[gentoo-commits] linux-patches r1351 - genpatches-2.6/trunk/2.6.27

[Mike Pagano (mpagano)]

Author: mpagano
Date: 2008-10-11 00:00:47 +0000 (Sat, 11 Oct 2008)
New Revision: 1351

Removed:
   genpatches-2.6/trunk/2.6.27/1000_linux-2.6.26.1.patch
   genpatches-2.6/trunk/2.6.27/1001_linux-2.6.26.2.patch
   genpatches-2.6/trunk/2.6.27/1002_linux-2.6.26.3.patch
   genpatches-2.6/trunk/2.6.27/1003_linux-2.6.26.4.patch
   genpatches-2.6/trunk/2.6.27/1004_linux-2.6.26.5.patch
   genpatches-2.6/trunk/2.6.27/1005_linux-2.6.26.6.patch
Log:
Removing 2.6.26.x patches

Deleted: genpatches-2.6/trunk/2.6.27/1000_linux-2.6.26.1.patch
===================================================================
--- genpatches-2.6/trunk/2.6.27/1000_linux-2.6.26.1.patch	2008-10-10 23:58:26 UTC (rev 1350)
+++ genpatches-2.6/trunk/2.6.27/1000_linux-2.6.26.1.patch	2008-10-11 00:00:47 UTC (rev 1351)
@@ -1,2185 +0,0 @@
-diff --git a/Documentation/networking/udplite.txt b/Documentation/networking/udplite.txt
-index 3870f28..855d8da 100644
---- a/Documentation/networking/udplite.txt
-+++ b/Documentation/networking/udplite.txt
-@@ -148,7 +148,7 @@
-         getsockopt(sockfd, SOL_SOCKET, SO_NO_CHECK, &value, ...);
- 
-   is meaningless (as in TCP). Packets with a zero checksum field are
--  illegal (cf. RFC 3828, sec. 3.1) will be silently discarded.
-+  illegal (cf. RFC 3828, sec. 3.1) and will be silently discarded.
- 
-   4) Fragmentation
- 
-diff --git a/Documentation/video4linux/cx18.txt b/Documentation/video4linux/cx18.txt
-index 6842c26..63f3aef 100644
---- a/Documentation/video4linux/cx18.txt
-+++ b/Documentation/video4linux/cx18.txt
-@@ -23,14 +23,8 @@ encoder chip:
- 
- Firmware:
- 
--The firmware needs to be extracted from the Windows Hauppauge HVR-1600
--driver, available here:
-+You can obtain the firmware files here:
- 
--http://hauppauge.lightpath.net/software/install_cd/hauppauge_cd_3.4d1.zip
-+http://dl.ivtvdriver.org/ivtv/firmware/cx18-firmware.tar.gz
- 
--Unzip, then copy the following files to the firmware directory
--and rename them as follows:
--
--Drivers/Driver18/hcw18apu.rom -> v4l-cx23418-apu.fw
--Drivers/Driver18/hcw18enc.rom -> v4l-cx23418-cpu.fw
--Drivers/Driver18/hcw18mlC.rom -> v4l-cx23418-dig.fw
-+Untar and copy the .fw files to your firmware directory.
-diff --git a/arch/ia64/kvm/kvm-ia64.c b/arch/ia64/kvm/kvm-ia64.c
-index 318b811..5152ba0 100644
---- a/arch/ia64/kvm/kvm-ia64.c
-+++ b/arch/ia64/kvm/kvm-ia64.c
-@@ -1460,6 +1460,9 @@ int kvm_arch_set_memory_region(struct kvm *kvm,
- 	return 0;
- }
- 
-+void kvm_arch_flush_shadow(struct kvm *kvm)
-+{
-+}
- 
- long kvm_arch_dev_ioctl(struct file *filp,
- 		unsigned int ioctl, unsigned long arg)
-diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c
-index 777e0f3..1eaa3e4 100644
---- a/arch/powerpc/kvm/powerpc.c
-+++ b/arch/powerpc/kvm/powerpc.c
-@@ -167,6 +167,10 @@ int kvm_arch_set_memory_region(struct kvm *kvm,
- 	return 0;
- }
- 
-+void kvm_arch_flush_shadow(struct kvm *kvm)
-+{
-+}
-+
- struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm, unsigned int id)
- {
- 	struct kvm_vcpu *vcpu;
-diff --git a/arch/powerpc/platforms/cell/cbe_cpufreq_pmi.c b/arch/powerpc/platforms/cell/cbe_cpufreq_pmi.c
-index 69288f6..3233fe8 100644
---- a/arch/powerpc/platforms/cell/cbe_cpufreq_pmi.c
-+++ b/arch/powerpc/platforms/cell/cbe_cpufreq_pmi.c
-@@ -96,6 +96,12 @@ static int pmi_notifier(struct notifier_block *nb,
- 	struct cpufreq_frequency_table *cbe_freqs;
- 	u8 node;
- 
-+	/* Should this really be called for CPUFREQ_ADJUST, CPUFREQ_INCOMPATIBLE
-+	 * and CPUFREQ_NOTIFY policy events?)
-+	 */
-+	if (event == CPUFREQ_START)
-+		return 0;
-+
- 	cbe_freqs = cpufreq_frequency_get_table(policy->cpu);
- 	node = cbe_cpu_to_node(policy->cpu);
- 
-diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
-index 6558b09..b19c170 100644
---- a/arch/s390/kvm/kvm-s390.c
-+++ b/arch/s390/kvm/kvm-s390.c
-@@ -672,6 +672,10 @@ int kvm_arch_set_memory_region(struct kvm *kvm,
- 	return 0;
- }
- 
-+void kvm_arch_flush_shadow(struct kvm *kvm)
-+{
-+}
-+
- gfn_t unalias_gfn(struct kvm *kvm, gfn_t gfn)
- {
- 	return gfn;
-diff --git a/arch/sparc64/kernel/irq.c b/arch/sparc64/kernel/irq.c
-index b441a26..c481673 100644
---- a/arch/sparc64/kernel/irq.c
-+++ b/arch/sparc64/kernel/irq.c
-@@ -621,8 +621,9 @@ unsigned int sun4v_build_irq(u32 devhandle, unsigned int devino)
- unsigned int sun4v_build_virq(u32 devhandle, unsigned int devino)
- {
- 	struct irq_handler_data *data;
--	struct ino_bucket *bucket;
- 	unsigned long hv_err, cookie;
-+	struct ino_bucket *bucket;
-+	struct irq_desc *desc;
- 	unsigned int virt_irq;
- 
- 	bucket = kzalloc(sizeof(struct ino_bucket), GFP_ATOMIC);
-@@ -643,6 +644,13 @@ unsigned int sun4v_build_virq(u32 devhandle, unsigned int devino)
- 	if (unlikely(!data))
- 		return 0;
- 
-+	/* In order to make the LDC channel startup sequence easier,
-+	 * especially wrt. locking, we do not let request_irq() enable
-+	 * the interrupt.
-+	 */
-+	desc = irq_desc + virt_irq;
-+	desc->status |= IRQ_NOAUTOEN;
-+
- 	set_irq_chip_data(virt_irq, data);
- 
- 	/* Catch accidental accesses to these things.  IMAP/ICLR handling
-diff --git a/arch/sparc64/kernel/ldc.c b/arch/sparc64/kernel/ldc.c
-index 63969f6..d689823 100644
---- a/arch/sparc64/kernel/ldc.c
-+++ b/arch/sparc64/kernel/ldc.c
-@@ -1,6 +1,6 @@
- /* ldc.c: Logical Domain Channel link-layer protocol driver.
-  *
-- * Copyright (C) 2007 David S. Miller <davem@×××××××××.net>
-+ * Copyright (C) 2007, 2008 David S. Miller <davem@×××××××××.net>
-  */
- 
- #include <linux/kernel.h>
-@@ -23,8 +23,8 @@
- 
- #define DRV_MODULE_NAME		"ldc"
- #define PFX DRV_MODULE_NAME	": "
--#define DRV_MODULE_VERSION	"1.0"
--#define DRV_MODULE_RELDATE	"June 25, 2007"
-+#define DRV_MODULE_VERSION	"1.1"
-+#define DRV_MODULE_RELDATE	"July 22, 2008"
- 
- static char version[] __devinitdata =
- 	DRV_MODULE_NAME ".c:v" DRV_MODULE_VERSION " (" DRV_MODULE_RELDATE ")\n";
-@@ -1235,13 +1235,9 @@ int ldc_bind(struct ldc_channel *lp, const char *name)
- 	unsigned long hv_err, flags;
- 	int err = -EINVAL;
- 
--	spin_lock_irqsave(&lp->lock, flags);
--
--	if (!name)
--		goto out_err;
--
--	if (lp->state != LDC_STATE_INIT)
--		goto out_err;
-+	if (!name ||
-+	    (lp->state != LDC_STATE_INIT))
-+		return -EINVAL;
- 
- 	snprintf(lp->rx_irq_name, LDC_IRQ_NAME_MAX, "%s RX", name);
- 	snprintf(lp->tx_irq_name, LDC_IRQ_NAME_MAX, "%s TX", name);
-@@ -1250,25 +1246,32 @@ int ldc_bind(struct ldc_channel *lp, const char *name)
- 			  IRQF_SAMPLE_RANDOM | IRQF_SHARED,
- 			  lp->rx_irq_name, lp);
- 	if (err)
--		goto out_err;
-+		return err;
- 
- 	err = request_irq(lp->cfg.tx_irq, ldc_tx,
- 			  IRQF_SAMPLE_RANDOM | IRQF_SHARED,
- 			  lp->tx_irq_name, lp);
--	if (err)
--		goto out_free_rx_irq;
-+	if (err) {
-+		free_irq(lp->cfg.rx_irq, lp);
-+		return err;
-+	}
-+
- 
-+	spin_lock_irqsave(&lp->lock, flags);
-+
-+	enable_irq(lp->cfg.rx_irq);
-+	enable_irq(lp->cfg.tx_irq);
- 
- 	lp->flags |= LDC_FLAG_REGISTERED_IRQS;
- 
- 	err = -ENODEV;
- 	hv_err = sun4v_ldc_tx_qconf(lp->id, 0, 0);
- 	if (hv_err)
--		goto out_free_tx_irq;
-+		goto out_free_irqs;
- 
- 	hv_err = sun4v_ldc_tx_qconf(lp->id, lp->tx_ra, lp->tx_num_entries);
- 	if (hv_err)
--		goto out_free_tx_irq;
-+		goto out_free_irqs;
- 
- 	hv_err = sun4v_ldc_rx_qconf(lp->id, 0, 0);
- 	if (hv_err)
-@@ -1304,14 +1307,11 @@ out_unmap_rx:
- out_unmap_tx:
- 	sun4v_ldc_tx_qconf(lp->id, 0, 0);
- 
--out_free_tx_irq:
-+out_free_irqs:
- 	lp->flags &= ~LDC_FLAG_REGISTERED_IRQS;
- 	free_irq(lp->cfg.tx_irq, lp);
--
--out_free_rx_irq:
- 	free_irq(lp->cfg.rx_irq, lp);
- 
--out_err:
- 	spin_unlock_irqrestore(&lp->lock, flags);
- 
- 	return err;
-diff --git a/arch/sparc64/kernel/time.c b/arch/sparc64/kernel/time.c
-index e5d2389..f464023 100644
---- a/arch/sparc64/kernel/time.c
-+++ b/arch/sparc64/kernel/time.c
-@@ -883,6 +883,16 @@ static struct notifier_block sparc64_cpufreq_notifier_block = {
- 	.notifier_call	= sparc64_cpufreq_notifier
- };
- 
-+static int __init register_sparc64_cpufreq_notifier(void)
-+{
-+
-+	cpufreq_register_notifier(&sparc64_cpufreq_notifier_block,
-+				  CPUFREQ_TRANSITION_NOTIFIER);
-+	return 0;
-+}
-+
-+core_initcall(register_sparc64_cpufreq_notifier);
-+
- #endif /* CONFIG_CPU_FREQ */
- 
- static int sparc64_next_event(unsigned long delta,
-@@ -1049,11 +1059,6 @@ void __init time_init(void)
- 	       sparc64_clockevent.mult, sparc64_clockevent.shift);
- 
- 	setup_sparc64_timer();
--
--#ifdef CONFIG_CPU_FREQ
--	cpufreq_register_notifier(&sparc64_cpufreq_notifier_block,
--				  CPUFREQ_TRANSITION_NOTIFIER);
--#endif
- }
- 
- unsigned long long sched_clock(void)
-diff --git a/arch/um/include/init.h b/arch/um/include/init.h
-index b00a957..37dd097 100644
---- a/arch/um/include/init.h
-+++ b/arch/um/include/init.h
-@@ -45,6 +45,8 @@ typedef void (*exitcall_t)(void);
- # define __section(S) __attribute__ ((__section__(#S)))
- #endif
- 
-+#if __GNUC__ == 3
-+
- #if __GNUC_MINOR__ >= 3
- # define __used			__attribute__((__used__))
- #else
-@@ -52,6 +54,12 @@ typedef void (*exitcall_t)(void);
- #endif
- 
- #else
-+#if __GNUC__ == 4
-+# define __used			__attribute__((__used__))
-+#endif
-+#endif
-+
-+#else
- #include <linux/compiler.h>
- #endif
- /* These are for everybody (although not all archs will actually
-diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
-index 2ad6301..dd138a2 100644
---- a/arch/x86/Kconfig.cpu
-+++ b/arch/x86/Kconfig.cpu
-@@ -414,4 +414,4 @@ config X86_MINIMUM_CPU_FAMILY
- 
- config X86_DEBUGCTLMSR
- 	def_bool y
--	depends on !(M586MMX || M586TSC || M586 || M486 || M386)
-+	depends on !(MK6 || MWINCHIPC6 || MWINCHIP2 || MWINCHIP3D || MCYRIXIII || M586MMX || M586TSC || M586 || M486 || M386)
-diff --git a/arch/x86/kernel/acpi/sleep.c b/arch/x86/kernel/acpi/sleep.c
-index 36af01f..130711f 100644
---- a/arch/x86/kernel/acpi/sleep.c
-+++ b/arch/x86/kernel/acpi/sleep.c
-@@ -23,6 +23,15 @@ static unsigned long acpi_realmode;
- static char temp_stack[10240];
- #endif
- 
-+/* XXX: this macro should move to asm-x86/segment.h and be shared with the
-+   boot code... */
-+#define GDT_ENTRY(flags, base, limit)		\
-+	(((u64)(base & 0xff000000) << 32) |	\
-+	 ((u64)flags << 40) |			\
-+	 ((u64)(limit & 0x00ff0000) << 32) |	\
-+	 ((u64)(base & 0x00ffffff) << 16) |	\
-+	 ((u64)(limit & 0x0000ffff)))
-+
- /**
-  * acpi_save_state_mem - save kernel state
-  *
-@@ -58,11 +67,11 @@ int acpi_save_state_mem(void)
- 			((char *)&header->wakeup_gdt - (char *)acpi_realmode))
- 				<< 16);
- 	/* GDT[1]: real-mode-like code segment */
--	header->wakeup_gdt[1] = (0x009bULL << 40) +
--		((u64)acpi_wakeup_address << 16) + 0xffff;
-+	header->wakeup_gdt[1] =
-+		GDT_ENTRY(0x809b, acpi_wakeup_address, 0xfffff);
- 	/* GDT[2]: real-mode-like data segment */
--	header->wakeup_gdt[2] = (0x0093ULL << 40) +
--		((u64)acpi_wakeup_address << 16) + 0xffff;
-+	header->wakeup_gdt[2] =
-+		GDT_ENTRY(0x8093, acpi_wakeup_address, 0xfffff);
- 
- #ifndef CONFIG_64BIT
- 	store_gdt((struct desc_ptr *)&header->pmode_gdt);
-diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c
-index 95e80e5..eb9ddd8 100644
---- a/arch/x86/kernel/i387.c
-+++ b/arch/x86/kernel/i387.c
-@@ -162,7 +162,7 @@ int xfpregs_get(struct task_struct *target, const struct user_regset *regset,
- 	int ret;
- 
- 	if (!cpu_has_fxsr)
--		return -EIO;
-+		return -ENODEV;
- 
- 	ret = init_fpu(target);
- 	if (ret)
-@@ -179,7 +179,7 @@ int xfpregs_set(struct task_struct *target, const struct user_regset *regset,
- 	int ret;
- 
- 	if (!cpu_has_fxsr)
--		return -EIO;
-+		return -ENODEV;
- 
- 	ret = init_fpu(target);
- 	if (ret)
-diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
-index a7835f2..77040b6 100644
---- a/arch/x86/kernel/ptrace.c
-+++ b/arch/x86/kernel/ptrace.c
-@@ -943,13 +943,13 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
- 		return copy_regset_to_user(child, &user_x86_32_view,
- 					   REGSET_XFP,
- 					   0, sizeof(struct user_fxsr_struct),
--					   datap);
-+					   datap) ? -EIO : 0;
- 
- 	case PTRACE_SETFPXREGS:	/* Set the child extended FPU state. */
- 		return copy_regset_from_user(child, &user_x86_32_view,
- 					     REGSET_XFP,
- 					     0, sizeof(struct user_fxsr_struct),
--					     datap);
-+					     datap) ? -EIO : 0;
- #endif
- 
- #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
-diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
-index f6be7d5..d834b36 100644
---- a/arch/x86/kernel/reboot.c
-+++ b/arch/x86/kernel/reboot.c
-@@ -177,6 +177,14 @@ static struct dmi_system_id __initdata reboot_dmi_table[] = {
- 			DMI_MATCH(DMI_PRODUCT_NAME, "PowerEdge 2400"),
- 		},
- 	},
-+	{	/* Handle problems with rebooting on Dell T5400's */
-+		.callback = set_bios_reboot,
-+		.ident = "Dell Precision T5400",
-+		.matches = {
-+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-+			DMI_MATCH(DMI_PRODUCT_NAME, "Precision WorkStation T5400"),
-+		},
-+	},
- 	{	/* Handle problems with rebooting on HP laptops */
- 		.callback = set_bios_reboot,
- 		.ident = "HP Compaq Laptop",
-diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
-index 7e7c396..c26d811 100644
---- a/arch/x86/kvm/mmu.c
-+++ b/arch/x86/kvm/mmu.c
-@@ -1171,9 +1171,10 @@ static int __direct_map(struct kvm_vcpu *vcpu, gpa_t v, int write,
- 				return -ENOMEM;
- 			}
- 
--			table[index] = __pa(new_table->spt)
--				| PT_PRESENT_MASK | PT_WRITABLE_MASK
--				| shadow_user_mask | shadow_x_mask;
-+			set_shadow_pte(&table[index],
-+				       __pa(new_table->spt)
-+				       | PT_PRESENT_MASK | PT_WRITABLE_MASK
-+				       | shadow_user_mask | shadow_x_mask);
- 		}
- 		table_addr = table[index] & PT64_BASE_ADDR_MASK;
- 	}
-@@ -1968,6 +1969,8 @@ static int mmu_shrink(int nr_to_scan, gfp_t gfp_mask)
- 	list_for_each_entry(kvm, &vm_list, vm_list) {
- 		int npages;
- 
-+		if (!down_read_trylock(&kvm->slots_lock))
-+			continue;
- 		spin_lock(&kvm->mmu_lock);
- 		npages = kvm->arch.n_alloc_mmu_pages -
- 			 kvm->arch.n_free_mmu_pages;
-@@ -1980,6 +1983,7 @@ static int mmu_shrink(int nr_to_scan, gfp_t gfp_mask)
- 		nr_to_scan--;
- 
- 		spin_unlock(&kvm->mmu_lock);
-+		up_read(&kvm->slots_lock);
- 	}
- 	if (kvm_freed)
- 		list_move_tail(&kvm_freed->vm_list, &vm_list);
-diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
-index 6b0d5fa..06992d6 100644
---- a/arch/x86/kvm/svm.c
-+++ b/arch/x86/kvm/svm.c
-@@ -270,19 +270,11 @@ static int has_svm(void)
- 
- static void svm_hardware_disable(void *garbage)
- {
--	struct svm_cpu_data *svm_data
--		= per_cpu(svm_data, raw_smp_processor_id());
--
--	if (svm_data) {
--		uint64_t efer;
-+	uint64_t efer;
- 
--		wrmsrl(MSR_VM_HSAVE_PA, 0);
--		rdmsrl(MSR_EFER, efer);
--		wrmsrl(MSR_EFER, efer & ~MSR_EFER_SVME_MASK);
--		per_cpu(svm_data, raw_smp_processor_id()) = NULL;
--		__free_page(svm_data->save_area);
--		kfree(svm_data);
--	}
-+	wrmsrl(MSR_VM_HSAVE_PA, 0);
-+	rdmsrl(MSR_EFER, efer);
-+	wrmsrl(MSR_EFER, efer & ~MSR_EFER_SVME_MASK);
- }
- 
- static void svm_hardware_enable(void *garbage)
-@@ -321,6 +313,19 @@ static void svm_hardware_enable(void *garbage)
- 	       page_to_pfn(svm_data->save_area) << PAGE_SHIFT);
- }
- 
-+static void svm_cpu_uninit(int cpu)
-+{
-+	struct svm_cpu_data *svm_data
-+		= per_cpu(svm_data, raw_smp_processor_id());
-+
-+	if (!svm_data)
-+		return;
-+
-+	per_cpu(svm_data, raw_smp_processor_id()) = NULL;
-+	__free_page(svm_data->save_area);
-+	kfree(svm_data);
-+}
-+
- static int svm_cpu_init(int cpu)
- {
- 	struct svm_cpu_data *svm_data;
-@@ -458,6 +463,11 @@ err:
- 
- static __exit void svm_hardware_unsetup(void)
- {
-+	int cpu;
-+
-+	for_each_online_cpu(cpu)
-+		svm_cpu_uninit(cpu);
-+
- 	__free_pages(pfn_to_page(iopm_base >> PAGE_SHIFT), IOPM_ALLOC_ORDER);
- 	iopm_base = 0;
- }
-diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
-index 540e951..2ce9063 100644
---- a/arch/x86/kvm/vmx.c
-+++ b/arch/x86/kvm/vmx.c
-@@ -88,6 +88,7 @@ static inline struct vcpu_vmx *to_vmx(struct kvm_vcpu *vcpu)
- }
- 
- static int init_rmode(struct kvm *kvm);
-+static u64 construct_eptp(unsigned long root_hpa);
- 
- static DEFINE_PER_CPU(struct vmcs *, vmxarea);
- static DEFINE_PER_CPU(struct vmcs *, current_vmcs);
-@@ -1389,6 +1390,8 @@ static void exit_lmode(struct kvm_vcpu *vcpu)
- static void vmx_flush_tlb(struct kvm_vcpu *vcpu)
- {
- 	vpid_sync_vcpu_all(to_vmx(vcpu));
-+	if (vm_need_ept())
-+		ept_sync_context(construct_eptp(vcpu->arch.mmu.root_hpa));
- }
- 
- static void vmx_decache_cr4_guest_bits(struct kvm_vcpu *vcpu)
-@@ -1420,7 +1423,7 @@ static void ept_update_paging_mode_cr0(unsigned long *hw_cr0,
- 	if (!(cr0 & X86_CR0_PG)) {
- 		/* From paging/starting to nonpaging */
- 		vmcs_write32(CPU_BASED_VM_EXEC_CONTROL,
--			     vmcs_config.cpu_based_exec_ctrl |
-+			     vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) |
- 			     (CPU_BASED_CR3_LOAD_EXITING |
- 			      CPU_BASED_CR3_STORE_EXITING));
- 		vcpu->arch.cr0 = cr0;
-@@ -1430,7 +1433,7 @@ static void ept_update_paging_mode_cr0(unsigned long *hw_cr0,
- 	} else if (!is_paging(vcpu)) {
- 		/* From nonpaging to paging */
- 		vmcs_write32(CPU_BASED_VM_EXEC_CONTROL,
--			     vmcs_config.cpu_based_exec_ctrl &
-+			     vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) &
- 			     ~(CPU_BASED_CR3_LOAD_EXITING |
- 			       CPU_BASED_CR3_STORE_EXITING));
- 		vcpu->arch.cr0 = cr0;
-diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index 63a77ca..5a7406e 100644
---- a/arch/x86/kvm/x86.c
-+++ b/arch/x86/kvm/x86.c
-@@ -4016,6 +4016,11 @@ int kvm_arch_set_memory_region(struct kvm *kvm,
- 	return 0;
- }
- 
-+void kvm_arch_flush_shadow(struct kvm *kvm)
-+{
-+	kvm_mmu_zap_all(kvm);
-+}
-+
- int kvm_arch_vcpu_runnable(struct kvm_vcpu *vcpu)
- {
- 	return vcpu->arch.mp_state == KVM_MP_STATE_RUNNABLE
-diff --git a/arch/x86/kvm/x86_emulate.c b/arch/x86/kvm/x86_emulate.c
-index 932f216..d41b9bc 100644
---- a/arch/x86/kvm/x86_emulate.c
-+++ b/arch/x86/kvm/x86_emulate.c
-@@ -1666,7 +1666,7 @@ special_insn:
- 		break;
- 	case 0xf4:              /* hlt */
- 		ctxt->vcpu->arch.halt_request = 1;
--		goto done;
-+		break;
- 	case 0xf5:	/* cmc */
- 		/* complement carry flag from eflags reg */
- 		ctxt->eflags ^= EFLG_CF;
-diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
-index 819dad9..7b27710 100644
---- a/arch/x86/mm/init_64.c
-+++ b/arch/x86/mm/init_64.c
-@@ -579,7 +579,7 @@ unsigned long __init_refok init_memory_mapping(unsigned long start, unsigned lon
- 		else
- 			pud = alloc_low_page(&pud_phys);
- 
--		next = start + PGDIR_SIZE;
-+		next = (start + PGDIR_SIZE) & PGDIR_MASK;
- 		if (next > end)
- 			next = end;
- 		last_map_addr = phys_pud_init(pud, __pa(start), __pa(next));
-diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c
-index d80b2d1..8c06a53 100644
---- a/drivers/acpi/processor_perflib.c
-+++ b/drivers/acpi/processor_perflib.c
-@@ -64,7 +64,13 @@ static DEFINE_MUTEX(performance_mutex);
-  * policy is adjusted accordingly.
-  */
- 
--static unsigned int ignore_ppc = 0;
-+/* ignore_ppc:
-+ * -1 -> cpufreq low level drivers not initialized -> _PSS, etc. not called yet
-+ *       ignore _PPC
-+ *  0 -> cpufreq low level drivers initialized -> consider _PPC values
-+ *  1 -> ignore _PPC totally -> forced by user through boot param
-+ */
-+static unsigned int ignore_ppc = -1;
- module_param(ignore_ppc, uint, 0644);
- MODULE_PARM_DESC(ignore_ppc, "If the frequency of your machine gets wrongly" \
- 		 "limited by BIOS, this should help");
-@@ -72,7 +78,7 @@ MODULE_PARM_DESC(ignore_ppc, "If the frequency of your machine gets wrongly" \
- #define PPC_REGISTERED   1
- #define PPC_IN_USE       2
- 
--static int acpi_processor_ppc_status = 0;
-+static int acpi_processor_ppc_status;
- 
- static int acpi_processor_ppc_notifier(struct notifier_block *nb,
- 				       unsigned long event, void *data)
-@@ -81,6 +87,11 @@ static int acpi_processor_ppc_notifier(struct notifier_block *nb,
- 	struct acpi_processor *pr;
- 	unsigned int ppc = 0;
- 
-+	if (event == CPUFREQ_START && ignore_ppc <= 0) {
-+		ignore_ppc = 0;
-+		return 0;
-+	}
-+
- 	if (ignore_ppc)
- 		return 0;
- 
-diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
-index 1d41496..0471ef5 100644
---- a/drivers/cpufreq/cpufreq.c
-+++ b/drivers/cpufreq/cpufreq.c
-@@ -825,6 +825,9 @@ static int cpufreq_add_dev(struct sys_device *sys_dev)
- 	policy->user_policy.min = policy->cpuinfo.min_freq;
- 	policy->user_policy.max = policy->cpuinfo.max_freq;
- 
-+	blocking_notifier_call_chain(&cpufreq_policy_notifier_list,
-+				     CPUFREQ_START, policy);
-+
- #ifdef CONFIG_SMP
- 
- #ifdef CONFIG_HOTPLUG_CPU
-diff --git a/drivers/dma/iop-adma.c b/drivers/dma/iop-adma.c
-index 0ec0f43..4e6b052 100644
---- a/drivers/dma/iop-adma.c
-+++ b/drivers/dma/iop-adma.c
-@@ -1387,6 +1387,8 @@ static void iop_chan_start_null_xor(struct iop_adma_chan *iop_chan)
- 	spin_unlock_bh(&iop_chan->lock);
- }
- 
-+MODULE_ALIAS("platform:iop-adma");
-+
- static struct platform_driver iop_adma_driver = {
- 	.probe		= iop_adma_probe,
- 	.remove		= iop_adma_remove,
-diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
-index 68e7f19..0cc854e 100644
---- a/drivers/ide/ide-cd.c
-+++ b/drivers/ide/ide-cd.c
-@@ -1308,13 +1308,30 @@ static int cdrom_read_capacity(ide_drive_t *drive, unsigned long *capacity,
- 	req.cmd_flags |= REQ_QUIET;
- 
- 	stat = ide_cd_queue_pc(drive, &req);
--	if (stat == 0) {
--		*capacity = 1 + be32_to_cpu(capbuf.lba);
--		*sectors_per_frame =
--			be32_to_cpu(capbuf.blocklen) >> SECTOR_BITS;
-+	if (stat)
-+		return stat;
-+
-+	/*
-+	 * Sanity check the given block size
-+	 */
-+	switch (capbuf.blocklen) {
-+	case __constant_cpu_to_be32(512):
-+	case __constant_cpu_to_be32(1024):
-+	case __constant_cpu_to_be32(2048):
-+	case __constant_cpu_to_be32(4096):
-+		break;
-+	default:
-+		printk(KERN_ERR "%s: weird block size %u\n",
-+			drive->name, capbuf.blocklen);
-+		printk(KERN_ERR "%s: default to 2kb block size\n",
-+			drive->name);
-+		capbuf.blocklen = __constant_cpu_to_be32(2048);
-+		break;
- 	}
- 
--	return stat;
-+	*capacity = 1 + be32_to_cpu(capbuf.lba);
-+	*sectors_per_frame = be32_to_cpu(capbuf.blocklen) >> SECTOR_BITS;
-+	return 0;
- }
- 
- static int cdrom_read_tocentry(ide_drive_t *drive, int trackno, int msf_flag,
-diff --git a/drivers/media/dvb/dvb-usb/dib0700_devices.c b/drivers/media/dvb/dvb-usb/dib0700_devices.c
-index c4d40fe..3dd20bf 100644
---- a/drivers/media/dvb/dvb-usb/dib0700_devices.c
-+++ b/drivers/media/dvb/dvb-usb/dib0700_devices.c
-@@ -1117,6 +1117,7 @@ struct usb_device_id dib0700_usb_id_table[] = {
- 	{ USB_DEVICE(USB_VID_TERRATEC,	USB_PID_TERRATEC_CINERGY_HT_EXPRESS) },
- 	{ USB_DEVICE(USB_VID_TERRATEC,	USB_PID_TERRATEC_CINERGY_T_XXS) },
- 	{ USB_DEVICE(USB_VID_LEADTEK,   USB_PID_WINFAST_DTV_DONGLE_STK7700P_2) },
-+	{ USB_DEVICE(USB_VID_HAUPPAUGE, USB_PID_HAUPPAUGE_NOVA_TD_STICK_52009) },
- 	{ 0 }		/* Terminating entry */
- };
- MODULE_DEVICE_TABLE(usb, dib0700_usb_id_table);
-@@ -1372,7 +1373,7 @@ struct dvb_usb_device_properties dib0700_devices[] = {
- 			}
- 		},
- 
--		.num_device_descs = 2,
-+		.num_device_descs = 3,
- 		.devices = {
- 			{   "DiBcom STK7070PD reference design",
- 				{ &dib0700_usb_id_table[17], NULL },
-@@ -1381,6 +1382,10 @@ struct dvb_usb_device_properties dib0700_devices[] = {
- 			{   "Pinnacle PCTV Dual DVB-T Diversity Stick",
- 				{ &dib0700_usb_id_table[18], NULL },
- 				{ NULL },
-+			},
-+			{   "Hauppauge Nova-TD Stick (52009)",
-+				{ &dib0700_usb_id_table[35], NULL },
-+				{ NULL },
- 			}
- 		}
- 	}, { DIB0700_DEFAULT_DEVICE_PROPERTIES,
-diff --git a/drivers/media/dvb/dvb-usb/dvb-usb-ids.h b/drivers/media/dvb/dvb-usb/dvb-usb-ids.h
-index 34245d1..31ded10 100644
---- a/drivers/media/dvb/dvb-usb/dvb-usb-ids.h
-+++ b/drivers/media/dvb/dvb-usb/dvb-usb-ids.h
-@@ -132,6 +132,7 @@
- #define USB_PID_HAUPPAUGE_NOVA_T_STICK_3		0x7070
- #define USB_PID_HAUPPAUGE_MYTV_T			0x7080
- #define USB_PID_HAUPPAUGE_NOVA_TD_STICK			0x9580
-+#define USB_PID_HAUPPAUGE_NOVA_TD_STICK_52009		0x5200
- #define USB_PID_AVERMEDIA_EXPRESS			0xb568
- #define USB_PID_AVERMEDIA_VOLAR				0xa807
- #define USB_PID_AVERMEDIA_VOLAR_2			0xb808
-diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig
-index 5ccb0ae..e00717d 100644
---- a/drivers/media/video/Kconfig
-+++ b/drivers/media/video/Kconfig
-@@ -793,13 +793,7 @@ menuconfig V4L_USB_DRIVERS
- 
- if V4L_USB_DRIVERS && USB
- 
--config USB_VIDEO_CLASS
--	tristate "USB Video Class (UVC)"
--	---help---
--	  Support for the USB Video Class (UVC).  Currently only video
--	  input devices, such as webcams, are supported.
