- 	sk_tun = session->tunnel_sock;
- 	if (sk_tun == NULL)
--		goto abort;
-+		goto abort_put_sess;
- 	tunnel = pppol2tp_sock_to_tunnel(sk_tun);
- 	if (tunnel == NULL)
--		goto abort;
-+		goto abort_put_sess;
- 
- 	/* What header length is configured for this session? */
- 	hdr_len = pppol2tp_l2tp_header_len(session);
- 
- 	/* Check that there's enough headroom in the skb to insert IP,
- 	 * UDP and L2TP and PPP headers. If not enough, expand it to
--	 * make room. Note that a new skb (or a clone) is
--	 * allocated. If we return an error from this point on, make
--	 * sure we free the new skb but do not free the original skb
--	 * since that is done by the caller for the error case.
-+	 * make room. Adjust truesize.
- 	 */
- 	headroom = NET_SKB_PAD + sizeof(struct iphdr) +
- 		sizeof(struct udphdr) + hdr_len + sizeof(ppph);
-+	old_headroom = skb_headroom(skb);
- 	if (skb_cow_head(skb, headroom))
--		goto abort;
-+		goto abort_put_sess_tun;
-+
-+	new_headroom = skb_headroom(skb);
-+	skb_orphan(skb);
-+	skb->truesize += new_headroom - old_headroom;
- 
- 	/* Setup PPP header */
- 	__skb_push(skb, sizeof(ppph));
-@@ -1065,8 +1103,7 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
- 	/* Get routing info from the tunnel socket */
- 	dst_release(skb->dst);
- 	skb->dst = dst_clone(__sk_dst_get(sk_tun));
--	skb_orphan(skb);
--	skb->sk = sk_tun;
-+	pppol2tp_skb_set_owner_w(skb, sk_tun);
- 
- 	/* Queue the packet to IP for output */
- 	len = skb->len;
-@@ -1083,8 +1120,14 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
- 		session->stats.tx_errors++;
- 	}
- 
-+	sock_put(sk_tun);
-+	sock_put(sk);
- 	return 1;
- 
-+abort_put_sess_tun:
-+	sock_put(sk_tun);
-+abort_put_sess:
-+	sock_put(sk);
- abort:
- 	/* Free the original skb */
- 	kfree_skb(skb);
-@@ -1188,7 +1231,7 @@ static void pppol2tp_tunnel_destruct(struct sock *sk)
- {
- 	struct pppol2tp_tunnel *tunnel;
- 
--	tunnel = pppol2tp_sock_to_tunnel(sk);
-+	tunnel = sk->sk_user_data;
- 	if (tunnel == NULL)
- 		goto end;
- 
-@@ -1227,10 +1270,12 @@ static void pppol2tp_session_destruct(struct sock *sk)
- 	if (sk->sk_user_data != NULL) {
- 		struct pppol2tp_tunnel *tunnel;
- 
--		session = pppol2tp_sock_to_session(sk);
-+		session = sk->sk_user_data;
- 		if (session == NULL)
- 			goto out;
- 
-+		BUG_ON(session->magic != L2TP_SESSION_MAGIC);
-+
- 		/* Don't use pppol2tp_sock_to_tunnel() here to
- 		 * get the tunnel context because the tunnel
- 		 * socket might have already been closed (its
-@@ -1276,6 +1321,7 @@ out:
- static int pppol2tp_release(struct socket *sock)
- {
- 	struct sock *sk = sock->sk;
-+	struct pppol2tp_session *session;
- 	int error;
- 
- 	if (!sk)
-@@ -1293,9 +1339,18 @@ static int pppol2tp_release(struct socket *sock)
- 	sock_orphan(sk);
- 	sock->sk = NULL;
- 
-+	session = pppol2tp_sock_to_session(sk);
-+
- 	/* Purge any queued data */
- 	skb_queue_purge(&sk->sk_receive_queue);
- 	skb_queue_purge(&sk->sk_write_queue);
-+	if (session != NULL) {
-+		struct sk_buff *skb;
-+		while ((skb = skb_dequeue(&session->reorder_q))) {
-+			kfree_skb(skb);
-+			sock_put(sk);
-+		}
-+	}
- 
- 	release_sock(sk);
- 
-@@ -1598,7 +1653,7 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
- 
- 	error = ppp_register_channel(&po->chan);
- 	if (error)
--		goto end;
-+		goto end_put_tun;
- 
- 	/* This is how we get the session context from the socket. */
- 	sk->sk_user_data = session;
-@@ -1618,6 +1673,8 @@ out_no_ppp:
- 	PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
- 	       "%s: created\n", session->name);
- 
-+end_put_tun:
-+	sock_put(tunnel_sock);
- end:
- 	release_sock(sk);
- 
-@@ -1658,6 +1715,7 @@ static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr,
- 	*usockaddr_len = len;
- 
- 	error = 0;
-+	sock_put(sock->sk);
- 
- end:
- 	return error;
-@@ -1896,14 +1954,17 @@ static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd,
- 		err = -EBADF;
- 		tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);
- 		if (tunnel == NULL)
--			goto end;
-+			goto end_put_sess;
- 
- 		err = pppol2tp_tunnel_ioctl(tunnel, cmd, arg);
--		goto end;
-+		sock_put(session->tunnel_sock);
-+		goto end_put_sess;
- 	}
- 
- 	err = pppol2tp_session_ioctl(session, cmd, arg);
- 
-+end_put_sess:
-+	sock_put(sk);
- end:
- 	return err;
- }
-@@ -2049,14 +2110,17 @@ static int pppol2tp_setsockopt(struct socket *sock, int level, int optname,
- 		err = -EBADF;
- 		tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);
- 		if (tunnel == NULL)
--			goto end;
-+			goto end_put_sess;
- 
- 		err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val);
-+		sock_put(session->tunnel_sock);
- 	} else
- 		err = pppol2tp_session_setsockopt(sk, session, optname, val);
- 
- 	err = 0;
- 
-+end_put_sess:
-+	sock_put(sk);
- end:
- 	return err;
- }
-@@ -2171,20 +2235,24 @@ static int pppol2tp_getsockopt(struct socket *sock, int level,
- 		err = -EBADF;
- 		tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);
- 		if (tunnel == NULL)
--			goto end;
-+			goto end_put_sess;
- 
- 		err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val);
-+		sock_put(session->tunnel_sock);
- 	} else
- 		err = pppol2tp_session_getsockopt(sk, session, optname, &val);
- 
- 	err = -EFAULT;
- 	if (put_user(len, (int __user *) optlen))
--		goto end;
-+		goto end_put_sess;
- 
- 	if (copy_to_user((void __user *) optval, &val, len))
--		goto end;
-+		goto end_put_sess;
- 
- 	err = 0;
-+
-+end_put_sess:
-+	sock_put(sk);
- end:
- 	return err;
- }
-diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
-index e0055d0..6966eec 100644
---- a/drivers/net/wireless/b43/main.c
-+++ b/drivers/net/wireless/b43/main.c
-@@ -3818,7 +3818,9 @@ static void b43_chip_reset(struct work_struct *work)
- 			goto out;
- 		}
- 	}
--      out:
-+out:
-+	if (err)
-+		wl->current_dev = NULL; /* Failed to init the dev. */
- 	mutex_unlock(&wl->mutex);
- 	if (err)
- 		b43err(wl, "Controller restart FAILED\n");
-@@ -3967,9 +3969,11 @@ static void b43_one_core_detach(struct ssb_device *dev)
- 	struct b43_wldev *wldev;
- 	struct b43_wl *wl;
- 
-+	/* Do not cancel ieee80211-workqueue based work here.
-+	 * See comment in b43_remove(). */
-+
- 	wldev = ssb_get_drvdata(dev);
- 	wl = wldev->wl;
--	cancel_work_sync(&wldev->restart_work);
- 	b43_debugfs_remove_device(wldev);
- 	b43_wireless_core_detach(wldev);
- 	list_del(&wldev->list);
-@@ -4152,6 +4156,10 @@ static void b43_remove(struct ssb_device *dev)
- 	struct b43_wl *wl = ssb_get_devtypedata(dev);
- 	struct b43_wldev *wldev = ssb_get_drvdata(dev);
- 
-+	/* We must cancel any work here before unregistering from ieee80211,
-+	 * as the ieee80211 unreg will destroy the workqueue. */
-+	cancel_work_sync(&wldev->restart_work);
-+
- 	B43_WARN_ON(!wl);
- 	if (wl->current_dev == wldev)
- 		ieee80211_unregister_hw(wl->hw);
-diff --git a/drivers/serial/serial_core.c b/drivers/serial/serial_core.c
-index 3bf9294..db9920e 100644
---- a/drivers/serial/serial_core.c
-+++ b/drivers/serial/serial_core.c
-@@ -2022,6 +2022,8 @@ int uart_suspend_port(struct uart_driver *drv, struct uart_port *port)
- int uart_resume_port(struct uart_driver *drv, struct uart_port *port)
- {
- 	struct uart_state *state = drv->state + port->line;
-+	struct device *tty_dev;
-+	struct uart_match match = {port, drv};
- 
- 	mutex_lock(&state->mutex);
- 
-@@ -2031,7 +2033,8 @@ int uart_resume_port(struct uart_driver *drv, struct uart_port *port)
- 		return 0;
- 	}
- 
--	if (!port->suspended) {
-+	tty_dev = device_find_child(port->dev, &match, serial_match_port);
-+	if (!port->suspended && device_may_wakeup(tty_dev)) {
- 		disable_irq_wake(port->irq);
- 		mutex_unlock(&state->mutex);
- 		return 0;
-diff --git a/drivers/serial/sunhv.c b/drivers/serial/sunhv.c
-index 145c028..2847336 100644
---- a/drivers/serial/sunhv.c
-+++ b/drivers/serial/sunhv.c
-@@ -499,7 +499,6 @@ static void sunhv_console_write_bychar(struct console *con, const char *s, unsig
- 	} else
- 		spin_lock(&port->lock);
- 
--	spin_lock_irqsave(&port->lock, flags);
- 	for (i = 0; i < n; i++) {
- 		if (*s == '\n')
- 			sunhv_console_putchar(port, '\r');
-diff --git a/drivers/ssb/driver_pcicore.c b/drivers/ssb/driver_pcicore.c
-index 5d777f2..3c8239a 100644
---- a/drivers/ssb/driver_pcicore.c
-+++ b/drivers/ssb/driver_pcicore.c
-@@ -519,12 +519,12 @@ int ssb_pcicore_dev_irqvecs_enable(struct ssb_pcicore *pc,
- 	int err = 0;
- 	u32 tmp;
- 
--	might_sleep();
--
- 	if (!pdev)
- 		goto out;
- 	bus = pdev->bus;
- 
-+	might_sleep_if(pdev->id.coreid != SSB_DEV_PCI);
-+
- 	/* Enable interrupts for this device. */
- 	if (bus->host_pci &&
- 	    ((pdev->id.revision >= 6) || (pdev->id.coreid == SSB_DEV_PCIE))) {
-diff --git a/drivers/video/hgafb.c b/drivers/video/hgafb.c
-index fb9e672..c18880d 100644
---- a/drivers/video/hgafb.c
-+++ b/drivers/video/hgafb.c
-@@ -279,7 +279,7 @@ static void hga_blank(int blank_mode)
- 
- static int __init hga_card_detect(void)
- {
--	int count=0;
-+	int count = 0;
- 	void __iomem *p, *q;
- 	unsigned short p_save, q_save;
- 
-@@ -303,20 +303,18 @@ static int __init hga_card_detect(void)
- 	writew(0x55aa, p); if (readw(p) == 0x55aa) count++;
- 	writew(p_save, p);
- 
--	if (count != 2) {
--		return 0;
--	}
-+	if (count != 2)
-+		goto error;
- 
- 	/* Ok, there is definitely a card registering at the correct
- 	 * memory location, so now we do an I/O port test.