--
--	  For more information see: <http://linux-uvc.berlios.de/>
-+source "drivers/media/video/uvc/Kconfig"
- 
- source "drivers/media/video/pvrusb2/Kconfig"
- 
-diff --git a/drivers/media/video/cx18/cx18-firmware.c b/drivers/media/video/cx18/cx18-firmware.c
-index 2694ce3..9dda2ca 100644
---- a/drivers/media/video/cx18/cx18-firmware.c
-+++ b/drivers/media/video/cx18/cx18-firmware.c
-@@ -90,7 +90,7 @@
- #define CX18_DSP0_INTERRUPT_MASK     	0xd0004C
- 
- /* Encoder/decoder firmware sizes */
--#define CX18_FW_CPU_SIZE 		(174716)
-+#define CX18_FW_CPU_SIZE 		(158332)
- #define CX18_FW_APU_SIZE 		(141200)
- 
- #define APU_ROM_SYNC1 0x6D676553 /* "mgeS" */
-diff --git a/drivers/media/video/cx23885/cx23885-core.c b/drivers/media/video/cx23885/cx23885-core.c
-index c4cc2f3..ad143f1 100644
---- a/drivers/media/video/cx23885/cx23885-core.c
-+++ b/drivers/media/video/cx23885/cx23885-core.c
-@@ -76,6 +76,117 @@ LIST_HEAD(cx23885_devlist);
-  * 0x00010ea0 0x00010xxx Free
-  */
- 
-+static struct sram_channel cx23885_sram_channels[] = {
-+	[SRAM_CH01] = {
-+		.name		= "VID A",
-+		.cmds_start	= 0x10000,
-+		.ctrl_start	= 0x10380,
-+		.cdt		= 0x104c0,
-+		.fifo_start	= 0x40,
-+		.fifo_size	= 0x2800,
-+		.ptr1_reg	= DMA1_PTR1,
-+		.ptr2_reg	= DMA1_PTR2,
-+		.cnt1_reg	= DMA1_CNT1,
-+		.cnt2_reg	= DMA1_CNT2,
-+	},
-+	[SRAM_CH02] = {
-+		.name		= "ch2",
-+		.cmds_start	= 0x0,
-+		.ctrl_start	= 0x0,
-+		.cdt		= 0x0,
-+		.fifo_start	= 0x0,
-+		.fifo_size	= 0x0,
-+		.ptr1_reg	= DMA2_PTR1,
-+		.ptr2_reg	= DMA2_PTR2,
-+		.cnt1_reg	= DMA2_CNT1,
-+		.cnt2_reg	= DMA2_CNT2,
-+	},
-+	[SRAM_CH03] = {
-+		.name		= "TS1 B",
-+		.cmds_start	= 0x100A0,
-+		.ctrl_start	= 0x10400,
-+		.cdt		= 0x10580,
-+		.fifo_start	= 0x5000,
-+		.fifo_size	= 0x1000,
-+		.ptr1_reg	= DMA3_PTR1,
-+		.ptr2_reg	= DMA3_PTR2,
-+		.cnt1_reg	= DMA3_CNT1,
-+		.cnt2_reg	= DMA3_CNT2,
-+	},
-+	[SRAM_CH04] = {
-+		.name		= "ch4",
-+		.cmds_start	= 0x0,
-+		.ctrl_start	= 0x0,
-+		.cdt		= 0x0,
-+		.fifo_start	= 0x0,
-+		.fifo_size	= 0x0,
-+		.ptr1_reg	= DMA4_PTR1,
-+		.ptr2_reg	= DMA4_PTR2,
-+		.cnt1_reg	= DMA4_CNT1,
-+		.cnt2_reg	= DMA4_CNT2,
-+	},
-+	[SRAM_CH05] = {
-+		.name		= "ch5",
-+		.cmds_start	= 0x0,
-+		.ctrl_start	= 0x0,
-+		.cdt		= 0x0,
-+		.fifo_start	= 0x0,
-+		.fifo_size	= 0x0,
-+		.ptr1_reg	= DMA5_PTR1,
-+		.ptr2_reg	= DMA5_PTR2,
-+		.cnt1_reg	= DMA5_CNT1,
-+		.cnt2_reg	= DMA5_CNT2,
-+	},
-+	[SRAM_CH06] = {
-+		.name		= "TS2 C",
-+		.cmds_start	= 0x10140,
-+		.ctrl_start	= 0x10440,
-+		.cdt		= 0x105e0,
-+		.fifo_start	= 0x6000,
-+		.fifo_size	= 0x1000,
-+		.ptr1_reg	= DMA5_PTR1,
-+		.ptr2_reg	= DMA5_PTR2,
-+		.cnt1_reg	= DMA5_CNT1,
-+		.cnt2_reg	= DMA5_CNT2,
-+	},
-+	[SRAM_CH07] = {
-+		.name		= "ch7",
-+		.cmds_start	= 0x0,
-+		.ctrl_start	= 0x0,
-+		.cdt		= 0x0,
-+		.fifo_start	= 0x0,
-+		.fifo_size	= 0x0,
-+		.ptr1_reg	= DMA6_PTR1,
-+		.ptr2_reg	= DMA6_PTR2,
-+		.cnt1_reg	= DMA6_CNT1,
-+		.cnt2_reg	= DMA6_CNT2,
-+	},
-+	[SRAM_CH08] = {
-+		.name		= "ch8",
-+		.cmds_start	= 0x0,
-+		.ctrl_start	= 0x0,
-+		.cdt		= 0x0,
-+		.fifo_start	= 0x0,
-+		.fifo_size	= 0x0,
-+		.ptr1_reg	= DMA7_PTR1,
-+		.ptr2_reg	= DMA7_PTR2,
-+		.cnt1_reg	= DMA7_CNT1,
-+		.cnt2_reg	= DMA7_CNT2,
-+	},
-+	[SRAM_CH09] = {
-+		.name		= "ch9",
-+		.cmds_start	= 0x0,
-+		.ctrl_start	= 0x0,
-+		.cdt		= 0x0,
-+		.fifo_start	= 0x0,
-+		.fifo_size	= 0x0,
-+		.ptr1_reg	= DMA8_PTR1,
-+		.ptr2_reg	= DMA8_PTR2,
-+		.cnt1_reg	= DMA8_CNT1,
-+		.cnt2_reg	= DMA8_CNT2,
-+	},
-+};
-+
- static struct sram_channel cx23887_sram_channels[] = {
- 	[SRAM_CH01] = {
- 		.name		= "VID A",
-@@ -104,8 +215,8 @@ static struct sram_channel cx23887_sram_channels[] = {
- 	[SRAM_CH03] = {
- 		.name		= "TS1 B",
- 		.cmds_start	= 0x100A0,
--		.ctrl_start	= 0x10780,
--		.cdt		= 0x10400,
-+		.ctrl_start	= 0x10630,
-+		.cdt		= 0x10870,
- 		.fifo_start	= 0x5000,
- 		.fifo_size	= 0x1000,
- 		.ptr1_reg	= DMA3_PTR1,
-@@ -140,7 +251,7 @@ static struct sram_channel cx23887_sram_channels[] = {
- 	[SRAM_CH06] = {
- 		.name		= "TS2 C",
- 		.cmds_start	= 0x10140,
--		.ctrl_start	= 0x10680,
-+		.ctrl_start	= 0x10670,
- 		.cdt		= 0x108d0,
- 		.fifo_start	= 0x6000,
- 		.fifo_size	= 0x1000,
-@@ -460,6 +571,7 @@ static void cx23885_reset(struct cx23885_dev *dev)
- 	cx_write(AUDIO_INT_INT_STAT, 0xffffffff);
- 	cx_write(AUDIO_EXT_INT_STAT, 0xffffffff);
- 	cx_write(CLK_DELAY, cx_read(CLK_DELAY) & 0x80000000);
-+	cx_write(PAD_CTRL, 0x00500300);
- 
- 	mdelay(100);
- 
-@@ -625,7 +737,6 @@ static int cx23885_dev_setup(struct cx23885_dev *dev)
- 	atomic_inc(&dev->refcount);
- 
- 	dev->nr = cx23885_devcount++;
--	dev->sram_channels = cx23887_sram_channels;
- 	sprintf(dev->name, "cx23885[%d]", dev->nr);
- 
- 	mutex_lock(&devlist);
-@@ -637,11 +748,13 @@ static int cx23885_dev_setup(struct cx23885_dev *dev)
- 		dev->bridge = CX23885_BRIDGE_887;
- 		/* Apply a sensible clock frequency for the PCIe bridge */
- 		dev->clk_freq = 25000000;
-+		dev->sram_channels = cx23887_sram_channels;
- 	} else
- 	if(dev->pci->device == 0x8852) {
- 		dev->bridge = CX23885_BRIDGE_885;
- 		/* Apply a sensible clock frequency for the PCIe bridge */
- 		dev->clk_freq = 28000000;
-+		dev->sram_channels = cx23885_sram_channels;
- 	} else
- 		BUG();
- 
-@@ -1042,6 +1155,9 @@ static int cx23885_start_dma(struct cx23885_tsport *port,
- 	dprintk(1, "%s() w: %d, h: %d, f: %d\n", __func__,
- 		buf->vb.width, buf->vb.height, buf->vb.field);
- 
-+	/* Stop the fifo and risc engine for this port */
-+	cx_clear(port->reg_dma_ctl, port->dma_ctl_val);
-+
- 	/* setup fifo + format */
- 	cx23885_sram_channel_setup(dev,
- 				   &dev->sram_channels[ port->sram_chno ],
-@@ -1083,7 +1199,21 @@ static int cx23885_start_dma(struct cx23885_tsport *port,
- 	cx_write(port->reg_gpcnt_ctl, 3);
- 	q->count = 1;
- 
--	if (cx23885_boards[dev->board].portb & CX23885_MPEG_ENCODER) {
-+	/* Set VIDB pins to input */
-+	if (cx23885_boards[dev->board].portb == CX23885_MPEG_DVB) {
-+		reg = cx_read(PAD_CTRL);
-+		reg &= ~0x3; /* Clear TS1_OE & TS1_SOP_OE */
-+		cx_write(PAD_CTRL, reg);
-+	}
-+
-+	/* Set VIDC pins to input */
-+	if (cx23885_boards[dev->board].portc == CX23885_MPEG_DVB) {
-+		reg = cx_read(PAD_CTRL);
-+		reg &= ~0x4; /* Clear TS2_SOP_OE */
-+		cx_write(PAD_CTRL, reg);
-+	}
-+
-+	if (cx23885_boards[dev->board].portb == CX23885_MPEG_ENCODER) {
- 
- 		reg = cx_read(PAD_CTRL);
- 		reg = reg & ~0x1;    /* Clear TS1_OE */
-@@ -1133,7 +1263,7 @@ static int cx23885_stop_dma(struct cx23885_tsport *port)
- 	cx_clear(port->reg_ts_int_msk, port->ts_int_msk_val);
- 	cx_clear(port->reg_dma_ctl, port->dma_ctl_val);
- 
--	if (cx23885_boards[dev->board].portb & CX23885_MPEG_ENCODER) {
-+	if (cx23885_boards[dev->board].portb == CX23885_MPEG_ENCODER) {
- 
- 		reg = cx_read(PAD_CTRL);
- 
-diff --git a/drivers/media/video/saa7134/saa7134-cards.c b/drivers/media/video/saa7134/saa7134-cards.c
-index 2618cfa..0227cf9 100644
---- a/drivers/media/video/saa7134/saa7134-cards.c
-+++ b/drivers/media/video/saa7134/saa7134-cards.c
-@@ -5703,9 +5703,6 @@ int saa7134_board_init2(struct saa7134_dev *dev)
- 	unsigned char buf;
- 	int board;
- 
--	dev->tuner_type = saa7134_boards[dev->board].tuner_type;
--	dev->tuner_addr = saa7134_boards[dev->board].tuner_addr;
--
- 	switch (dev->board) {
- 	case SAA7134_BOARD_BMK_MPEX_NOTUNER:
- 	case SAA7134_BOARD_BMK_MPEX_TUNER:
-diff --git a/drivers/media/video/saa7134/saa7134-core.c b/drivers/media/video/saa7134/saa7134-core.c
-index 2c19cd0..69f340d 100644
---- a/drivers/media/video/saa7134/saa7134-core.c
-+++ b/drivers/media/video/saa7134/saa7134-core.c
-@@ -946,11 +946,12 @@ static int __devinit saa7134_initdev(struct pci_dev *pci_dev,
- 		dev->board = SAA7134_BOARD_UNKNOWN;
- 	}
- 	dev->autodetected = card[dev->nr] != dev->board;
--	dev->tuner_type   = saa7134_boards[dev->board].tuner_type;
-+	dev->tuner_type = saa7134_boards[dev->board].tuner_type;
-+	dev->tuner_addr = saa7134_boards[dev->board].tuner_addr;
- 	dev->tda9887_conf = saa7134_boards[dev->board].tda9887_conf;
- 	if (UNSET != tuner[dev->nr])
- 		dev->tuner_type = tuner[dev->nr];
--		printk(KERN_INFO "%s: subsystem: %04x:%04x, board: %s [card=%d,%s]\n",
-+	printk(KERN_INFO "%s: subsystem: %04x:%04x, board: %s [card=%d,%s]\n",
- 		dev->name,pci_dev->subsystem_vendor,
- 		pci_dev->subsystem_device,saa7134_boards[dev->board].name,
- 		dev->board, dev->autodetected ?
-diff --git a/drivers/media/video/uvc/Kconfig b/drivers/media/video/uvc/Kconfig
-new file mode 100644
-index 0000000..c2d9760
---- /dev/null
-+++ b/drivers/media/video/uvc/Kconfig
-@@ -0,0 +1,17 @@
-+config USB_VIDEO_CLASS
-+	tristate "USB Video Class (UVC)"
-+	---help---
-+	  Support for the USB Video Class (UVC).  Currently only video
-+	  input devices, such as webcams, are supported.
-+
-+	  For more information see: <http://linux-uvc.berlios.de/>
-+
-+config USB_VIDEO_CLASS_INPUT_EVDEV
-+	bool "UVC input events device support"
-+	default y
-+	depends on USB_VIDEO_CLASS && INPUT
-+	---help---
-+	  This option makes USB Video Class devices register an input device
-+	  to report button events.
-+
-+	  If you are in doubt, say Y.
-diff --git a/drivers/media/video/uvc/uvc_driver.c b/drivers/media/video/uvc/uvc_driver.c
-index 60ced58..9d954d2 100644
---- a/drivers/media/video/uvc/uvc_driver.c
-+++ b/drivers/media/video/uvc/uvc_driver.c
-@@ -298,7 +298,8 @@ static int uvc_parse_format(struct uvc_device *dev,
- 	switch (buffer[2]) {
- 	case VS_FORMAT_UNCOMPRESSED:
- 	case VS_FORMAT_FRAME_BASED:
--		if (buflen < 27) {
-+		n = buffer[2] == VS_FORMAT_UNCOMPRESSED ? 27 : 28;
-+		if (buflen < n) {
- 			uvc_trace(UVC_TRACE_DESCR, "device %d videostreaming"
- 			       "interface %d FORMAT error\n",
- 			       dev->udev->devnum,
-@@ -1891,6 +1892,15 @@ static struct usb_device_id uvc_ids[] = {
- 	  .bInterfaceSubClass	= 1,
- 	  .bInterfaceProtocol	= 0,
- 	  .driver_info		= UVC_QUIRK_PROBE_MINMAX },
-+	/* Medion Akoya Mini E1210 */
-+	{ .match_flags		= USB_DEVICE_ID_MATCH_DEVICE
-+				| USB_DEVICE_ID_MATCH_INT_INFO,
-+	  .idVendor		= 0x5986,
-+	  .idProduct		= 0x0141,
-+	  .bInterfaceClass	= USB_CLASS_VIDEO,
-+	  .bInterfaceSubClass	= 1,
-+	  .bInterfaceProtocol	= 0,
-+	  .driver_info		= UVC_QUIRK_PROBE_MINMAX },
- 	/* Acer OrbiCam - Unknown vendor */
- 	{ .match_flags		= USB_DEVICE_ID_MATCH_DEVICE
- 				| USB_DEVICE_ID_MATCH_INT_INFO,
-diff --git a/drivers/media/video/uvc/uvc_status.c b/drivers/media/video/uvc/uvc_status.c
-index be9084e..eb2f970 100644
---- a/drivers/media/video/uvc/uvc_status.c
-+++ b/drivers/media/video/uvc/uvc_status.c
-@@ -22,6 +22,7 @@
- /* --------------------------------------------------------------------------
-  * Input device
-  */
-+#ifdef CONFIG_USB_VIDEO_CLASS_INPUT_EVDEV
- static int uvc_input_init(struct uvc_device *dev)
- {
- 	struct usb_device *udev = dev->udev;
-@@ -67,6 +68,19 @@ static void uvc_input_cleanup(struct uvc_device *dev)
- 		input_unregister_device(dev->input);
- }
- 
-+static void uvc_input_report_key(struct uvc_device *dev, unsigned int code,
-+	int value)
-+{
-+	if (dev->input)
-+		input_report_key(dev->input, code, value);
-+}
-+
-+#else
-+#define uvc_input_init(dev)
-+#define uvc_input_cleanup(dev)
-+#define uvc_input_report_key(dev, code, value)
-+#endif /* CONFIG_USB_VIDEO_CLASS_INPUT_EVDEV */
-+
- /* --------------------------------------------------------------------------
-  * Status interrupt endpoint
-  */
-@@ -83,8 +97,7 @@ static void uvc_event_streaming(struct uvc_device *dev, __u8 *data, int len)
- 			return;
- 		uvc_trace(UVC_TRACE_STATUS, "Button (intf %u) %s len %d\n",
- 			data[1], data[3] ? "pressed" : "released", len);
--		if (dev->input)
--			input_report_key(dev->input, BTN_0, data[3]);
-+		uvc_input_report_key(dev, BTN_0, data[3]);
- 	} else {
- 		uvc_trace(UVC_TRACE_STATUS, "Stream %u error event %02x %02x "
- 			"len %d.\n", data[1], data[2], data[3], len);
-@@ -203,5 +216,5 @@ int uvc_status_resume(struct uvc_device *dev)
- 	if (dev->int_urb == NULL)
- 		return 0;
- 
--	return usb_submit_urb(dev->int_urb, GFP_KERNEL);
-+	return usb_submit_urb(dev->int_urb, GFP_NOIO);
- }
-diff --git a/drivers/media/video/uvc/uvc_video.c b/drivers/media/video/uvc/uvc_video.c
-index 6faf1fb..817af2e 100644
---- a/drivers/media/video/uvc/uvc_video.c
-+++ b/drivers/media/video/uvc/uvc_video.c
-@@ -554,9 +554,56 @@ static void uvc_video_complete(struct urb *urb)
- }
- 
- /*
-+ * Free transfer buffers.
-+ */
-+static void uvc_free_urb_buffers(struct uvc_video_device *video)
-+{
-+	unsigned int i;
-+
-+	for (i = 0; i < UVC_URBS; ++i) {
-+		if (video->urb_buffer[i]) {
-+			usb_buffer_free(video->dev->udev, video->urb_size,
-+				video->urb_buffer[i], video->urb_dma[i]);
-+			video->urb_buffer[i] = NULL;
-+		}
-+	}
-+
-+	video->urb_size = 0;
-+}
-+
-+/*
-+ * Allocate transfer buffers. This function can be called with buffers
-+ * already allocated when resuming from suspend, in which case it will
-+ * return without touching the buffers.
-+ *
-+ * Return 0 on success or -ENOMEM when out of memory.
-+ */
-+static int uvc_alloc_urb_buffers(struct uvc_video_device *video,
-+	unsigned int size)
-+{
-+	unsigned int i;
-+
-+	/* Buffers are already allocated, bail out. */
-+	if (video->urb_size)
-+		return 0;
-+
-+	for (i = 0; i < UVC_URBS; ++i) {
-+		video->urb_buffer[i] = usb_buffer_alloc(video->dev->udev,
-+			size, GFP_KERNEL, &video->urb_dma[i]);
-+		if (video->urb_buffer[i] == NULL) {
-+			uvc_free_urb_buffers(video);
-+			return -ENOMEM;
-+		}
-+	}
-+
-+	video->urb_size = size;
-+	return 0;
-+}
-+
-+/*
-  * Uninitialize isochronous/bulk URBs and free transfer buffers.
-  */
--static void uvc_uninit_video(struct uvc_video_device *video)
-+static void uvc_uninit_video(struct uvc_video_device *video, int free_buffers)
- {
- 	struct urb *urb;
- 	unsigned int i;
-@@ -566,19 +613,12 @@ static void uvc_uninit_video(struct uvc_video_device *video)
- 			continue;
- 
- 		usb_kill_urb(urb);
--		/* urb->transfer_buffer_length is not touched by USB core, so
--		 * we can use it here as the buffer length.
--		 */
--		if (video->urb_buffer[i]) {
--			usb_buffer_free(video->dev->udev,
--				urb->transfer_buffer_length,
--				video->urb_buffer[i], urb->transfer_dma);
--			video->urb_buffer[i] = NULL;
--		}
--
- 		usb_free_urb(urb);
- 		video->urb[i] = NULL;
- 	}
-+
-+	if (free_buffers)
-+		uvc_free_urb_buffers(video);
- }
- 
- /*
-@@ -586,7 +626,7 @@ static void uvc_uninit_video(struct uvc_video_device *video)
-  * is given by the endpoint.
-  */
- static int uvc_init_video_isoc(struct uvc_video_device *video,
--	struct usb_host_endpoint *ep)
-+	struct usb_host_endpoint *ep, gfp_t gfp_flags)
- {
- 	struct urb *urb;
- 	unsigned int npackets, i, j;
-@@ -610,18 +650,13 @@ static int uvc_init_video_isoc(struct uvc_video_device *video,
- 
- 	size = npackets * psize;
- 
-+	if (uvc_alloc_urb_buffers(video, size) < 0)
-+		return -ENOMEM;
-+
- 	for (i = 0; i < UVC_URBS; ++i) {
--		urb = usb_alloc_urb(npackets, GFP_KERNEL);
-+		urb = usb_alloc_urb(npackets, gfp_flags);
- 		if (urb == NULL) {
--			uvc_uninit_video(video);
--			return -ENOMEM;
--		}
--
--		video->urb_buffer[i] = usb_buffer_alloc(video->dev->udev,
--			size, GFP_KERNEL, &urb->transfer_dma);
--		if (video->urb_buffer[i] == NULL) {
--			usb_free_urb(urb);
--			uvc_uninit_video(video);
-+			uvc_uninit_video(video, 1);
- 			return -ENOMEM;
- 		}
- 
-@@ -632,6 +667,7 @@ static int uvc_init_video_isoc(struct uvc_video_device *video,
- 		urb->transfer_flags = URB_ISO_ASAP | URB_NO_TRANSFER_DMA_MAP;
- 		urb->interval = ep->desc.bInterval;
- 		urb->transfer_buffer = video->urb_buffer[i];
-+		urb->transfer_dma = video->urb_dma[i];
- 		urb->complete = uvc_video_complete;
- 		urb->number_of_packets = npackets;
- 		urb->transfer_buffer_length = size;
-@@ -652,7 +688,7 @@ static int uvc_init_video_isoc(struct uvc_video_device *video,
-  * given by the endpoint.
-  */
- static int uvc_init_video_bulk(struct uvc_video_device *video,
--	struct usb_host_endpoint *ep)
-+	struct usb_host_endpoint *ep, gfp_t gfp_flags)
- {
- 	struct urb *urb;
- 	unsigned int pipe, i;
-@@ -671,20 +707,15 @@ static int uvc_init_video_bulk(struct uvc_video_device *video,
- 	if (size > psize * UVC_MAX_ISO_PACKETS)
- 		size = psize * UVC_MAX_ISO_PACKETS;
- 
-+	if (uvc_alloc_urb_buffers(video, size) < 0)
-+		return -ENOMEM;
-+
- 	pipe = usb_rcvbulkpipe(video->dev->udev, ep->desc.bEndpointAddress);
- 
- 	for (i = 0; i < UVC_URBS; ++i) {
--		urb = usb_alloc_urb(0, GFP_KERNEL);
-+		urb = usb_alloc_urb(0, gfp_flags);
- 		if (urb == NULL) {
--			uvc_uninit_video(video);
--			return -ENOMEM;
--		}
--
--		video->urb_buffer[i] = usb_buffer_alloc(video->dev->udev,
--			size, GFP_KERNEL, &urb->transfer_dma);
--		if (video->urb_buffer[i] == NULL) {
--			usb_free_urb(urb);
--			uvc_uninit_video(video);
-+			uvc_uninit_video(video, 1);
- 			return -ENOMEM;
- 		}
- 
-@@ -692,6 +723,7 @@ static int uvc_init_video_bulk(struct uvc_video_device *video,
- 			video->urb_buffer[i], size, uvc_video_complete,
- 			video);
- 		urb->transfer_flags = URB_NO_TRANSFER_DMA_MAP;
-+		urb->transfer_dma = video->urb_dma[i];
- 
- 		video->urb[i] = urb;
- 	}
-@@ -702,7 +734,7 @@ static int uvc_init_video_bulk(struct uvc_video_device *video,
- /*
-  * Initialize isochronous/bulk URBs and allocate transfer buffers.
-  */
--static int uvc_init_video(struct uvc_video_device *video)
-+static int uvc_init_video(struct uvc_video_device *video, gfp_t gfp_flags)
- {
- 	struct usb_interface *intf = video->streaming->intf;
- 	struct usb_host_interface *alts;
-@@ -747,7 +779,7 @@ static int uvc_init_video(struct uvc_video_device *video)
- 		if ((ret = usb_set_interface(video->dev->udev, intfnum, i)) < 0)
- 			return ret;
- 
--		ret = uvc_init_video_isoc(video, ep);
-+		ret = uvc_init_video_isoc(video, ep, gfp_flags);
- 	} else {
- 		/* Bulk endpoint, proceed to URB initialization. */
- 		ep = uvc_find_endpoint(&intf->altsetting[0],
-@@ -755,7 +787,7 @@ static int uvc_init_video(struct uvc_video_device *video)
- 		if (ep == NULL)
- 			return -EIO;
- 
--		ret = uvc_init_video_bulk(video, ep);
-+		ret = uvc_init_video_bulk(video, ep, gfp_flags);
- 	}
- 
- 	if (ret < 0)
-@@ -763,10 +795,10 @@ static int uvc_init_video(struct uvc_video_device *video)
- 
- 	/* Submit the URBs. */
- 	for (i = 0; i < UVC_URBS; ++i) {
--		if ((ret = usb_submit_urb(video->urb[i], GFP_KERNEL)) < 0) {
-+		if ((ret = usb_submit_urb(video->urb[i], gfp_flags)) < 0) {
- 			uvc_printk(KERN_ERR, "Failed to submit URB %u "
- 					"(%d).\n", i, ret);
--			uvc_uninit_video(video);
-+			uvc_uninit_video(video, 1);
- 			return ret;
- 		}
- 	}
-@@ -791,7 +823,7 @@ int uvc_video_suspend(struct uvc_video_device *video)
- 		return 0;
- 
- 	video->frozen = 1;
--	uvc_uninit_video(video);
-+	uvc_uninit_video(video, 0);
- 	usb_set_interface(video->dev->udev, video->streaming->intfnum, 0);
- 	return 0;
- }
-@@ -818,7 +850,7 @@ int uvc_video_resume(struct uvc_video_device *video)
- 	if (!uvc_queue_streaming(&video->queue))
- 		return 0;
- 
--	if ((ret = uvc_init_video(video)) < 0)
-+	if ((ret = uvc_init_video(video, GFP_NOIO)) < 0)
- 		uvc_queue_enable(&video->queue, 0);
- 
- 	return ret;
-@@ -920,7 +952,7 @@ int uvc_video_enable(struct uvc_video_device *video, int enable)
- 	int ret;
- 
- 	if (!enable) {
--		uvc_uninit_video(video);
-+		uvc_uninit_video(video, 1);
- 		usb_set_interface(video->dev->udev,
- 			video->streaming->intfnum, 0);
- 		uvc_queue_enable(&video->queue, 0);
-@@ -930,5 +962,5 @@ int uvc_video_enable(struct uvc_video_device *video, int enable)
- 	if ((ret = uvc_queue_enable(&video->queue, 1)) < 0)
- 		return ret;
- 
--	return uvc_init_video(video);
-+	return uvc_init_video(video, GFP_KERNEL);
- }
-diff --git a/drivers/media/video/uvc/uvcvideo.h b/drivers/media/video/uvc/uvcvideo.h
-index a995a78..2444b8a 100644
---- a/drivers/media/video/uvc/uvcvideo.h
-+++ b/drivers/media/video/uvc/uvcvideo.h
-@@ -602,6 +602,8 @@ struct uvc_video_device {
- 
- 	struct urb *urb[UVC_URBS];
- 	char *urb_buffer[UVC_URBS];
-+	dma_addr_t urb_dma[UVC_URBS];
-+	unsigned int urb_size;
- 
- 	__u8 last_fid;
- };
-diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c
-index d89475d..5c35e63 100644
---- a/drivers/mmc/host/pxamci.c
-+++ b/drivers/mmc/host/pxamci.c
-@@ -177,7 +177,7 @@ static void pxamci_setup_data(struct pxamci_host *host, struct mmc_data *data)
- 	if (dalgn)
- 		DALGN |= (1 << host->dma);
- 	else
--		DALGN &= (1 << host->dma);
-+		DALGN &= ~(1 << host->dma);
- 	DDADR(host->dma) = host->sg_dma;
- 	DCSR(host->dma) = DCSR_RUN;
- }
-diff --git a/drivers/net/hamradio/hdlcdrv.c b/drivers/net/hamradio/hdlcdrv.c
-index ae9629f..c258a05 100644
---- a/drivers/net/hamradio/hdlcdrv.c
-+++ b/drivers/net/hamradio/hdlcdrv.c
-@@ -88,6 +88,7 @@
- static inline void append_crc_ccitt(unsigned char *buffer, int len)
- {
-  	unsigned int crc = crc_ccitt(0xffff, buffer, len) ^ 0xffff;
-+	buffer += len;
- 	*buffer++ = crc;
- 	*buffer++ = crc >> 8;
- }
-diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
-index 8f04609..e248f80 100644
---- a/drivers/net/ixgbe/ixgbe_main.c
-+++ b/drivers/net/ixgbe/ixgbe_main.c
-@@ -70,8 +70,6 @@ static struct pci_device_id ixgbe_pci_tbl[] = {
- 	 board_82598 },
- 	{PCI_VDEVICE(INTEL, IXGBE_DEV_ID_82598AF_SINGLE_PORT),
- 	 board_82598 },
--	{PCI_VDEVICE(INTEL, IXGBE_DEV_ID_82598AT_DUAL_PORT),
--	 board_82598 },
- 	{PCI_VDEVICE(INTEL, IXGBE_DEV_ID_82598EB_CX4),
- 	 board_82598 },
- 
-diff --git a/drivers/net/myri10ge/myri10ge.c b/drivers/net/myri10ge/myri10ge.c
-index e0d76c7..9e28d91 100644
---- a/drivers/net/myri10ge/myri10ge.c
-+++ b/drivers/net/myri10ge/myri10ge.c
-@@ -3126,6 +3126,8 @@ static int myri10ge_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
- 
- 	mgp = netdev_priv(netdev);
- 	mgp->dev = netdev;
-+	mgp->ss.mgp = mgp;
-+	mgp->ss.dev = mgp->dev;
- 	netif_napi_add(netdev, &mgp->ss.napi, myri10ge_poll, myri10ge_napi_weight);
- 	mgp->pdev = pdev;
- 	mgp->csum_flag = MXGEFW_FLAGS_CKSUM;
-@@ -3213,26 +3215,26 @@ static int myri10ge_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
- 	for (i = 0; i < ETH_ALEN; i++)
- 		netdev->dev_addr[i] = mgp->mac_addr[i];
- 
--	/* allocate rx done ring */
--	bytes = mgp->max_intr_slots * sizeof(*mgp->ss.rx_done.entry);
--	mgp->ss.rx_done.entry = dma_alloc_coherent(&pdev->dev, bytes,
--						&mgp->ss.rx_done.bus, GFP_KERNEL);
--	if (mgp->ss.rx_done.entry == NULL)
--		goto abort_with_ioremap;
--	memset(mgp->ss.rx_done.entry, 0, bytes);
--
- 	myri10ge_select_firmware(mgp);
- 
- 	status = myri10ge_load_firmware(mgp);
- 	if (status != 0) {
- 		dev_err(&pdev->dev, "failed to load firmware\n");
--		goto abort_with_rx_done;
-+		goto abort_with_ioremap;
- 	}
- 
-+	/* allocate rx done ring */
-+	bytes = mgp->max_intr_slots * sizeof(*mgp->ss.rx_done.entry);
-+	mgp->ss.rx_done.entry = dma_alloc_coherent(&pdev->dev, bytes,
-+						&mgp->ss.rx_done.bus, GFP_KERNEL);
-+	if (mgp->ss.rx_done.entry == NULL)
-+		goto abort_with_firmware;
-+	memset(mgp->ss.rx_done.entry, 0, bytes);
-+
- 	status = myri10ge_reset(mgp);
- 	if (status != 0) {
- 		dev_err(&pdev->dev, "failed reset\n");
--		goto abort_with_firmware;
-+		goto abort_with_rx_done;
- 	}
- 
- 	pci_set_drvdata(pdev, mgp);
-@@ -3258,7 +3260,7 @@ static int myri10ge_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
- 	 * is set to correct value if MSI is enabled */
- 	status = myri10ge_request_irq(mgp);
- 	if (status != 0)
--		goto abort_with_firmware;
-+		goto abort_with_rx_done;
- 	netdev->irq = pdev->irq;
- 	myri10ge_free_irq(mgp);
- 
-@@ -3287,14 +3289,14 @@ static int myri10ge_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
- abort_with_state:
- 	pci_restore_state(pdev);
- 
--abort_with_firmware:
--	myri10ge_dummy_rdma(mgp, 0);
--
- abort_with_rx_done:
- 	bytes = mgp->max_intr_slots * sizeof(*mgp->ss.rx_done.entry);
- 	dma_free_coherent(&pdev->dev, bytes,
- 			  mgp->ss.rx_done.entry, mgp->ss.rx_done.bus);
- 
-+abort_with_firmware:
-+	myri10ge_dummy_rdma(mgp, 0);
-+
- abort_with_ioremap:
- 	iounmap(mgp->sram);
- 
-diff --git a/drivers/net/wireless/ath5k/base.c b/drivers/net/wireless/ath5k/base.c
-index 635b9ac..e57905c 100644
---- a/drivers/net/wireless/ath5k/base.c
-+++ b/drivers/net/wireless/ath5k/base.c
-@@ -487,9 +487,6 @@ ath5k_pci_probe(struct pci_dev *pdev,
- 	/* Set private data */
- 	pci_set_drvdata(pdev, hw);
- 
--	/* Enable msi for devices that support it */
--	pci_enable_msi(pdev);
--
- 	/* Setup interrupt handler */
- 	ret = request_irq(pdev->irq, ath5k_intr, IRQF_SHARED, "ath", sc);
- 	if (ret) {
-@@ -567,7 +564,6 @@ err_ah:
- err_irq:
- 	free_irq(pdev->irq, sc);
- err_free:
--	pci_disable_msi(pdev);
- 	ieee80211_free_hw(hw);
- err_map:
- 	pci_iounmap(pdev, mem);
-@@ -589,7 +585,6 @@ ath5k_pci_remove(struct pci_dev *pdev)
- 	ath5k_detach(pdev, hw);
- 	ath5k_hw_detach(sc->ah);
- 	free_irq(pdev->irq, sc);
--	pci_disable_msi(pdev);
- 	pci_iounmap(pdev, sc->iobase);
- 	pci_release_region(pdev, 0);
- 	pci_disable_device(pdev);
-diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
-index 3e612d0..9bba3ec 100644
---- a/drivers/net/wireless/b43legacy/main.c
-+++ b/drivers/net/wireless/b43legacy/main.c
-@@ -3862,10 +3862,10 @@ static int b43legacy_resume(struct ssb_device *dev)
- 			goto out;
- 		}
- 	}
--	mutex_unlock(&wl->mutex);
- 
- 	b43legacydbg(wl, "Device resumed.\n");
- out:
-+	mutex_unlock(&wl->mutex);
- 	return err;
- }
- 
-diff --git a/drivers/rtc/rtc-at91rm9200.c b/drivers/rtc/rtc-at91rm9200.c
-index 39e64ab..67c7a01 100644
---- a/drivers/rtc/rtc-at91rm9200.c
-+++ b/drivers/rtc/rtc-at91rm9200.c
-@@ -175,8 +175,10 @@ static int at91_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
- 		| BIN2BCD(tm.tm_mday) << 24
- 		| AT91_RTC_DATEEN | AT91_RTC_MTHEN);
- 
--	if (alrm->enabled)
-+	if (alrm->enabled) {
-+		at91_sys_write(AT91_RTC_SCCR, AT91_RTC_ALARM);
- 		at91_sys_write(AT91_RTC_IER, AT91_RTC_ALARM);
-+	}
- 
- 	pr_debug("%s(): %4d-%02d-%02d %02d:%02d:%02d\n", __func__,
- 		at91_alarm_year, tm.tm_mon, tm.tm_mday, tm.tm_hour,
-@@ -195,28 +197,22 @@ static int at91_rtc_ioctl(struct device *dev, unsigned int cmd,
- 
- 	pr_debug("%s(): cmd=%08x, arg=%08lx.\n", __func__, cmd, arg);
- 
-+	/* important:  scrub old status before enabling IRQs */
- 	switch (cmd) {
- 	case RTC_AIE_OFF:	/* alarm off */
- 		at91_sys_write(AT91_RTC_IDR, AT91_RTC_ALARM);
- 		break;
- 	case RTC_AIE_ON:	/* alarm on */
-+		at91_sys_write(AT91_RTC_SCCR, AT91_RTC_ALARM);
- 		at91_sys_write(AT91_RTC_IER, AT91_RTC_ALARM);
- 		break;
- 	case RTC_UIE_OFF:	/* update off */
--	case RTC_PIE_OFF:	/* periodic off */
- 		at91_sys_write(AT91_RTC_IDR, AT91_RTC_SECEV);
- 		break;
- 	case RTC_UIE_ON:	/* update on */
--	case RTC_PIE_ON:	/* periodic on */
-+		at91_sys_write(AT91_RTC_SCCR, AT91_RTC_SECEV);
- 		at91_sys_write(AT91_RTC_IER, AT91_RTC_SECEV);
- 		break;
--	case RTC_IRQP_READ:	/* read periodic alarm frequency */
--		ret = put_user(AT91_RTC_FREQ, (unsigned long *) arg);
--		break;
--	case RTC_IRQP_SET:	/* set periodic alarm frequency */
--		if (arg != AT91_RTC_FREQ)
--			ret = -EINVAL;
--		break;
- 	default:
- 		ret = -ENOIOCTLCMD;
- 		break;
-diff --git a/drivers/spi/mpc52xx_psc_spi.c b/drivers/spi/mpc52xx_psc_spi.c
-index 681d623..d8a1f91 100644
---- a/drivers/spi/mpc52xx_psc_spi.c
-+++ b/drivers/spi/mpc52xx_psc_spi.c
-@@ -148,7 +148,6 @@ static int mpc52xx_psc_spi_transfer_rxtx(struct spi_device *spi,
- 	unsigned rfalarm;
- 	unsigned send_at_once = MPC52xx_PSC_BUFSIZE;
- 	unsigned recv_at_once;
--	unsigned bpw = mps->bits_per_word / 8;
- 
- 	if (!t->tx_buf && !t->rx_buf && t->len)
- 		return -EINVAL;
-@@ -164,22 +163,15 @@ static int mpc52xx_psc_spi_transfer_rxtx(struct spi_device *spi,
- 		}
- 
- 		dev_dbg(&spi->dev, "send %d bytes...\n", send_at_once);
--		if (tx_buf) {
--			for (; send_at_once; sb++, send_at_once--) {
--				/* set EOF flag */
--				if (mps->bits_per_word
--						&& (sb + 1) % bpw == 0)
--					out_8(&psc->ircr2, 0x01);
-+		for (; send_at_once; sb++, send_at_once--) {
-+			/* set EOF flag before the last word is sent */
-+			if (send_at_once == 1)
-+				out_8(&psc->ircr2, 0x01);
-+
-+			if (tx_buf)
- 				out_8(&psc->mpc52xx_psc_buffer_8, tx_buf[sb]);
--			}
--		} else {
--			for (; send_at_once; sb++, send_at_once--) {
--				/* set EOF flag */
--				if (mps->bits_per_word
--						&& ((sb + 1) % bpw) == 0)
--					out_8(&psc->ircr2, 0x01);
-+			else
- 				out_8(&psc->mpc52xx_psc_buffer_8, 0);
--			}
- 		}
- 
- 
-diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
-index 0cb0d77..db1db4c 100644
---- a/drivers/usb/serial/usb-serial.c
-+++ b/drivers/usb/serial/usb-serial.c
-@@ -283,7 +283,10 @@ static void serial_close(struct tty_struct *tty, struct file * filp)
- 	}
- 
- 	if (port->open_count == 0) {
--		usb_autopm_put_interface(port->serial->interface);
-+		mutex_lock(&port->serial->disc_mutex);
-+		if (!port->serial->disconnected)
-+			usb_autopm_put_interface(port->serial->interface);
-+		mutex_unlock(&port->serial->disc_mutex);
- 		module_put(port->serial->type->driver.owner);
- 	}
- 
-diff --git a/fs/dquot.c b/fs/dquot.c
-index 5ac77da..ad88cf6 100644
---- a/fs/dquot.c
-+++ b/fs/dquot.c
-@@ -562,6 +562,8 @@ static struct shrinker dqcache_shrinker = {
-  */
- static void dqput(struct dquot *dquot)
- {
-+	int ret;
-+
- 	if (!dquot)
- 		return;
- #ifdef __DQUOT_PARANOIA
-@@ -594,7 +596,19 @@ we_slept:
- 	if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags) && dquot_dirty(dquot)) {
- 		spin_unlock(&dq_list_lock);
- 		/* Commit dquot before releasing */
--		dquot->dq_sb->dq_op->write_dquot(dquot);
-+		ret = dquot->dq_sb->dq_op->write_dquot(dquot);
-+		if (ret < 0) {
-+			printk(KERN_ERR "VFS: cannot write quota structure on "
-+				"device %s (error %d). Quota may get out of "
-+				"sync!\n", dquot->dq_sb->s_id, ret);
-+			/*
-+			 * We clear dirty bit anyway, so that we avoid
-+			 * infinite loop here
-+			 */
-+			spin_lock(&dq_list_lock);
-+			clear_dquot_dirty(dquot);
-+			spin_unlock(&dq_list_lock);
-+		}
- 		goto we_slept;
- 	}
- 	/* Clear flag in case dquot was inactive (something bad happened) */
-diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
-index e2832bc..a82e0cb 100644
---- a/fs/ecryptfs/crypto.c
-+++ b/fs/ecryptfs/crypto.c
-@@ -474,8 +474,8 @@ int ecryptfs_encrypt_page(struct page *page)
- {
- 	struct inode *ecryptfs_inode;
- 	struct ecryptfs_crypt_stat *crypt_stat;
--	char *enc_extent_virt = NULL;
--	struct page *enc_extent_page;
-+	char *enc_extent_virt;
-+	struct page *enc_extent_page = NULL;
- 	loff_t extent_offset;
- 	int rc = 0;
- 
-@@ -491,14 +491,14 @@ int ecryptfs_encrypt_page(struct page *page)
- 			       page->index);
- 		goto out;
- 	}
--	enc_extent_virt = kmalloc(PAGE_CACHE_SIZE, GFP_USER);
--	if (!enc_extent_virt) {
-+	enc_extent_page = alloc_page(GFP_USER);
-+	if (!enc_extent_page) {
- 		rc = -ENOMEM;
- 		ecryptfs_printk(KERN_ERR, "Error allocating memory for "
- 				"encrypted extent\n");
- 		goto out;
- 	}
--	enc_extent_page = virt_to_page(enc_extent_virt);
-+	enc_extent_virt = kmap(enc_extent_page);
- 	for (extent_offset = 0;
- 	     extent_offset < (PAGE_CACHE_SIZE / crypt_stat->extent_size);
- 	     extent_offset++) {
-@@ -526,7 +526,10 @@ int ecryptfs_encrypt_page(struct page *page)
- 		}
- 	}
- out:
--	kfree(enc_extent_virt);
-+	if (enc_extent_page) {
-+		kunmap(enc_extent_page);
-+		__free_page(enc_extent_page);
-+	}
- 	return rc;
- }
- 
-@@ -608,8 +611,8 @@ int ecryptfs_decrypt_page(struct page *page)
- {
- 	struct inode *ecryptfs_inode;
- 	struct ecryptfs_crypt_stat *crypt_stat;
--	char *enc_extent_virt = NULL;
--	struct page *enc_extent_page;
-+	char *enc_extent_virt;
-+	struct page *enc_extent_page = NULL;
- 	unsigned long extent_offset;
- 	int rc = 0;
- 
-@@ -626,14 +629,14 @@ int ecryptfs_decrypt_page(struct page *page)
- 			       page->index);
- 		goto out;
- 	}
--	enc_extent_virt = kmalloc(PAGE_CACHE_SIZE, GFP_USER);
--	if (!enc_extent_virt) {
-+	enc_extent_page = alloc_page(GFP_USER);
-+	if (!enc_extent_page) {
- 		rc = -ENOMEM;
- 		ecryptfs_printk(KERN_ERR, "Error allocating memory for "
- 				"encrypted extent\n");
- 		goto out;
- 	}
--	enc_extent_page = virt_to_page(enc_extent_virt);
-+	enc_extent_virt = kmap(enc_extent_page);
- 	for (extent_offset = 0;
- 	     extent_offset < (PAGE_CACHE_SIZE / crypt_stat->extent_size);
- 	     extent_offset++) {
-@@ -661,7 +664,10 @@ int ecryptfs_decrypt_page(struct page *page)
- 		}
- 	}
- out:
--	kfree(enc_extent_virt);
-+	if (enc_extent_page) {
-+		kunmap(enc_extent_page);
-+		__free_page(enc_extent_page);
-+	}
- 	return rc;
- }
- 
-diff --git a/fs/isofs/rock.c b/fs/isofs/rock.c
-index 6bd48f0..c2fb2dd 100644
---- a/fs/isofs/rock.c
-+++ b/fs/isofs/rock.c
-@@ -209,6 +209,11 @@ repeat:
- 
- 	while (rs.len > 2) { /* There may be one byte for padding somewhere */
- 		rr = (struct rock_ridge *)rs.chr;
-+		/*
-+		 * Ignore rock ridge info if rr->len is out of range, but
-+		 * don't return -EIO because that would make the file
-+		 * invisible.
-+		 */
- 		if (rr->len < 3)
- 			goto out;	/* Something got screwed up here */
- 		sig = isonum_721(rs.chr);
-@@ -216,8 +221,12 @@ repeat:
- 			goto eio;
- 		rs.chr += rr->len;
- 		rs.len -= rr->len;
-+		/*
-+		 * As above, just ignore the rock ridge info if rr->len
-+		 * is bogus.
-+		 */
- 		if (rs.len < 0)
--			goto eio;	/* corrupted isofs */
-+			goto out;	/* Something got screwed up here */
- 
- 		switch (sig) {
- 		case SIG('R', 'R'):
-@@ -307,6 +316,11 @@ parse_rock_ridge_inode_internal(struct iso_directory_record *de,
- repeat:
- 	while (rs.len > 2) { /* There may be one byte for padding somewhere */
- 		rr = (struct rock_ridge *)rs.chr;
-+		/*
-+		 * Ignore rock ridge info if rr->len is out of range, but
-+		 * don't return -EIO because that would make the file
-+		 * invisible.
-+		 */
- 		if (rr->len < 3)
- 			goto out;	/* Something got screwed up here */
- 		sig = isonum_721(rs.chr);
-@@ -314,8 +328,12 @@ repeat:
- 			goto eio;
- 		rs.chr += rr->len;
- 		rs.len -= rr->len;
-+		/*
-+		 * As above, just ignore the rock ridge info if rr->len
-+		 * is bogus.
-+		 */
- 		if (rs.len < 0)
--			goto eio;	/* corrupted isofs */
-+			goto out;	/* Something got screwed up here */
- 
- 		switch (sig) {
- #ifndef CONFIG_ZISOFS		/* No flag for SF or ZF */
-diff --git a/fs/libfs.c b/fs/libfs.c
-index baeb71e..1add676 100644
---- a/fs/libfs.c
-+++ b/fs/libfs.c
-@@ -216,8 +216,8 @@ int get_sb_pseudo(struct file_system_type *fs_type, char *name,
- 
- 	s->s_flags = MS_NOUSER;
- 	s->s_maxbytes = ~0ULL;
--	s->s_blocksize = 1024;
--	s->s_blocksize_bits = 10;
-+	s->s_blocksize = PAGE_SIZE;
-+	s->s_blocksize_bits = PAGE_SHIFT;
- 	s->s_magic = magic;
- 	s->s_op = ops ? ops : &simple_super_operations;
- 	s->s_time_gran = 1;
-diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
-index c492449..1eaa39a 100644
---- a/fs/proc/task_mmu.c
-+++ b/fs/proc/task_mmu.c
-@@ -636,7 +636,7 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
- 	struct pagemapread pm;
- 	int pagecount;
- 	int ret = -ESRCH;
--	struct mm_walk pagemap_walk;
-+	struct mm_walk pagemap_walk = {};
- 	unsigned long src;
- 	unsigned long svpfn;
- 	unsigned long start_vaddr;
-diff --git a/include/asm-arm/bitops.h b/include/asm-arm/bitops.h
-index 5c60bfc..9a1db20 100644
---- a/include/asm-arm/bitops.h
-+++ b/include/asm-arm/bitops.h
-@@ -277,9 +277,16 @@ static inline int constant_fls(int x)
-  * the clz instruction for much better code efficiency.
-  */
- 
--#define fls(x) \
-+#define __fls(x) \
- 	( __builtin_constant_p(x) ? constant_fls(x) : \
- 	  ({ int __r; asm("clz\t%0, %1" : "=r"(__r) : "r"(x) : "cc"); 32-__r; }) )
-+
-+/* Implement fls() in C so that 64-bit args are suitably truncated */
-+static inline int fls(int x)
-+{
-+	return __fls(x);
-+}
-+
- #define ffs(x) ({ unsigned long __t = (x); fls(__t & -__t); })
- #define __ffs(x) (ffs(x) - 1)
- #define ffz(x) __ffs( ~(x) )
-diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
-index f054778..5a544bf 100644
---- a/include/asm-generic/vmlinux.lds.h
-+++ b/include/asm-generic/vmlinux.lds.h
-@@ -204,6 +204,7 @@
-  * during second ld run in second ld pass when generating System.map */
- #define TEXT_TEXT							\
- 		ALIGN_FUNCTION();					\
-+		*(.text.hot)						\
- 		*(.text)						\
- 		*(.ref.text)						\
- 		*(.text.init.refok)					\
-@@ -213,7 +214,8 @@
- 	CPU_KEEP(init.text)						\
- 	CPU_KEEP(exit.text)						\
- 	MEM_KEEP(init.text)						\
--	MEM_KEEP(exit.text)
-+	MEM_KEEP(exit.text)						\
-+		*(.text.unlikely)
- 
- 
- /* sched.text is aling to function alignment to secure we have same
-diff --git a/include/asm-sparc64/io.h b/include/asm-sparc64/io.h
-index 3158960..38e7ba6 100644
---- a/include/asm-sparc64/io.h
-+++ b/include/asm-sparc64/io.h
-@@ -16,7 +16,6 @@
- /* BIO layer definitions. */
- extern unsigned long kern_base, kern_size;
- #define page_to_phys(page)	(page_to_pfn(page) << PAGE_SHIFT)
--#define BIO_VMERGE_BOUNDARY	8192
- 
- static inline u8 _inb(unsigned long addr)
- {
-diff --git a/include/asm-x86/signal.h b/include/asm-x86/signal.h
-index f15186d..6dac493 100644
---- a/include/asm-x86/signal.h
-+++ b/include/asm-x86/signal.h
-@@ -181,12 +181,12 @@ typedef struct sigaltstack {
- #ifdef __KERNEL__
- #include <asm/sigcontext.h>
- 
--#ifdef __386__
-+#ifdef __i386__
- 
- #define __HAVE_ARCH_SIG_BITOPS
- 
- #define sigaddset(set,sig)		    \
--	(__builtin_constantp(sig)	    \
-+	(__builtin_constant_p(sig)	    \
- 	 ? __const_sigaddset((set), (sig))  \
- 	 : __gen_sigaddset((set), (sig)))
- 
-diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h
-index e7e91db..07cb761 100644
---- a/include/linux/cpufreq.h
-+++ b/include/linux/cpufreq.h
-@@ -109,6 +109,7 @@ struct cpufreq_policy {
- #define CPUFREQ_ADJUST		(0)
- #define CPUFREQ_INCOMPATIBLE	(1)
- #define CPUFREQ_NOTIFY		(2)
-+#define CPUFREQ_START		(3)
- 
- #define CPUFREQ_SHARED_TYPE_NONE (0) /* None */
- #define CPUFREQ_SHARED_TYPE_HW	 (1) /* HW does needed coordination */
-diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
-index cde056e..0bfd97f 100644
---- a/include/linux/ipv6.h
-+++ b/include/linux/ipv6.h
-@@ -123,6 +123,7 @@ struct ipv6hdr {
- 	struct	in6_addr	daddr;
- };
- 
-+#ifdef __KERNEL__
- /*
-  * This structure contains configuration options per IPv6 link.
-  */
-@@ -165,6 +166,7 @@ struct ipv6_devconf {
- #endif
- 	void		*sysctl;
- };
-+#endif
- 
- /* index values for the variables in ipv6_devconf */
- enum {
-diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
-index de9d1df..d413e89 100644
---- a/include/linux/kvm_host.h
-+++ b/include/linux/kvm_host.h
-@@ -166,6 +166,7 @@ int kvm_arch_set_memory_region(struct kvm *kvm,
- 				struct kvm_userspace_memory_region *mem,
- 				struct kvm_memory_slot old,
- 				int user_alloc);
-+void kvm_arch_flush_shadow(struct kvm *kvm);
- gfn_t unalias_gfn(struct kvm *kvm, gfn_t gfn);
- struct page *gfn_to_page(struct kvm *kvm, gfn_t gfn);
- unsigned long gfn_to_hva(struct kvm *kvm, gfn_t gfn);
-diff --git a/kernel/cpuset.c b/kernel/cpuset.c
-index 798b3ab..2a028f5 100644
---- a/kernel/cpuset.c
-+++ b/kernel/cpuset.c
-@@ -679,7 +679,9 @@ restart:
- 				if (apn == b->pn) {
- 					cpus_or(*dp, *dp, b->cpus_allowed);
- 					b->pn = -1;
--					update_domain_attr(dattr, b);
-+					if (dattr)
-+						update_domain_attr(dattr
-+								   + nslot, b);
- 				}
- 			}
- 			nslot++;
-diff --git a/kernel/marker.c b/kernel/marker.c
-index b5a9fe1..39e7596 100644
---- a/kernel/marker.c
-+++ b/kernel/marker.c
-@@ -127,6 +127,11 @@ void marker_probe_cb(const struct marker *mdata, void *call_private,
- 		struct marker_probe_closure *multi;
- 		int i;
- 		/*
-+		 * Read mdata->ptype before mdata->multi.
-+		 */
-+		smp_rmb();
-+		multi = mdata->multi;
-+		/*
- 		 * multi points to an array, therefore accessing the array
- 		 * depends on reading multi. However, even in this case,
- 		 * we must insure that the pointer is read _before_ the array
-@@ -134,7 +139,6 @@ void marker_probe_cb(const struct marker *mdata, void *call_private,
- 		 * in the fast path, so put the explicit barrier here.
- 		 */
- 		smp_read_barrier_depends();
--		multi = mdata->multi;
- 		for (i = 0; multi[i].func; i++) {
- 			va_start(args, fmt);
- 			multi[i].func(multi[i].probe_private, call_private, fmt,
-@@ -177,6 +181,11 @@ void marker_probe_cb_noarg(const struct marker *mdata,
- 		struct marker_probe_closure *multi;
- 		int i;
- 		/*
-+		 * Read mdata->ptype before mdata->multi.