- 	 */
- 	
--	if (!test_hga_b(0x66, 0x0f)) {	    /* cursor low register */
--		return 0;
--	}
--	if (!test_hga_b(0x99, 0x0f)) {     /* cursor low register */
--		return 0;
--	}
-+	if (!test_hga_b(0x66, 0x0f))	    /* cursor low register */
-+		goto error;
-+
-+	if (!test_hga_b(0x99, 0x0f))     /* cursor low register */
-+		goto error;
- 
- 	/* See if the card is a Hercules, by checking whether the vsync
- 	 * bit of the status register is changing.  This test lasts for
-@@ -331,7 +329,7 @@ static int __init hga_card_detect(void)
- 	}
- 
- 	if (p_save == q_save) 
--		return 0;
-+		goto error;
- 
- 	switch (inb_p(HGA_STATUS_PORT) & 0x70) {
- 		case 0x10:
-@@ -348,6 +346,12 @@ static int __init hga_card_detect(void)
- 			break;
- 	}
- 	return 1;
-+error:
-+	if (release_io_ports)
-+		release_region(0x3b0, 12);
-+	if (release_io_port)
-+		release_region(0x3bf, 1);
-+	return 0;
- }
- 
- /**
-diff --git a/drivers/video/modedb.c b/drivers/video/modedb.c
-index 08d0725..971b338 100644
---- a/drivers/video/modedb.c
-+++ b/drivers/video/modedb.c
-@@ -28,6 +28,7 @@
- #endif
- 
- const char *fb_mode_option;
-+EXPORT_SYMBOL_GPL(fb_mode_option);
- 
-     /*
-      *  Standard video mode definitions (taken from XFree86)
-diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
-index a04b17e..b94fb5c 100644
---- a/fs/cifs/cifsfs.c
-+++ b/fs/cifs/cifsfs.c
-@@ -97,9 +97,6 @@ cifs_read_super(struct super_block *sb, void *data,
- {
- 	struct inode *inode;
- 	struct cifs_sb_info *cifs_sb;
--#ifdef CONFIG_CIFS_DFS_UPCALL
--	int len;
--#endif
- 	int rc = 0;
- 
- 	/* BB should we make this contingent on mount parm? */
-@@ -117,15 +114,17 @@ cifs_read_super(struct super_block *sb, void *data,
- 	 * complex operation (mount), and in case of fail
- 	 * just exit instead of doing mount and attempting
- 	 * undo it if this copy fails?*/
--	len = strlen(data);
--	cifs_sb->mountdata = kzalloc(len + 1, GFP_KERNEL);
--	if (cifs_sb->mountdata == NULL) {
--		kfree(sb->s_fs_info);
--		sb->s_fs_info = NULL;
--		return -ENOMEM;
-+	if (data) {
-+		int len = strlen(data);
-+		cifs_sb->mountdata = kzalloc(len + 1, GFP_KERNEL);
-+		if (cifs_sb->mountdata == NULL) {
-+			kfree(sb->s_fs_info);
-+			sb->s_fs_info = NULL;
-+			return -ENOMEM;
-+		}
-+		strncpy(cifs_sb->mountdata, data, len + 1);
-+		cifs_sb->mountdata[len] = '\0';
- 	}
--	strncpy(cifs_sb->mountdata, data, len + 1);
--	cifs_sb->mountdata[len] = '\0';
- #endif
- 
- 	rc = cifs_mount(sb, cifs_sb, data, devname);
-diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
-index a066e10..086b312 100644
---- a/fs/ecryptfs/crypto.c
-+++ b/fs/ecryptfs/crypto.c
-@@ -1907,9 +1907,9 @@ int ecryptfs_get_tfm_and_mutex_for_cipher_name(struct crypto_blkcipher **tfm,
- 			goto out;
- 		}
- 	}
--	mutex_unlock(&key_tfm_list_mutex);
- 	(*tfm) = key_tfm->key_tfm;
- 	(*tfm_mutex) = &key_tfm->key_tfm_mutex;
- out:
-+	mutex_unlock(&key_tfm_list_mutex);
- 	return rc;
- }
-diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
-index 2b8f5ed..2258b8f 100644
---- a/fs/ecryptfs/file.c
-+++ b/fs/ecryptfs/file.c
-@@ -195,7 +195,9 @@ static int ecryptfs_open(struct inode *inode, struct file *file)
- 		file, ecryptfs_inode_to_private(inode)->lower_file);
- 	if (S_ISDIR(ecryptfs_dentry->d_inode->i_mode)) {
- 		ecryptfs_printk(KERN_DEBUG, "This is a directory\n");
-+		mutex_lock(&crypt_stat->cs_mutex);
- 		crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
-+		mutex_unlock(&crypt_stat->cs_mutex);
- 		rc = 0;
- 		goto out;
- 	}
-diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
-index e238611..a2174c2 100644
---- a/fs/ecryptfs/inode.c
-+++ b/fs/ecryptfs/inode.c
-@@ -37,17 +37,11 @@ static struct dentry *lock_parent(struct dentry *dentry)
- {
- 	struct dentry *dir;
- 
--	dir = dget(dentry->d_parent);
-+	dir = dget_parent(dentry);
- 	mutex_lock_nested(&(dir->d_inode->i_mutex), I_MUTEX_PARENT);
- 	return dir;
- }
- 
--static void unlock_parent(struct dentry *dentry)
--{
--	mutex_unlock(&(dentry->d_parent->d_inode->i_mutex));
--	dput(dentry->d_parent);
--}
--
- static void unlock_dir(struct dentry *dir)
- {
- 	mutex_unlock(&dir->d_inode->i_mutex);
-@@ -426,8 +420,9 @@ static int ecryptfs_unlink(struct inode *dir, struct dentry *dentry)
- 	int rc = 0;
- 	struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
- 	struct inode *lower_dir_inode = ecryptfs_inode_to_lower(dir);
-+	struct dentry *lower_dir_dentry;
- 
--	lock_parent(lower_dentry);
-+	lower_dir_dentry = lock_parent(lower_dentry);
- 	rc = vfs_unlink(lower_dir_inode, lower_dentry);
- 	if (rc) {
- 		printk(KERN_ERR "Error in vfs_unlink; rc = [%d]\n", rc);
-@@ -439,7 +434,7 @@ static int ecryptfs_unlink(struct inode *dir, struct dentry *dentry)
- 	dentry->d_inode->i_ctime = dir->i_ctime;
- 	d_drop(dentry);
- out_unlock:
--	unlock_parent(lower_dentry);
-+	unlock_dir(lower_dir_dentry);
- 	return rc;
- }
- 
-@@ -908,7 +903,9 @@ static int ecryptfs_setattr(struct dentry *dentry, struct iattr *ia)
- 	if (ia->ia_valid & (ATTR_KILL_SUID | ATTR_KILL_SGID))
- 		ia->ia_valid &= ~ATTR_MODE;
- 
-+	mutex_lock(&lower_dentry->d_inode->i_mutex);
- 	rc = notify_change(lower_dentry, ia);
-+	mutex_unlock(&lower_dentry->d_inode->i_mutex);
- out:
- 	fsstack_copy_attr_all(inode, lower_inode, NULL);
- 	return rc;
-diff --git a/fs/pipe.c b/fs/pipe.c
-index 8be381b..f73492b 100644
---- a/fs/pipe.c
-+++ b/fs/pipe.c
-@@ -988,7 +988,10 @@ struct file *create_write_pipe(void)
- 	return f;
- 
-  err_dentry:
-+	free_pipe_info(inode);
- 	dput(dentry);
-+	return ERR_PTR(err);
-+
-  err_inode:
- 	free_pipe_info(inode);
- 	iput(inode);
-diff --git a/include/asm-m68k/bitops.h b/include/asm-m68k/bitops.h
-index 83d1f28..fbb7f06 100644
---- a/include/asm-m68k/bitops.h
-+++ b/include/asm-m68k/bitops.h
-@@ -410,8 +410,50 @@ static inline int ext2_find_next_zero_bit(const void *vaddr, unsigned size,
- 	res = ext2_find_first_zero_bit (p, size - 32 * (p - addr));
- 	return (p - addr) * 32 + res;
- }
--#define ext2_find_next_bit(addr, size, off) \
--	generic_find_next_le_bit((unsigned long *)(addr), (size), (off))
-+
-+static inline int ext2_find_first_bit(const void *vaddr, unsigned size)
-+{
-+	const unsigned long *p = vaddr, *addr = vaddr;
-+	int res;
-+
-+	if (!size)
-+		return 0;
-+
-+	size = (size >> 5) + ((size & 31) > 0);
-+	while (*p++ == 0UL)
-+	{
-+		if (--size == 0)
-+			return (p - addr) << 5;
-+	}
-+
-+	--p;
-+	for (res = 0; res < 32; res++)
-+		if (ext2_test_bit(res, p))
-+			break;
-+	return (p - addr) * 32 + res;
-+}
-+
-+static inline int ext2_find_next_bit(const void *vaddr, unsigned size,
-+				     unsigned offset)
-+{
-+	const unsigned long *addr = vaddr;
-+	const unsigned long *p = addr + (offset >> 5);
-+	int bit = offset & 31UL, res;
-+
-+	if (offset >= size)
-+		return size;
-+
-+	if (bit) {
-+		/* Look for one in first longword */
-+		for (res = bit; res < 32; res++)
-+			if (ext2_test_bit(res, p))
-+				return (p - addr) * 32 + res;
-+		p++;
-+	}
-+	/* No set bit yet, search remaining full bytes for a set bit */
-+	res = ext2_find_first_bit(p, size - 32 * (p - addr));
-+	return (p - addr) * 32 + res;
-+}
- 
- #endif /* __KERNEL__ */
- 
-diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
-index 70eb3c8..f624e7c 100644
---- a/include/linux/pci_ids.h
-+++ b/include/linux/pci_ids.h
-@@ -716,6 +716,7 @@
- #define PCI_DEVICE_ID_HP_CISSA		0x3220
- #define PCI_DEVICE_ID_HP_CISSC		0x3230
- #define PCI_DEVICE_ID_HP_CISSD		0x3238
-+#define PCI_DEVICE_ID_HP_CISSE		0x323a
- #define PCI_DEVICE_ID_HP_ZX2_IOC	0x4031
- 
- #define PCI_VENDOR_ID_PCTECH		0x1042
-diff --git a/include/media/videobuf-core.h b/include/media/videobuf-core.h
-index 9903394..7552731 100644
---- a/include/media/videobuf-core.h
-+++ b/include/media/videobuf-core.h
-@@ -227,6 +227,9 @@ unsigned int videobuf_poll_stream(struct file *file,
- int videobuf_mmap_setup(struct videobuf_queue *q,
- 			unsigned int bcount, unsigned int bsize,
- 			enum v4l2_memory memory);
-+int __videobuf_mmap_setup(struct videobuf_queue *q,
-+			unsigned int bcount, unsigned int bsize,
-+			enum v4l2_memory memory);
- int videobuf_mmap_free(struct videobuf_queue *q);
- int videobuf_mmap_mapper(struct videobuf_queue *q,
- 			 struct vm_area_struct *vma);
-diff --git a/include/net/netlink.h b/include/net/netlink.h
-index a5506c4..112dcdf 100644
---- a/include/net/netlink.h
-+++ b/include/net/netlink.h
-@@ -772,12 +772,13 @@ static inline int __nla_parse_nested_compat(struct nlattr *tb[], int maxtype,
- 					    const struct nla_policy *policy,
- 					    int len)
- {
--	if (nla_len(nla) < len)
-+	int nested_len = nla_len(nla) - NLA_ALIGN(len);
-+
-+	if (nested_len < 0)
- 		return -1;
--	if (nla_len(nla) >= NLA_ALIGN(len) + sizeof(struct nlattr))
--		return nla_parse_nested(tb, maxtype,
--					nla_data(nla) + NLA_ALIGN(len),
--					policy);
-+	if (nested_len >= nla_attr_size(0))
-+		return nla_parse(tb, maxtype, nla_data(nla) + NLA_ALIGN(len),
-+				 nested_len, policy);
- 	memset(tb, 0, sizeof(struct nlattr *) * (maxtype + 1));
- 	return 0;
- }
-diff --git a/init/Kconfig b/init/Kconfig
-index a97924b..021476f 100644
---- a/init/Kconfig
-+++ b/init/Kconfig
-@@ -13,6 +13,7 @@ config DEFCONFIG_LIST
- 	default "/lib/modules/$UNAME_RELEASE/.config"
- 	default "/etc/kernel-config"
- 	default "/boot/config-$UNAME_RELEASE"
-+	default "$ARCH_DEFCONFIG"
- 	default "arch/$ARCH/defconfig"
- 
- menu "General setup"
-diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
-index b33410a..c0bac6d 100644
---- a/net/8021q/vlan.c
-+++ b/net/8021q/vlan.c
-@@ -397,10 +397,8 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event,
- 	if (dev->nd_net != &init_net)
- 		return NOTIFY_DONE;
- 
--	if (is_vlan_dev(dev)) {
-+	if (is_vlan_dev(dev))
- 		__vlan_device_event(dev, event);
--		goto out;
--	}
- 
- 	grp = __vlan_find_group(dev->ifindex);
- 	if (!grp)
-diff --git a/net/ax25/ax25_subr.c b/net/ax25/ax25_subr.c
-index d8f2157..034aa10 100644
---- a/net/ax25/ax25_subr.c
-+++ b/net/ax25/ax25_subr.c
-@@ -64,20 +64,15 @@ void ax25_frames_acked(ax25_cb *ax25, unsigned short nr)
- 
- void ax25_requeue_frames(ax25_cb *ax25)
- {
--	struct sk_buff *skb, *skb_prev = NULL;
-+	struct sk_buff *skb;
- 
- 	/*
- 	 * Requeue all the un-ack-ed frames on the output queue to be picked
- 	 * up by ax25_kick called from the timer. This arrangement handles the
- 	 * possibility of an empty output queue.
- 	 */
--	while ((skb = skb_dequeue(&ax25->ack_queue)) != NULL) {
--		if (skb_prev == NULL)
--			skb_queue_head(&ax25->write_queue, skb);
--		else
--			skb_append(skb_prev, skb, &ax25->write_queue);
--		skb_prev = skb;
--	}
-+	while ((skb = skb_dequeue_tail(&ax25->ack_queue)) != NULL)
-+		skb_queue_head(&ax25->write_queue, skb);
- }
- 
- /*
-diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
-index eb62558..0c2c937 100644
---- a/net/bluetooth/rfcomm/core.c
-+++ b/net/bluetooth/rfcomm/core.c
-@@ -423,8 +423,8 @@ static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
- 
- 		rfcomm_dlc_lock(d);
- 		d->state = BT_CLOSED;
--		rfcomm_dlc_unlock(d);
- 		d->state_change(d, err);
-+		rfcomm_dlc_unlock(d);
- 
- 		skb_queue_purge(&d->tx_queue);
- 		rfcomm_dlc_unlink(d);
-diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
-index c3f749a..c919187 100644
---- a/net/bluetooth/rfcomm/tty.c
-+++ b/net/bluetooth/rfcomm/tty.c
-@@ -566,11 +566,22 @@ static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
- 	if (dlc->state == BT_CLOSED) {
- 		if (!dev->tty) {
- 			if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
--				if (rfcomm_dev_get(dev->id) == NULL)
-+				/* Drop DLC lock here to avoid deadlock
-+				 * 1. rfcomm_dev_get will take rfcomm_dev_lock
-+				 *    but in rfcomm_dev_add there's lock order:
-+				 *    rfcomm_dev_lock -> dlc lock
-+				 * 2. rfcomm_dev_put will deadlock if it's
-+				 *    the last reference
-+				 */
-+				rfcomm_dlc_unlock(dlc);
-+				if (rfcomm_dev_get(dev->id) == NULL) {
-+					rfcomm_dlc_lock(dlc);
- 					return;
-+				}
- 
- 				rfcomm_dev_del(dev);
- 				rfcomm_dev_put(dev);
-+				rfcomm_dlc_lock(dlc);
- 			}
- 		} else
- 			tty_hangup(dev->tty);
-diff --git a/net/can/raw.c b/net/can/raw.c
-index c92cb8e..da26bbb 100644
---- a/net/can/raw.c
-+++ b/net/can/raw.c
-@@ -435,15 +435,13 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
- 			if (!filter)
- 				return -ENOMEM;
- 
--			err = copy_from_user(filter, optval, optlen);
--			if (err) {
-+			if (copy_from_user(filter, optval, optlen)) {
- 				kfree(filter);
--				return err;
-+				return -EFAULT;
- 			}
- 		} else if (count == 1) {
--			err = copy_from_user(&sfilter, optval, optlen);
--			if (err)
--				return err;
-+			if (copy_from_user(&sfilter, optval, optlen))
-+				return -EFAULT;
- 		}
- 
- 		lock_sock(sk);
-@@ -493,9 +491,8 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
- 		if (optlen != sizeof(err_mask))
- 			return -EINVAL;
- 
--		err = copy_from_user(&err_mask, optval, optlen);
--		if (err)
--			return err;
-+		if (copy_from_user(&err_mask, optval, optlen))
-+			return -EFAULT;
- 
- 		err_mask &= CAN_ERR_MASK;
- 
-@@ -531,7 +528,8 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
- 		if (optlen != sizeof(ro->loopback))
- 			return -EINVAL;
- 
--		err = copy_from_user(&ro->loopback, optval, optlen);
-+		if (copy_from_user(&ro->loopback, optval, optlen))
-+			return -EFAULT;
- 
- 		break;
- 
-@@ -539,7 +537,8 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
- 		if (optlen != sizeof(ro->recv_own_msgs))
- 			return -EINVAL;
- 
--		err = copy_from_user(&ro->recv_own_msgs, optval, optlen);
-+		if (copy_from_user(&ro->recv_own_msgs, optval, optlen))
-+			return -EFAULT;
- 
- 		break;
- 
-diff --git a/net/core/dev.c b/net/core/dev.c
-index 460e7f9..37ffd7a 100644
---- a/net/core/dev.c
-+++ b/net/core/dev.c
-@@ -3132,7 +3132,7 @@ int dev_change_flags(struct net_device *dev, unsigned flags)
- 	 *	Load in the correct multicast list now the flags have changed.
- 	 */
- 
--	if (dev->change_rx_flags && (dev->flags ^ flags) & IFF_MULTICAST)
-+	if (dev->change_rx_flags && (old_flags ^ flags) & IFF_MULTICAST)
- 		dev->change_rx_flags(dev, IFF_MULTICAST);
- 
- 	dev_set_rx_mode(dev);
-diff --git a/net/ipv4/route.c b/net/ipv4/route.c
-index 7b5e8e1..d39cf9f 100644
---- a/net/ipv4/route.c
-+++ b/net/ipv4/route.c
-@@ -162,7 +162,7 @@ static struct dst_ops ipv4_dst_ops = {
- 	.negative_advice =	ipv4_negative_advice,
- 	.link_failure =		ipv4_link_failure,
- 	.update_pmtu =		ip_rt_update_pmtu,
--	.local_out =		ip_local_out,
-+	.local_out =		__ip_local_out,
- 	.entry_size =		sizeof(struct rtable),
- 	.entries =		ATOMIC_INIT(0),
- };
-diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
-index 3a6be23..fde7146 100644
---- a/net/ipv4/tcp_cong.c
-+++ b/net/ipv4/tcp_cong.c
-@@ -285,14 +285,12 @@ int tcp_is_cwnd_limited(const struct sock *sk, u32 in_flight)
- 	if (in_flight >= tp->snd_cwnd)
- 		return 1;
- 
--	if (!sk_can_gso(sk))
--		return 0;
--
- 	left = tp->snd_cwnd - in_flight;
--	if (sysctl_tcp_tso_win_divisor)
--		return left * sysctl_tcp_tso_win_divisor < tp->snd_cwnd;
--	else
--		return left <= tcp_max_burst(tp);
-+	if (sk_can_gso(sk) &&
-+	    left * sysctl_tcp_tso_win_divisor < tp->snd_cwnd &&
-+	    left * tp->mss_cache < 65536)
-+		return 1;
-+	return left <= tcp_max_burst(tp);
- }
- EXPORT_SYMBOL_GPL(tcp_is_cwnd_limited);
- 
-diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
-index bbb7d88..3180963 100644
---- a/net/ipv4/tcp_input.c
-+++ b/net/ipv4/tcp_input.c
-@@ -113,8 +113,6 @@ int sysctl_tcp_abc __read_mostly;
- #define FLAG_FORWARD_PROGRESS	(FLAG_ACKED|FLAG_DATA_SACKED)
- #define FLAG_ANY_PROGRESS	(FLAG_FORWARD_PROGRESS|FLAG_SND_UNA_ADVANCED)
- 
--#define IsSackFrto() (sysctl_tcp_frto == 0x2)
--
- #define TCP_REMNANT (TCP_FLAG_FIN|TCP_FLAG_URG|TCP_FLAG_SYN|TCP_FLAG_PSH)
- #define TCP_HP_BITS (~(TCP_RESERVED_BITS|TCP_FLAG_PSH))
- 
-@@ -1393,9 +1391,9 @@ static struct sk_buff *tcp_maybe_skipping_dsack(struct sk_buff *skb,
- 
- 	if (before(next_dup->start_seq, skip_to_seq)) {
- 		skb = tcp_sacktag_skip(skb, sk, next_dup->start_seq, fack_count);
--		tcp_sacktag_walk(skb, sk, NULL,
--				 next_dup->start_seq, next_dup->end_seq,
--				 1, fack_count, reord, flag);
-+		skb = tcp_sacktag_walk(skb, sk, NULL,
-+				     next_dup->start_seq, next_dup->end_seq,
-+				     1, fack_count, reord, flag);
- 	}
- 
- 	return skb;
-@@ -1685,6 +1683,11 @@ static inline void tcp_reset_reno_sack(struct tcp_sock *tp)
- 	tp->sacked_out = 0;
- }
- 
-+static int tcp_is_sackfrto(const struct tcp_sock *tp)
-+{
-+	return (sysctl_tcp_frto == 0x2) && !tcp_is_reno(tp);
-+}
-+
- /* F-RTO can only be used if TCP has never retransmitted anything other than
-  * head (SACK enhanced variant from Appendix B of RFC4138 is more robust here)
-  */
-@@ -1701,7 +1704,7 @@ int tcp_use_frto(struct sock *sk)
- 	if (icsk->icsk_mtup.probe_size)
- 		return 0;
- 
--	if (IsSackFrto())
-+	if (tcp_is_sackfrto(tp))
- 		return 1;
- 
- 	/* Avoid expensive walking of rexmit queue if possible */
-@@ -1791,7 +1794,7 @@ void tcp_enter_frto(struct sock *sk)
- 	/* Earlier loss recovery underway (see RFC4138; Appendix B).
- 	 * The last condition is necessary at least in tp->frto_counter case.
- 	 */
--	if (IsSackFrto() && (tp->frto_counter ||
-+	if (tcp_is_sackfrto(tp) && (tp->frto_counter ||
- 	    ((1 << icsk->icsk_ca_state) & (TCPF_CA_Recovery|TCPF_CA_Loss))) &&
- 	    after(tp->high_seq, tp->snd_una)) {
- 		tp->frto_highmark = tp->high_seq;
-@@ -1838,9 +1841,16 @@ static void tcp_enter_frto_loss(struct sock *sk, int allowed_segments, int flag)
- 			TCP_SKB_CB(skb)->sacked &= ~TCPCB_SACKED_RETRANS;
- 		}
- 
--		/* Don't lost mark skbs that were fwd transmitted after RTO */
--		if (!(TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED) &&
--		    !after(TCP_SKB_CB(skb)->end_seq, tp->frto_highmark)) {
-+		/* Marking forward transmissions that were made after RTO lost
-+		 * can cause unnecessary retransmissions in some scenarios,
-+		 * SACK blocks will mitigate that in some but not in all cases.
-+		 * We used to not mark them but it was causing break-ups with
-+		 * receivers that do only in-order receival.
-+		 *
-+		 * TODO: we could detect presence of such receiver and select
-+		 * different behavior per flow.
-+		 */
-+		if (!(TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED)) {
- 			TCP_SKB_CB(skb)->sacked |= TCPCB_LOST;
- 			tp->lost_out += tcp_skb_pcount(skb);
- 		}
-@@ -1856,7 +1866,7 @@ static void tcp_enter_frto_loss(struct sock *sk, int allowed_segments, int flag)
- 	tp->reordering = min_t(unsigned int, tp->reordering,
- 			       sysctl_tcp_reordering);
- 	tcp_set_ca_state(sk, TCP_CA_Loss);
--	tp->high_seq = tp->frto_highmark;
-+	tp->high_seq = tp->snd_nxt;
- 	TCP_ECN_queue_cwr(tp);
- 
- 	tcp_clear_retrans_hints_partial(tp);
-@@ -2459,28 +2469,34 @@ static inline void tcp_complete_cwr(struct sock *sk)
- 	tcp_ca_event(sk, CA_EVENT_COMPLETE_CWR);
- }
- 
-+static void tcp_try_keep_open(struct sock *sk)
-+{
-+	struct tcp_sock *tp = tcp_sk(sk);
-+	int state = TCP_CA_Open;
-+
-+	if (tcp_left_out(tp) || tp->retrans_out || tp->undo_marker)
-+		state = TCP_CA_Disorder;
-+
-+	if (inet_csk(sk)->icsk_ca_state != state) {
-+		tcp_set_ca_state(sk, state);
-+		tp->high_seq = tp->snd_nxt;
-+	}
-+}
-+
- static void tcp_try_to_open(struct sock *sk, int flag)
- {
- 	struct tcp_sock *tp = tcp_sk(sk);
- 
- 	tcp_verify_left_out(tp);
- 
--	if (tp->retrans_out == 0)
-+	if (!tp->frto_counter && tp->retrans_out == 0)
- 		tp->retrans_stamp = 0;
- 
- 	if (flag & FLAG_ECE)
- 		tcp_enter_cwr(sk, 1);
- 
- 	if (inet_csk(sk)->icsk_ca_state != TCP_CA_CWR) {
--		int state = TCP_CA_Open;
--
--		if (tcp_left_out(tp) || tp->retrans_out || tp->undo_marker)
--			state = TCP_CA_Disorder;
--
--		if (inet_csk(sk)->icsk_ca_state != state) {
--			tcp_set_ca_state(sk, state);
--			tp->high_seq = tp->snd_nxt;
--		}
-+		tcp_try_keep_open(sk);
- 		tcp_moderate_cwnd(tp);
- 	} else {
- 		tcp_cwnd_down(sk, flag);
-@@ -3110,7 +3126,7 @@ static int tcp_process_frto(struct sock *sk, int flag)
- 		return 1;
- 	}
- 
--	if (!IsSackFrto() || tcp_is_reno(tp)) {
-+	if (!tcp_is_sackfrto(tp)) {
- 		/* RFC4138 shortcoming in step 2; should also have case c):
- 		 * ACK isn't duplicate nor advances window, e.g., opposite dir
- 		 * data, winupdate
-@@ -3286,8 +3302,11 @@ no_queue:
- 	return 1;
- 
- old_ack:
--	if (TCP_SKB_CB(skb)->sacked)
-+	if (TCP_SKB_CB(skb)->sacked) {
- 		tcp_sacktag_write_queue(sk, skb, prior_snd_una);
-+		if (icsk->icsk_ca_state == TCP_CA_Open)
-+			tcp_try_keep_open(sk);
-+	}
- 
- uninteresting_ack:
- 	SOCK_DEBUG(sk, "Ack %u out of %u:%u\n", ack, tp->snd_una, tp->snd_nxt);
-diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
-index d29ef79..6c3d8a1 100644
---- a/net/ipv4/tcp_output.c
-+++ b/net/ipv4/tcp_output.c
-@@ -1836,7 +1836,7 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
- {
- 	struct tcp_sock *tp = tcp_sk(sk);
- 	struct inet_connection_sock *icsk = inet_csk(sk);
--	unsigned int cur_mss = tcp_current_mss(sk, 0);
-+	unsigned int cur_mss;
- 	int err;
- 
- 	/* Inconslusive MTU probe */
-@@ -1858,6 +1858,11 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
- 			return -ENOMEM;
- 	}
- 
-+	if (inet_csk(sk)->icsk_af_ops->rebuild_header(sk))
-+		return -EHOSTUNREACH; /* Routing failure or similar. */
-+
-+	cur_mss = tcp_current_mss(sk, 0);
-+
- 	/* If receiver has shrunk his window, and skb is out of
- 	 * new window, do not retransmit it. The exception is the
- 	 * case, when window is shrunk to zero. In this case
-@@ -1884,9 +1889,6 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
- 	    (sysctl_tcp_retrans_collapse != 0))
- 		tcp_retrans_try_collapse(sk, skb, cur_mss);
- 
--	if (inet_csk(sk)->icsk_af_ops->rebuild_header(sk))
--		return -EHOSTUNREACH; /* Routing failure or similar. */
--
- 	/* Some Solaris stacks overoptimize and ignore the FIN on a
- 	 * retransmit when old data is attached.  So strip it off
- 	 * since it is cheap to do so and saves bytes on the network.