-+		 */
-+		smp_rmb();
-+		multi = mdata->multi;
-+		/*
- 		 * multi points to an array, therefore accessing the array
- 		 * depends on reading multi. However, even in this case,
- 		 * we must insure that the pointer is read _before_ the array
-@@ -184,7 +193,6 @@ void marker_probe_cb_noarg(const struct marker *mdata,
- 		 * in the fast path, so put the explicit barrier here.
- 		 */
- 		smp_read_barrier_depends();
--		multi = mdata->multi;
- 		for (i = 0; multi[i].func; i++)
- 			multi[i].func(multi[i].probe_private, call_private, fmt,
- 				&args);
-diff --git a/kernel/rcupreempt.c b/kernel/rcupreempt.c
-index 41d275a..379c25e 100644
---- a/kernel/rcupreempt.c
-+++ b/kernel/rcupreempt.c
-@@ -567,7 +567,7 @@ rcu_try_flip_waitack_needed(int cpu)
- 	 * that this CPU already acknowledged the counter.
- 	 */
- 
--	if ((curr - snap) > 2 || (snap & 0x1) == 0)
-+	if ((curr - snap) > 2 || (curr & 0x1) == 0)
- 		return 0;
- 
- 	/* We need this CPU to explicitly acknowledge the counter flip. */
-diff --git a/kernel/sys_ni.c b/kernel/sys_ni.c
-index 5b9b467..0fea0ee 100644
---- a/kernel/sys_ni.c
-+++ b/kernel/sys_ni.c
-@@ -59,6 +59,7 @@ cond_syscall(sys_epoll_create);
- cond_syscall(sys_epoll_ctl);
- cond_syscall(sys_epoll_wait);
- cond_syscall(sys_epoll_pwait);
-+cond_syscall(compat_sys_epoll_pwait);
- cond_syscall(sys_semget);
- cond_syscall(sys_semop);
- cond_syscall(sys_semtimedop);
-diff --git a/mm/filemap.c b/mm/filemap.c
-index 1e6a7d3..4f32423 100644
---- a/mm/filemap.c
-+++ b/mm/filemap.c
-@@ -1778,7 +1778,7 @@ void iov_iter_advance(struct iov_iter *i, size_t bytes)
- 		 * The !iov->iov_len check ensures we skip over unlikely
- 		 * zero-length segments (without overruning the iovec).
- 		 */
--		while (bytes || unlikely(!iov->iov_len && i->count)) {
-+		while (bytes || unlikely(i->count && !iov->iov_len)) {
- 			int copy;
- 
- 			copy = min(bytes, iov->iov_len - base);
-diff --git a/mm/shmem.c b/mm/shmem.c
-index e2a6ae1..8f8412b 100644
---- a/mm/shmem.c
-+++ b/mm/shmem.c
-@@ -1503,7 +1503,6 @@ shmem_get_inode(struct super_block *sb, int mode, dev_t dev)
- 		inode->i_uid = current->fsuid;
- 		inode->i_gid = current->fsgid;
- 		inode->i_blocks = 0;
--		inode->i_mapping->a_ops = &shmem_aops;
- 		inode->i_mapping->backing_dev_info = &shmem_backing_dev_info;
- 		inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME;
- 		inode->i_generation = get_seconds();
-@@ -1518,6 +1517,7 @@ shmem_get_inode(struct super_block *sb, int mode, dev_t dev)
- 			init_special_inode(inode, mode, dev);
- 			break;
- 		case S_IFREG:
-+			inode->i_mapping->a_ops = &shmem_aops;
- 			inode->i_op = &shmem_inode_operations;
- 			inode->i_fop = &shmem_file_operations;
- 			mpol_shared_policy_init(&info->policy,
-@@ -1907,6 +1907,7 @@ static int shmem_symlink(struct inode *dir, struct dentry *dentry, const char *s
- 			return error;
- 		}
- 		unlock_page(page);
-+		inode->i_mapping->a_ops = &shmem_aops;
- 		inode->i_op = &shmem_symlink_inode_operations;
- 		kaddr = kmap_atomic(page, KM_USER0);
- 		memcpy(kaddr, symname, len);
-diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
-index cad73b7..c443a7f 100644
---- a/net/ipv4/tcp_input.c
-+++ b/net/ipv4/tcp_input.c
-@@ -3273,6 +3273,7 @@ static int tcp_ack(struct sock *sk, struct sk_buff *skb, int flag)
- 	 * log. Something worked...
- 	 */
- 	sk->sk_err_soft = 0;
-+	icsk->icsk_probes_out = 0;
- 	tp->rcv_tstamp = tcp_time_stamp;
- 	prior_packets = tp->packets_out;
- 	if (!prior_packets)
-@@ -3305,8 +3306,6 @@ static int tcp_ack(struct sock *sk, struct sk_buff *skb, int flag)
- 	return 1;
- 
- no_queue:
--	icsk->icsk_probes_out = 0;
--
- 	/* If this ack opens up a zero window, clear backoff.  It was
- 	 * being used to time the probes, and is probably far higher than
- 	 * it needs to be for normal retransmission.
-diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
-index 56fcda3..9f3f7ba 100644
---- a/net/ipv4/udp.c
-+++ b/net/ipv4/udp.c
-@@ -1319,6 +1319,8 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname,
- 			return -ENOPROTOOPT;
- 		if (val != 0 && val < 8) /* Illegal coverage: use default (8) */
- 			val = 8;
-+		else if (val > USHORT_MAX)
-+			val = USHORT_MAX;
- 		up->pcslen = val;
- 		up->pcflag |= UDPLITE_SEND_CC;
- 		break;
-@@ -1331,6 +1333,8 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname,
- 			return -ENOPROTOOPT;
- 		if (val != 0 && val < 8) /* Avoid silly minimal values.       */
- 			val = 8;
-+		else if (val > USHORT_MAX)
-+			val = USHORT_MAX;
- 		up->pcrlen = val;
- 		up->pcflag |= UDPLITE_RECV_CC;
- 		break;
-diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
-index 1ee4fa1..918fde4 100644
---- a/net/ipv6/ip6_fib.c
-+++ b/net/ipv6/ip6_fib.c
-@@ -663,7 +663,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
- 
- static __inline__ void fib6_start_gc(struct net *net, struct rt6_info *rt)
- {
--	if (net->ipv6.ip6_fib_timer->expires == 0 &&
-+	if (!timer_pending(net->ipv6.ip6_fib_timer) &&
- 	    (rt->rt6i_flags & (RTF_EXPIRES|RTF_CACHE)))
- 		mod_timer(net->ipv6.ip6_fib_timer, jiffies +
- 			  net->ipv6.sysctl.ip6_rt_gc_interval);
-@@ -671,7 +671,7 @@ static __inline__ void fib6_start_gc(struct net *net, struct rt6_info *rt)
- 
- void fib6_force_start_gc(struct net *net)
- {
--	if (net->ipv6.ip6_fib_timer->expires == 0)
-+	if (!timer_pending(net->ipv6.ip6_fib_timer))
- 		mod_timer(net->ipv6.ip6_fib_timer, jiffies +
- 			  net->ipv6.sysctl.ip6_rt_gc_interval);
- }
-diff --git a/scripts/Makefile.modpost b/scripts/Makefile.modpost
-index 17092d6..9ee9783 100644
---- a/scripts/Makefile.modpost
-+++ b/scripts/Makefile.modpost
-@@ -101,6 +101,7 @@ quiet_cmd_kernel-mod = MODPOST $@
-       cmd_kernel-mod = $(modpost) $@
- 
- vmlinux.o: FORCE
-+	@rm -fr $(kernelmarkersfile)
- 	$(call cmd,kernel-mod)
- 
- # Declare generated files as targets for modpost
-diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
-index a07f91a..8f038e6 100644
---- a/scripts/mod/modpost.c
-+++ b/scripts/mod/modpost.c
-@@ -1992,7 +1992,8 @@ static void read_markers(const char *fname)
- 			mod->skip = 1;
- 		}
- 
--		add_marker(mod, marker, fmt);
-+		if (!mod->skip)
-+			add_marker(mod, marker, fmt);
- 	}
- 	return;
- fail:
-diff --git a/sound/pci/trident/trident_main.c b/sound/pci/trident/trident_main.c
-index bbcee2c..a69b420 100644
---- a/sound/pci/trident/trident_main.c
-+++ b/sound/pci/trident/trident_main.c
-@@ -1590,7 +1590,10 @@ static int snd_trident_trigger(struct snd_pcm_substream *substream,
- 	if (spdif_flag) {
- 		if (trident->device != TRIDENT_DEVICE_ID_SI7018) {
- 			outl(trident->spdif_pcm_bits, TRID_REG(trident, NX_SPCSTATUS));
--			outb(trident->spdif_pcm_ctrl, TRID_REG(trident, NX_SPCTRL_SPCSO + 3));
-+			val = trident->spdif_pcm_ctrl;
-+			if (!go)
-+				val &= ~(0x28);
-+			outb(val, TRID_REG(trident, NX_SPCTRL_SPCSO + 3));
- 		} else {
- 			outl(trident->spdif_pcm_bits, TRID_REG(trident, SI_SPDIF_CS));
- 			val = inl(TRID_REG(trident, SI_SERIAL_INTF_CTRL)) | SPDIF_EN;
-diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
-index 2d29e26..0262847 100644
---- a/virt/kvm/kvm_main.c
-+++ b/virt/kvm/kvm_main.c
-@@ -377,6 +377,9 @@ int __kvm_set_memory_region(struct kvm *kvm,
- 	if (mem->slot >= kvm->nmemslots)
- 		kvm->nmemslots = mem->slot + 1;
- 
-+	if (!npages)
-+		kvm_arch_flush_shadow(kvm);
-+
- 	*memslot = new;
- 
- 	r = kvm_arch_set_memory_region(kvm, mem, old, user_alloc);

Deleted: genpatches-2.6/trunk/2.6.27/1001_linux-2.6.26.2.patch
===================================================================
--- genpatches-2.6/trunk/2.6.27/1001_linux-2.6.26.2.patch	2008-10-10 23:58:26 UTC (rev 1350)
+++ genpatches-2.6/trunk/2.6.27/1001_linux-2.6.26.2.patch	2008-10-11 00:00:47 UTC (rev 1351)
@@ -1,2510 +0,0 @@
-diff --git a/Documentation/ftrace.txt b/Documentation/ftrace.txt
-deleted file mode 100644
-index 13e4bf0..0000000
---- a/Documentation/ftrace.txt
-+++ /dev/null
-@@ -1,1353 +0,0 @@
--		ftrace - Function Tracer
--		========================
--
--Copyright 2008 Red Hat Inc.
--Author: Steven Rostedt <srostedt@××××××.com>
--
--
--Introduction
--------------
--
--Ftrace is an internal tracer designed to help out developers and
--designers of systems to find what is going on inside the kernel.
--It can be used for debugging or analyzing latencies and performance
--issues that take place outside of user-space.
--
--Although ftrace is the function tracer, it also includes an
--infrastructure that allows for other types of tracing. Some of the
--tracers that are currently in ftrace is a tracer to trace
--context switches, the time it takes for a high priority task to
--run after it was woken up, the time interrupts are disabled, and
--more.
--
--
--The File System
-----------------
--
--Ftrace uses the debugfs file system to hold the control files as well
--as the files to display output.
--
--To mount the debugfs system:
--
--  # mkdir /debug
--  # mount -t debugfs nodev /debug
--
--
--That's it! (assuming that you have ftrace configured into your kernel)
--
--After mounting the debugfs, you can see a directory called
--"tracing".  This directory contains the control and output files
--of ftrace. Here is a list of some of the key files:
--
--
-- Note: all time values are in microseconds.
--
--  current_tracer : This is used to set or display the current tracer
--		that is configured.
--
--  available_tracers : This holds the different types of tracers that
--		has been compiled into the kernel. The tracers
--		listed here can be configured by echoing in their
--		name into current_tracer.
--
--  tracing_enabled : This sets or displays whether the current_tracer
--		is activated and tracing or not. Echo 0 into this
--		file to disable the tracer or 1 (or non-zero) to
--		enable it.
--
--  trace : This file holds the output of the trace in a human readable
--		format.
--
--  latency_trace : This file shows the same trace but the information
--		is organized more to display possible latencies
--		in the system.
--
--  trace_pipe : The output is the same as the "trace" file but this
--		file is meant to be streamed with live tracing.
--		Reads from this file will block until new data
--		is retrieved. Unlike the "trace" and "latency_trace"
--		files, this file is a consumer. This means reading
--		from this file causes sequential reads to display
--		more current data. Once data is read from this
--		file, it is consumed, and will not be read
--		again with a sequential read. The "trace" and
--		"latency_trace" files are static, and if the
--		tracer isn't adding more data, they will display
--		the same information every time they are read.
--
--  iter_ctrl : This file lets the user control the amount of data
--		that is displayed in one of the above output
--		files.
--
--  trace_max_latency : Some of the tracers record the max latency.
--		For example, the time interrupts are disabled.
--		This time is saved in this file. The max trace
--		will also be stored, and displayed by either
--		"trace" or "latency_trace".  A new max trace will
--		only be recorded if the latency is greater than
--		the value in this file. (in microseconds)
--
--  trace_entries : This sets or displays the number of trace
--		entries each CPU buffer can hold. The tracer buffers
--		are the same size for each CPU, so care must be
--		taken when modifying the trace_entries. The number
--		of actually entries will be the number given
--		times the number of possible CPUS. The buffers
--		are saved as individual pages, and the actual entries
--		will always be rounded up to entries per page.
--
--		This can only be updated when the current_tracer
--		is set to "none".
--
--		NOTE: It is planned on changing the allocated buffers
--		      from being the number of possible CPUS to
--		      the number of online CPUS.
--
--  tracing_cpumask : This is a mask that lets the user only trace
--		on specified CPUS. The format is a hex string
--		representing the CPUS.
--
--  set_ftrace_filter : When dynamic ftrace is configured in, the
--		code is dynamically modified to disable calling
--		of the function profiler (mcount). This lets
--		tracing be configured in with practically no overhead
--		in performance.  This also has a side effect of
--		enabling or disabling specific functions to be
--		traced.  Echoing in names of functions into this
--		file will limit the trace to only those files.
--
--  set_ftrace_notrace: This has the opposite effect that
--		set_ftrace_filter has. Any function that is added
--		here will not be traced. If a function exists
--		in both set_ftrace_filter and set_ftrace_notrace
--		the function will _not_ bet traced.
--
--  available_filter_functions : When a function is encountered the first
--		time by the dynamic tracer, it is recorded and
--		later the call is converted into a nop. This file
--		lists the functions that have been recorded
--		by the dynamic tracer and these functions can
--		be used to set the ftrace filter by the above
--		"set_ftrace_filter" file.
--
--
--The Tracers
-------------
--
--Here are the list of current tracers that can be configured.
--
--  ftrace - function tracer that uses mcount to trace all functions.
--		It is possible to filter out which functions that are
--		traced when dynamic ftrace is configured in.
--
--  sched_switch - traces the context switches between tasks.
--
--  irqsoff - traces the areas that disable interrupts and saves off
--  		the trace with the longest max latency.
--		See tracing_max_latency.  When a new max is recorded,
--		it replaces the old trace. It is best to view this
--		trace with the latency_trace file.
--
--  preemptoff - Similar to irqsoff but traces and records the time
--		preemption is disabled.
--
--  preemptirqsoff - Similar to irqsoff and preemptoff, but traces and
--		 records the largest time irqs and/or preemption is
--		 disabled.
--
--  wakeup - Traces and records the max latency that it takes for
--		the highest priority task to get scheduled after
--		it has been woken up.
--
--  none - This is not a tracer. To remove all tracers from tracing
--		simply echo "none" into current_tracer.
--
--
--Examples of using the tracer
------------------------------
--
--Here are typical examples of using the tracers with only controlling
--them with the debugfs interface (without using any user-land utilities).
--
--Output format:
----------------
--
--Here's an example of the output format of the file "trace"
--
--                             --------
--# tracer: ftrace
--#
--#           TASK-PID   CPU#    TIMESTAMP  FUNCTION
--#              | |      |          |         |
--            bash-4251  [01] 10152.583854: path_put <-path_walk
--            bash-4251  [01] 10152.583855: dput <-path_put
--            bash-4251  [01] 10152.583855: _atomic_dec_and_lock <-dput
--                             --------
--
--A header is printed with the trace that is represented. In this case
--the tracer is "ftrace". Then a header showing the format. Task name
--"bash", the task PID "4251", the CPU that it was running on
--"01", the timestamp in <secs>.<usecs> format, the function name that was
--traced "path_put" and the parent function that called this function
--"path_walk".
--
--The sched_switch tracer also includes tracing of task wake ups and
--context switches.
--
--     ksoftirqd/1-7     [01]  1453.070013:      7:115:R   +  2916:115:S
--     ksoftirqd/1-7     [01]  1453.070013:      7:115:R   +    10:115:S
--     ksoftirqd/1-7     [01]  1453.070013:      7:115:R ==>    10:115:R
--        events/1-10    [01]  1453.070013:     10:115:S ==>  2916:115:R
--     kondemand/1-2916  [01]  1453.070013:   2916:115:S ==>     7:115:R
--     ksoftirqd/1-7     [01]  1453.070013:      7:115:S ==>     0:140:R
--
--Wake ups are represented by a "+" and the context switches show
--"==>".  The format is:
--
-- Context switches:
--
--       Previous task              Next Task
--
--  <pid>:<prio>:<state>  ==>  <pid>:<prio>:<state>
--
-- Wake ups:
--
--       Current task               Task waking up
--
--  <pid>:<prio>:<state>    +  <pid>:<prio>:<state>
--
--The prio is the internal kernel priority, which is inverse to the
--priority that is usually displayed by user-space tools. Zero represents
--the highest priority (99). Prio 100 starts the "nice" priorities with
--100 being equal to nice -20 and 139 being nice 19. The prio "140" is
--reserved for the idle task which is the lowest priority thread (pid 0).
--
--
--Latency trace format
----------------------
--
--For traces that display latency times, the latency_trace file gives
--a bit more information to see why a latency happened. Here's a typical
--trace.
--
--# tracer: irqsoff
--#
--irqsoff latency trace v1.1.5 on 2.6.26-rc8
----------------------------------------------------------------------
-- latency: 97 us, #3/3, CPU#0 | (M:preempt VP:0, KP:0, SP:0 HP:0 #P:2)
--    -----------------
--    | task: swapper-0 (uid:0 nice:0 policy:0 rt_prio:0)
--    -----------------
-- => started at: apic_timer_interrupt
-- => ended at:   do_softirq
--
--#                _------=> CPU#
--#               / _-----=> irqs-off
--#              | / _----=> need-resched
--#              || / _---=> hardirq/softirq
--#              ||| / _--=> preempt-depth
--#              |||| /
--#              |||||     delay
--#  cmd     pid ||||| time  |   caller
--#     \   /    |||||   \   |   /
--  <idle>-0     0d..1    0us+: trace_hardirqs_off_thunk (apic_timer_interrupt)
--  <idle>-0     0d.s.   97us : __do_softirq (do_softirq)
--  <idle>-0     0d.s1   98us : trace_hardirqs_on (do_softirq)
--
--
--vim:ft=help
--
--
--This shows that the current tracer is "irqsoff" tracing the time
--interrupts are disabled. It gives the trace version and the kernel
--this was executed on (2.6.26-rc8). Then it displays the max latency
--in microsecs (97 us). The number of trace entries displayed
--by the total number recorded (both are three: #3/3). The type of
--preemption that was used (PREEMPT). VP, KP, SP, and HP are always zero
--and reserved for later use. #P is the number of online CPUS (#P:2).
--
--The task is the process that was running when the latency happened.
--(swapper pid: 0).
--
--The start and stop that caused the latencies:
--
--  apic_timer_interrupt is where the interrupts were disabled.
--  do_softirq is where they were enabled again.
--
--The next lines after the header are the trace itself. The header
--explains which is which.
--
--  cmd: The name of the process in the trace.
--
--  pid: The PID of that process.
--
--  CPU#: The CPU that the process was running on.
--
--  irqs-off: 'd' interrupts are disabled. '.' otherwise.
--
--  need-resched: 'N' task need_resched is set, '.' otherwise.
--
--  hardirq/softirq:
--	'H' - hard irq happened inside a softirq.
--	'h' - hard irq is running
--	's' - soft irq is running
--	'.' - normal context.
--
--  preempt-depth: The level of preempt_disabled
--
--The above is mostly meaningful for kernel developers.
--
--  time: This differs from the trace output where as the trace output
--	contained a absolute timestamp. This timestamp is relative
--	to the start of the first entry in the the trace.
--
--  delay: This is just to help catch your eye a bit better. And
--	needs to be fixed to be only relative to the same CPU.
--	The marks is determined by the difference between this
--	current trace and the next trace.
--	 '!' - greater than preempt_mark_thresh (default 100)
--	 '+' - greater than 1 microsecond
--	 ' ' - less than or equal to 1 microsecond.
--
--  The rest is the same as the 'trace' file.
--
--
--iter_ctrl
-----------
--
--The iter_ctrl file is used to control what gets printed in the trace
--output. To see what is available, simply cat the file:
--
--  cat /debug/tracing/iter_ctrl
--  print-parent nosym-offset nosym-addr noverbose noraw nohex nobin \
-- noblock nostacktrace nosched-tree
--
--To disable one of the options, echo in the option appended with "no".
--
--  echo noprint-parent > /debug/tracing/iter_ctrl
--
--To enable an option, leave off the "no".
--
--  echo sym-offest > /debug/tracing/iter_ctrl
--
--Here are the available options:
--
--  print-parent - On function traces, display the calling function
--		as well as the function being traced.
--
--  print-parent:
--   bash-4000  [01]  1477.606694: simple_strtoul <-strict_strtoul
--
--  noprint-parent:
--   bash-4000  [01]  1477.606694: simple_strtoul
--
--
--  sym-offset - Display not only the function name, but also the offset
--		in the function. For example, instead of seeing just
--		"ktime_get" you will see "ktime_get+0xb/0x20"
--
--  sym-offset:
--   bash-4000  [01]  1477.606694: simple_strtoul+0x6/0xa0
--
--  sym-addr - this will also display the function address as well as
--		the function name.
--
--  sym-addr:
--   bash-4000  [01]  1477.606694: simple_strtoul <c0339346>
--
--  verbose - This deals with the latency_trace file.
--
--    bash  4000 1 0 00000000 00010a95 [58127d26] 1720.415ms \
--    (+0.000ms): simple_strtoul (strict_strtoul)
--
--  raw - This will display raw numbers. This option is best for use with
--	user applications that can translate the raw numbers better than
--	having it done in the kernel.
--
--  hex - similar to raw, but the numbers will be in a hexadecimal format.
--
--  bin - This will print out the formats in raw binary.
--
--  block - TBD (needs update)
--
--  stacktrace - This is one of the options that changes the trace itself.
--		When a trace is recorded, so is the stack of functions.
--		This allows for back traces of trace sites.
--
--  sched-tree - TBD (any users??)
--
--
--sched_switch
--------------
--
--This tracer simply records schedule switches. Here's an example
--on how to implement it.
--
-- # echo sched_switch > /debug/tracing/current_tracer
-- # echo 1 > /debug/tracing/tracing_enabled
-- # sleep 1
-- # echo 0 > /debug/tracing/tracing_enabled
-- # cat /debug/tracing/trace
--
--# tracer: sched_switch
--#
--#           TASK-PID   CPU#    TIMESTAMP  FUNCTION
--#              | |      |          |         |
--            bash-3997  [01]   240.132281:   3997:120:R   +  4055:120:R
--            bash-3997  [01]   240.132284:   3997:120:R ==>  4055:120:R
--           sleep-4055  [01]   240.132371:   4055:120:S ==>  3997:120:R
--            bash-3997  [01]   240.132454:   3997:120:R   +  4055:120:S
--            bash-3997  [01]   240.132457:   3997:120:R ==>  4055:120:R
--           sleep-4055  [01]   240.132460:   4055:120:D ==>  3997:120:R
--            bash-3997  [01]   240.132463:   3997:120:R   +  4055:120:D
--            bash-3997  [01]   240.132465:   3997:120:R ==>  4055:120:R
--          <idle>-0     [00]   240.132589:      0:140:R   +     4:115:S
--          <idle>-0     [00]   240.132591:      0:140:R ==>     4:115:R
--     ksoftirqd/0-4     [00]   240.132595:      4:115:S ==>     0:140:R
--          <idle>-0     [00]   240.132598:      0:140:R   +     4:115:S
--          <idle>-0     [00]   240.132599:      0:140:R ==>     4:115:R
--     ksoftirqd/0-4     [00]   240.132603:      4:115:S ==>     0:140:R
--           sleep-4055  [01]   240.133058:   4055:120:S ==>  3997:120:R
-- [...]
--
--
--As we have discussed previously about this format, the header shows
--the name of the trace and points to the options. The "FUNCTION"
--is a misnomer since here it represents the wake ups and context
--switches.
--
--The sched_switch only lists the wake ups (represented with '+')
--and context switches ('==>') with the previous task or current
--first followed by the next task or task waking up. The format for both
--of these is PID:KERNEL-PRIO:TASK-STATE. Remember that the KERNEL-PRIO
--is the inverse of the actual priority with zero (0) being the highest
--priority and the nice values starting at 100 (nice -20). Below is
--a quick chart to map the kernel priority to user land priorities.
--
--  Kernel priority: 0 to 99    ==> user RT priority 99 to 0
--  Kernel priority: 100 to 139 ==> user nice -20 to 19
--  Kernel priority: 140        ==> idle task priority
--
--The task states are:
--
-- R - running : wants to run, may not actually be running
-- S - sleep   : process is waiting to be woken up (handles signals)
-- D - deep sleep : process must be woken up (ignores signals)
-- T - stopped : process suspended
-- t - traced  : process is being traced (with something like gdb)
-- Z - zombie  : process waiting to be cleaned up
-- X - unknown
--
--
--ftrace_enabled
----------------
--
--The following tracers give different output depending on whether
--or not the sysctl ftrace_enabled is set. To set ftrace_enabled,
--one can either use the sysctl function or set it via the proc
--file system interface.
--
--  sysctl kernel.ftrace_enabled=1
--
-- or
--
--  echo 1 > /proc/sys/kernel/ftrace_enabled
--
--To disable ftrace_enabled simply replace the '1' with '0' in
--the above commands.
--
--When ftrace_enabled is set the tracers will also record the functions
--that are within the trace. The descriptions of the tracers
--will also show an example with ftrace enabled.
--
--
--irqsoff
---------
--
--When interrupts are disabled, the CPU can not react to any other
--external event (besides NMIs and SMIs). This prevents the timer
--interrupt from triggering or the mouse interrupt from letting the
--kernel know of a new mouse event. The result is a latency with the
--reaction time.
--
--The irqsoff tracer tracks the time interrupts are disabled and when
--they are re-enabled. When a new maximum latency is hit, it saves off
--the trace so that it may be retrieved at a later time. Every time a
--new maximum in reached, the old saved trace is discarded and the new
--trace is saved.
--
--To reset the maximum, echo 0 into tracing_max_latency. Here's an
--example:
--
-- # echo irqsoff > /debug/tracing/current_tracer
-- # echo 0 > /debug/tracing/tracing_max_latency
-- # echo 1 > /debug/tracing/tracing_enabled
-- # ls -ltr
-- [...]
-- # echo 0 > /debug/tracing/tracing_enabled
-- # cat /debug/tracing/latency_trace
--# tracer: irqsoff
--#
--irqsoff latency trace v1.1.5 on 2.6.26-rc8
----------------------------------------------------------------------
-- latency: 6 us, #3/3, CPU#1 | (M:preempt VP:0, KP:0, SP:0 HP:0 #P:2)
--    -----------------
--    | task: bash-4269 (uid:0 nice:0 policy:0 rt_prio:0)
--    -----------------
-- => started at: copy_page_range
-- => ended at:   copy_page_range
--
--#                _------=> CPU#
--#               / _-----=> irqs-off
--#              | / _----=> need-resched
--#              || / _---=> hardirq/softirq
--#              ||| / _--=> preempt-depth
--#              |||| /
--#              |||||     delay
--#  cmd     pid ||||| time  |   caller
--#     \   /    |||||   \   |   /
--    bash-4269  1...1    0us+: _spin_lock (copy_page_range)
--    bash-4269  1...1    7us : _spin_unlock (copy_page_range)
--    bash-4269  1...2    7us : trace_preempt_on (copy_page_range)
--
--
--vim:ft=help
--
--Here we see that that we had a latency of 6 microsecs (which is
--very good). The spin_lock in copy_page_range disabled interrupts.
--The difference between the 6 and the displayed timestamp 7us is
--because the clock must have incremented between the time of recording
--the max latency and recording the function that had that latency.
--
--Note the above had ftrace_enabled not set. If we set the ftrace_enabled
--we get a much larger output:
--
--# tracer: irqsoff
--#
--irqsoff latency trace v1.1.5 on 2.6.26-rc8
----------------------------------------------------------------------
-- latency: 50 us, #101/101, CPU#0 | (M:preempt VP:0, KP:0, SP:0 HP:0 #P:2)
--    -----------------
--    | task: ls-4339 (uid:0 nice:0 policy:0 rt_prio:0)
--    -----------------
-- => started at: __alloc_pages_internal
-- => ended at:   __alloc_pages_internal
--
--#                _------=> CPU#
--#               / _-----=> irqs-off
--#              | / _----=> need-resched
--#              || / _---=> hardirq/softirq
--#              ||| / _--=> preempt-depth
--#              |||| /
--#              |||||     delay
--#  cmd     pid ||||| time  |   caller
--#     \   /    |||||   \   |   /
--      ls-4339  0...1    0us+: get_page_from_freelist (__alloc_pages_internal)
--      ls-4339  0d..1    3us : rmqueue_bulk (get_page_from_freelist)
--      ls-4339  0d..1    3us : _spin_lock (rmqueue_bulk)
--      ls-4339  0d..1    4us : add_preempt_count (_spin_lock)
--      ls-4339  0d..2    4us : __rmqueue (rmqueue_bulk)
--      ls-4339  0d..2    5us : __rmqueue_smallest (__rmqueue)
--      ls-4339  0d..2    5us : __mod_zone_page_state (__rmqueue_smallest)
--      ls-4339  0d..2    6us : __rmqueue (rmqueue_bulk)
--      ls-4339  0d..2    6us : __rmqueue_smallest (__rmqueue)
--      ls-4339  0d..2    7us : __mod_zone_page_state (__rmqueue_smallest)
--      ls-4339  0d..2    7us : __rmqueue (rmqueue_bulk)
--      ls-4339  0d..2    8us : __rmqueue_smallest (__rmqueue)
--[...]