-diff --git a/net/ipv6/route.c b/net/ipv6/route.c
-index e8b241c..f95745f 100644
---- a/net/ipv6/route.c
-+++ b/net/ipv6/route.c
-@@ -105,7 +105,7 @@ static struct dst_ops ip6_dst_ops = {
- 	.negative_advice	=	ip6_negative_advice,
- 	.link_failure		=	ip6_link_failure,
- 	.update_pmtu		=	ip6_rt_update_pmtu,
--	.local_out		=	ip6_local_out,
-+	.local_out		=	__ip6_local_out,
- 	.entry_size		=	sizeof(struct rt6_info),
- 	.entries		=	ATOMIC_INIT(0),
- };
-diff --git a/net/key/af_key.c b/net/key/af_key.c
-index 5ceab25..11c42e3 100644
---- a/net/key/af_key.c
-+++ b/net/key/af_key.c
-@@ -1219,7 +1219,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct sadb_msg *hdr,
- 		x->sel.prefixlen_s = addr->sadb_address_prefixlen;
- 	}
- 
--	if (x->props.mode == XFRM_MODE_TRANSPORT)
-+	if (!x->sel.family)
- 		x->sel.family = x->props.family;
- 
- 	if (ext_hdrs[SADB_X_EXT_NAT_T_TYPE-1]) {
-diff --git a/net/mac80211/ieee80211_sta.c b/net/mac80211/ieee80211_sta.c
-index c170685..7d5c263 100644
---- a/net/mac80211/ieee80211_sta.c
-+++ b/net/mac80211/ieee80211_sta.c
-@@ -2723,6 +2723,7 @@ static int ieee80211_sta_join_ibss(struct net_device *dev,
- 	struct rate_selection ratesel;
- 	u8 *pos;
- 	struct ieee80211_sub_if_data *sdata;
-+	union iwreq_data wrqu;
- 
- 	/* Remove possible STA entries from other IBSS networks. */
- 	sta_info_flush(local, NULL);
-@@ -2863,6 +2864,10 @@ static int ieee80211_sta_join_ibss(struct net_device *dev,
- 
- 	ieee80211_rx_bss_put(dev, bss);
- 
-+	memset(&wrqu, 0, sizeof(wrqu));
-+	memcpy(wrqu.ap_addr.sa_data, bss->bssid, ETH_ALEN);
-+	wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
-+
- 	return res;
- }
- 
-diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
-index 0fbedca..855c33c 100644
---- a/net/sched/cls_api.c
-+++ b/net/sched/cls_api.c
-@@ -220,7 +220,7 @@ replay:
- 		tp = kzalloc(sizeof(*tp), GFP_KERNEL);
- 		if (tp == NULL)
- 			goto errout;
--		err = -EINVAL;
-+		err = -ENOENT;
- 		tp_ops = tcf_proto_lookup_ops(tca[TCA_KIND]);
- 		if (tp_ops == NULL) {
- #ifdef CONFIG_KMOD
-diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c
-index 9a9b977..d0330d8 100644
---- a/sound/pci/emu10k1/emu10k1_main.c
-+++ b/sound/pci/emu10k1/emu10k1_main.c
-@@ -1817,13 +1817,6 @@ int __devinit snd_emu10k1_create(struct snd_card *card,
- 	}
- 	emu->port = pci_resource_start(pci, 0);
- 
--	if (request_irq(pci->irq, snd_emu10k1_interrupt, IRQF_SHARED,
--			"EMU10K1", emu)) {
--		err = -EBUSY;
--		goto error;
--	}
--	emu->irq = pci->irq;
--
- 	emu->max_cache_pages = max_cache_bytes >> PAGE_SHIFT;
- 	if (snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(pci),
- 				32 * 1024, &emu->ptb_pages) < 0) {
-@@ -1886,6 +1879,14 @@ int __devinit snd_emu10k1_create(struct snd_card *card,
- 	emu->fx8010.etram_pages.area = NULL;
- 	emu->fx8010.etram_pages.bytes = 0;
- 
-+	/* irq handler must be registered after I/O ports are activated */
-+	if (request_irq(pci->irq, snd_emu10k1_interrupt, IRQF_SHARED,
-+			"EMU10K1", emu)) {
-+		err = -EBUSY;
-+		goto error;
-+	}
-+	emu->irq = pci->irq;
-+
- 	/*
- 	 *  Init to 0x02109204 :
- 	 *  Clock accuracy    = 0     (1000ppm)
-diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
-index 33282f9..52a7f0f 100644
---- a/sound/pci/hda/patch_realtek.c
-+++ b/sound/pci/hda/patch_realtek.c
-@@ -940,7 +940,6 @@ do_sku:
- 			    AC_VERB_SET_UNSOLICITED_ENABLE,
- 			    AC_USRSP_EN | ALC880_HP_EVENT);
- 	spec->unsol_event = alc_sku_unsol_event;
--	spec->init_hook = alc_sku_automute;	
- }
- 
- /*

Deleted: genpatches-2.6/trunk/2.6.26/1007_linux-2.6.25.8.patch
===================================================================
--- genpatches-2.6/trunk/2.6.26/1007_linux-2.6.25.8.patch	2008-07-17 02:44:10 UTC (rev 1328)
+++ genpatches-2.6/trunk/2.6.26/1007_linux-2.6.25.8.patch	2008-07-17 02:47:50 UTC (rev 1329)
@@ -1,495 +0,0 @@
-diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
-index c8890b8..39b1b7e 100644
---- a/arch/x86/kernel/process_32.c
-+++ b/arch/x86/kernel/process_32.c
-@@ -259,12 +259,31 @@ static void mwait_idle(void)
- 	mwait_idle_with_hints(0, 0);
- }
- 
-+/*
-+ * mwait selection logic:
-+ *
-+ * It depends on the CPU. For AMD CPUs that support MWAIT this is
-+ * wrong. Family 0x10 and 0x11 CPUs will enter C1 on HLT. Powersavings
-+ * then depend on a clock divisor and current Pstate of the core. If
-+ * all cores of a processor are in halt state (C1) the processor can
-+ * enter the C1E (C1 enhanced) state. If mwait is used this will never
-+ * happen.
-+ *
-+ * idle=mwait overrides this decision and forces the usage of mwait.
-+ */
- static int __cpuinit mwait_usable(const struct cpuinfo_x86 *c)
- {
- 	if (force_mwait)
- 		return 1;
--	/* Any C1 states supported? */
--	return c->cpuid_level >= 5 && ((cpuid_edx(5) >> 4) & 0xf) > 0;
-+
-+	if (c->x86_vendor == X86_VENDOR_AMD) {
-+		switch(c->x86) {
-+		case 0x10:
-+		case 0x11:
-+			return 0;
-+		}
-+	}
-+	return 1;
- }
- 
- void __cpuinit select_idle_routine(const struct cpuinfo_x86 *c)
-diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
-index 1316f1c..53b9c4c 100644
---- a/arch/x86/kernel/process_64.c
-+++ b/arch/x86/kernel/process_64.c
-@@ -254,13 +254,31 @@ static void mwait_idle(void)
- 	}
- }
- 
--
-+/*
-+ * mwait selection logic:
-+ *
-+ * It depends on the CPU. For AMD CPUs that support MWAIT this is
-+ * wrong. Family 0x10 and 0x11 CPUs will enter C1 on HLT. Powersavings
-+ * then depend on a clock divisor and current Pstate of the core. If
-+ * all cores of a processor are in halt state (C1) the processor can
-+ * enter the C1E (C1 enhanced) state. If mwait is used this will never
-+ * happen.
-+ *
-+ * idle=mwait overrides this decision and forces the usage of mwait.
-+ */
- static int __cpuinit mwait_usable(const struct cpuinfo_x86 *c)
- {
- 	if (force_mwait)
- 		return 1;
--	/* Any C1 states supported? */
--	return c->cpuid_level >= 5 && ((cpuid_edx(5) >> 4) & 0xf) > 0;
-+
-+	if (c->x86_vendor == X86_VENDOR_AMD) {
-+		switch(c->x86) {
-+		case 0x10:
-+		case 0x11:
-+			return 0;
-+		}
-+	}
-+	return 1;
- }
- 
- void __cpuinit select_idle_routine(const struct cpuinfo_x86 *c)
-diff --git a/arch/x86/lib/copy_user_64.S b/arch/x86/lib/copy_user_64.S
-index 70bebd3..ee1c3f6 100644
---- a/arch/x86/lib/copy_user_64.S
-+++ b/arch/x86/lib/copy_user_64.S
-@@ -217,19 +217,19 @@ ENTRY(copy_user_generic_unrolled)
- 	/* table sorted by exception address */
- 	.section __ex_table,"a"
- 	.align 8
--	.quad .Ls1,.Ls1e
--	.quad .Ls2,.Ls2e
--	.quad .Ls3,.Ls3e
--	.quad .Ls4,.Ls4e
--	.quad .Ld1,.Ls1e
-+	.quad .Ls1,.Ls1e	/* Ls1-Ls4 have copied zero bytes */
-+	.quad .Ls2,.Ls1e
-+	.quad .Ls3,.Ls1e
-+	.quad .Ls4,.Ls1e
-+	.quad .Ld1,.Ls1e	/* Ld1-Ld4 have copied 0-24 bytes */
- 	.quad .Ld2,.Ls2e
- 	.quad .Ld3,.Ls3e
- 	.quad .Ld4,.Ls4e
--	.quad .Ls5,.Ls5e
--	.quad .Ls6,.Ls6e
--	.quad .Ls7,.Ls7e
--	.quad .Ls8,.Ls8e
--	.quad .Ld5,.Ls5e
-+	.quad .Ls5,.Ls5e	/* Ls5-Ls8 have copied 32 bytes */
-+	.quad .Ls6,.Ls5e
-+	.quad .Ls7,.Ls5e
-+	.quad .Ls8,.Ls5e
-+	.quad .Ld5,.Ls5e	/* Ld5-Ld8 have copied 32-56 bytes */
- 	.quad .Ld6,.Ls6e
- 	.quad .Ld7,.Ls7e
- 	.quad .Ld8,.Ls8e
-@@ -244,11 +244,8 @@ ENTRY(copy_user_generic_unrolled)
- 	.quad .Le5,.Le_zero
- 	.previous
- 
--	/* compute 64-offset for main loop. 8 bytes accuracy with error on the
--	   pessimistic side. this is gross. it would be better to fix the
--	   interface. */
- 	/* eax: zero, ebx: 64 */
--.Ls1e: 	addl $8,%eax
-+.Ls1e: 	addl $8,%eax		/* eax is bytes left uncopied within the loop (Ls1e: 64 .. Ls8e: 8) */
- .Ls2e: 	addl $8,%eax
- .Ls3e: 	addl $8,%eax
- .Ls4e: 	addl $8,%eax
-diff --git a/arch/x86/lib/copy_user_nocache_64.S b/arch/x86/lib/copy_user_nocache_64.S
-index 5196762..9d3d1ab 100644
---- a/arch/x86/lib/copy_user_nocache_64.S
-+++ b/arch/x86/lib/copy_user_nocache_64.S
-@@ -145,19 +145,19 @@ ENTRY(__copy_user_nocache)
- 	/* table sorted by exception address */
- 	.section __ex_table,"a"
- 	.align 8
--	.quad .Ls1,.Ls1e
--	.quad .Ls2,.Ls2e
--	.quad .Ls3,.Ls3e
--	.quad .Ls4,.Ls4e
--	.quad .Ld1,.Ls1e
-+	.quad .Ls1,.Ls1e	/* .Ls[1-4] - 0 bytes copied */
-+	.quad .Ls2,.Ls1e
-+	.quad .Ls3,.Ls1e
-+	.quad .Ls4,.Ls1e
-+	.quad .Ld1,.Ls1e	/* .Ld[1-4] - 0..24 bytes coped */
- 	.quad .Ld2,.Ls2e
- 	.quad .Ld3,.Ls3e
- 	.quad .Ld4,.Ls4e
--	.quad .Ls5,.Ls5e
--	.quad .Ls6,.Ls6e
--	.quad .Ls7,.Ls7e
--	.quad .Ls8,.Ls8e
--	.quad .Ld5,.Ls5e
-+	.quad .Ls5,.Ls5e	/* .Ls[5-8] - 32 bytes copied */
-+	.quad .Ls6,.Ls5e
-+	.quad .Ls7,.Ls5e
-+	.quad .Ls8,.Ls5e
-+	.quad .Ld5,.Ls5e	/* .Ld[5-8] - 32..56 bytes copied */
- 	.quad .Ld6,.Ls6e
- 	.quad .Ld7,.Ls7e
- 	.quad .Ld8,.Ls8e
-@@ -172,11 +172,8 @@ ENTRY(__copy_user_nocache)
- 	.quad .Le5,.Le_zero
- 	.previous
- 
--	/* compute 64-offset for main loop. 8 bytes accuracy with error on the
--	   pessimistic side. this is gross. it would be better to fix the
--	   interface. */
- 	/* eax: zero, ebx: 64 */
--.Ls1e: 	addl $8,%eax
-+.Ls1e: 	addl $8,%eax	/* eax: bytes left uncopied: Ls1e: 64 .. Ls8e: 8 */
- .Ls2e: 	addl $8,%eax
- .Ls3e: 	addl $8,%eax
- .Ls4e: 	addl $8,%eax
-diff --git a/drivers/acpi/tables/tbinstal.c b/drivers/acpi/tables/tbinstal.c
-index 3bc0c67..225e88c 100644
---- a/drivers/acpi/tables/tbinstal.c
-+++ b/drivers/acpi/tables/tbinstal.c
-@@ -123,17 +123,13 @@ acpi_tb_add_table(struct acpi_table_desc *table_desc,
- 		}
- 	}
- 
--	/* The table must be either an SSDT or a PSDT or an OEMx */
--
--	if ((!ACPI_COMPARE_NAME(table_desc->pointer->signature, ACPI_SIG_PSDT))
--	    &&
--	    (!ACPI_COMPARE_NAME(table_desc->pointer->signature, ACPI_SIG_SSDT))
--	    && (strncmp(table_desc->pointer->signature, "OEM", 3))) {
--		ACPI_ERROR((AE_INFO,
--			    "Table has invalid signature [%4.4s], must be SSDT, PSDT or OEMx",
--			    table_desc->pointer->signature));
--		return_ACPI_STATUS(AE_BAD_SIGNATURE);
--	}
-+	/*
-+	 * Originally, we checked the table signature for "SSDT" or "PSDT" here.
-+	 * Next, we added support for OEMx tables, signature "OEM".
-+	 * Valid tables were encountered with a null signature, so we've just
-+	 * given up on validating the signature, since it seems to be a waste
-+	 * of code. The original code was removed (05/2008).
-+	 */
- 
- 	(void)acpi_ut_acquire_mutex(ACPI_MTX_TABLES);
- 
-diff --git a/drivers/ide/pci/opti621.c b/drivers/ide/pci/opti621.c
-index 46e8748..3eecbd4 100644
---- a/drivers/ide/pci/opti621.c
-+++ b/drivers/ide/pci/opti621.c
-@@ -103,18 +103,6 @@
-  *  address: 50 ns, data: 50 ns, recovery: 100 ns.
-  */
- 
--/* #define READ_PREFETCH 0 */
--/* Uncomment for disable read prefetch.
-- * There is some readprefetch capatibility in hdparm,
-- * but when I type hdparm -P 1 /dev/hda, I got errors
-- * and till reset drive is inaccessible.
-- * This (hw) read prefetch is safe on my drive.
-- */
--
--#ifndef READ_PREFETCH
--#define READ_PREFETCH 0x40 /* read prefetch is enabled */
--#endif /* else read prefetch is disabled */
--
- #define READ_REG 0	/* index of Read cycle timing register */
- #define WRITE_REG 1	/* index of Write cycle timing register */
- #define CNTRL_REG 3	/* index of Control register */
-@@ -260,7 +248,8 @@ static void opti621_set_pio_mode(ide_drive_t *drive, const u8 pio)
- 
- 	cycle1 = ((first.data_time-1)<<4)  | (first.recovery_time-2);
- 	cycle2 = ((second.data_time-1)<<4) | (second.recovery_time-2);
--	misc = READ_PREFETCH | ((ax-1)<<4) | ((drdy-2)<<1);
-+
-+	misc = ((ax - 1) << 4) | ((drdy - 2) << 1);
- 
- #ifdef OPTI621_DEBUG
- 	printk("%s: master: address: %d, data: %d, "
-@@ -335,20 +324,16 @@ static const struct ide_port_info opti621_chipsets[] __devinitdata = {
- 		.name		= "OPTI621",
- 		.init_hwif	= init_hwif_opti621,
- 		.enablebits	= {{0x45,0x80,0x00}, {0x40,0x08,0x00}},
--		.host_flags	= IDE_HFLAG_TRUST_BIOS_FOR_DMA |
-+		.host_flags	= IDE_HFLAG_NO_DMA |
- 				  IDE_HFLAG_BOOTABLE,
- 		.pio_mask	= ATA_PIO3,
--		.swdma_mask	= ATA_SWDMA2,
--		.mwdma_mask	= ATA_MWDMA2,
- 	},{	/* 1 */
- 		.name		= "OPTI621X",
- 		.init_hwif	= init_hwif_opti621,
- 		.enablebits	= {{0x45,0x80,0x00}, {0x40,0x08,0x00}},
--		.host_flags	= IDE_HFLAG_TRUST_BIOS_FOR_DMA |
-+		.host_flags	= IDE_HFLAG_NO_DMA |
- 				  IDE_HFLAG_BOOTABLE,
- 		.pio_mask	= ATA_PIO3,
--		.swdma_mask	= ATA_SWDMA2,
--		.mwdma_mask	= ATA_MWDMA2,
- 	}
- };
- 
-diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
-index 555b70c..2d31587 100644
---- a/drivers/net/virtio_net.c
-+++ b/drivers/net/virtio_net.c
-@@ -83,9 +83,7 @@ static void receive_skb(struct net_device *dev, struct sk_buff *skb,
- 	BUG_ON(len > MAX_PACKET_LEN);
- 
- 	skb_trim(skb, len);
--	skb->protocol = eth_type_trans(skb, dev);
--	pr_debug("Receiving skb proto 0x%04x len %i type %i\n",
--		 ntohs(skb->protocol), skb->len, skb->pkt_type);
-+
- 	dev->stats.rx_bytes += skb->len;
- 	dev->stats.rx_packets++;
- 
-@@ -95,6 +93,10 @@ static void receive_skb(struct net_device *dev, struct sk_buff *skb,
- 			goto frame_err;
- 	}
- 
-+	skb->protocol = eth_type_trans(skb, dev);
-+	pr_debug("Receiving skb proto 0x%04x len %i type %i\n",
-+		 ntohs(skb->protocol), skb->len, skb->pkt_type);
-+
- 	if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) {
- 		pr_debug("GSO!\n");
- 		switch (hdr->gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
-diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
-index 44ebdea..b14087b 100644
---- a/drivers/net/wireless/b43/b43.h
-+++ b/drivers/net/wireless/b43/b43.h
-@@ -596,7 +596,6 @@ struct b43_dma {
- 
- /* Context information for a noise calculation (Link Quality). */
- struct b43_noise_calculation {
--	u8 channel_at_start;
- 	bool calculation_running;
- 	u8 nr_samples;
- 	s8 samples[8][4];
-diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
-index 4ec1915..f74dba2 100644
---- a/drivers/net/wireless/b43/dma.c
-+++ b/drivers/net/wireless/b43/dma.c
-@@ -850,6 +850,7 @@ struct b43_dmaring *b43_setup_dmaring(struct b43_wldev *dev,
- 	if (!ring)
- 		goto out;
- 	ring->type = type;
-+	ring->dev = dev;
- 
- 	nr_slots = B43_RXRING_SLOTS;
- 	if (for_tx)
-@@ -901,7 +902,6 @@ struct b43_dmaring *b43_setup_dmaring(struct b43_wldev *dev,
- 				 DMA_TO_DEVICE);
- 	}
- 
--	ring->dev = dev;
- 	ring->nr_slots = nr_slots;
- 	ring->mmio_base = b43_dmacontroller_base(type, controller_index);
- 	ring->index = controller_index;
-diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
-index 6966eec..b4a2042 100644
---- a/drivers/net/wireless/b43/main.c
-+++ b/drivers/net/wireless/b43/main.c
-@@ -1027,7 +1027,6 @@ static void b43_generate_noise_sample(struct b43_wldev *dev)
- 	b43_jssi_write(dev, 0x7F7F7F7F);
- 	b43_write32(dev, B43_MMIO_MACCMD,
- 		    b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
--	B43_WARN_ON(dev->noisecalc.channel_at_start != dev->phy.channel);
- }
- 
- static void b43_calculate_link_quality(struct b43_wldev *dev)
-@@ -1036,7 +1035,6 @@ static void b43_calculate_link_quality(struct b43_wldev *dev)
- 
- 	if (dev->noisecalc.calculation_running)
- 		return;
--	dev->noisecalc.channel_at_start = dev->phy.channel;
- 	dev->noisecalc.calculation_running = 1;
- 	dev->noisecalc.nr_samples = 0;
- 
-@@ -1053,9 +1051,16 @@ static void handle_irq_noise(struct b43_wldev *dev)
- 
- 	/* Bottom half of Link Quality calculation. */
- 
-+	/* Possible race condition: It might be possible that the user
-+	 * changed to a different channel in the meantime since we
-+	 * started the calculation. We ignore that fact, since it's
-+	 * not really that much of a problem. The background noise is
-+	 * an estimation only anyway. Slightly wrong results will get damped
-+	 * by the averaging of the 8 sample rounds. Additionally the
-+	 * value is shortlived. So it will be replaced by the next noise
-+	 * calculation round soon. */
-+
- 	B43_WARN_ON(!dev->noisecalc.calculation_running);
--	if (dev->noisecalc.channel_at_start != phy->channel)
--		goto drop_calculation;
- 	*((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
- 	if (noise[0] == 0x7F || noise[1] == 0x7F ||
- 	    noise[2] == 0x7F || noise[3] == 0x7F)
-@@ -1096,11 +1101,10 @@ static void handle_irq_noise(struct b43_wldev *dev)
- 			average -= 48;
- 
- 		dev->stats.link_noise = average;
--	      drop_calculation:
- 		dev->noisecalc.calculation_running = 0;
- 		return;
- 	}
--      generate_new:
-+generate_new:
- 	b43_generate_noise_sample(dev);
- }
- 
-diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
-index ed7e0a1..079c733 100644
---- a/drivers/scsi/hosts.c
-+++ b/drivers/scsi/hosts.c
-@@ -455,9 +455,10 @@ struct Scsi_Host *scsi_host_lookup(unsigned short hostnum)
- 	struct Scsi_Host *shost = ERR_PTR(-ENXIO);
- 
- 	cdev = class_find_child(&shost_class, &hostnum, __scsi_host_match);
--	if (cdev)
-+	if (cdev) {
- 		shost = scsi_host_get(class_to_shost(cdev));
--
-+		class_device_put(cdev);
-+	}
- 	return shost;
- }
- EXPORT_SYMBOL(scsi_host_lookup);
-diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
-index 7ee86d4..c82df8b 100644
---- a/drivers/scsi/sr.c
-+++ b/drivers/scsi/sr.c
-@@ -178,6 +178,9 @@ int sr_test_unit_ready(struct scsi_device *sdev, struct scsi_sense_hdr *sshdr)
- 		the_result = scsi_execute_req(sdev, cmd, DMA_NONE, NULL,
- 					      0, sshdr, SR_TIMEOUT,
- 					      retries--);
-+		if (scsi_sense_valid(sshdr) &&
-+		    sshdr->sense_key == UNIT_ATTENTION)
-+			sdev->changed = 1;
- 
- 	} while (retries > 0 &&
- 		 (!scsi_status_is_good(the_result) ||
-diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c
-index 77f7a7f..d60705e 100644
---- a/drivers/serial/8250.c
-+++ b/drivers/serial/8250.c
-@@ -2174,7 +2174,9 @@ serial8250_set_termios(struct uart_port *port, struct ktermios *termios,
- 	}
- 	serial8250_set_mctrl(&up->port, up->port.mctrl);
- 	spin_unlock_irqrestore(&up->port.lock, flags);
--	tty_termios_encode_baud_rate(termios, baud, baud);
-+	/* Don't rewrite B0 */
-+	if (tty_termios_baud_rate(termios))
-+		tty_termios_encode_baud_rate(termios, baud, baud);
- }
- 
- static void
-diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
-index 4147de6..8785784 100644
---- a/net/netfilter/nf_conntrack_core.c
-+++ b/net/netfilter/nf_conntrack_core.c
-@@ -199,8 +199,6 @@ destroy_conntrack(struct nf_conntrack *nfct)
- 	if (l4proto && l4proto->destroy)
- 		l4proto->destroy(ct);
- 
--	nf_ct_ext_destroy(ct);
--
- 	rcu_read_unlock();
- 
- 	spin_lock_bh(&nf_conntrack_lock);
-@@ -523,6 +521,7 @@ static void nf_conntrack_free_rcu(struct rcu_head *head)
- 
- void nf_conntrack_free(struct nf_conn *ct)
- {
-+	nf_ct_ext_destroy(ct);
- 	call_rcu(&ct->rcu, nf_conntrack_free_rcu);
- }
- EXPORT_SYMBOL_GPL(nf_conntrack_free);
-diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
-index 898f192..7407dd3 100644