--      ls-4339  0d..2   46us : __rmqueue_smallest (__rmqueue)
--      ls-4339  0d..2   47us : __mod_zone_page_state (__rmqueue_smallest)
--      ls-4339  0d..2   47us : __rmqueue (rmqueue_bulk)
--      ls-4339  0d..2   48us : __rmqueue_smallest (__rmqueue)
--      ls-4339  0d..2   48us : __mod_zone_page_state (__rmqueue_smallest)
--      ls-4339  0d..2   49us : _spin_unlock (rmqueue_bulk)
--      ls-4339  0d..2   49us : sub_preempt_count (_spin_unlock)
--      ls-4339  0d..1   50us : get_page_from_freelist (__alloc_pages_internal)
--      ls-4339  0d..2   51us : trace_hardirqs_on (__alloc_pages_internal)
--
--
--vim:ft=help
--
--
--Here we traced a 50 microsecond latency. But we also see all the
--functions that were called during that time. Note that enabling
--function tracing we endure an added overhead. This overhead may
--extend the latency times. But never the less, this trace has provided
--some very helpful debugging.
--
--
--preemptoff
------------
--
--When preemption is disabled we may be able to receive interrupts but
--the task can not be preempted and a higher priority task must wait
--for preemption to be enabled again before it can preempt a lower
--priority task.
--
--The preemptoff tracer traces the places that disables preemption.
--Like the irqsoff, it records the maximum latency that preemption
--was disabled. The control of preemptoff is much like the irqsoff.
--
-- # echo preemptoff > /debug/tracing/current_tracer
-- # echo 0 > /debug/tracing/tracing_max_latency
-- # echo 1 > /debug/tracing/tracing_enabled
-- # ls -ltr
-- [...]
-- # echo 0 > /debug/tracing/tracing_enabled
-- # cat /debug/tracing/latency_trace
--# tracer: preemptoff
--#
--preemptoff latency trace v1.1.5 on 2.6.26-rc8
----------------------------------------------------------------------
-- latency: 29 us, #3/3, CPU#0 | (M:preempt VP:0, KP:0, SP:0 HP:0 #P:2)
--    -----------------
--    | task: sshd-4261 (uid:0 nice:0 policy:0 rt_prio:0)
--    -----------------
-- => started at: do_IRQ
-- => ended at:   __do_softirq
--
--#                _------=> CPU#
--#               / _-----=> irqs-off
--#              | / _----=> need-resched
--#              || / _---=> hardirq/softirq
--#              ||| / _--=> preempt-depth
--#              |||| /
--#              |||||     delay
--#  cmd     pid ||||| time  |   caller
--#     \   /    |||||   \   |   /
--    sshd-4261  0d.h.    0us+: irq_enter (do_IRQ)
--    sshd-4261  0d.s.   29us : _local_bh_enable (__do_softirq)
--    sshd-4261  0d.s1   30us : trace_preempt_on (__do_softirq)
--
--
--vim:ft=help
--
--This has some more changes. Preemption was disabled when an interrupt
--came in (notice the 'h'), and was enabled while doing a softirq.
--(notice the 's'). But we also see that interrupts have been disabled
--when entering the preempt off section and leaving it (the 'd').
--We do not know if interrupts were enabled in the mean time.
--
--# tracer: preemptoff
--#
--preemptoff latency trace v1.1.5 on 2.6.26-rc8
----------------------------------------------------------------------
-- latency: 63 us, #87/87, CPU#0 | (M:preempt VP:0, KP:0, SP:0 HP:0 #P:2)
--    -----------------
--    | task: sshd-4261 (uid:0 nice:0 policy:0 rt_prio:0)
--    -----------------
-- => started at: remove_wait_queue
-- => ended at:   __do_softirq
--
--#                _------=> CPU#
--#               / _-----=> irqs-off
--#              | / _----=> need-resched
--#              || / _---=> hardirq/softirq
--#              ||| / _--=> preempt-depth
--#              |||| /
--#              |||||     delay
--#  cmd     pid ||||| time  |   caller
--#     \   /    |||||   \   |   /
--    sshd-4261  0d..1    0us : _spin_lock_irqsave (remove_wait_queue)
--    sshd-4261  0d..1    1us : _spin_unlock_irqrestore (remove_wait_queue)
--    sshd-4261  0d..1    2us : do_IRQ (common_interrupt)
--    sshd-4261  0d..1    2us : irq_enter (do_IRQ)
--    sshd-4261  0d..1    2us : idle_cpu (irq_enter)
--    sshd-4261  0d..1    3us : add_preempt_count (irq_enter)
--    sshd-4261  0d.h1    3us : idle_cpu (irq_enter)
--    sshd-4261  0d.h.    4us : handle_fasteoi_irq (do_IRQ)
--[...]
--    sshd-4261  0d.h.   12us : add_preempt_count (_spin_lock)
--    sshd-4261  0d.h1   12us : ack_ioapic_quirk_irq (handle_fasteoi_irq)
--    sshd-4261  0d.h1   13us : move_native_irq (ack_ioapic_quirk_irq)
--    sshd-4261  0d.h1   13us : _spin_unlock (handle_fasteoi_irq)
--    sshd-4261  0d.h1   14us : sub_preempt_count (_spin_unlock)
--    sshd-4261  0d.h1   14us : irq_exit (do_IRQ)
--    sshd-4261  0d.h1   15us : sub_preempt_count (irq_exit)
--    sshd-4261  0d..2   15us : do_softirq (irq_exit)
--    sshd-4261  0d...   15us : __do_softirq (do_softirq)
--    sshd-4261  0d...   16us : __local_bh_disable (__do_softirq)
--    sshd-4261  0d...   16us+: add_preempt_count (__local_bh_disable)
--    sshd-4261  0d.s4   20us : add_preempt_count (__local_bh_disable)
--    sshd-4261  0d.s4   21us : sub_preempt_count (local_bh_enable)
--    sshd-4261  0d.s5   21us : sub_preempt_count (local_bh_enable)
--[...]
--    sshd-4261  0d.s6   41us : add_preempt_count (__local_bh_disable)
--    sshd-4261  0d.s6   42us : sub_preempt_count (local_bh_enable)
--    sshd-4261  0d.s7   42us : sub_preempt_count (local_bh_enable)
--    sshd-4261  0d.s5   43us : add_preempt_count (__local_bh_disable)
--    sshd-4261  0d.s5   43us : sub_preempt_count (local_bh_enable_ip)
--    sshd-4261  0d.s6   44us : sub_preempt_count (local_bh_enable_ip)
--    sshd-4261  0d.s5   44us : add_preempt_count (__local_bh_disable)
--    sshd-4261  0d.s5   45us : sub_preempt_count (local_bh_enable)
--[...]
--    sshd-4261  0d.s.   63us : _local_bh_enable (__do_softirq)
--    sshd-4261  0d.s1   64us : trace_preempt_on (__do_softirq)
--
--
--The above is an example of the preemptoff trace with ftrace_enabled
--set. Here we see that interrupts were disabled the entire time.
--The irq_enter code lets us know that we entered an interrupt 'h'.
--Before that, the functions being traced still show that it is not
--in an interrupt, but we can see by the functions themselves that
--this is not the case.
--
--Notice that the __do_softirq when called doesn't have a preempt_count.
--It may seem that we missed a preempt enabled. What really happened
--is that the preempt count is held on the threads stack and we
--switched to the softirq stack (4K stacks in effect). The code
--does not copy the preempt count, but because interrupts are disabled
--we don't need to worry about it. Having a tracer like this is good
--to let people know what really happens inside the kernel.
--
--
--preemptirqsoff
----------------
--
--Knowing the locations that have interrupts disabled or preemption
--disabled for the longest times is helpful. But sometimes we would
--like to know when either preemption and/or interrupts are disabled.
--
--The following code:
--
--    local_irq_disable();
--    call_function_with_irqs_off();
--    preempt_disable();
--    call_function_with_irqs_and_preemption_off();
--    local_irq_enable();
--    call_function_with_preemption_off();
--    preempt_enable();
--
--The irqsoff tracer will record the total length of
--call_function_with_irqs_off() and
--call_function_with_irqs_and_preemption_off().
--
--The preemptoff tracer will record the total length of
--call_function_with_irqs_and_preemption_off() and
--call_function_with_preemption_off().
--
--But neither will trace the time that interrupts and/or preemption
--is disabled. This total time is the time that we can not schedule.
--To record this time, use the preemptirqsoff tracer.
--
--Again, using this trace is much like the irqsoff and preemptoff tracers.
--
-- # echo preemptoff > /debug/tracing/current_tracer
-- # echo 0 > /debug/tracing/tracing_max_latency
-- # echo 1 > /debug/tracing/tracing_enabled
-- # ls -ltr
-- [...]
-- # echo 0 > /debug/tracing/tracing_enabled
-- # cat /debug/tracing/latency_trace
--# tracer: preemptirqsoff
--#
--preemptirqsoff latency trace v1.1.5 on 2.6.26-rc8
----------------------------------------------------------------------
-- latency: 293 us, #3/3, CPU#0 | (M:preempt VP:0, KP:0, SP:0 HP:0 #P:2)
--    -----------------
--    | task: ls-4860 (uid:0 nice:0 policy:0 rt_prio:0)
--    -----------------
-- => started at: apic_timer_interrupt
-- => ended at:   __do_softirq
--
--#                _------=> CPU#
--#               / _-----=> irqs-off
--#              | / _----=> need-resched
--#              || / _---=> hardirq/softirq
--#              ||| / _--=> preempt-depth
--#              |||| /
--#              |||||     delay
--#  cmd     pid ||||| time  |   caller
--#     \   /    |||||   \   |   /
--      ls-4860  0d...    0us!: trace_hardirqs_off_thunk (apic_timer_interrupt)
--      ls-4860  0d.s.  294us : _local_bh_enable (__do_softirq)
--      ls-4860  0d.s1  294us : trace_preempt_on (__do_softirq)
--
--
--vim:ft=help
--
--
--The trace_hardirqs_off_thunk is called from assembly on x86 when
--interrupts are disabled in the assembly code. Without the function
--tracing, we don't know if interrupts were enabled within the preemption
--points. We do see that it started with preemption enabled.
--
--Here is a trace with ftrace_enabled set:
--
--
--# tracer: preemptirqsoff
--#
--preemptirqsoff latency trace v1.1.5 on 2.6.26-rc8
----------------------------------------------------------------------
-- latency: 105 us, #183/183, CPU#0 | (M:preempt VP:0, KP:0, SP:0 HP:0 #P:2)
--    -----------------
--    | task: sshd-4261 (uid:0 nice:0 policy:0 rt_prio:0)
--    -----------------
-- => started at: write_chan
-- => ended at:   __do_softirq
--
--#                _------=> CPU#
--#               / _-----=> irqs-off
--#              | / _----=> need-resched
--#              || / _---=> hardirq/softirq
--#              ||| / _--=> preempt-depth
--#              |||| /
--#              |||||     delay
--#  cmd     pid ||||| time  |   caller
--#     \   /    |||||   \   |   /
--      ls-4473  0.N..    0us : preempt_schedule (write_chan)
--      ls-4473  0dN.1    1us : _spin_lock (schedule)
--      ls-4473  0dN.1    2us : add_preempt_count (_spin_lock)
--      ls-4473  0d..2    2us : put_prev_task_fair (schedule)
--[...]
--      ls-4473  0d..2   13us : set_normalized_timespec (ktime_get_ts)
--      ls-4473  0d..2   13us : __switch_to (schedule)
--    sshd-4261  0d..2   14us : finish_task_switch (schedule)
--    sshd-4261  0d..2   14us : _spin_unlock_irq (finish_task_switch)
--    sshd-4261  0d..1   15us : add_preempt_count (_spin_lock_irqsave)
--    sshd-4261  0d..2   16us : _spin_unlock_irqrestore (hrtick_set)
--    sshd-4261  0d..2   16us : do_IRQ (common_interrupt)
--    sshd-4261  0d..2   17us : irq_enter (do_IRQ)
--    sshd-4261  0d..2   17us : idle_cpu (irq_enter)
--    sshd-4261  0d..2   18us : add_preempt_count (irq_enter)
--    sshd-4261  0d.h2   18us : idle_cpu (irq_enter)
--    sshd-4261  0d.h.   18us : handle_fasteoi_irq (do_IRQ)
--    sshd-4261  0d.h.   19us : _spin_lock (handle_fasteoi_irq)
--    sshd-4261  0d.h.   19us : add_preempt_count (_spin_lock)
--    sshd-4261  0d.h1   20us : _spin_unlock (handle_fasteoi_irq)
--    sshd-4261  0d.h1   20us : sub_preempt_count (_spin_unlock)
--[...]
--    sshd-4261  0d.h1   28us : _spin_unlock (handle_fasteoi_irq)
--    sshd-4261  0d.h1   29us : sub_preempt_count (_spin_unlock)
--    sshd-4261  0d.h2   29us : irq_exit (do_IRQ)
--    sshd-4261  0d.h2   29us : sub_preempt_count (irq_exit)
--    sshd-4261  0d..3   30us : do_softirq (irq_exit)
--    sshd-4261  0d...   30us : __do_softirq (do_softirq)
--    sshd-4261  0d...   31us : __local_bh_disable (__do_softirq)
--    sshd-4261  0d...   31us+: add_preempt_count (__local_bh_disable)
--    sshd-4261  0d.s4   34us : add_preempt_count (__local_bh_disable)
--[...]
--    sshd-4261  0d.s3   43us : sub_preempt_count (local_bh_enable_ip)
--    sshd-4261  0d.s4   44us : sub_preempt_count (local_bh_enable_ip)
--    sshd-4261  0d.s3   44us : smp_apic_timer_interrupt (apic_timer_interrupt)
--    sshd-4261  0d.s3   45us : irq_enter (smp_apic_timer_interrupt)
--    sshd-4261  0d.s3   45us : idle_cpu (irq_enter)
--    sshd-4261  0d.s3   46us : add_preempt_count (irq_enter)
--    sshd-4261  0d.H3   46us : idle_cpu (irq_enter)
--    sshd-4261  0d.H3   47us : hrtimer_interrupt (smp_apic_timer_interrupt)
--    sshd-4261  0d.H3   47us : ktime_get (hrtimer_interrupt)
--[...]
--    sshd-4261  0d.H3   81us : tick_program_event (hrtimer_interrupt)
--    sshd-4261  0d.H3   82us : ktime_get (tick_program_event)
--    sshd-4261  0d.H3   82us : ktime_get_ts (ktime_get)
--    sshd-4261  0d.H3   83us : getnstimeofday (ktime_get_ts)
--    sshd-4261  0d.H3   83us : set_normalized_timespec (ktime_get_ts)
--    sshd-4261  0d.H3   84us : clockevents_program_event (tick_program_event)
--    sshd-4261  0d.H3   84us : lapic_next_event (clockevents_program_event)
--    sshd-4261  0d.H3   85us : irq_exit (smp_apic_timer_interrupt)
--    sshd-4261  0d.H3   85us : sub_preempt_count (irq_exit)
--    sshd-4261  0d.s4   86us : sub_preempt_count (irq_exit)
--    sshd-4261  0d.s3   86us : add_preempt_count (__local_bh_disable)
--[...]
--    sshd-4261  0d.s1   98us : sub_preempt_count (net_rx_action)
--    sshd-4261  0d.s.   99us : add_preempt_count (_spin_lock_irq)
--    sshd-4261  0d.s1   99us+: _spin_unlock_irq (run_timer_softirq)
--    sshd-4261  0d.s.  104us : _local_bh_enable (__do_softirq)
--    sshd-4261  0d.s.  104us : sub_preempt_count (_local_bh_enable)
--    sshd-4261  0d.s.  105us : _local_bh_enable (__do_softirq)
--    sshd-4261  0d.s1  105us : trace_preempt_on (__do_softirq)
--
--
--This is a very interesting trace. It started with the preemption of
--the ls task. We see that the task had the "need_resched" bit set
--with the 'N' in the trace.  Interrupts are disabled in the spin_lock
--and the trace started. We see that a schedule took place to run
--sshd.  When the interrupts were enabled we took an interrupt.
--On return of the interrupt the softirq ran. We took another interrupt
--while running the softirq as we see with the capital 'H'.
--
--
--wakeup
--------
--
--In Real-Time environment it is very important to know the wakeup
--time it takes for the highest priority task that wakes up to the
--time it executes. This is also known as "schedule latency".
--I stress the point that this is about RT tasks. It is also important
--to know the scheduling latency of non-RT tasks, but the average
--schedule latency is better for non-RT tasks. Tools like
--LatencyTop is more appropriate for such measurements.
--
--Real-Time environments is interested in the worst case latency.
--That is the longest latency it takes for something to happen, and
--not the average. We can have a very fast scheduler that may only
--have a large latency once in a while, but that would not work well
--with Real-Time tasks.  The wakeup tracer was designed to record
--the worst case wakeups of RT tasks. Non-RT tasks are not recorded
--because the tracer only records one worst case and tracing non-RT
--tasks that are unpredictable will overwrite the worst case latency
--of RT tasks.
--
--Since this tracer only deals with RT tasks, we will run this slightly
--different than we did with the previous tracers. Instead of performing
--an 'ls' we will run 'sleep 1' under 'chrt' which changes the
--priority of the task.
--
-- # echo wakeup > /debug/tracing/current_tracer
-- # echo 0 > /debug/tracing/tracing_max_latency
-- # echo 1 > /debug/tracing/tracing_enabled
-- # chrt -f 5 sleep 1
-- # echo 0 > /debug/tracing/tracing_enabled
-- # cat /debug/tracing/latency_trace
--# tracer: wakeup
--#
--wakeup latency trace v1.1.5 on 2.6.26-rc8
----------------------------------------------------------------------
-- latency: 4 us, #2/2, CPU#1 | (M:preempt VP:0, KP:0, SP:0 HP:0 #P:2)
--    -----------------
--    | task: sleep-4901 (uid:0 nice:0 policy:1 rt_prio:5)
--    -----------------
--
--#                _------=> CPU#
--#               / _-----=> irqs-off
--#              | / _----=> need-resched
--#              || / _---=> hardirq/softirq
--#              ||| / _--=> preempt-depth
--#              |||| /
--#              |||||     delay
--#  cmd     pid ||||| time  |   caller
--#     \   /    |||||   \   |   /
--  <idle>-0     1d.h4    0us+: try_to_wake_up (wake_up_process)
--  <idle>-0     1d..4    4us : schedule (cpu_idle)
--
--
--vim:ft=help
--
--
--Running this on an idle system we see that it only took 4 microseconds
--to perform the task switch.  Note, since the trace marker in the
--schedule is before the actual "switch" we stop the tracing when
--the recorded task is about to schedule in. This may change if
--we add a new marker at the end of the scheduler.
--
--Notice that the recorded task is 'sleep' with the PID of 4901 and it
--has an rt_prio of 5. This priority is user-space priority and not
--the internal kernel priority. The policy is 1 for SCHED_FIFO and 2
--for SCHED_RR.
--
--Doing the same with chrt -r 5 and ftrace_enabled set.
--
--# tracer: wakeup
--#
--wakeup latency trace v1.1.5 on 2.6.26-rc8
----------------------------------------------------------------------
-- latency: 50 us, #60/60, CPU#1 | (M:preempt VP:0, KP:0, SP:0 HP:0 #P:2)
--    -----------------
--    | task: sleep-4068 (uid:0 nice:0 policy:2 rt_prio:5)
--    -----------------
--
--#                _------=> CPU#
--#               / _-----=> irqs-off
--#              | / _----=> need-resched
--#              || / _---=> hardirq/softirq
--#              ||| / _--=> preempt-depth
--#              |||| /
--#              |||||     delay
--#  cmd     pid ||||| time  |   caller
--#     \   /    |||||   \   |   /
--ksoftirq-7     1d.H3    0us : try_to_wake_up (wake_up_process)
--ksoftirq-7     1d.H4    1us : sub_preempt_count (marker_probe_cb)
--ksoftirq-7     1d.H3    2us : check_preempt_wakeup (try_to_wake_up)
--ksoftirq-7     1d.H3    3us : update_curr (check_preempt_wakeup)
--ksoftirq-7     1d.H3    4us : calc_delta_mine (update_curr)
--ksoftirq-7     1d.H3    5us : __resched_task (check_preempt_wakeup)
--ksoftirq-7     1d.H3    6us : task_wake_up_rt (try_to_wake_up)
--ksoftirq-7     1d.H3    7us : _spin_unlock_irqrestore (try_to_wake_up)
--[...]
--ksoftirq-7     1d.H2   17us : irq_exit (smp_apic_timer_interrupt)
--ksoftirq-7     1d.H2   18us : sub_preempt_count (irq_exit)
--ksoftirq-7     1d.s3   19us : sub_preempt_count (irq_exit)
--ksoftirq-7     1..s2   20us : rcu_process_callbacks (__do_softirq)
--[...]
--ksoftirq-7     1..s2   26us : __rcu_process_callbacks (rcu_process_callbacks)
--ksoftirq-7     1d.s2   27us : _local_bh_enable (__do_softirq)
--ksoftirq-7     1d.s2   28us : sub_preempt_count (_local_bh_enable)
--ksoftirq-7     1.N.3   29us : sub_preempt_count (ksoftirqd)
--ksoftirq-7     1.N.2   30us : _cond_resched (ksoftirqd)
--ksoftirq-7     1.N.2   31us : __cond_resched (_cond_resched)
--ksoftirq-7     1.N.2   32us : add_preempt_count (__cond_resched)
--ksoftirq-7     1.N.2   33us : schedule (__cond_resched)
--ksoftirq-7     1.N.2   33us : add_preempt_count (schedule)
--ksoftirq-7     1.N.3   34us : hrtick_clear (schedule)
--ksoftirq-7     1dN.3   35us : _spin_lock (schedule)
--ksoftirq-7     1dN.3   36us : add_preempt_count (_spin_lock)
--ksoftirq-7     1d..4   37us : put_prev_task_fair (schedule)
--ksoftirq-7     1d..4   38us : update_curr (put_prev_task_fair)
--[...]
--ksoftirq-7     1d..5   47us : _spin_trylock (tracing_record_cmdline)
--ksoftirq-7     1d..5   48us : add_preempt_count (_spin_trylock)
--ksoftirq-7     1d..6   49us : _spin_unlock (tracing_record_cmdline)
--ksoftirq-7     1d..6   49us : sub_preempt_count (_spin_unlock)
--ksoftirq-7     1d..4   50us : schedule (__cond_resched)
--
--The interrupt went off while running ksoftirqd. This task runs at
--SCHED_OTHER. Why didn't we see the 'N' set early? This may be
--a harmless bug with x86_32 and 4K stacks. The need_reched() function
--that tests if we need to reschedule looks on the actual stack.
--Where as the setting of the NEED_RESCHED bit happens on the
--task's stack. But because we are in a hard interrupt, the test
--is with the interrupts stack which has that to be false. We don't
--see the 'N' until we switch back to the task's stack.
--
--ftrace
--------
--
--ftrace is not only the name of the tracing infrastructure, but it
--is also a name of one of the tracers. The tracer is the function
--tracer. Enabling the function tracer can be done from the
--debug file system. Make sure the ftrace_enabled is set otherwise
--this tracer is a nop.
--
-- # sysctl kernel.ftrace_enabled=1
-- # echo ftrace > /debug/tracing/current_tracer
-- # echo 1 > /debug/tracing/tracing_enabled
-- # usleep 1
-- # echo 0 > /debug/tracing/tracing_enabled
-- # cat /debug/tracing/trace
--# tracer: ftrace
--#
--#           TASK-PID   CPU#    TIMESTAMP  FUNCTION
--#              | |      |          |         |
--            bash-4003  [00]   123.638713: finish_task_switch <-schedule
--            bash-4003  [00]   123.638714: _spin_unlock_irq <-finish_task_switch
--            bash-4003  [00]   123.638714: sub_preempt_count <-_spin_unlock_irq
--            bash-4003  [00]   123.638715: hrtick_set <-schedule
--            bash-4003  [00]   123.638715: _spin_lock_irqsave <-hrtick_set
--            bash-4003  [00]   123.638716: add_preempt_count <-_spin_lock_irqsave
--            bash-4003  [00]   123.638716: _spin_unlock_irqrestore <-hrtick_set
--            bash-4003  [00]   123.638717: sub_preempt_count <-_spin_unlock_irqrestore
--            bash-4003  [00]   123.638717: hrtick_clear <-hrtick_set
--            bash-4003  [00]   123.638718: sub_preempt_count <-schedule
--            bash-4003  [00]   123.638718: sub_preempt_count <-preempt_schedule
--            bash-4003  [00]   123.638719: wait_for_completion <-__stop_machine_run
--            bash-4003  [00]   123.638719: wait_for_common <-wait_for_completion
--            bash-4003  [00]   123.638720: _spin_lock_irq <-wait_for_common
--            bash-4003  [00]   123.638720: add_preempt_count <-_spin_lock_irq
--[...]
--
--
--Note: It is sometimes better to enable or disable tracing directly from
--a program, because the buffer may be overflowed by the echo commands
--before you get to the point you want to trace. It is also easier to
--stop the tracing at the point that you hit the part that you are
--interested in. Since the ftrace buffer is a ring buffer with the
--oldest data being overwritten, usually it is sufficient to start the
--tracer with an echo command but have you code stop it. Something
--like the following is usually appropriate for this.
--
--int trace_fd;
--[...]
--int main(int argc, char *argv[]) {
--	[...]
--	trace_fd = open("/debug/tracing/tracing_enabled", O_WRONLY);
--	[...]
--	if (condition_hit()) {
--	write(trace_fd, "0", 1);
--	}
--	[...]
--}
--
--
--dynamic ftrace
----------------
--
--If CONFIG_DYNAMIC_FTRACE is set, then the system will run with
--virtually no overhead when function tracing is disabled. The way
--this works is the mcount function call (placed at the start of
--every kernel function, produced by the -pg switch in gcc), starts
--of pointing to a simple return.
--
--When dynamic ftrace is initialized, it calls kstop_machine to make it
--act like a uniprocessor so that it can freely modify code without
--worrying about other processors executing that same code.  At
--initialization, the mcount calls are change to call a "record_ip"
--function.  After this, the first time a kernel function is called,
--it has the calling address saved in a hash table.
--
--Later on the ftraced kernel thread is awoken and will again call
--kstop_machine if new functions have been recorded. The ftraced thread
--will change all calls to mcount to "nop".  Just calling mcount
--and having mcount return has shown a 10% overhead. By converting
--it to a nop, there is no recordable overhead to the system.
--
--One special side-effect to the recording of the functions being
--traced, is that we can now selectively choose which functions we
--want to trace and which ones we want the mcount calls to remain as
--nops.
--
--Two files that contain to the enabling and disabling of recorded
--functions are:
--
--  set_ftrace_filter
--
--and
--
--  set_ftrace_notrace
--
--A list of available functions that you can add to this files is listed
--in:
--
--   available_filter_functions
--
-- # cat /debug/tracing/available_filter_functions
--put_prev_task_idle
--kmem_cache_create
--pick_next_task_rt
--get_online_cpus
--pick_next_task_fair
--mutex_lock
--[...]
--
--If I'm only interested in sys_nanosleep and hrtimer_interrupt:
--
-- # echo sys_nanosleep hrtimer_interrupt \
--		> /debug/tracing/set_ftrace_filter
-- # echo ftrace > /debug/tracing/current_tracer
-- # echo 1 > /debug/tracing/tracing_enabled
-- # usleep 1
-- # echo 0 > /debug/tracing/tracing_enabled
-- # cat /debug/tracing/trace
--# tracer: ftrace
--#
--#           TASK-PID   CPU#    TIMESTAMP  FUNCTION
--#              | |      |          |         |
--          usleep-4134  [00]  1317.070017: hrtimer_interrupt <-smp_apic_timer_interrupt
--          usleep-4134  [00]  1317.070111: sys_nanosleep <-syscall_call
--          <idle>-0     [00]  1317.070115: hrtimer_interrupt <-smp_apic_timer_interrupt
--
--To see what functions are being traced, you can cat the file:
--
-- # cat /debug/tracing/set_ftrace_filter
--hrtimer_interrupt
--sys_nanosleep
--
--
--Perhaps this isn't enough. The filters also allow simple wild cards.
--Only the following is currently available
--
--  <match>*  - will match functions that begins with <match>
--  *<match>  - will match functions that end with <match>
--  *<match>* - will match functions that have <match> in it
--
--Thats all the wild cards that are allowed.
--
--  <match>*<match> will not work.
--
-- # echo hrtimer_* > /debug/tracing/set_ftrace_filter
--
--Produces:
--
--# tracer: ftrace
--#
--#           TASK-PID   CPU#    TIMESTAMP  FUNCTION
--#              | |      |          |         |
--            bash-4003  [00]  1480.611794: hrtimer_init <-copy_process
--            bash-4003  [00]  1480.611941: hrtimer_start <-hrtick_set
--            bash-4003  [00]  1480.611956: hrtimer_cancel <-hrtick_clear
--            bash-4003  [00]  1480.611956: hrtimer_try_to_cancel <-hrtimer_cancel
--          <idle>-0     [00]  1480.612019: hrtimer_get_next_event <-get_next_timer_interrupt
--          <idle>-0     [00]  1480.612025: hrtimer_get_next_event <-get_next_timer_interrupt
--          <idle>-0     [00]  1480.612032: hrtimer_get_next_event <-get_next_timer_interrupt
--          <idle>-0     [00]  1480.612037: hrtimer_get_next_event <-get_next_timer_interrupt
--          <idle>-0     [00]  1480.612382: hrtimer_get_next_event <-get_next_timer_interrupt
--
--
--Notice that we lost the sys_nanosleep.
--
-- # cat /debug/tracing/set_ftrace_filter
--hrtimer_run_queues
--hrtimer_run_pending
--hrtimer_init
--hrtimer_cancel
--hrtimer_try_to_cancel
--hrtimer_forward
--hrtimer_start
--hrtimer_reprogram
--hrtimer_force_reprogram
--hrtimer_get_next_event
--hrtimer_interrupt
--hrtimer_nanosleep
--hrtimer_wakeup
--hrtimer_get_remaining
--hrtimer_get_res
--hrtimer_init_sleeper
--
--
--This is because the '>' and '>>' act just like they do in bash.
--To rewrite the filters, use '>'
--To append to the filters, use '>>'
--
--To clear out a filter so that all functions will be recorded again.
--
-- # echo > /debug/tracing/set_ftrace_filter
-- # cat /debug/tracing/set_ftrace_filter
-- #
--
--Again, now we want to append.
--
-- # echo sys_nanosleep > /debug/tracing/set_ftrace_filter
-- # cat /debug/tracing/set_ftrace_filter
--sys_nanosleep
-- # echo hrtimer_* >> /debug/tracing/set_ftrace_filter
-- # cat /debug/tracing/set_ftrace_filter
--hrtimer_run_queues
--hrtimer_run_pending
--hrtimer_init
--hrtimer_cancel
--hrtimer_try_to_cancel
--hrtimer_forward
--hrtimer_start
--hrtimer_reprogram
--hrtimer_force_reprogram
--hrtimer_get_next_event
--hrtimer_interrupt
--sys_nanosleep
--hrtimer_nanosleep
--hrtimer_wakeup
--hrtimer_get_remaining
--hrtimer_get_res
--hrtimer_init_sleeper
--
--
--The set_ftrace_notrace prevents those functions from being traced.
--
-- # echo '*preempt*' '*lock*' > /debug/tracing/set_ftrace_notrace
--
--Produces:
--
--# tracer: ftrace
--#
--#           TASK-PID   CPU#    TIMESTAMP  FUNCTION
--#              | |      |          |         |
--            bash-4043  [01]   115.281644: finish_task_switch <-schedule
--            bash-4043  [01]   115.281645: hrtick_set <-schedule
--            bash-4043  [01]   115.281645: hrtick_clear <-hrtick_set
--            bash-4043  [01]   115.281646: wait_for_completion <-__stop_machine_run
--            bash-4043  [01]   115.281647: wait_for_common <-wait_for_completion
--            bash-4043  [01]   115.281647: kthread_stop <-stop_machine_run
--            bash-4043  [01]   115.281648: init_waitqueue_head <-kthread_stop
--            bash-4043  [01]   115.281648: wake_up_process <-kthread_stop
--            bash-4043  [01]   115.281649: try_to_wake_up <-wake_up_process
--
--We can see that there's no more lock or preempt tracing.
--
--ftraced
---------
--
--As mentioned above, when dynamic ftrace is configured in, a kernel
--thread wakes up once a second and checks to see if there are mcount
--calls that need to be converted into nops. If there is not, then
--it simply goes back to sleep. But if there is, it will call
--kstop_machine to convert the calls to nops.
--
--There may be a case that you do not want this added latency.
--Perhaps you are doing some audio recording and this activity might
--cause skips in the playback. There is an interface to disable
--and enable the ftraced kernel thread.
--
-- # echo 0 > /debug/tracing/ftraced_enabled
--
--This will disable the calling of the kstop_machine to update the
--mcount calls to nops. Remember that there's a large overhead
--to calling mcount. Without this kernel thread, that overhead will
--exist.
--
--Any write to the ftraced_enabled file will cause the kstop_machine
--to run if there are recorded calls to mcount. This means that a
--user can manually perform the updates when they want to by simply
--echoing a '0' into the ftraced_enabled file.
--
--The updates are also done at the beginning of enabling a tracer
--that uses ftrace function recording.
--
--
--trace_pipe
------------
--
--The trace_pipe outputs the same as trace, but the effect on the
--tracing is different. Every read from trace_pipe is consumed.
--This means that subsequent reads will be different. The trace
--is live.
--
-- # echo ftrace > /debug/tracing/current_tracer
-- # cat /debug/tracing/trace_pipe > /tmp/trace.out &
--[1] 4153
-- # echo 1 > /debug/tracing/tracing_enabled
-- # usleep 1
-- # echo 0 > /debug/tracing/tracing_enabled
-- # cat /debug/tracing/trace
--# tracer: ftrace
--#
--#           TASK-PID   CPU#    TIMESTAMP  FUNCTION
--#              | |      |          |         |
--
-- #
-- # cat /tmp/trace.out
--            bash-4043  [00] 41.267106: finish_task_switch <-schedule
--            bash-4043  [00] 41.267106: hrtick_set <-schedule
--            bash-4043  [00] 41.267107: hrtick_clear <-hrtick_set
--            bash-4043  [00] 41.267108: wait_for_completion <-__stop_machine_run
--            bash-4043  [00] 41.267108: wait_for_common <-wait_for_completion
--            bash-4043  [00] 41.267109: kthread_stop <-stop_machine_run
--            bash-4043  [00] 41.267109: init_waitqueue_head <-kthread_stop
--            bash-4043  [00] 41.267110: wake_up_process <-kthread_stop
--            bash-4043  [00] 41.267110: try_to_wake_up <-wake_up_process
--            bash-4043  [00] 41.267111: select_task_rq_rt <-try_to_wake_up
--
--
--Note, reading the trace_pipe will block until more input is added.
--By changing the tracer, trace_pipe will issue an EOF. We needed
--to set the ftrace tracer _before_ cating the trace_pipe file.
--
--
--trace entries
---------------
--
--Having too much or not enough data can be troublesome in diagnosing
--some issue in the kernel. The file trace_entries is used to modify
--the size of the internal trace buffers. The numbers listed
--is the number of entries that can be recorded per CPU. To know
--the full size, multiply the number of possible CPUS with the
--number of entries.
--
-- # cat /debug/tracing/trace_entries
--65620
--
--Note, to modify this you must have tracing fulling disabled. To do that,
--echo "none" into the current_tracer.
--
-- # echo none > /debug/tracing/current_tracer
-- # echo 100000 > /debug/tracing/trace_entries
-- # cat /debug/tracing/trace_entries
--100045
--
--
--Notice that we echoed in 100,000 but the size is 100,045. The entries
--are held by individual pages. It allocates the number of pages it takes
--to fulfill the request. If more entries may fit on the last page
--it will add them.
--
-- # echo 1 > /debug/tracing/trace_entries
-- # cat /debug/tracing/trace_entries
--85
--
--This shows us that 85 entries can fit on a single page.
--
--The number of pages that will be allocated is a percentage of available
--memory. Allocating too much will produces an error.
--
-- # echo 1000000000000 > /debug/tracing/trace_entries
---bash: echo: write error: Cannot allocate memory
-- # cat /debug/tracing/trace_entries
--85
--
-diff --git a/arch/powerpc/kernel/ppc32.h b/arch/powerpc/kernel/ppc32.h
-index 90e5627..fda05e2 100644
---- a/arch/powerpc/kernel/ppc32.h
-+++ b/arch/powerpc/kernel/ppc32.h
-@@ -135,4 +135,6 @@ struct ucontext32 {
- 	struct mcontext32	uc_mcontext;
- };
- 
-+extern int copy_siginfo_to_user32(struct compat_siginfo __user *d, siginfo_t *s);
-+
- #endif  /* _PPC64_PPC32_H */
-diff --git a/arch/powerpc/kernel/ptrace32.c b/arch/powerpc/kernel/ptrace32.c
-index 4c1de6a..9d30e10 100644
---- a/arch/powerpc/kernel/ptrace32.c
-+++ b/arch/powerpc/kernel/ptrace32.c
-@@ -29,12 +29,15 @@
- #include <linux/security.h>
- #include <linux/signal.h>
- #include <linux/compat.h>
-+#include <linux/elf.h>
- 
- #include <asm/uaccess.h>
- #include <asm/page.h>
- #include <asm/pgtable.h>
- #include <asm/system.h>
- 
-+#include "ppc32.h"
-+
- /*
-  * does not yet catch signals sent when the child dies.
-  * in exit.c or in signal.c.
-@@ -64,6 +67,27 @@ static long compat_ptrace_old(struct task_struct *child, long request,
- 	return -EPERM;
- }
- 
-+static int compat_ptrace_getsiginfo(struct task_struct *child, compat_siginfo_t __user *data)
-+{
-+	siginfo_t lastinfo;
-+	int error = -ESRCH;
-+
-+	read_lock(&tasklist_lock);
-+	if (likely(child->sighand != NULL)) {
-+		error = -EINVAL;
-+		spin_lock_irq(&child->sighand->siglock);
-+		if (likely(child->last_siginfo != NULL)) {
-+			lastinfo = *child->last_siginfo;
-+			error = 0;
-+		}
-+		spin_unlock_irq(&child->sighand->siglock);
-+	}
-+	read_unlock(&tasklist_lock);
-+	if (!error)
-+		return copy_siginfo_to_user32(data, &lastinfo);
-+	return error;
-+}
-+
- long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
- 			compat_ulong_t caddr, compat_ulong_t cdata)
- {
-@@ -282,6 +306,9 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
- 			0, PT_REGS_COUNT * sizeof(compat_long_t),
- 			compat_ptr(data));
- 
-+	case PTRACE_GETSIGINFO:
-+		return compat_ptrace_getsiginfo(child, compat_ptr(data));
-+
- 	case PTRACE_GETFPREGS:
- 	case PTRACE_SETFPREGS:
- 	case PTRACE_GETVRREGS:
-diff --git a/arch/x86/kernel/io_delay.c b/arch/x86/kernel/io_delay.c
-index 5921e5f..1c3a66a 100644
---- a/arch/x86/kernel/io_delay.c
-+++ b/arch/x86/kernel/io_delay.c
-@@ -103,6 +103,9 @@ void __init io_delay_init(void)
- 
- static int __init io_delay_param(char *s)
- {
-+	if (!s)
-+		return -EINVAL;
-+
- 	if (!strcmp(s, "0x80"))
- 		io_delay_type = CONFIG_IO_DELAY_TYPE_0X80;
- 	else if (!strcmp(s, "0xed"))
-diff --git a/arch/x86/kernel/kprobes.c b/arch/x86/kernel/kprobes.c
-index b8c6743..43c019f 100644
---- a/arch/x86/kernel/kprobes.c
-+++ b/arch/x86/kernel/kprobes.c
-@@ -860,7 +860,6 @@ static int __kprobes post_kprobe_handler(struct pt_regs *regs)
- 
- 	resume_execution(cur, regs, kcb);
- 	regs->flags |= kcb->kprobe_saved_flags;
--	trace_hardirqs_fixup_flags(regs->flags);
- 
- 	if ((kcb->kprobe_status != KPROBE_REENTER) && cur->post_handler) {
- 		kcb->kprobe_status = KPROBE_HIT_SSDONE;
-diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
-index ba370dc..58325a6 100644
---- a/arch/x86/kernel/process.c
-+++ b/arch/x86/kernel/process.c
-@@ -164,6 +164,9 @@ void __cpuinit select_idle_routine(const struct cpuinfo_x86 *c)
- 
- static int __init idle_setup(char *str)
- {
-+	if (!str)
-+		return -EINVAL;
-+
- 	if (!strcmp(str, "poll")) {
- 		printk("using polling idle threads.\n");
- 		pm_idle = poll_idle;
-diff --git a/block/bsg.c b/block/bsg.c
-index 54d617f..0526471 100644
---- a/block/bsg.c
-+++ b/block/bsg.c
-@@ -725,8 +725,13 @@ static int bsg_put_device(struct bsg_device *bd)
- 	mutex_lock(&bsg_mutex);
- 
- 	do_free = atomic_dec_and_test(&bd->ref_count);
--	if (!do_free)
-+	if (!do_free) {
-+		mutex_unlock(&bsg_mutex);
- 		goto out;
-+	}
-+
-+	hlist_del(&bd->dev_list);
-+	mutex_unlock(&bsg_mutex);
- 
- 	dprintk("%s: tearing down\n", bd->name);
- 
-@@ -742,10 +747,8 @@ static int bsg_put_device(struct bsg_device *bd)
- 	 */
- 	ret = bsg_complete_all_commands(bd);
- 
--	hlist_del(&bd->dev_list);
- 	kfree(bd);
- out:
--	mutex_unlock(&bsg_mutex);
- 	kref_put(&q->bsg_dev.ref, bsg_kref_release_function);
- 	if (do_free)
- 		blk_put_queue(q);
-diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
-index 78eb784..7828ef2 100644
---- a/drivers/input/serio/i8042-x86ia64io.h
-+++ b/drivers/input/serio/i8042-x86ia64io.h
-@@ -63,7 +63,7 @@ static inline void i8042_write_command(int val)
- 	outb(val, I8042_COMMAND_REG);
- }
- 
--#if defined(__i386__) || defined(__x86_64__)
-+#ifdef CONFIG_X86
- 
- #include <linux/dmi.h>
- 
-@@ -291,17 +291,36 @@ static struct dmi_system_id __initdata i8042_dmi_nomux_table[] = {
- 			DMI_MATCH(DMI_PRODUCT_VERSION, "3000 N100"),
- 		},
- 	},
-+	{
-+		.ident = "Acer Aspire 1360",
-+		.matches = {
-+			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
-+			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 1360"),
-+		},
-+	},
- 	{ }
- };
- 
--
--
-+#ifdef CONFIG_PNP
-+static struct dmi_system_id __initdata i8042_dmi_nopnp_table[] = {
-+	{
-+		.ident = "Intel MBO Desktop D845PESV",
-+		.matches = {
-+			DMI_MATCH(DMI_BOARD_NAME, "D845PESV"),
-+			DMI_MATCH(DMI_BOARD_VENDOR, "Intel Corporation"),
-+		},
-+	},
-+	{
-+		.ident = "Gericom Bellagio",
-+		.matches = {
-+			DMI_MATCH(DMI_SYS_VENDOR, "Gericom"),
-+			DMI_MATCH(DMI_PRODUCT_NAME, "N34AS6"),
-+		},
-+	},
-+	{ }
-+};
- #endif
- 
--#ifdef CONFIG_X86
--
--#include <linux/dmi.h>
--
- /*
-  * Some Wistron based laptops need us to explicitly enable the 'Dritek
-  * keyboard extension' to make their extra keys start generating scancodes.
-@@ -356,7 +375,6 @@ static struct dmi_system_id __initdata i8042_dmi_dritek_table[] = {
- 
- #endif /* CONFIG_X86 */
- 
--
- #ifdef CONFIG_PNP
- #include <linux/pnp.h>
- 
-@@ -466,6 +484,11 @@ static int __init i8042_pnp_init(void)
- 	int pnp_data_busted = 0;
- 	int err;
- 
-+#ifdef CONFIG_X86
-+	if (dmi_check_system(i8042_dmi_nopnp_table))
-+		i8042_nopnp = 1;
-+#endif
-+
- 	if (i8042_nopnp) {
- 		printk(KERN_INFO "i8042: PNP detection disabled\n");
- 		return 0;
-@@ -591,15 +614,13 @@ static int __init i8042_platform_init(void)
-         i8042_reset = 1;
- #endif
- 
--#if defined(__i386__) || defined(__x86_64__)
-+#ifdef CONFIG_X86
- 	if (dmi_check_system(i8042_dmi_noloop_table))
- 		i8042_noloop = 1;
- 
- 	if (dmi_check_system(i8042_dmi_nomux_table))
- 		i8042_nomux = 1;
--#endif
- 
--#ifdef CONFIG_X86
- 	if (dmi_check_system(i8042_dmi_dritek_table))
- 		i8042_dritek = 1;
- #endif /* CONFIG_X86 */
-diff --git a/drivers/md/linear.c b/drivers/md/linear.c
-index 1074824..ec921f5 100644
---- a/drivers/md/linear.c
-+++ b/drivers/md/linear.c
-@@ -126,7 +126,7 @@ static linear_conf_t *linear_conf(mddev_t *mddev, int raid_disks)
- 		int j = rdev->raid_disk;
- 		dev_info_t *disk = conf->disks + j;
- 
--		if (j < 0 || j > raid_disks || disk->rdev) {
-+		if (j < 0 || j >= raid_disks || disk->rdev) {
- 			printk("linear: disk numbering problem. Aborting!\n");
- 			goto out;
- 		}
-diff --git a/drivers/md/md.c b/drivers/md/md.c
-index 2580ac1..9664511 100644
---- a/drivers/md/md.c
-+++ b/drivers/md/md.c
-@@ -3326,9 +3326,9 @@ static struct kobject *md_probe(dev_t dev, int *part, void *data)
- 	disk->queue = mddev->queue;
- 	add_disk(disk);
- 	mddev->gendisk = disk;
--	mutex_unlock(&disks_mutex);
- 	error = kobject_init_and_add(&mddev->kobj, &md_ktype, &disk->dev.kobj,
- 				     "%s", "md");
-+	mutex_unlock(&disks_mutex);
- 	if (error)
- 		printk(KERN_WARNING "md: cannot register %s/md - name in use\n",
- 		       disk->disk_name);
-diff --git a/drivers/net/wireless/ath5k/base.c b/drivers/net/wireless/ath5k/base.c
-index e57905c..bc3ea09 100644
---- a/drivers/net/wireless/ath5k/base.c
-+++ b/drivers/net/wireless/ath5k/base.c
-@@ -1774,20 +1774,21 @@ ath5k_tasklet_rx(unsigned long data)
- 	struct ath5k_rx_status rs = {};
- 	struct sk_buff *skb;
- 	struct ath5k_softc *sc = (void *)data;
--	struct ath5k_buf *bf;
-+	struct ath5k_buf *bf, *bf_last;
- 	struct ath5k_desc *ds;
- 	int ret;
- 	int hdrlen;
- 	int pad;
- 
- 	spin_lock(&sc->rxbuflock);
-+	if (list_empty(&sc->rxbuf)) {
-+		ATH5K_WARN(sc, "empty rx buf pool\n");
-+		goto unlock;
-+	}
-+	bf_last = list_entry(sc->rxbuf.prev, struct ath5k_buf, list);
- 	do {
- 		rxs.flag = 0;
- 
--		if (unlikely(list_empty(&sc->rxbuf))) {
--			ATH5K_WARN(sc, "empty rx buf pool\n");
--			break;
--		}
- 		bf = list_first_entry(&sc->rxbuf, struct ath5k_buf, list);
- 		BUG_ON(bf->skb == NULL);
- 		skb = bf->skb;
-@@ -1797,8 +1798,24 @@ ath5k_tasklet_rx(unsigned long data)
- 		pci_dma_sync_single_for_cpu(sc->pdev, sc->desc_daddr,
- 				sc->desc_len, PCI_DMA_FROMDEVICE);
- 
--		if (unlikely(ds->ds_link == bf->daddr)) /* this is the end */
--			break;
-+		/*
-+		 * last buffer must not be freed to ensure proper hardware
-+		 * function. When the hardware finishes also a packet next to
-+		 * it, we are sure, it doesn't use it anymore and we can go on.
-+		 */
-+		if (bf_last == bf)
-+			bf->flags |= 1;
-+		if (bf->flags) {
-+			struct ath5k_buf *bf_next = list_entry(bf->list.next,
-+					struct ath5k_buf, list);
-+			ret = sc->ah->ah_proc_rx_desc(sc->ah, bf_next->desc,
-+					&rs);
-+			if (ret)
-+				break;
-+			bf->flags &= ~1;
-+			/* skip the overwritten one (even status is martian) */
-+			goto next;
-+		}
- 
- 		ret = sc->ah->ah_proc_rx_desc(sc->ah, ds, &rs);
- 		if (unlikely(ret == -EINPROGRESS))
-@@ -1921,6 +1938,7 @@ accept:
- next:
- 		list_move_tail(&bf->list, &sc->rxbuf);
- 	} while (ath5k_rxbuf_setup(sc, bf) == 0);
-+unlock:
- 	spin_unlock(&sc->rxbuflock);
- }
- 
-@@ -2435,6 +2453,9 @@ ath5k_stop_hw(struct ath5k_softc *sc)
- 	mutex_unlock(&sc->lock);
- 
- 	del_timer_sync(&sc->calib_tim);
-+	tasklet_kill(&sc->rxtq);
-+	tasklet_kill(&sc->txtq);
-+	tasklet_kill(&sc->restq);
- 
- 	return ret;
- }
-diff --git a/drivers/net/wireless/ath5k/base.h b/drivers/net/wireless/ath5k/base.h
-index 3a97558..4badca7 100644
---- a/drivers/net/wireless/ath5k/base.h
-+++ b/drivers/net/wireless/ath5k/base.h
-@@ -55,7 +55,7 @@
- 
- struct ath5k_buf {
- 	struct list_head	list;
--	unsigned int		flags;	/* tx descriptor flags */
-+	unsigned int		flags;	/* rx descriptor flags */
- 	struct ath5k_desc	*desc;	/* virtual addr of desc */
- 	dma_addr_t		daddr;	/* physical addr of desc */
- 	struct sk_buff		*skb;	/* skbuff for buf */
-diff --git a/drivers/scsi/ch.c b/drivers/scsi/ch.c
-index c4b938b..2be2da6 100644
---- a/drivers/scsi/ch.c
-+++ b/drivers/scsi/ch.c
-@@ -926,6 +926,7 @@ static int ch_probe(struct device *dev)
- 	if (init)
- 		ch_init_elem(ch);
- 
-+	dev_set_drvdata(dev, ch);
- 	sdev_printk(KERN_INFO, sd, "Attached scsi changer %s\n", ch->name);
- 
- 	return 0;
-diff --git a/fs/jbd/transaction.c b/fs/jbd/transaction.c
-index 67ff202..8dee320 100644
---- a/fs/jbd/transaction.c
-+++ b/fs/jbd/transaction.c
-@@ -1648,12 +1648,42 @@ out:
- 	return;
- }
- 
-+/*
-+ * journal_try_to_free_buffers() could race with journal_commit_transaction()
-+ * The latter might still hold the a count on buffers when inspecting
-+ * them on t_syncdata_list or t_locked_list.
-+ *
-+ * journal_try_to_free_buffers() will call this function to
-+ * wait for the current transaction to finish syncing data buffers, before
-+ * tryinf to free that buffer.
-+ *
-+ * Called with journal->j_state_lock held.
-+ */
-+static void journal_wait_for_transaction_sync_data(journal_t *journal)
-+{
-+	transaction_t *transaction = NULL;
-+	tid_t tid;
-+
-+	spin_lock(&journal->j_state_lock);
-+	transaction = journal->j_committing_transaction;
-+
-+	if (!transaction) {
-+		spin_unlock(&journal->j_state_lock);
-+		return;
-+	}
-+
-+	tid = transaction->t_tid;
-+	spin_unlock(&journal->j_state_lock);
-+	log_wait_commit(journal, tid);
-+}
- 
- /**
-  * int journal_try_to_free_buffers() - try to free page buffers.
-  * @journal: journal for operation
-  * @page: to try and free
-- * @unused_gfp_mask: unused
-+ * @gfp_mask: we use the mask to detect how hard should we try to release
-+ * buffers. If __GFP_WAIT and __GFP_FS is set, we wait for commit code to
-+ * release the buffers.
-  *
-  *
-  * For all the buffers on this page,
-@@ -1682,9 +1712,11 @@ out:
-  * journal_try_to_free_buffer() is changing its state.  But that
-  * cannot happen because we never reallocate freed data as metadata
-  * while the data is part of a transaction.  Yes?
-+ *
-+ * Return 0 on failure, 1 on success
-  */
- int journal_try_to_free_buffers(journal_t *journal,
--				struct page *page, gfp_t unused_gfp_mask)
-+				struct page *page, gfp_t gfp_mask)
- {
- 	struct buffer_head *head;
- 	struct buffer_head *bh;
-@@ -1713,7 +1745,28 @@ int journal_try_to_free_buffers(journal_t *journal,
- 		if (buffer_jbd(bh))
- 			goto busy;
- 	} while ((bh = bh->b_this_page) != head);
-+
- 	ret = try_to_free_buffers(page);
-+
-+	/*
-+	 * There are a number of places where journal_try_to_free_buffers()
-+	 * could race with journal_commit_transaction(), the later still
-+	 * holds the reference to the buffers to free while processing them.
-+	 * try_to_free_buffers() failed to free those buffers. Some of the
-+	 * caller of releasepage() request page buffers to be dropped, otherwise
-+	 * treat the fail-to-free as errors (such as generic_file_direct_IO())
-+	 *
-+	 * So, if the caller of try_to_release_page() wants the synchronous
-+	 * behaviour(i.e make sure buffers are dropped upon return),
-+	 * let's wait for the current transaction to finish flush of
-+	 * dirty data buffers, then try to free those buffers again,
-+	 * with the journal locked.
-+	 */
-+	if (ret == 0 && (gfp_mask & __GFP_WAIT) && (gfp_mask & __GFP_FS)) {
-+		journal_wait_for_transaction_sync_data(journal);
-+		ret = try_to_free_buffers(page);
-+	}
-+
- busy:
- 	return ret;
- }
-diff --git a/fs/namei.c b/fs/namei.c
-index 01e67dd..3b26a24 100644
---- a/fs/namei.c
-+++ b/fs/namei.c
-@@ -519,7 +519,14 @@ static struct dentry * real_lookup(struct dentry * parent, struct qstr * name, s
- 	 */
- 	result = d_lookup(parent, name);
- 	if (!result) {
--		struct dentry * dentry = d_alloc(parent, name);
-+		struct dentry *dentry;
-+
-+		/* Don't create child dentry for a dead directory. */
-+		result = ERR_PTR(-ENOENT);
-+		if (IS_DEADDIR(dir))
-+			goto out_unlock;
-+
-+		dentry = d_alloc(parent, name);
- 		result = ERR_PTR(-ENOMEM);
- 		if (dentry) {
- 			result = dir->i_op->lookup(dir, dentry, nd);
-@@ -528,6 +535,7 @@ static struct dentry * real_lookup(struct dentry * parent, struct qstr * name, s
- 			else
- 				result = dentry;
- 		}
-+out_unlock:
- 		mutex_unlock(&dir->i_mutex);
- 		return result;
- 	}
-@@ -1317,7 +1325,14 @@ static struct dentry *__lookup_hash(struct qstr *name,
- 
- 	dentry = cached_lookup(base, name, nd);
- 	if (!dentry) {
--		struct dentry *new = d_alloc(base, name);
-+		struct dentry *new;
-+
-+		/* Don't create child dentry for a dead directory. */
-+		dentry = ERR_PTR(-ENOENT);
-+		if (IS_DEADDIR(inode))
-+			goto out;
-+
-+		new = d_alloc(base, name);
- 		dentry = ERR_PTR(-ENOMEM);
- 		if (!new)
- 			goto out;
-diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
-index 596c5d8..1d7ac64 100644
---- a/fs/nfs/inode.c
-+++ b/fs/nfs/inode.c
-@@ -57,8 +57,6 @@ static int enable_ino64 = NFS_64_BIT_INODE_NUMBERS_ENABLED;
- static void nfs_invalidate_inode(struct inode *);
- static int nfs_update_inode(struct inode *, struct nfs_fattr *);
- 
--static void nfs_zap_acl_cache(struct inode *);
--
- static struct kmem_cache * nfs_inode_cachep;
- 
- static inline unsigned long
-@@ -167,7 +165,7 @@ void nfs_zap_mapping(struct inode *inode, struct address_space *mapping)
- 	}
- }
- 
--static void nfs_zap_acl_cache(struct inode *inode)
-+void nfs_zap_acl_cache(struct inode *inode)
- {
- 	void (*clear_acl_cache)(struct inode *);
- 
-diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
-index 04ae867..24241fc 100644
---- a/fs/nfs/internal.h
-+++ b/fs/nfs/internal.h
-@@ -150,6 +150,7 @@ extern void nfs_clear_inode(struct inode *);
- #ifdef CONFIG_NFS_V4
- extern void nfs4_clear_inode(struct inode *);
- #endif
-+void nfs_zap_acl_cache(struct inode *inode);
- 
- /* super.c */
- extern struct file_system_type nfs_xdev_fs_type;
-diff --git a/fs/nfs/nfs3acl.c b/fs/nfs/nfs3acl.c
-index 9b73625..423842f 100644
---- a/fs/nfs/nfs3acl.c
-+++ b/fs/nfs/nfs3acl.c
-@@ -5,6 +5,8 @@
- #include <linux/posix_acl_xattr.h>
- #include <linux/nfsacl.h>
- 
-+#include "internal.h"
-+
- #define NFSDBG_FACILITY	NFSDBG_PROC
- 
- ssize_t nfs3_listxattr(struct dentry *dentry, char *buffer, size_t size)
-@@ -205,6 +207,8 @@ struct posix_acl *nfs3_proc_getacl(struct inode *inode, int type)
- 	status = nfs_revalidate_inode(server, inode);
- 	if (status < 0)
- 		return ERR_PTR(status);
-+	if (NFS_I(inode)->cache_validity & NFS_INO_INVALID_ACL)
-+		nfs_zap_acl_cache(inode);
- 	acl = nfs3_get_cached_acl(inode, type);
- 	if (acl != ERR_PTR(-EAGAIN))
- 		return acl;
-@@ -319,9 +323,8 @@ static int nfs3_proc_setacls(struct inode *inode, struct posix_acl *acl,
- 	dprintk("NFS call setacl\n");
- 	msg.rpc_proc = &server->client_acl->cl_procinfo[ACLPROC3_SETACL];
- 	status = rpc_call_sync(server->client_acl, &msg, 0);
--	spin_lock(&inode->i_lock);
--	NFS_I(inode)->cache_validity |= NFS_INO_INVALID_ACCESS;
--	spin_unlock(&inode->i_lock);
-+	nfs_access_zap_cache(inode);
-+	nfs_zap_acl_cache(inode);
- 	dprintk("NFS reply setacl: %d\n", status);
- 
- 	/* pages may have been allocated at the xdr layer. */
-diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
-index 1293e0a..806d17f 100644
---- a/fs/nfs/nfs4proc.c
-+++ b/fs/nfs/nfs4proc.c
-@@ -2706,6 +2706,8 @@ static ssize_t nfs4_proc_get_acl(struct inode *inode, void *buf, size_t buflen)
- 	ret = nfs_revalidate_inode(server, inode);
- 	if (ret < 0)
- 		return ret;
-+	if (NFS_I(inode)->cache_validity & NFS_INO_INVALID_ACL)
-+		nfs_zap_acl_cache(inode);
- 	ret = nfs4_read_cached_acl(inode, buf, buflen);
- 	if (ret != -ENOENT)
- 		return ret;
-@@ -2733,7 +2735,8 @@ static int __nfs4_proc_set_acl(struct inode *inode, const void *buf, size_t bufl
- 	nfs_inode_return_delegation(inode);
- 	buf_to_pages(buf, buflen, arg.acl_pages, &arg.acl_pgbase);
- 	ret = rpc_call_sync(NFS_CLIENT(inode), &msg, 0);
--	nfs_zap_caches(inode);
-+	nfs_access_zap_cache(inode);
-+	nfs_zap_acl_cache(inode);
- 	return ret;
- }
- 
-diff --git a/fs/romfs/inode.c b/fs/romfs/inode.c
-index 3f13d49..35e5c6e 100644
---- a/fs/romfs/inode.c
-+++ b/fs/romfs/inode.c
-@@ -418,7 +418,8 @@ static int
- romfs_readpage(struct file *file, struct page * page)
- {
- 	struct inode *inode = page->mapping->host;
--	loff_t offset, avail, readlen;
-+	loff_t offset, size;
-+	unsigned long filled;
- 	void *buf;
- 	int result = -EIO;
- 
-@@ -430,21 +431,29 @@ romfs_readpage(struct file *file, struct page * page)
- 
- 	/* 32 bit warning -- but not for us :) */
- 	offset = page_offset(page);
--	if (offset < i_size_read(inode)) {
--		avail = inode->i_size-offset;
--		readlen = min_t(unsigned long, avail, PAGE_SIZE);
--		if (romfs_copyfrom(inode, buf, ROMFS_I(inode)->i_dataoffset+offset, readlen) == readlen) {
--			if (readlen < PAGE_SIZE) {
--				memset(buf + readlen,0,PAGE_SIZE-readlen);
--			}
--			SetPageUptodate(page);
--			result = 0;
-+	size = i_size_read(inode);
-+	filled = 0;
-+	result = 0;
-+	if (offset < size) {
-+		unsigned long readlen;
-+
-+		size -= offset;
-+		readlen = size > PAGE_SIZE ? PAGE_SIZE : size;
-+
-+		filled = romfs_copyfrom(inode, buf, ROMFS_I(inode)->i_dataoffset+offset, readlen);
-+
-+		if (filled != readlen) {
-+			SetPageError(page);
-+			filled = 0;
-+			result = -EIO;
- 		}
- 	}
--	if (result) {
--		memset(buf, 0, PAGE_SIZE);
--		SetPageError(page);
--	}
-+
-+	if (filled < PAGE_SIZE)
-+		memset(buf + filled, 0, PAGE_SIZE-filled);
-+
-+	if (!result)
-+		SetPageUptodate(page);
- 	flush_dcache_page(page);
- 
- 	unlock_page(page);
-diff --git a/include/sound/emu10k1.h b/include/sound/emu10k1.h
-index 7b7b9b1..10ee28e 100644
---- a/include/sound/emu10k1.h
-+++ b/include/sound/emu10k1.h
-@@ -1670,6 +1670,7 @@ struct snd_emu_chip_details {
- 	unsigned char spi_dac;      /* SPI interface for DAC */
- 	unsigned char i2c_adc;      /* I2C interface for ADC */
- 	unsigned char adc_1361t;    /* Use Philips 1361T ADC */
-+	unsigned char invert_shared_spdif; /* analog/digital switch inverted */
- 	const char *driver;
- 	const char *name;
- 	const char *id;		/* for backward compatibility - can be NULL if not needed */
-diff --git a/mm/filemap.c b/mm/filemap.c
-index 4f32423..afb991a 100644
---- a/mm/filemap.c
-+++ b/mm/filemap.c
-@@ -2581,9 +2581,8 @@ out:
-  * Otherwise return zero.