---- a/net/netfilter/nf_conntrack_h323_main.c
-+++ b/net/netfilter/nf_conntrack_h323_main.c
-@@ -617,6 +617,7 @@ static struct nf_conntrack_helper nf_conntrack_helper_h245 __read_mostly = {
- 	.me			= THIS_MODULE,
- 	.max_expected		= H323_RTP_CHANNEL_MAX * 4 + 2 /* T.120 */,
- 	.timeout		= 240,
-+	.tuple.src.l3num	= AF_UNSPEC,
- 	.tuple.dst.protonum	= IPPROTO_UDP,
- 	.help			= h245_help
- };
-@@ -1758,6 +1759,7 @@ static void __exit nf_conntrack_h323_fini(void)
- 	nf_conntrack_helper_unregister(&nf_conntrack_helper_ras[0]);
- 	nf_conntrack_helper_unregister(&nf_conntrack_helper_q931[1]);
- 	nf_conntrack_helper_unregister(&nf_conntrack_helper_q931[0]);
-+	nf_conntrack_helper_unregister(&nf_conntrack_helper_h245);
- 	kfree(h323_buffer);
- 	pr_debug("nf_ct_h323: fini\n");
- }
-@@ -1770,28 +1772,34 @@ static int __init nf_conntrack_h323_init(void)
- 	h323_buffer = kmalloc(65536, GFP_KERNEL);
- 	if (!h323_buffer)
- 		return -ENOMEM;
--	ret = nf_conntrack_helper_register(&nf_conntrack_helper_q931[0]);
-+	ret = nf_conntrack_helper_register(&nf_conntrack_helper_h245);
- 	if (ret < 0)
- 		goto err1;
--	ret = nf_conntrack_helper_register(&nf_conntrack_helper_q931[1]);
-+	ret = nf_conntrack_helper_register(&nf_conntrack_helper_q931[0]);
- 	if (ret < 0)
- 		goto err2;
--	ret = nf_conntrack_helper_register(&nf_conntrack_helper_ras[0]);
-+	ret = nf_conntrack_helper_register(&nf_conntrack_helper_q931[1]);
- 	if (ret < 0)
- 		goto err3;
--	ret = nf_conntrack_helper_register(&nf_conntrack_helper_ras[1]);
-+	ret = nf_conntrack_helper_register(&nf_conntrack_helper_ras[0]);
- 	if (ret < 0)
- 		goto err4;
-+	ret = nf_conntrack_helper_register(&nf_conntrack_helper_ras[1]);
-+	if (ret < 0)
-+		goto err5;
- 	pr_debug("nf_ct_h323: init success\n");
- 	return 0;
- 
--err4:
-+err5:
- 	nf_conntrack_helper_unregister(&nf_conntrack_helper_ras[0]);
--err3:
-+err4:
- 	nf_conntrack_helper_unregister(&nf_conntrack_helper_q931[1]);
--err2:
-+err3:
- 	nf_conntrack_helper_unregister(&nf_conntrack_helper_q931[0]);
-+err2:
-+	nf_conntrack_helper_unregister(&nf_conntrack_helper_h245);
- err1:
-+	kfree(h323_buffer);
- 	return ret;
- }
- 

Deleted: genpatches-2.6/trunk/2.6.26/1008_linux-2.6.25.9.patch
===================================================================
--- genpatches-2.6/trunk/2.6.26/1008_linux-2.6.25.9.patch	2008-07-17 02:44:10 UTC (rev 1328)
+++ genpatches-2.6/trunk/2.6.26/1008_linux-2.6.25.9.patch	2008-07-17 02:47:50 UTC (rev 1329)
@@ -1,426 +0,0 @@
-diff --git a/arch/powerpc/kernel/vdso.c b/arch/powerpc/kernel/vdso.c
-index d3437c4..e3b2185 100644
---- a/arch/powerpc/kernel/vdso.c
-+++ b/arch/powerpc/kernel/vdso.c
-@@ -141,7 +141,7 @@ static void dump_one_vdso_page(struct page *pg, struct page *upg)
- 	printk("kpg: %p (c:%d,f:%08lx)", __va(page_to_pfn(pg) << PAGE_SHIFT),
- 	       page_count(pg),
- 	       pg->flags);
--	if (upg/* && pg != upg*/) {
-+	if (upg && !IS_ERR(upg) /* && pg != upg*/) {
- 		printk(" upg: %p (c:%d,f:%08lx)", __va(page_to_pfn(upg)
- 						       << PAGE_SHIFT),
- 		       page_count(upg),
-diff --git a/arch/x86/kernel/setup_32.c b/arch/x86/kernel/setup_32.c
-index 2b3e5d4..9ac056b 100644
---- a/arch/x86/kernel/setup_32.c
-+++ b/arch/x86/kernel/setup_32.c
-@@ -483,10 +483,16 @@ static void __init reserve_crashkernel(void)
- 					(unsigned long)(crash_size >> 20),
- 					(unsigned long)(crash_base >> 20),
- 					(unsigned long)(total_mem >> 20));
-+
-+			if (reserve_bootmem(crash_base, crash_size,
-+					BOOTMEM_EXCLUSIVE) < 0) {
-+				printk(KERN_INFO "crashkernel reservation "
-+					"failed - memory is in use\n");
-+				return;
-+			}
-+
- 			crashk_res.start = crash_base;
- 			crashk_res.end   = crash_base + crash_size - 1;
--			reserve_bootmem(crash_base, crash_size,
--					BOOTMEM_DEFAULT);
- 		} else
- 			printk(KERN_INFO "crashkernel reservation failed - "
- 					"you have to specify a base address\n");
-diff --git a/drivers/hwmon/adt7473.c b/drivers/hwmon/adt7473.c
-index 9587869..8396e0f 100644
---- a/drivers/hwmon/adt7473.c
-+++ b/drivers/hwmon/adt7473.c
-@@ -309,6 +309,9 @@ no_sensor_update:
- 						ADT7473_REG_PWM_BHVR(i));
- 	}
- 
-+	i = i2c_smbus_read_byte_data(client, ADT7473_REG_CFG4);
-+	data->max_duty_at_overheat = !!(i & ADT7473_CFG4_MAX_DUTY_AT_OVT);
-+
- 	data->limits_last_updated = local_jiffies;
- 	data->limits_valid = 1;
- 
-diff --git a/drivers/hwmon/lm85.c b/drivers/hwmon/lm85.c
-index 182fe6a..30bdd50 100644
---- a/drivers/hwmon/lm85.c
-+++ b/drivers/hwmon/lm85.c
-@@ -192,7 +192,7 @@ static int RANGE_TO_REG( int range )
- {
- 	int i;
- 
--	if ( range < lm85_range_map[0] ) { 
-+	if (range <= lm85_range_map[0]) {
- 		return 0 ;
- 	} else if ( range > lm85_range_map[15] ) {
- 		return 15 ;
-diff --git a/drivers/net/atl1/atl1_hw.c b/drivers/net/atl1/atl1_hw.c
-index 9d3bd22..a965f68 100644
---- a/drivers/net/atl1/atl1_hw.c
-+++ b/drivers/net/atl1/atl1_hw.c
-@@ -250,7 +250,6 @@ static int atl1_get_permanent_address(struct atl1_hw *hw)
- 			memcpy(hw->perm_mac_addr, eth_addr, ETH_ALEN);
- 			return 0;
- 		}
--		return 1;
- 	}
- 
- 	/* see if SPI FLAGS exist ? */
-diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
-index 6483d10..2b756ef 100644
---- a/drivers/watchdog/hpwdt.c
-+++ b/drivers/watchdog/hpwdt.c
-@@ -140,49 +140,52 @@ static struct pci_device_id hpwdt_devices[] = {
- };
- MODULE_DEVICE_TABLE(pci, hpwdt_devices);
- 
-+extern asmlinkage void asminline_call(struct cmn_registers *pi86Regs, unsigned long *pRomEntry);
-+
- #ifndef CONFIG_X86_64
- /* --32 Bit Bios------------------------------------------------------------ */
- 
- #define HPWDT_ARCH	32
- 
--static void asminline_call(struct cmn_registers *pi86Regs,
--			   unsigned long *pRomEntry)
--{
--	asm("pushl       %ebp               \n\t"
--	    "movl        %esp, %ebp         \n\t"
--	    "pusha                          \n\t"
--	    "pushf                          \n\t"
--	    "push        %es                \n\t"
--	    "push        %ds                \n\t"
--	    "pop         %es                \n\t"
--	    "movl        8(%ebp),%eax       \n\t"
--	    "movl        4(%eax),%ebx       \n\t"
--	    "movl        8(%eax),%ecx       \n\t"
--	    "movl        12(%eax),%edx      \n\t"
--	    "movl        16(%eax),%esi      \n\t"
--	    "movl        20(%eax),%edi      \n\t"
--	    "movl        (%eax),%eax        \n\t"
--	    "push        %cs                \n\t"
--	    "call        *12(%ebp)          \n\t"
--	    "pushf                          \n\t"
--	    "pushl       %eax               \n\t"
--	    "movl        8(%ebp),%eax       \n\t"
--	    "movl        %ebx,4(%eax)       \n\t"
--	    "movl        %ecx,8(%eax)       \n\t"
--	    "movl        %edx,12(%eax)      \n\t"
--	    "movl        %esi,16(%eax)      \n\t"
--	    "movl        %edi,20(%eax)      \n\t"
--	    "movw        %ds,24(%eax)       \n\t"
--	    "movw        %es,26(%eax)       \n\t"
--	    "popl        %ebx               \n\t"
--	    "movl        %ebx,(%eax)        \n\t"
--	    "popl        %ebx               \n\t"
--	    "movl        %ebx,28(%eax)      \n\t"
--	    "pop         %es                \n\t"
--	    "popf                           \n\t"
--	    "popa                           \n\t"
--	    "leave                          \n\t" "ret");
--}
-+asm(".text                          \n\t"
-+    ".align 4                       \n"
-+    "asminline_call:                \n\t"
-+    "pushl       %ebp               \n\t"
-+    "movl        %esp, %ebp         \n\t"
-+    "pusha                          \n\t"
-+    "pushf                          \n\t"
-+    "push        %es                \n\t"
-+    "push        %ds                \n\t"
-+    "pop         %es                \n\t"
-+    "movl        8(%ebp),%eax       \n\t"
-+    "movl        4(%eax),%ebx       \n\t"
-+    "movl        8(%eax),%ecx       \n\t"
-+    "movl        12(%eax),%edx      \n\t"
-+    "movl        16(%eax),%esi      \n\t"
-+    "movl        20(%eax),%edi      \n\t"
-+    "movl        (%eax),%eax        \n\t"
-+    "push        %cs                \n\t"
-+    "call        *12(%ebp)          \n\t"
-+    "pushf                          \n\t"
-+    "pushl       %eax               \n\t"
-+    "movl        8(%ebp),%eax       \n\t"
-+    "movl        %ebx,4(%eax)       \n\t"
-+    "movl        %ecx,8(%eax)       \n\t"
-+    "movl        %edx,12(%eax)      \n\t"
-+    "movl        %esi,16(%eax)      \n\t"
-+    "movl        %edi,20(%eax)      \n\t"
-+    "movw        %ds,24(%eax)       \n\t"
-+    "movw        %es,26(%eax)       \n\t"
-+    "popl        %ebx               \n\t"
-+    "movl        %ebx,(%eax)        \n\t"
-+    "popl        %ebx               \n\t"
-+    "movl        %ebx,28(%eax)      \n\t"
-+    "pop         %es                \n\t"
-+    "popf                           \n\t"
-+    "popa                           \n\t"
-+    "leave                          \n\t"
-+    "ret                            \n\t"
-+    ".previous");
- 
- /*
-  *	cru_detect
-@@ -333,43 +336,44 @@ static int __devinit detect_cru_service(void)
- 
- #define HPWDT_ARCH	64
- 
--static void asminline_call(struct cmn_registers *pi86Regs,
--			   unsigned long *pRomEntry)
--{
--	asm("pushq      %rbp            \n\t"
--	    "movq       %rsp, %rbp      \n\t"
--	    "pushq      %rax            \n\t"
--	    "pushq      %rbx            \n\t"
--	    "pushq      %rdx            \n\t"
--	    "pushq      %r12            \n\t"
--	    "pushq      %r9             \n\t"
--	    "movq       %rsi, %r12      \n\t"
--	    "movq       %rdi, %r9       \n\t"
--	    "movl       4(%r9),%ebx     \n\t"
--	    "movl       8(%r9),%ecx     \n\t"
--	    "movl       12(%r9),%edx    \n\t"
--	    "movl       16(%r9),%esi    \n\t"
--	    "movl       20(%r9),%edi    \n\t"
--	    "movl       (%r9),%eax      \n\t"
--	    "call       *%r12           \n\t"
--	    "pushfq                     \n\t"
--	    "popq        %r12           \n\t"
--	    "popfq                      \n\t"
--	    "movl       %eax, (%r9)     \n\t"
--	    "movl       %ebx, 4(%r9)    \n\t"
--	    "movl       %ecx, 8(%r9)    \n\t"
--	    "movl       %edx, 12(%r9)   \n\t"
--	    "movl       %esi, 16(%r9)   \n\t"
--	    "movl       %edi, 20(%r9)   \n\t"
--	    "movq       %r12, %rax      \n\t"
--	    "movl       %eax, 28(%r9)   \n\t"
--	    "popq       %r9             \n\t"
--	    "popq       %r12            \n\t"
--	    "popq       %rdx            \n\t"
--	    "popq       %rbx            \n\t"
--	    "popq       %rax            \n\t"
--	    "leave                      \n\t" "ret");
--}
-+asm(".text                      \n\t"
-+    ".align 4                   \n"
-+    "asminline_call:            \n\t"
-+    "pushq      %rbp            \n\t"
-+    "movq       %rsp, %rbp      \n\t"
-+    "pushq      %rax            \n\t"
-+    "pushq      %rbx            \n\t"
-+    "pushq      %rdx            \n\t"
-+    "pushq      %r12            \n\t"
-+    "pushq      %r9             \n\t"
-+    "movq       %rsi, %r12      \n\t"
-+    "movq       %rdi, %r9       \n\t"
-+    "movl       4(%r9),%ebx     \n\t"
-+    "movl       8(%r9),%ecx     \n\t"
-+    "movl       12(%r9),%edx    \n\t"
-+    "movl       16(%r9),%esi    \n\t"
-+    "movl       20(%r9),%edi    \n\t"
-+    "movl       (%r9),%eax      \n\t"
-+    "call       *%r12           \n\t"
-+    "pushfq                     \n\t"
-+    "popq        %r12           \n\t"
-+    "popfq                      \n\t"
-+    "movl       %eax, (%r9)     \n\t"
-+    "movl       %ebx, 4(%r9)    \n\t"
-+    "movl       %ecx, 8(%r9)    \n\t"
-+    "movl       %edx, 12(%r9)   \n\t"
-+    "movl       %esi, 16(%r9)   \n\t"
-+    "movl       %edi, 20(%r9)   \n\t"
-+    "movq       %r12, %rax      \n\t"
-+    "movl       %eax, 28(%r9)   \n\t"
-+    "popq       %r9             \n\t"
-+    "popq       %r12            \n\t"
-+    "popq       %rdx            \n\t"
-+    "popq       %rbx            \n\t"
-+    "popq       %rax            \n\t"
-+    "leave                      \n\t"
-+    "ret                        \n\t"
-+    ".previous");
- 
- /*
-  *	dmi_find_cru
-diff --git a/include/asm-x86/page_32.h b/include/asm-x86/page_32.h
-index 5f7257f..8f8085b 100644
---- a/include/asm-x86/page_32.h
-+++ b/include/asm-x86/page_32.h
-@@ -14,7 +14,8 @@
- #define __PAGE_OFFSET		_AC(CONFIG_PAGE_OFFSET, UL)
- 
- #ifdef CONFIG_X86_PAE
--#define __PHYSICAL_MASK_SHIFT	36
-+/* 44=32+12, the limit we can fit into an unsigned long pfn */
-+#define __PHYSICAL_MASK_SHIFT	44
- #define __VIRTUAL_MASK_SHIFT	32
- #define PAGETABLE_LEVELS	3
- 
-diff --git a/include/linux/bootmem.h b/include/linux/bootmem.h
-index 4e4e340..db3d837 100644
---- a/include/linux/bootmem.h
-+++ b/include/linux/bootmem.h
-@@ -94,7 +94,7 @@ extern unsigned long init_bootmem_node(pg_data_t *pgdat,
- 				       unsigned long freepfn,
- 				       unsigned long startpfn,
- 				       unsigned long endpfn);
--extern void reserve_bootmem_node(pg_data_t *pgdat,
-+extern int reserve_bootmem_node(pg_data_t *pgdat,
- 				 unsigned long physaddr,
- 				 unsigned long size,
- 				 int flags);
-diff --git a/mm/bootmem.c b/mm/bootmem.c
-index 2ccea70..8bb58da 100644
---- a/mm/bootmem.c
-+++ b/mm/bootmem.c
-@@ -398,10 +398,10 @@ unsigned long __init init_bootmem_node(pg_data_t *pgdat, unsigned long freepfn,
- 	return init_bootmem_core(pgdat, freepfn, startpfn, endpfn);
- }
- 
--void __init reserve_bootmem_node(pg_data_t *pgdat, unsigned long physaddr,
-+int __init reserve_bootmem_node(pg_data_t *pgdat, unsigned long physaddr,
- 				 unsigned long size, int flags)
- {
--	reserve_bootmem_core(pgdat->bdata, physaddr, size, flags);
-+	return reserve_bootmem_core(pgdat->bdata, physaddr, size, flags);
- }
- 
- void __init free_bootmem_node(pg_data_t *pgdat, unsigned long physaddr,
-diff --git a/mm/memory.c b/mm/memory.c
-index 0d14d1e..df84668 100644
---- a/mm/memory.c
-+++ b/mm/memory.c
-@@ -943,17 +943,15 @@ struct page *follow_page(struct vm_area_struct *vma, unsigned long address,
- 	}
- 
- 	ptep = pte_offset_map_lock(mm, pmd, address, &ptl);
--	if (!ptep)
--		goto out;
- 
- 	pte = *ptep;
- 	if (!pte_present(pte))
--		goto unlock;
-+		goto no_page;
- 	if ((flags & FOLL_WRITE) && !pte_write(pte))
- 		goto unlock;
- 	page = vm_normal_page(vma, address, pte);
- 	if (unlikely(!page))
--		goto unlock;
-+		goto bad_page;
- 
- 	if (flags & FOLL_GET)
- 		get_page(page);
-@@ -968,6 +966,15 @@ unlock:
- out:
- 	return page;
- 
-+bad_page:
-+	pte_unmap_unlock(ptep, ptl);
-+	return ERR_PTR(-EFAULT);
-+
-+no_page:
-+	pte_unmap_unlock(ptep, ptl);
-+	if (!pte_none(pte))
-+		return page;
-+	/* Fall through to ZERO_PAGE handling */
- no_page_table:
- 	/*
- 	 * When core dumping an enormous anonymous area that nobody
-@@ -982,6 +989,26 @@ no_page_table:
- 	return page;
- }
- 
-+/* Can we do the FOLL_ANON optimization? */
-+static inline int use_zero_page(struct vm_area_struct *vma)
-+{
-+	/*
-+	 * We don't want to optimize FOLL_ANON for make_pages_present()
-+	 * when it tries to page in a VM_LOCKED region. As to VM_SHARED,
-+	 * we want to get the page from the page tables to make sure
-+	 * that we serialize and update with any other user of that
-+	 * mapping.
-+	 */
-+	if (vma->vm_flags & (VM_LOCKED | VM_SHARED))
-+		return 0;
-+	/*
-+	 * And if we have a fault or a nopfn routine, it's not an
-+	 * anonymous region.
-+	 */
-+	return !vma->vm_ops ||
-+		(!vma->vm_ops->fault && !vma->vm_ops->nopfn);
-+}
-+
- int get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
- 		unsigned long start, int len, int write, int force,
- 		struct page **pages, struct vm_area_struct **vmas)
-@@ -1056,9 +1083,7 @@ int get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
- 		foll_flags = FOLL_TOUCH;
- 		if (pages)
- 			foll_flags |= FOLL_GET;
--		if (!write && !(vma->vm_flags & VM_LOCKED) &&
--		    (!vma->vm_ops || (!vma->vm_ops->nopage &&
--					!vma->vm_ops->fault)))
-+		if (!write && use_zero_page(vma))
- 			foll_flags |= FOLL_ANON;
- 
- 		do {
-@@ -1104,6 +1129,8 @@ int get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
- 
- 				cond_resched();
- 			}
-+			if (IS_ERR(page))
-+				return i ? i : PTR_ERR(page);
- 			if (pages) {
- 				pages[i] = page;
- 
-diff --git a/mm/migrate.c b/mm/migrate.c
-index 4e0eccc..6acc815 100644
---- a/mm/migrate.c
-+++ b/mm/migrate.c
-@@ -858,6 +858,11 @@ static int do_move_pages(struct mm_struct *mm, struct page_to_node *pm,
- 			goto set_status;
- 
- 		page = follow_page(vma, pp->addr, FOLL_GET);
-+
-+		err = PTR_ERR(page);
-+		if (IS_ERR(page))
-+			goto set_status;
-+
- 		err = -ENOENT;
- 		if (!page)
- 			goto set_status;
-@@ -921,6 +926,11 @@ static int do_pages_stat(struct mm_struct *mm, struct page_to_node *pm)
- 			goto set_status;
- 
- 		page = follow_page(vma, pm->addr, 0);
-+
-+		err = PTR_ERR(page);
-+		if (IS_ERR(page))
-+			goto set_status;
-+
- 		err = -ENOENT;
- 		/* Use PageReserved to check for zero page */
- 		if (!page || PageReserved(page))
-diff --git a/net/sctp/socket.c b/net/sctp/socket.c
-index 998e63a..2d42260 100644
---- a/net/sctp/socket.c
-+++ b/net/sctp/socket.c
-@@ -4421,7 +4421,9 @@ static int sctp_getsockopt_local_addrs_old(struct sock *sk, int len,
- 	if (copy_from_user(&getaddrs, optval, len))
- 		return -EFAULT;
- 
--	if (getaddrs.addr_num <= 0) return -EINVAL;
-+	if (getaddrs.addr_num <= 0 ||
-+	    getaddrs.addr_num >= (INT_MAX / sizeof(union sctp_addr)))
-+		return -EINVAL;
- 	/*
- 	 *  For UDP-style sockets, id specifies the association to query.