-  *
-  * The @gfp_mask argument specifies whether I/O may be performed to release
-- * this page (__GFP_IO), and whether the call may block (__GFP_WAIT).
-+ * this page (__GFP_IO), and whether the call may block (__GFP_WAIT & __GFP_FS).
-  *
-- * NOTE: @gfp_mask may go away, and this function may become non-blocking.
-  */
- int try_to_release_page(struct page *page, gfp_t gfp_mask)
- {
-diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c
-index f85d946..24e91eb 100644
---- a/net/bluetooth/bnep/core.c
-+++ b/net/bluetooth/bnep/core.c
-@@ -507,6 +507,11 @@ static int bnep_session(void *arg)
- 	/* Delete network device */
- 	unregister_netdev(dev);
- 
-+	/* Wakeup user-space polling for socket errors */
-+	s->sock->sk->sk_err = EUNATCH;
-+
-+	wake_up_interruptible(s->sock->sk->sk_sleep);
-+
- 	/* Release the socket */
- 	fput(s->sock->file);
- 
-diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
-index 519cdb9..96434d7 100644
---- a/net/bluetooth/hidp/core.c
-+++ b/net/bluetooth/hidp/core.c
-@@ -581,6 +581,12 @@ static int hidp_session(void *arg)
- 		hid_free_device(session->hid);
- 	}
- 
-+	/* Wakeup user-space polling for socket errors */
-+	session->intr_sock->sk->sk_err = EUNATCH;
-+	session->ctrl_sock->sk->sk_err = EUNATCH;
-+
-+	hidp_schedule(session);
-+
- 	fput(session->intr_sock->file);
- 
- 	wait_event_timeout(*(ctrl_sk->sk_sleep),
-@@ -879,6 +885,10 @@ int hidp_del_connection(struct hidp_conndel_req *req)
- 			skb_queue_purge(&session->ctrl_transmit);
- 			skb_queue_purge(&session->intr_transmit);
- 
-+			/* Wakeup user-space polling for socket errors */
-+			session->intr_sock->sk->sk_err = EUNATCH;
-+			session->ctrl_sock->sk->sk_err = EUNATCH;
-+
- 			/* Kill session thread */
- 			atomic_inc(&session->terminate);
- 			hidp_schedule(session);
-diff --git a/net/ipv4/netfilter/nf_nat_sip.c b/net/ipv4/netfilter/nf_nat_sip.c
-index 4334d5c..1454432 100644
---- a/net/ipv4/netfilter/nf_nat_sip.c
-+++ b/net/ipv4/netfilter/nf_nat_sip.c
-@@ -318,11 +318,11 @@ static int mangle_content_len(struct sk_buff *skb,
- 			     buffer, buflen);
- }
- 
--static unsigned mangle_sdp_packet(struct sk_buff *skb, const char **dptr,
--				  unsigned int dataoff, unsigned int *datalen,
--				  enum sdp_header_types type,
--				  enum sdp_header_types term,
--				  char *buffer, int buflen)
-+static int mangle_sdp_packet(struct sk_buff *skb, const char **dptr,
-+			     unsigned int dataoff, unsigned int *datalen,
-+			     enum sdp_header_types type,
-+			     enum sdp_header_types term,
-+			     char *buffer, int buflen)
- {
- 	enum ip_conntrack_info ctinfo;
- 	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
-@@ -330,9 +330,9 @@ static unsigned mangle_sdp_packet(struct sk_buff *skb, const char **dptr,
- 
- 	if (ct_sip_get_sdp_header(ct, *dptr, dataoff, *datalen, type, term,
- 				  &matchoff, &matchlen) <= 0)
--		return 0;
-+		return -ENOENT;
- 	return mangle_packet(skb, dptr, datalen, matchoff, matchlen,
--			     buffer, buflen);
-+			     buffer, buflen) ? 0 : -EINVAL;
- }
- 
- static unsigned int ip_nat_sdp_addr(struct sk_buff *skb, const char **dptr,
-@@ -346,8 +346,8 @@ static unsigned int ip_nat_sdp_addr(struct sk_buff *skb, const char **dptr,
- 	unsigned int buflen;
- 
- 	buflen = sprintf(buffer, NIPQUAD_FMT, NIPQUAD(addr->ip));
--	if (!mangle_sdp_packet(skb, dptr, dataoff, datalen, type, term,
--			       buffer, buflen))
-+	if (mangle_sdp_packet(skb, dptr, dataoff, datalen, type, term,
-+			      buffer, buflen))
- 		return 0;
- 
- 	return mangle_content_len(skb, dptr, datalen);
-@@ -381,15 +381,27 @@ static unsigned int ip_nat_sdp_session(struct sk_buff *skb, const char **dptr,
- 
- 	/* Mangle session description owner and contact addresses */
- 	buflen = sprintf(buffer, "%u.%u.%u.%u", NIPQUAD(addr->ip));
--	if (!mangle_sdp_packet(skb, dptr, dataoff, datalen,
-+	if (mangle_sdp_packet(skb, dptr, dataoff, datalen,
- 			       SDP_HDR_OWNER_IP4, SDP_HDR_MEDIA,
- 			       buffer, buflen))
- 		return 0;
- 
--	if (!mangle_sdp_packet(skb, dptr, dataoff, datalen,
--			       SDP_HDR_CONNECTION_IP4, SDP_HDR_MEDIA,
--			       buffer, buflen))
-+	switch (mangle_sdp_packet(skb, dptr, dataoff, datalen,
-+				  SDP_HDR_CONNECTION_IP4, SDP_HDR_MEDIA,
-+				  buffer, buflen)) {
-+	case 0:
-+	/*
-+	 * RFC 2327:
-+	 *
-+	 * Session description
-+	 *
-+	 * c=* (connection information - not required if included in all media)
-+	 */
-+	case -ENOENT:
-+		break;
-+	default:
- 		return 0;
-+	}
- 
- 	return mangle_content_len(skb, dptr, datalen);
- }
-diff --git a/net/netfilter/xt_time.c b/net/netfilter/xt_time.c
-index ed76baa..9f32859 100644
---- a/net/netfilter/xt_time.c
-+++ b/net/netfilter/xt_time.c
-@@ -173,7 +173,7 @@ time_mt(const struct sk_buff *skb, const struct net_device *in,
- 		__net_timestamp((struct sk_buff *)skb);
- 
- 	stamp = ktime_to_ns(skb->tstamp);
--	do_div(stamp, NSEC_PER_SEC);
-+	stamp = div_s64(stamp, NSEC_PER_SEC);
- 
- 	if (info->flags & XT_TIME_LOCAL_TZ)
- 		/* Adjust for local timezone */
-diff --git a/sound/core/seq/oss/seq_oss_synth.c b/sound/core/seq/oss/seq_oss_synth.c
-index 558dadb..e024e45 100644
---- a/sound/core/seq/oss/seq_oss_synth.c
-+++ b/sound/core/seq/oss/seq_oss_synth.c
-@@ -604,6 +604,9 @@ snd_seq_oss_synth_make_info(struct seq_oss_devinfo *dp, int dev, struct synth_in
- {
- 	struct seq_oss_synth *rec;
- 
-+	if (dev < 0 || dev >= dp->max_synthdev)
-+		return -ENXIO;
-+
- 	if (dp->synths[dev].is_midi) {
- 		struct midi_info minf;
- 		snd_seq_oss_midi_make_info(dp, dp->synths[dev].midi_mapped, &minf);
-diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c
-index 548c9cc..2f283ea 100644
---- a/sound/pci/emu10k1/emu10k1_main.c
-+++ b/sound/pci/emu10k1/emu10k1_main.c
-@@ -1528,6 +1528,7 @@ static struct snd_emu_chip_details emu_chip_details[] = {
- 	 .ca0151_chip = 1,
- 	 .spk71 = 1,
- 	 .spdif_bug = 1,
-+	 .invert_shared_spdif = 1,	/* digital/analog switch swapped */
- 	 .adc_1361t = 1,  /* 24 bit capture instead of 16bit. Fixes ALSA bug#324 */
- 	 .ac97_chip = 1} ,
- 	{.vendor = 0x1102, .device = 0x0004, .revision = 0x04,
-diff --git a/sound/pci/emu10k1/emumixer.c b/sound/pci/emu10k1/emumixer.c
-index fd22120..9f77692 100644
---- a/sound/pci/emu10k1/emumixer.c
-+++ b/sound/pci/emu10k1/emumixer.c
-@@ -1578,6 +1578,10 @@ static int snd_emu10k1_shared_spdif_get(struct snd_kcontrol *kcontrol,
- 		ucontrol->value.integer.value[0] = inl(emu->port + A_IOCFG) & A_IOCFG_GPOUT0 ? 1 : 0;
- 	else
- 		ucontrol->value.integer.value[0] = inl(emu->port + HCFG) & HCFG_GPOUT0 ? 1 : 0;
-+	if (emu->card_capabilities->invert_shared_spdif)
-+		ucontrol->value.integer.value[0] =
-+			!ucontrol->value.integer.value[0];
-+
- 	return 0;
- }
- 
-@@ -1586,15 +1590,18 @@ static int snd_emu10k1_shared_spdif_put(struct snd_kcontrol *kcontrol,
- {
- 	unsigned long flags;
- 	struct snd_emu10k1 *emu = snd_kcontrol_chip(kcontrol);
--	unsigned int reg, val;
-+	unsigned int reg, val, sw;
- 	int change = 0;
- 
-+	sw = ucontrol->value.integer.value[0];
-+	if (emu->card_capabilities->invert_shared_spdif)
-+		sw = !sw;
- 	spin_lock_irqsave(&emu->reg_lock, flags);
- 	if ( emu->card_capabilities->i2c_adc) {
- 		/* Do nothing for Audigy 2 ZS Notebook */
- 	} else if (emu->audigy) {
- 		reg = inl(emu->port + A_IOCFG);
--		val = ucontrol->value.integer.value[0] ? A_IOCFG_GPOUT0 : 0;
-+		val = sw ? A_IOCFG_GPOUT0 : 0;
- 		change = (reg & A_IOCFG_GPOUT0) != val;
- 		if (change) {
- 			reg &= ~A_IOCFG_GPOUT0;
-@@ -1603,7 +1610,7 @@ static int snd_emu10k1_shared_spdif_put(struct snd_kcontrol *kcontrol,
- 		}
- 	}
- 	reg = inl(emu->port + HCFG);
--	val = ucontrol->value.integer.value[0] ? HCFG_GPOUT0 : 0;
-+	val = sw ? HCFG_GPOUT0 : 0;
- 	change |= (reg & HCFG_GPOUT0) != val;
- 	if (change) {
- 		reg &= ~HCFG_GPOUT0;
-diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
-index b3a618e..6ba7ac0 100644
---- a/sound/pci/hda/hda_intel.c
-+++ b/sound/pci/hda/hda_intel.c
-@@ -285,6 +285,7 @@ struct azx_dev {
- 	u32 *posbuf;		/* position buffer pointer */
- 
- 	unsigned int bufsize;	/* size of the play buffer in bytes */
-+	unsigned int period_bytes; /* size of the period in bytes */
- 	unsigned int frags;	/* number for period in the play buffer */
- 	unsigned int fifo_size;	/* FIFO size */
- 
-@@ -301,11 +302,10 @@ struct azx_dev {
- 					 */
- 	unsigned char stream_tag;	/* assigned stream */
- 	unsigned char index;		/* stream index */
--	/* for sanity check of position buffer */
--	unsigned int period_intr;
- 
- 	unsigned int opened :1;
- 	unsigned int running :1;
-+	unsigned int irq_pending: 1;
- };
- 
- /* CORB/RIRB */
-@@ -369,6 +369,9 @@ struct azx {
- 
- 	/* for debugging */
- 	unsigned int last_cmd;	/* last issued command (to sync) */
-+
-+	/* for pending irqs */
-+	struct work_struct irq_pending_work;
- };
- 
- /* driver types */
-@@ -908,6 +911,8 @@ static void azx_init_pci(struct azx *chip)
- }
- 
- 
-+static int azx_position_ok(struct azx *chip, struct azx_dev *azx_dev);
-+
- /*
-  * interrupt handler
-  */
-@@ -930,11 +935,18 @@ static irqreturn_t azx_interrupt(int irq, void *dev_id)
- 		azx_dev = &chip->azx_dev[i];
- 		if (status & azx_dev->sd_int_sta_mask) {
- 			azx_sd_writeb(azx_dev, SD_STS, SD_INT_MASK);
--			if (azx_dev->substream && azx_dev->running) {
--				azx_dev->period_intr++;
-+			if (!azx_dev->substream || !azx_dev->running)
-+				continue;
-+			/* check whether this IRQ is really acceptable */
-+			if (azx_position_ok(chip, azx_dev)) {
-+				azx_dev->irq_pending = 0;
- 				spin_unlock(&chip->reg_lock);
- 				snd_pcm_period_elapsed(azx_dev->substream);
- 				spin_lock(&chip->reg_lock);
-+			} else {
-+				/* bogus IRQ, process it later */
-+				azx_dev->irq_pending = 1;
-+				schedule_work(&chip->irq_pending_work);
- 			}
- 		}
- 	}
-@@ -973,6 +985,7 @@ static int azx_setup_periods(struct snd_pcm_substream *substream,
- 	azx_sd_writel(azx_dev, SD_BDLPU, 0);
- 
- 	period_bytes = snd_pcm_lib_period_bytes(substream);
-+	azx_dev->period_bytes = period_bytes;
- 	periods = azx_dev->bufsize / period_bytes;
- 
- 	/* program the initial BDL entries */
-@@ -1421,27 +1434,16 @@ static int azx_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
- 	return 0;
- }
- 
--static snd_pcm_uframes_t azx_pcm_pointer(struct snd_pcm_substream *substream)
-+static unsigned int azx_get_position(struct azx *chip,
-+				     struct azx_dev *azx_dev)
- {
--	struct azx_pcm *apcm = snd_pcm_substream_chip(substream);
--	struct azx *chip = apcm->chip;
--	struct azx_dev *azx_dev = get_azx_dev(substream);
- 	unsigned int pos;
- 
- 	if (chip->position_fix == POS_FIX_POSBUF ||
- 	    chip->position_fix == POS_FIX_AUTO) {
- 		/* use the position buffer */
- 		pos = le32_to_cpu(*azx_dev->posbuf);
--		if (chip->position_fix == POS_FIX_AUTO &&
--		    azx_dev->period_intr == 1 && !pos) {
--			printk(KERN_WARNING
--			       "hda-intel: Invalid position buffer, "
--			       "using LPIB read method instead.\n");
--			chip->position_fix = POS_FIX_NONE;
--			goto read_lpib;
--		}
- 	} else {
--	read_lpib:
- 		/* read LPIB */
- 		pos = azx_sd_readl(azx_dev, SD_LPIB);
- 		if (chip->position_fix == POS_FIX_FIFO)
-@@ -1449,7 +1451,90 @@ static snd_pcm_uframes_t azx_pcm_pointer(struct snd_pcm_substream *substream)
- 	}
- 	if (pos >= azx_dev->bufsize)
- 		pos = 0;
--	return bytes_to_frames(substream->runtime, pos);
-+	return pos;
-+}
-+
-+static snd_pcm_uframes_t azx_pcm_pointer(struct snd_pcm_substream *substream)
-+{
-+	struct azx_pcm *apcm = snd_pcm_substream_chip(substream);
-+	struct azx *chip = apcm->chip;
-+	struct azx_dev *azx_dev = get_azx_dev(substream);
-+	return bytes_to_frames(substream->runtime,
-+			       azx_get_position(chip, azx_dev));
-+}
-+
-+/*
-+ * Check whether the current DMA position is acceptable for updating
-+ * periods.  Returns non-zero if it's OK.
-+ *
-+ * Many HD-audio controllers appear pretty inaccurate about
-+ * the update-IRQ timing.  The IRQ is issued before actually the
-+ * data is processed.  So, we need to process it afterwords in a
-+ * workqueue.
-+ */
-+static int azx_position_ok(struct azx *chip, struct azx_dev *azx_dev)
-+{
-+	unsigned int pos;
-+
-+	pos = azx_get_position(chip, azx_dev);
-+	if (chip->position_fix == POS_FIX_AUTO) {
-+		if (!pos) {
-+			printk(KERN_WARNING
-+			       "hda-intel: Invalid position buffer, "
-+			       "using LPIB read method instead.\n");
-+			chip->position_fix = POS_FIX_NONE;
-+			pos = azx_get_position(chip, azx_dev);
-+		} else
-+			chip->position_fix = POS_FIX_POSBUF;
-+	}
-+
-+	if (pos % azx_dev->period_bytes > azx_dev->period_bytes / 2)
-+		return 0; /* NG - it's below the period boundary */
-+	return 1; /* OK, it's fine */
-+}
-+
-+/*
-+ * The work for pending PCM period updates.
-+ */
-+static void azx_irq_pending_work(struct work_struct *work)
-+{
-+	struct azx *chip = container_of(work, struct azx, irq_pending_work);
-+	int i, pending;
-+
-+	for (;;) {
-+		pending = 0;
-+		spin_lock_irq(&chip->reg_lock);
-+		for (i = 0; i < chip->num_streams; i++) {
-+			struct azx_dev *azx_dev = &chip->azx_dev[i];
-+			if (!azx_dev->irq_pending ||
-+			    !azx_dev->substream ||
-+			    !azx_dev->running)
-+				continue;
-+			if (azx_position_ok(chip, azx_dev)) {
-+				azx_dev->irq_pending = 0;
-+				spin_unlock(&chip->reg_lock);
-+				snd_pcm_period_elapsed(azx_dev->substream);
-+				spin_lock(&chip->reg_lock);
-+			} else
-+				pending++;
-+		}
-+		spin_unlock_irq(&chip->reg_lock);
-+		if (!pending)
-+			return;
-+		cond_resched();
-+	}
-+}
-+
-+/* clear irq_pending flags and assure no on-going workq */
-+static void azx_clear_irq_pending(struct azx *chip)
-+{
-+	int i;
-+
-+	spin_lock_irq(&chip->reg_lock);
-+	for (i = 0; i < chip->num_streams; i++)
-+		chip->azx_dev[i].irq_pending = 0;
-+	spin_unlock_irq(&chip->reg_lock);
-+	flush_scheduled_work();
- }
- 
- static struct snd_pcm_ops azx_pcm_ops = {
-@@ -1676,6 +1761,7 @@ static int azx_suspend(struct pci_dev *pci, pm_message_t state)
- 	int i;
- 
- 	snd_power_change_state(card, SNDRV_CTL_POWER_D3hot);
-+	azx_clear_irq_pending(chip);
- 	for (i = 0; i < AZX_MAX_PCMS; i++)
- 		snd_pcm_suspend_all(chip->pcm[i]);
- 	if (chip->initialized)
-@@ -1732,6 +1818,7 @@ static int azx_free(struct azx *chip)
- 	int i;
- 
- 	if (chip->initialized) {
-+		azx_clear_irq_pending(chip);
- 		for (i = 0; i < chip->num_streams; i++)
- 			azx_stream_stop(chip, &chip->azx_dev[i]);
- 		azx_stop_chip(chip);
-@@ -1857,6 +1944,7 @@ static int __devinit azx_create(struct snd_card *card, struct pci_dev *pci,
- 	chip->irq = -1;
- 	chip->driver_type = driver_type;
- 	chip->msi = enable_msi;
-+	INIT_WORK(&chip->irq_pending_work, azx_irq_pending_work);
- 
- 	chip->position_fix = check_position_fix(chip, position_fix[dev]);
- 	check_probe_mask(chip, dev);
-diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c
-index a99e86d..b5f655d 100644
---- a/sound/pci/hda/patch_analog.c
-+++ b/sound/pci/hda/patch_analog.c
-@@ -1618,6 +1618,7 @@ static const char *ad1981_models[AD1981_MODELS] = {
- 
- static struct snd_pci_quirk ad1981_cfg_tbl[] = {
- 	SND_PCI_QUIRK(0x1014, 0x0597, "Lenovo Z60", AD1981_THINKPAD),
-+	SND_PCI_QUIRK(0x1014, 0x05b7, "Lenovo Z60m", AD1981_THINKPAD),
- 	/* All HP models */
- 	SND_PCI_QUIRK(0x103c, 0, "HP nx", AD1981_HP),
- 	SND_PCI_QUIRK(0x1179, 0x0001, "Toshiba U205", AD1981_TOSHIBA),
-@@ -2623,7 +2624,7 @@ static int ad1988_auto_create_extra_out(struct hda_codec *codec, hda_nid_t pin,
- {
- 	struct ad198x_spec *spec = codec->spec;
- 	hda_nid_t nid;
--	int idx, err;
-+	int i, idx, err;
- 	char name[32];
- 
- 	if (! pin)
-@@ -2631,16 +2632,26 @@ static int ad1988_auto_create_extra_out(struct hda_codec *codec, hda_nid_t pin,
- 
- 	idx = ad1988_pin_idx(pin);
- 	nid = ad1988_idx_to_dac(codec, idx);
--	/* specify the DAC as the extra output */
--	if (! spec->multiout.hp_nid)
--		spec->multiout.hp_nid = nid;
--	else
--		spec->multiout.extra_out_nid[0] = nid;
--	/* control HP volume/switch on the output mixer amp */
--	sprintf(name, "%s Playback Volume", pfx);
--	if ((err = add_control(spec, AD_CTL_WIDGET_VOL, name,
--			       HDA_COMPOSE_AMP_VAL(nid, 3, 0, HDA_OUTPUT))) < 0)
--		return err;
-+	/* check whether the corresponding DAC was already taken */
-+	for (i = 0; i < spec->autocfg.line_outs; i++) {
-+		hda_nid_t pin = spec->autocfg.line_out_pins[i];
-+		hda_nid_t dac = ad1988_idx_to_dac(codec, ad1988_pin_idx(pin));
-+		if (dac == nid)
-+			break;
-+	}
-+	if (i >= spec->autocfg.line_outs) {
-+		/* specify the DAC as the extra output */
-+		if (!spec->multiout.hp_nid)
-+			spec->multiout.hp_nid = nid;
-+		else
-+			spec->multiout.extra_out_nid[0] = nid;
-+		/* control HP volume/switch on the output mixer amp */
-+		sprintf(name, "%s Playback Volume", pfx);
-+		err = add_control(spec, AD_CTL_WIDGET_VOL, name,
-+				  HDA_COMPOSE_AMP_VAL(nid, 3, 0, HDA_OUTPUT));
-+		if (err < 0)
-+			return err;
-+	}
- 	nid = ad1988_mixer_nids[idx];
- 	sprintf(name, "%s Playback Switch", pfx);
- 	if ((err = add_control(spec, AD_CTL_BIND_MUTE, name,

Deleted: genpatches-2.6/trunk/2.6.27/1002_linux-2.6.26.3.patch
===================================================================
--- genpatches-2.6/trunk/2.6.27/1002_linux-2.6.26.3.patch	2008-10-10 23:58:26 UTC (rev 1350)
+++ genpatches-2.6/trunk/2.6.27/1002_linux-2.6.26.3.patch	2008-10-11 00:00:47 UTC (rev 1351)
@@ -1,3210 +0,0 @@
-diff --git a/arch/ia64/kvm/kvm-ia64.c b/arch/ia64/kvm/kvm-ia64.c
-index 5152ba0..778de8d 100644
---- a/arch/ia64/kvm/kvm-ia64.c
-+++ b/arch/ia64/kvm/kvm-ia64.c
-@@ -125,9 +125,9 @@ void kvm_arch_hardware_enable(void *garbage)
- 				PAGE_KERNEL));
- 	local_irq_save(saved_psr);
- 	slot = ia64_itr_entry(0x3, KVM_VMM_BASE, pte, KVM_VMM_SHIFT);
-+	local_irq_restore(saved_psr);
- 	if (slot < 0)
- 		return;
--	local_irq_restore(saved_psr);
- 
- 	spin_lock(&vp_lock);
- 	status = ia64_pal_vp_init_env(kvm_vsa_base ?