- 	 *  If the id field is set to the value '0' then the locally bound

Deleted: genpatches-2.6/trunk/2.6.26/2705_alsa-hda-fujitsu.patch
===================================================================
--- genpatches-2.6/trunk/2.6.26/2705_alsa-hda-fujitsu.patch	2008-07-17 02:44:10 UTC (rev 1328)
+++ genpatches-2.6/trunk/2.6.26/2705_alsa-hda-fujitsu.patch	2008-07-17 02:47:50 UTC (rev 1329)
@@ -1,75 +0,0 @@
-
-From: Tony Vroon <chainsaw@g.o>
-
-Applied in ALSA upstream, queued for 2.6.25
-
---- a/sound/pci/hda/patch_realtek.c.orig	2008-04-12 13:40:33.000000000 +0100
-+++ b/sound/pci/hda/patch_realtek.c	2008-04-12 13:40:40.000000000 +0100
-@@ -7939,7 +7939,8 @@
- 
- /*
-  * fujitsu model
-- *  0x14 = headphone/spdif-out, 0x15 = internal speaker
-+ *  0x14 = headphone/spdif-out, 0x15 = internal speaker,
-+ *  0x1b = port replicator headphone out
-  */
- 
- #define ALC_HP_EVENT	0x37
-@@ -7947,6 +7948,8 @@
- static struct hda_verb alc262_fujitsu_unsol_verbs[] = {
- 	{0x14, AC_VERB_SET_UNSOLICITED_ENABLE, AC_USRSP_EN | ALC_HP_EVENT},
- 	{0x14, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_HP},
-+	{0x1b, AC_VERB_SET_UNSOLICITED_ENABLE, AC_USRSP_EN | ALC_HP_EVENT},
-+	{0x1b, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_HP},
- 	{}
- };
- 
-@@ -7987,12 +7990,16 @@
- 	unsigned int mute;
- 
- 	if (force || !spec->sense_updated) {
--		unsigned int present;
-+		unsigned int present_int_hp, present_dock_hp;
- 		/* need to execute and sync at first */
- 		snd_hda_codec_read(codec, 0x14, 0, AC_VERB_SET_PIN_SENSE, 0);
--		present = snd_hda_codec_read(codec, 0x14, 0,
-+		present_int_hp = snd_hda_codec_read(codec, 0x14, 0,
- 				    	 AC_VERB_GET_PIN_SENSE, 0);
--		spec->jack_present = (present & 0x80000000) != 0;
-+		snd_hda_codec_read(codec, 0x1B, 0, AC_VERB_SET_PIN_SENSE, 0);
-+		present_dock_hp = snd_hda_codec_read(codec, 0x1b, 0,
-+				    	 AC_VERB_GET_PIN_SENSE, 0);
-+		spec->jack_present = (present_int_hp & 0x80000000) != 0;
-+		spec->jack_present |= (present_dock_hp & 0x80000000) != 0;
- 		spec->sense_updated = 1;
- 	}
- 	if (spec->jack_present) {
-@@ -8034,12 +8041,13 @@
- 	long *valp = ucontrol->value.integer.value;
- 	int change;
- 
--	change = snd_hda_codec_amp_update(codec, 0x14, 0, HDA_OUTPUT, 0,
--					  HDA_AMP_MUTE,
--					  valp[0] ? 0 : HDA_AMP_MUTE);
--	change |= snd_hda_codec_amp_update(codec, 0x14, 1, HDA_OUTPUT, 0,
--					   HDA_AMP_MUTE,
--					   valp[1] ? 0 : HDA_AMP_MUTE);
-+	change = snd_hda_codec_amp_stereo(codec, 0x14, HDA_OUTPUT, 0,
-+						 HDA_AMP_MUTE,
-+						 valp ? 0 : HDA_AMP_MUTE);
-+	change |= snd_hda_codec_amp_stereo(codec, 0x1b, HDA_OUTPUT, 0,
-+						 HDA_AMP_MUTE,
-+						 valp ? 0 : HDA_AMP_MUTE);
-+
- 	if (change)
- 		alc262_fujitsu_automute(codec, 0);
- 	return change;
-@@ -8057,6 +8065,8 @@
- 	},
- 	HDA_CODEC_VOLUME("CD Playback Volume", 0x0b, 0x04, HDA_INPUT),
- 	HDA_CODEC_MUTE("CD Playback Switch", 0x0b, 0x04, HDA_INPUT),
-+	HDA_CODEC_VOLUME("PC Speaker Volume", 0x0b, 0x05, HDA_INPUT),
-+	HDA_CODEC_MUTE("PC Speaker Switch", 0x0b, 0x05, HDA_INPUT),
- 	HDA_CODEC_VOLUME("Mic Boost", 0x18, 0, HDA_INPUT),
- 	HDA_CODEC_VOLUME("Mic Playback Volume", 0x0b, 0x0, HDA_INPUT),
- 	HDA_CODEC_MUTE("Mic Playback Switch", 0x0b, 0x0, HDA_INPUT),

Deleted: genpatches-2.6/trunk/2.6.26/2710_ssa7134-tuner-type-setup.patch
===================================================================
--- genpatches-2.6/trunk/2.6.26/2710_ssa7134-tuner-type-setup.patch	2008-07-17 02:44:10 UTC (rev 1328)
+++ genpatches-2.6/trunk/2.6.26/2710_ssa7134-tuner-type-setup.patch	2008-07-17 02:47:50 UTC (rev 1329)
@@ -1,219 +0,0 @@
-diff -urN linux-2.6.25.10.orig/drivers/media/video/saa7134/saa7134-cards.c linux-2.6.25.10/drivers/media/video/saa7134/saa7134-cards.c
---- linux-2.6.25.10.orig/drivers/media/video/saa7134/saa7134-cards.c	2008-07-12 09:34:30.000000000 +0200
-+++ linux-2.6.25.10/drivers/media/video/saa7134/saa7134-cards.c	2008-07-12 09:35:22.000000000 +0200
-@@ -50,7 +50,7 @@
- 		.tuner_type	= TUNER_ABSENT,
- 		.radio_type     = UNSET,
- 		.tuner_addr	= ADDR_UNSET,
--		.radio_addr	= ADDR_UNSET,
-+		.radio_addr	= 0x60,
- 
- 		.inputs         = {{
- 			.name = "default",
-@@ -5176,14 +5176,56 @@
- 	return 0;
- }
- 
-+static void saa7134_tuner_setup(struct saa7134_dev *dev)
-+{
-+	struct tuner_setup tun_setup;
-+	unsigned int mode_mask = T_RADIO     |
-+				 T_ANALOG_TV |
-+				 T_DIGITAL_TV;
-+
-+	memset(&tun_setup, 0, sizeof(tun_setup));
-+	tun_setup.tuner_callback = saa7134_tuner_callback;
-+
-+	if (saa7134_boards[dev->board].radio_type != UNSET) {
-+		tun_setup.type = saa7134_boards[dev->board].radio_type;
-+		tun_setup.addr = saa7134_boards[dev->board].radio_addr;
-+
-+		tun_setup.mode_mask = T_RADIO;
-+
-+		saa7134_i2c_call_clients(dev, TUNER_SET_TYPE_ADDR, &tun_setup);
-+		mode_mask &= ~T_RADIO;
-+	}
-+
-+	if ((dev->tuner_type != TUNER_ABSENT) && (dev->tuner_type != UNSET)) {
-+		tun_setup.type = dev->tuner_type;
-+		tun_setup.addr = dev->tuner_addr;
-+		tun_setup.config = saa7134_boards[dev->board].tuner_config;
-+		tun_setup.tuner_callback = saa7134_tuner_callback;
-+
-+		tun_setup.mode_mask = mode_mask;
-+
-+		saa7134_i2c_call_clients(dev, TUNER_SET_TYPE_ADDR, &tun_setup);
-+	}
-+
-+	if (dev->tda9887_conf) {
-+		struct v4l2_priv_tun_config tda9887_cfg;
-+
-+		tda9887_cfg.tuner = TUNER_TDA9887;
-+		tda9887_cfg.priv = &dev->tda9887_conf;
-+
-+		saa7134_i2c_call_clients(dev, TUNER_SET_CONFIG,
-+					 &tda9887_cfg);
-+	}
-+}
-+
- /* stuff which needs working i2c */
- int saa7134_board_init2(struct saa7134_dev *dev)
- {
- 	unsigned char buf;
- 	int board;
--	struct tuner_setup tun_setup;
--	tun_setup.config = 0;
--	tun_setup.tuner_callback = saa7134_tuner_callback;
-+
-+	dev->tuner_type = saa7134_boards[dev->board].tuner_type;
-+	dev->tuner_addr = saa7134_boards[dev->board].tuner_addr;
- 
- 	switch (dev->board) {
- 	case SAA7134_BOARD_BMK_MPEX_NOTUNER:
-@@ -5198,14 +5240,6 @@
- 		printk("%s: board type fixup: %s\n", dev->name,
- 		saa7134_boards[dev->board].name);
- 		dev->tuner_type = saa7134_boards[dev->board].tuner_type;
--
--		if (TUNER_ABSENT != dev->tuner_type) {
--				tun_setup.mode_mask = T_RADIO | T_ANALOG_TV | T_DIGITAL_TV;
--				tun_setup.type = dev->tuner_type;
--				tun_setup.addr = ADDR_UNSET;
--
--				saa7134_i2c_call_clients (dev, TUNER_SET_TYPE_ADDR, &tun_setup);
--		}
- 		break;
- 	case SAA7134_BOARD_MD7134:
- 		{
-@@ -5261,25 +5295,6 @@
- 		}
- 
- 		printk(KERN_INFO "%s Tuner type is %d\n", dev->name, dev->tuner_type);
--		if (dev->tuner_type == TUNER_PHILIPS_FMD1216ME_MK3) {
--			struct v4l2_priv_tun_config tda9887_cfg;
--
--			tda9887_cfg.tuner = TUNER_TDA9887;
--			tda9887_cfg.priv  = &dev->tda9887_conf;
--
--			dev->tda9887_conf = TDA9887_PRESENT      |
--					    TDA9887_PORT1_ACTIVE |
--					    TDA9887_PORT2_ACTIVE;
--
--			saa7134_i2c_call_clients(dev, TUNER_SET_CONFIG,
--						 &tda9887_cfg);
--		}
--
--		tun_setup.mode_mask = T_RADIO | T_ANALOG_TV | T_DIGITAL_TV;
--		tun_setup.type = dev->tuner_type;
--		tun_setup.addr = ADDR_UNSET;
--
--		saa7134_i2c_call_clients (dev, TUNER_SET_TYPE_ADDR,&tun_setup);
- 		}
- 		break;
- 	case SAA7134_BOARD_PHILIPS_EUROPA:
-@@ -5292,12 +5307,6 @@
- 		u8 data[] = { 0x07, 0x02};
- 		struct i2c_msg msg = {.addr=0x08, .flags=0, .buf=data, .len = sizeof(data)};
- 		i2c_transfer(&dev->i2c_adap, &msg, 1);
--
--		tun_setup.mode_mask = T_ANALOG_TV | T_DIGITAL_TV;
--		tun_setup.type = dev->tuner_type;
--		tun_setup.addr = dev->tuner_addr;
--
--		saa7134_i2c_call_clients (dev, TUNER_SET_TYPE_ADDR,&tun_setup);
- 		}
- 		break;
- 	case SAA7134_BOARD_PHILIPS_TIGER:
-@@ -5310,14 +5319,18 @@
- 			printk(KERN_INFO "%s: Reconfigured board as %s\n",
- 				dev->name, saa7134_boards[dev->board].name);
- 		}
--		if(dev->board == SAA7134_BOARD_PHILIPS_TIGER_S) {
--			tun_setup.mode_mask = T_ANALOG_TV | T_DIGITAL_TV;
--			tun_setup.type = TUNER_PHILIPS_TDA8290;
--			tun_setup.addr = 0x4b;
--			tun_setup.config = 2;
-+		if (dev->board == SAA7134_BOARD_PHILIPS_TIGER_S) {
-+			dev->tuner_type = TUNER_PHILIPS_TDA8290;
-+
-+			saa7134_tuner_setup(dev);
- 
--			saa7134_i2c_call_clients (dev, TUNER_SET_TYPE_ADDR,&tun_setup);
- 			data[2] = 0x68;
-+			i2c_transfer(&dev->i2c_adap, &msg, 1);
-+
-+			/* Tuner setup is handled before I2C transfer.
-+			   Due to that, there's no need to do it later
-+			 */
-+			return 0;
- 		}
- 		i2c_transfer(&dev->i2c_adap, &msg, 1);
- 		}
-@@ -5403,6 +5416,7 @@
- 		}
- 		break;
- 	}
-+	saa7134_tuner_setup(dev);
- 	return 0;
- }
- 
-diff -urN linux-2.6.25.10.orig/drivers/media/video/saa7134/saa7134-i2c.c linux-2.6.25.10/drivers/media/video/saa7134/saa7134-i2c.c
---- linux-2.6.25.10.orig/drivers/media/video/saa7134/saa7134-i2c.c	2008-07-12 09:34:30.000000000 +0200
-+++ linux-2.6.25.10/drivers/media/video/saa7134/saa7134-i2c.c	2008-07-12 09:35:22.000000000 +0200
-@@ -322,8 +322,6 @@
- static int attach_inform(struct i2c_client *client)
- {
- 	struct saa7134_dev *dev = client->adapter->algo_data;
--	int tuner = dev->tuner_type;
--	struct tuner_setup tun_setup;
- 
- 	d1printk( "%s i2c attach [addr=0x%x,client=%s]\n",
- 		client->driver->driver.name, client->addr, client->name);
-@@ -344,46 +342,6 @@
- 		}
- 	}
- 
--	if (!client->driver->command)
--		return 0;
--
--	if (saa7134_boards[dev->board].radio_type != UNSET) {
--
--		tun_setup.type = saa7134_boards[dev->board].radio_type;
--		tun_setup.addr = saa7134_boards[dev->board].radio_addr;
--
--		if ((tun_setup.addr == ADDR_UNSET) || (tun_setup.addr == client->addr)) {
--			tun_setup.mode_mask = T_RADIO;
--
--			client->driver->command(client, TUNER_SET_TYPE_ADDR, &tun_setup);
--		}
--	}
--
--	if (tuner != UNSET) {
--		tun_setup.type = tuner;
--		tun_setup.addr = saa7134_boards[dev->board].tuner_addr;
--		tun_setup.config = saa7134_boards[dev->board].tuner_config;
--		tun_setup.tuner_callback = saa7134_tuner_callback;
--
--		if ((tun_setup.addr == ADDR_UNSET)||(tun_setup.addr == client->addr)) {
--
--			tun_setup.mode_mask = T_ANALOG_TV;
--
--			client->driver->command(client,TUNER_SET_TYPE_ADDR, &tun_setup);
--		}
--
--		if (tuner == TUNER_TDA9887) {
--			struct v4l2_priv_tun_config tda9887_cfg;
--
--			tda9887_cfg.tuner = TUNER_TDA9887;
--			tda9887_cfg.priv = &dev->tda9887_conf;
--
--			client->driver->command(client, TUNER_SET_CONFIG,
--						&tda9887_cfg);
--		}
--	}
--
--
- 	return 0;
- }
- 
-

-- 
gentoo-commits@l.g.o mailing list