-@@ -160,9 +160,9 @@ void kvm_arch_hardware_disable(void *garbage)
- 
- 	local_irq_save(saved_psr);
- 	slot = ia64_itr_entry(0x3, KVM_VMM_BASE, pte, KVM_VMM_SHIFT);
-+	local_irq_restore(saved_psr);
- 	if (slot < 0)
- 		return;
--	local_irq_restore(saved_psr);
- 
- 	status = ia64_pal_vp_exit_env(host_iva);
- 	if (status)
-@@ -1258,6 +1258,7 @@ static int vti_vcpu_setup(struct kvm_vcpu *vcpu, int id)
- uninit:
- 	kvm_vcpu_uninit(vcpu);
- fail:
-+	local_irq_restore(psr);
- 	return r;
- }
- 
-diff --git a/arch/sparc64/kernel/irq.c b/arch/sparc64/kernel/irq.c
-index c481673..acb0b97 100644
---- a/arch/sparc64/kernel/irq.c
-+++ b/arch/sparc64/kernel/irq.c
-@@ -682,10 +682,32 @@ void ack_bad_irq(unsigned int virt_irq)
- 	       ino, virt_irq);
- }
- 
-+void *hardirq_stack[NR_CPUS];
-+void *softirq_stack[NR_CPUS];
-+
-+static __attribute__((always_inline)) void *set_hardirq_stack(void)
-+{
-+	void *orig_sp, *sp = hardirq_stack[smp_processor_id()];
-+
-+	__asm__ __volatile__("mov %%sp, %0" : "=r" (orig_sp));
-+	if (orig_sp < sp ||
-+	    orig_sp > (sp + THREAD_SIZE)) {
-+		sp += THREAD_SIZE - 192 - STACK_BIAS;
-+		__asm__ __volatile__("mov %0, %%sp" : : "r" (sp));
-+	}
-+
-+	return orig_sp;
-+}
-+static __attribute__((always_inline)) void restore_hardirq_stack(void *orig_sp)
-+{
-+	__asm__ __volatile__("mov %0, %%sp" : : "r" (orig_sp));
-+}
-+
- void handler_irq(int irq, struct pt_regs *regs)
- {
- 	unsigned long pstate, bucket_pa;
- 	struct pt_regs *old_regs;
-+	void *orig_sp;
- 
- 	clear_softint(1 << irq);
- 
-@@ -703,6 +725,8 @@ void handler_irq(int irq, struct pt_regs *regs)
- 			       "i" (PSTATE_IE)
- 			     : "memory");
- 
-+	orig_sp = set_hardirq_stack();
-+
- 	while (bucket_pa) {
- 		struct irq_desc *desc;
- 		unsigned long next_pa;
-@@ -719,10 +743,38 @@ void handler_irq(int irq, struct pt_regs *regs)
- 		bucket_pa = next_pa;
- 	}
- 
-+	restore_hardirq_stack(orig_sp);
-+
- 	irq_exit();
- 	set_irq_regs(old_regs);
- }
- 
-+void do_softirq(void)
-+{
-+	unsigned long flags;
-+
-+	if (in_interrupt())
-+		return;
-+
-+	local_irq_save(flags);
-+
-+	if (local_softirq_pending()) {
-+		void *orig_sp, *sp = softirq_stack[smp_processor_id()];
-+
-+		sp += THREAD_SIZE - 192 - STACK_BIAS;
-+
-+		__asm__ __volatile__("mov %%sp, %0\n\t"
-+				     "mov %1, %%sp"
-+				     : "=&r" (orig_sp)
-+				     : "r" (sp));
-+		__do_softirq();
-+		__asm__ __volatile__("mov %0, %%sp"
-+				     : : "r" (orig_sp));
-+	}
-+
-+	local_irq_restore(flags);
-+}
-+
- #ifdef CONFIG_HOTPLUG_CPU
- void fixup_irqs(void)
- {
-diff --git a/arch/sparc64/kernel/kstack.h b/arch/sparc64/kernel/kstack.h
-new file mode 100644
-index 0000000..4248d96
---- /dev/null
-+++ b/arch/sparc64/kernel/kstack.h
-@@ -0,0 +1,60 @@
-+#ifndef _KSTACK_H
-+#define _KSTACK_H
-+
-+#include <linux/thread_info.h>
-+#include <linux/sched.h>
-+#include <asm/ptrace.h>
-+#include <asm/irq.h>
-+
-+/* SP must be STACK_BIAS adjusted already.  */
-+static inline bool kstack_valid(struct thread_info *tp, unsigned long sp)
-+{
-+	unsigned long base = (unsigned long) tp;
-+
-+	if (sp >= (base + sizeof(struct thread_info)) &&
-+	    sp <= (base + THREAD_SIZE - sizeof(struct sparc_stackf)))
-+		return true;
-+
-+	if (hardirq_stack[tp->cpu]) {
-+		base = (unsigned long) hardirq_stack[tp->cpu];
-+		if (sp >= base &&
-+		    sp <= (base + THREAD_SIZE - sizeof(struct sparc_stackf)))
-+			return true;
-+		base = (unsigned long) softirq_stack[tp->cpu];
-+		if (sp >= base &&
-+		    sp <= (base + THREAD_SIZE - sizeof(struct sparc_stackf)))
-+			return true;
-+	}
-+	return false;
-+}
-+
-+/* Does "regs" point to a valid pt_regs trap frame?  */
-+static inline bool kstack_is_trap_frame(struct thread_info *tp, struct pt_regs *regs)
-+{
-+	unsigned long base = (unsigned long) tp;
-+	unsigned long addr = (unsigned long) regs;
-+
-+	if (addr >= base &&
-+	    addr <= (base + THREAD_SIZE - sizeof(*regs)))
-+		goto check_magic;
-+
-+	if (hardirq_stack[tp->cpu]) {
-+		base = (unsigned long) hardirq_stack[tp->cpu];
-+		if (addr >= base &&
-+		    addr <= (base + THREAD_SIZE - sizeof(*regs)))
-+			goto check_magic;
-+		base = (unsigned long) softirq_stack[tp->cpu];
-+		if (addr >= base &&
-+		    addr <= (base + THREAD_SIZE - sizeof(*regs)))
-+			goto check_magic;
-+	}
-+	return false;
-+
-+check_magic:
-+	if ((regs->magic & ~0x1ff) == PT_REGS_MAGIC)
-+		return true;
-+	return false;
-+
-+}
-+
-+#endif /* _KSTACK_H */
-diff --git a/arch/sparc64/kernel/process.c b/arch/sparc64/kernel/process.c
-index 2084f81..d9f4cd0 100644
---- a/arch/sparc64/kernel/process.c
-+++ b/arch/sparc64/kernel/process.c
-@@ -55,6 +55,8 @@
- 
- /* #define VERBOSE_SHOWREGS */
- 
-+#include "kstack.h"
-+
- static void sparc64_yield(int cpu)
- {
- 	if (tlb_type != hypervisor)
-@@ -316,14 +318,22 @@ static void __global_reg_self(struct thread_info *tp, struct pt_regs *regs,
- 	global_reg_snapshot[this_cpu].o7 = regs->u_regs[UREG_I7];
- 
- 	if (regs->tstate & TSTATE_PRIV) {
-+		struct thread_info *tp = current_thread_info();
- 		struct reg_window *rw;
- 
- 		rw = (struct reg_window *)
- 			(regs->u_regs[UREG_FP] + STACK_BIAS);
--		global_reg_snapshot[this_cpu].i7 = rw->ins[6];
--	} else
-+		if (kstack_valid(tp, (unsigned long) rw)) {
-+			global_reg_snapshot[this_cpu].i7 = rw->ins[7];
-+			rw = (struct reg_window *)
-+				(rw->ins[6] + STACK_BIAS);
-+			if (kstack_valid(tp, (unsigned long) rw))
-+				global_reg_snapshot[this_cpu].rpc = rw->ins[7];
-+		}
-+	} else {
- 		global_reg_snapshot[this_cpu].i7 = 0;
--
-+		global_reg_snapshot[this_cpu].rpc = 0;
-+	}
- 	global_reg_snapshot[this_cpu].thread = tp;
- }
- 
-@@ -384,12 +394,14 @@ static void sysrq_handle_globreg(int key, struct tty_struct *tty)
- 			sprint_symbol(buffer, gp->o7);
- 			printk("O7[%s] ", buffer);
- 			sprint_symbol(buffer, gp->i7);
--			printk("I7[%s]\n", buffer);
-+			printk("I7[%s] ", buffer);
-+			sprint_symbol(buffer, gp->rpc);
-+			printk("RPC[%s]\n", buffer);
- 		} else
- #endif
- 		{
--			printk("             TPC[%lx] O7[%lx] I7[%lx]\n",
--			       gp->tpc, gp->o7, gp->i7);
-+			printk("             TPC[%lx] O7[%lx] I7[%lx] RPC[%lx]\n",
-+			       gp->tpc, gp->o7, gp->i7, gp->rpc);
- 		}
- 	}
- 
-@@ -876,7 +888,7 @@ out:
- unsigned long get_wchan(struct task_struct *task)
- {
- 	unsigned long pc, fp, bias = 0;
--	unsigned long thread_info_base;
-+	struct thread_info *tp;
- 	struct reg_window *rw;
-         unsigned long ret = 0;
- 	int count = 0; 
-@@ -885,14 +897,12 @@ unsigned long get_wchan(struct task_struct *task)
-             task->state == TASK_RUNNING)
- 		goto out;
- 
--	thread_info_base = (unsigned long) task_stack_page(task);
-+	tp = task_thread_info(task);
- 	bias = STACK_BIAS;
- 	fp = task_thread_info(task)->ksp + bias;
- 
- 	do {
--		/* Bogus frame pointer? */
--		if (fp < (thread_info_base + sizeof(struct thread_info)) ||
--		    fp >= (thread_info_base + THREAD_SIZE))
-+		if (!kstack_valid(tp, fp))
- 			break;
- 		rw = (struct reg_window *) fp;
- 		pc = rw->ins[7];
-diff --git a/arch/sparc64/kernel/signal.c b/arch/sparc64/kernel/signal.c
-index 9667e96..10a12cb 100644
---- a/arch/sparc64/kernel/signal.c
-+++ b/arch/sparc64/kernel/signal.c
-@@ -2,7 +2,7 @@
-  *  arch/sparc64/kernel/signal.c
-  *
-  *  Copyright (C) 1991, 1992  Linus Torvalds
-- *  Copyright (C) 1995 David S. Miller (davem@××××××××××××.edu)
-+ *  Copyright (C) 1995, 2008 David S. Miller (davem@×××××××××.net)
-  *  Copyright (C) 1996 Miguel de Icaza (miguel@××××××××××××.mx)
-  *  Copyright (C) 1997 Eddie C. Dost   (ecd@××××××.be)
-  *  Copyright (C) 1997,1998 Jakub Jelinek   (jj@××××××××××××××××.cz)
-@@ -89,7 +89,9 @@ asmlinkage void sparc64_set_context(struct pt_regs *regs)
- 	err |= __get_user(regs->u_regs[UREG_G4], (&(*grp)[MC_G4]));
- 	err |= __get_user(regs->u_regs[UREG_G5], (&(*grp)[MC_G5]));
- 	err |= __get_user(regs->u_regs[UREG_G6], (&(*grp)[MC_G6]));
--	err |= __get_user(regs->u_regs[UREG_G7], (&(*grp)[MC_G7]));
-+
-+	/* Skip %g7 as that's the thread register in userspace.  */
-+
- 	err |= __get_user(regs->u_regs[UREG_I0], (&(*grp)[MC_O0]));
- 	err |= __get_user(regs->u_regs[UREG_I1], (&(*grp)[MC_O1]));
- 	err |= __get_user(regs->u_regs[UREG_I2], (&(*grp)[MC_O2]));
-diff --git a/arch/sparc64/kernel/stacktrace.c b/arch/sparc64/kernel/stacktrace.c
-index c73ce3f..8d749ef 100644
---- a/arch/sparc64/kernel/stacktrace.c
-+++ b/arch/sparc64/kernel/stacktrace.c
-@@ -4,10 +4,12 @@
- #include <asm/ptrace.h>
- #include <asm/stacktrace.h>
- 
-+#include "kstack.h"
-+
- void save_stack_trace(struct stack_trace *trace)
- {
--	unsigned long ksp, fp, thread_base;
- 	struct thread_info *tp = task_thread_info(current);
-+	unsigned long ksp, fp;
- 
- 	stack_trace_flush();
- 
-@@ -17,21 +19,18 @@ void save_stack_trace(struct stack_trace *trace)
- 	);
- 
- 	fp = ksp + STACK_BIAS;
--	thread_base = (unsigned long) tp;
- 	do {
- 		struct sparc_stackf *sf;
- 		struct pt_regs *regs;
- 		unsigned long pc;
- 
--		/* Bogus frame pointer? */
--		if (fp < (thread_base + sizeof(struct thread_info)) ||
--		    fp >= (thread_base + THREAD_SIZE))
-+		if (!kstack_valid(tp, fp))
- 			break;
- 
- 		sf = (struct sparc_stackf *) fp;
- 		regs = (struct pt_regs *) (sf + 1);
- 
--		if ((regs->magic & ~0x1ff) == PT_REGS_MAGIC) {
-+		if (kstack_is_trap_frame(tp, regs)) {
- 			if (!(regs->tstate & TSTATE_PRIV))
- 				break;
- 			pc = regs->tpc;
-diff --git a/arch/sparc64/kernel/traps.c b/arch/sparc64/kernel/traps.c
-index 3697492..1389e38 100644
---- a/arch/sparc64/kernel/traps.c
-+++ b/arch/sparc64/kernel/traps.c
-@@ -43,6 +43,7 @@
- #include <asm/prom.h>
- 
- #include "entry.h"
-+#include "kstack.h"
- 
- /* When an irrecoverable trap occurs at tl > 0, the trap entry
-  * code logs the trap state registers at every level in the trap
-@@ -2120,14 +2121,12 @@ void show_stack(struct task_struct *tsk, unsigned long *_ksp)
- 		struct pt_regs *regs;
- 		unsigned long pc;
- 
--		/* Bogus frame pointer? */
--		if (fp < (thread_base + sizeof(struct thread_info)) ||
--		    fp >= (thread_base + THREAD_SIZE))
-+		if (!kstack_valid(tp, fp))
- 			break;
- 		sf = (struct sparc_stackf *) fp;
- 		regs = (struct pt_regs *) (sf + 1);
- 
--		if ((regs->magic & ~0x1ff) == PT_REGS_MAGIC) {
-+		if (kstack_is_trap_frame(tp, regs)) {
- 			if (!(regs->tstate & TSTATE_PRIV))
- 				break;
- 			pc = regs->tpc;
-diff --git a/arch/sparc64/lib/mcount.S b/arch/sparc64/lib/mcount.S
-index 9e4534b..0935f84 100644
---- a/arch/sparc64/lib/mcount.S
-+++ b/arch/sparc64/lib/mcount.S
-@@ -45,12 +45,45 @@ _mcount:
- 	sub		%g3, STACK_BIAS, %g3
- 	cmp		%sp, %g3
- 	bg,pt		%xcc, 1f
--	 sethi		%hi(panicstring), %g3
-+	 nop
-+	lduh		[%g6 + TI_CPU], %g1
-+	sethi		%hi(hardirq_stack), %g3
-+	or		%g3, %lo(hardirq_stack), %g3
-+	sllx		%g1, 3, %g1
-+	ldx		[%g3 + %g1], %g7
-+	sub		%g7, STACK_BIAS, %g7
-+	cmp		%sp, %g7
-+	bleu,pt		%xcc, 2f
-+	 sethi		%hi(THREAD_SIZE), %g3
-+	add		%g7, %g3, %g7
-+	cmp		%sp, %g7
-+	blu,pn		%xcc, 1f
-+2:	 sethi		%hi(softirq_stack), %g3
-+	or		%g3, %lo(softirq_stack), %g3
-+	ldx		[%g3 + %g1], %g7
-+	cmp		%sp, %g7
-+	bleu,pt		%xcc, 2f
-+	 sethi		%hi(THREAD_SIZE), %g3
-+	add		%g7, %g3, %g7
-+	cmp		%sp, %g7
-+	blu,pn		%xcc, 1f
-+	 nop
-+	/* If we are already on ovstack, don't hop onto it
-+	 * again, we are already trying to output the stack overflow
-+	 * message.
-+	 */
- 	sethi		%hi(ovstack), %g7		! cant move to panic stack fast enough
- 	 or		%g7, %lo(ovstack), %g7
--	add		%g7, OVSTACKSIZE, %g7
-+	add		%g7, OVSTACKSIZE, %g3
-+	sub		%g3, STACK_BIAS + 192, %g3
- 	sub		%g7, STACK_BIAS, %g7
--	mov		%g7, %sp
-+	cmp		%sp, %g7
-+	blu,pn		%xcc, 2f
-+	 cmp		%sp, %g3
-+	bleu,pn		%xcc, 1f
-+	 nop
-+2:	mov		%g3, %sp
-+	sethi		%hi(panicstring), %g3
- 	call		prom_printf
- 	 or		%g3, %lo(panicstring), %o0
- 	call		prom_halt
-diff --git a/arch/sparc64/mm/init.c b/arch/sparc64/mm/init.c
-index 84898c4..e289a98 100644
---- a/arch/sparc64/mm/init.c
-+++ b/arch/sparc64/mm/init.c
-@@ -49,6 +49,7 @@
- #include <asm/sstate.h>
- #include <asm/mdesc.h>
- #include <asm/cpudata.h>
-+#include <asm/irq.h>
- 
- #define MAX_PHYS_ADDRESS	(1UL << 42UL)
- #define KPTE_BITMAP_CHUNK_SZ	(256UL * 1024UL * 1024UL)
-@@ -1817,6 +1818,16 @@ void __init paging_init(void)
- 	if (tlb_type == hypervisor)
- 		sun4v_mdesc_init();
- 
-+	/* Once the OF device tree and MDESC have been setup, we know
-+	 * the list of possible cpus.  Therefore we can allocate the
-+	 * IRQ stacks.
-+	 */
-+	for_each_possible_cpu(i) {
-+		/* XXX Use node local allocations... XXX */
-+		softirq_stack[i] = __va(lmb_alloc(THREAD_SIZE, THREAD_SIZE));
-+		hardirq_stack[i] = __va(lmb_alloc(THREAD_SIZE, THREAD_SIZE));
-+	}
-+
- 	/* Setup bootmem... */
- 	last_valid_pfn = end_pfn = bootmem_init(phys_base);
- 
-diff --git a/arch/sparc64/mm/ultra.S b/arch/sparc64/mm/ultra.S
-index 9bb2d90..db57686 100644
---- a/arch/sparc64/mm/ultra.S
-+++ b/arch/sparc64/mm/ultra.S
-@@ -531,6 +531,13 @@ xcall_fetch_glob_regs:
- 	stx		%g7, [%g1 + GR_SNAP_TNPC]
- 	stx		%o7, [%g1 + GR_SNAP_O7]
- 	stx		%i7, [%g1 + GR_SNAP_I7]
-+	/* Don't try this at home kids... */
-+	rdpr		%cwp, %g2
-+	sub		%g2, 1, %g7
-+	wrpr		%g7, %cwp
-+	mov		%i7, %g7
-+	wrpr		%g2, %cwp
-+	stx		%g7, [%g1 + GR_SNAP_RPC]
- 	sethi		%hi(trap_block), %g7
- 	or		%g7, %lo(trap_block), %g7
- 	sllx		%g2, TRAP_BLOCK_SZ_SHIFT, %g2
-diff --git a/arch/x86/boot/boot.h b/arch/x86/boot/boot.h
-index a34b998..9d4b4b4 100644
---- a/arch/x86/boot/boot.h
-+++ b/arch/x86/boot/boot.h
-@@ -25,6 +25,8 @@
- #include <asm/boot.h>
- #include <asm/setup.h>
- 
-+#define NCAPINTS   8
-+
- /* Useful macros */
- #define BUILD_BUG_ON(condition) ((void)sizeof(char[1 - 2*!!(condition)]))
- 
-@@ -242,6 +244,12 @@ int cmdline_find_option(const char *option, char *buffer, int bufsize);
- int cmdline_find_option_bool(const char *option);
- 
- /* cpu.c, cpucheck.c */
-+struct cpu_features {
-+	int level;		/* Family, or 64 for x86-64 */
-+	int model;
-+	u32 flags[NCAPINTS];
-+};
-+extern struct cpu_features cpu;
- int check_cpu(int *cpu_level_ptr, int *req_level_ptr, u32 **err_flags_ptr);
- int validate_cpu(void);
- 
-diff --git a/arch/x86/boot/cpucheck.c b/arch/x86/boot/cpucheck.c
-index 7804389..c1ce030 100644
---- a/arch/x86/boot/cpucheck.c
-+++ b/arch/x86/boot/cpucheck.c
-@@ -30,13 +30,7 @@
- #include <asm/required-features.h>
- #include <asm/msr-index.h>
- 
--struct cpu_features {
--	int level;		/* Family, or 64 for x86-64 */
--	int model;
--	u32 flags[NCAPINTS];
--};
--
--static struct cpu_features cpu;
-+struct cpu_features cpu;
- static u32 cpu_vendor[3];
- static u32 err_flags[NCAPINTS];
- 
-diff --git a/arch/x86/boot/main.c b/arch/x86/boot/main.c
-index 77569a4..1b92cb6 100644
---- a/arch/x86/boot/main.c
-+++ b/arch/x86/boot/main.c
-@@ -73,6 +73,10 @@ static void keyboard_set_repeat(void)
-  */
- static void query_ist(void)
- {
-+	/* Some 486 BIOSes apparently crash on this call */
-+	if (cpu.level < 6)
-+		return;
-+
- 	asm("int $0x15"
- 	    : "=a" (boot_params.ist_info.signature),
- 	      "=b" (boot_params.ist_info.command),
-diff --git a/arch/x86/kernel/cpu/mtrr/generic.c b/arch/x86/kernel/cpu/mtrr/generic.c
-index 5d241ce..75b14b1 100644
---- a/arch/x86/kernel/cpu/mtrr/generic.c
-+++ b/arch/x86/kernel/cpu/mtrr/generic.c
-@@ -219,7 +219,7 @@ void __init get_mtrr_state(void)
- 		tom2 = hi;
- 		tom2 <<= 32;
- 		tom2 |= lo;
--		tom2 &= 0xffffff8000000ULL;
-+		tom2 &= 0xffffff800000ULL;
- 	}
- 	if (mtrr_show) {
- 		int high_width;
-diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
-index c26d811..67d00bc 100644
---- a/arch/x86/kvm/mmu.c
-+++ b/arch/x86/kvm/mmu.c
-@@ -1792,6 +1792,7 @@ int kvm_mmu_unprotect_page_virt(struct kvm_vcpu *vcpu, gva_t gva)
- 	spin_unlock(&vcpu->kvm->mmu_lock);
- 	return r;
- }
-+EXPORT_SYMBOL_GPL(kvm_mmu_unprotect_page_virt);
- 
- void __kvm_mmu_free_some_pages(struct kvm_vcpu *vcpu)
- {
-diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
-index 06992d6..7d6071d 100644
---- a/arch/x86/kvm/svm.c
-+++ b/arch/x86/kvm/svm.c
-@@ -1007,13 +1007,18 @@ static int pf_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
- 	struct kvm *kvm = svm->vcpu.kvm;
- 	u64 fault_address;
- 	u32 error_code;
-+	bool event_injection = false;
- 
- 	if (!irqchip_in_kernel(kvm) &&
--		is_external_interrupt(exit_int_info))
-+	    is_external_interrupt(exit_int_info)) {
-+		event_injection = true;
- 		push_irq(&svm->vcpu, exit_int_info & SVM_EVTINJ_VEC_MASK);
-+	}
- 
- 	fault_address  = svm->vmcb->control.exit_info_2;
- 	error_code = svm->vmcb->control.exit_info_1;
-+	if (event_injection)
-+		kvm_mmu_unprotect_page_virt(&svm->vcpu, fault_address);
- 	return kvm_mmu_page_fault(&svm->vcpu, fault_address, error_code);
- }
- 
-diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
-index 2ce9063..3ff39c1 100644
---- a/arch/x86/kvm/vmx.c
-+++ b/arch/x86/kvm/vmx.c
-@@ -2258,6 +2258,8 @@ static int handle_exception(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
- 		cr2 = vmcs_readl(EXIT_QUALIFICATION);
- 		KVMTRACE_3D(PAGE_FAULT, vcpu, error_code, (u32)cr2,
- 			    (u32)((u64)cr2 >> 32), handler);
-+		if (vect_info & VECTORING_INFO_VALID_MASK)
-+			kvm_mmu_unprotect_page_virt(vcpu, cr2);
- 		return kvm_mmu_page_fault(vcpu, cr2, error_code);
- 	}
- 
-diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index 5a7406e..8ab14ab 100644
---- a/arch/x86/kvm/x86.c
-+++ b/arch/x86/kvm/x86.c
-@@ -3168,6 +3168,10 @@ static void seg_desct_to_kvm_desct(struct desc_struct *seg_desc, u16 selector,
- 	kvm_desct->base |= seg_desc->base2 << 24;
- 	kvm_desct->limit = seg_desc->limit0;
- 	kvm_desct->limit |= seg_desc->limit << 16;
-+	if (seg_desc->g) {
-+		kvm_desct->limit <<= 12;
-+		kvm_desct->limit |= 0xfff;
-+	}
- 	kvm_desct->selector = selector;
- 	kvm_desct->type = seg_desc->type;
- 	kvm_desct->present = seg_desc->p;
-@@ -3207,6 +3211,7 @@ static void get_segment_descritptor_dtable(struct kvm_vcpu *vcpu,
- static int load_guest_segment_descriptor(struct kvm_vcpu *vcpu, u16 selector,
- 					 struct desc_struct *seg_desc)
- {
-+	gpa_t gpa;
- 	struct descriptor_table dtable;
- 	u16 index = selector >> 3;
- 
-@@ -3216,13 +3221,16 @@ static int load_guest_segment_descriptor(struct kvm_vcpu *vcpu, u16 selector,
- 		kvm_queue_exception_e(vcpu, GP_VECTOR, selector & 0xfffc);
- 		return 1;
- 	}
--	return kvm_read_guest(vcpu->kvm, dtable.base + index * 8, seg_desc, 8);
-+	gpa = vcpu->arch.mmu.gva_to_gpa(vcpu, dtable.base);
-+	gpa += index * 8;
-+	return kvm_read_guest(vcpu->kvm, gpa, seg_desc, 8);
- }
- 
- /* allowed just for 8 bytes segments */
- static int save_guest_segment_descriptor(struct kvm_vcpu *vcpu, u16 selector,
- 					 struct desc_struct *seg_desc)
- {
-+	gpa_t gpa;
- 	struct descriptor_table dtable;
- 	u16 index = selector >> 3;
- 
-@@ -3230,7 +3238,9 @@ static int save_guest_segment_descriptor(struct kvm_vcpu *vcpu, u16 selector,
- 
- 	if (dtable.limit < index * 8 + 7)
- 		return 1;
--	return kvm_write_guest(vcpu->kvm, dtable.base + index * 8, seg_desc, 8);
-+	gpa = vcpu->arch.mmu.gva_to_gpa(vcpu, dtable.base);
-+	gpa += index * 8;
-+	return kvm_write_guest(vcpu->kvm, gpa, seg_desc, 8);
- }
- 
- static u32 get_tss_base_addr(struct kvm_vcpu *vcpu,
-@@ -3242,55 +3252,7 @@ static u32 get_tss_base_addr(struct kvm_vcpu *vcpu,
- 	base_addr |= (seg_desc->base1 << 16);
- 	base_addr |= (seg_desc->base2 << 24);
- 
--	return base_addr;
--}
--
--static int load_tss_segment32(struct kvm_vcpu *vcpu,
--			      struct desc_struct *seg_desc,
--			      struct tss_segment_32 *tss)
--{
--	u32 base_addr;
--
--	base_addr = get_tss_base_addr(vcpu, seg_desc);
--
--	return kvm_read_guest(vcpu->kvm, base_addr, tss,
--			      sizeof(struct tss_segment_32));
--}
--
--static int save_tss_segment32(struct kvm_vcpu *vcpu,
--			      struct desc_struct *seg_desc,
--			      struct tss_segment_32 *tss)
--{
--	u32 base_addr;
--
--	base_addr = get_tss_base_addr(vcpu, seg_desc);
--
--	return kvm_write_guest(vcpu->kvm, base_addr, tss,
--			       sizeof(struct tss_segment_32));
--}
--
--static int load_tss_segment16(struct kvm_vcpu *vcpu,
--			      struct desc_struct *seg_desc,
--			      struct tss_segment_16 *tss)
--{
--	u32 base_addr;
--
--	base_addr = get_tss_base_addr(vcpu, seg_desc);
--
--	return kvm_read_guest(vcpu->kvm, base_addr, tss,
--			      sizeof(struct tss_segment_16));
--}
--
--static int save_tss_segment16(struct kvm_vcpu *vcpu,
--			      struct desc_struct *seg_desc,
--			      struct tss_segment_16 *tss)
--{
--	u32 base_addr;
--
--	base_addr = get_tss_base_addr(vcpu, seg_desc);
--
--	return kvm_write_guest(vcpu->kvm, base_addr, tss,
--			       sizeof(struct tss_segment_16));
-+	return vcpu->arch.mmu.gva_to_gpa(vcpu, base_addr);
- }
- 
- static u16 get_segment_selector(struct kvm_vcpu *vcpu, int seg)
-@@ -3450,20 +3412,26 @@ static int load_state_from_tss16(struct kvm_vcpu *vcpu,
- }
- 
- int kvm_task_switch_16(struct kvm_vcpu *vcpu, u16 tss_selector,
--		       struct desc_struct *cseg_desc,
-+		       u32 old_tss_base,
- 		       struct desc_struct *nseg_desc)
- {
- 	struct tss_segment_16 tss_segment_16;
- 	int ret = 0;
- 
--	if (load_tss_segment16(vcpu, cseg_desc, &tss_segment_16))
-+	if (kvm_read_guest(vcpu->kvm, old_tss_base, &tss_segment_16,
-+			   sizeof tss_segment_16))
- 		goto out;
- 
- 	save_state_to_tss16(vcpu, &tss_segment_16);
--	save_tss_segment16(vcpu, cseg_desc, &tss_segment_16);
- 
--	if (load_tss_segment16(vcpu, nseg_desc, &tss_segment_16))
-+	if (kvm_write_guest(vcpu->kvm, old_tss_base, &tss_segment_16,
-+			    sizeof tss_segment_16))
- 		goto out;
-+
-+	if (kvm_read_guest(vcpu->kvm, get_tss_base_addr(vcpu, nseg_desc),
-+			   &tss_segment_16, sizeof tss_segment_16))
-+		goto out;
-+
- 	if (load_state_from_tss16(vcpu, &tss_segment_16))
- 		goto out;
- 
-@@ -3473,20 +3441,26 @@ out:
- }
- 
- int kvm_task_switch_32(struct kvm_vcpu *vcpu, u16 tss_selector,
--		       struct desc_struct *cseg_desc,
-+		       u32 old_tss_base,
- 		       struct desc_struct *nseg_desc)
- {
- 	struct tss_segment_32 tss_segment_32;
- 	int ret = 0;
- 
--	if (load_tss_segment32(vcpu, cseg_desc, &tss_segment_32))
-+	if (kvm_read_guest(vcpu->kvm, old_tss_base, &tss_segment_32,
-+			   sizeof tss_segment_32))
- 		goto out;
- 
- 	save_state_to_tss32(vcpu, &tss_segment_32);
--	save_tss_segment32(vcpu, cseg_desc, &tss_segment_32);
- 
--	if (load_tss_segment32(vcpu, nseg_desc, &tss_segment_32))
-+	if (kvm_write_guest(vcpu->kvm, old_tss_base, &tss_segment_32,
-+			    sizeof tss_segment_32))
-+		goto out;
-+
-+	if (kvm_read_guest(vcpu->kvm, get_tss_base_addr(vcpu, nseg_desc),
-+			   &tss_segment_32, sizeof tss_segment_32))
- 		goto out;
-+
- 	if (load_state_from_tss32(vcpu, &tss_segment_32))
- 		goto out;
- 
-@@ -3501,16 +3475,20 @@ int kvm_task_switch(struct kvm_vcpu *vcpu, u16 tss_selector, int reason)
- 	struct desc_struct cseg_desc;
- 	struct desc_struct nseg_desc;
- 	int ret = 0;
-+	u32 old_tss_base = get_segment_base(vcpu, VCPU_SREG_TR);
-+	u16 old_tss_sel = get_segment_selector(vcpu, VCPU_SREG_TR);
- 
--	get_segment(vcpu, &tr_seg, VCPU_SREG_TR);
-+	old_tss_base = vcpu->arch.mmu.gva_to_gpa(vcpu, old_tss_base);
- 
-+	/* FIXME: Handle errors. Failure to read either TSS or their
-+	 * descriptors should generate a pagefault.
-+	 */
- 	if (load_guest_segment_descriptor(vcpu, tss_selector, &nseg_desc))
- 		goto out;
- 
--	if (load_guest_segment_descriptor(vcpu, tr_seg.selector, &cseg_desc))
-+	if (load_guest_segment_descriptor(vcpu, old_tss_sel, &cseg_desc))
- 		goto out;
- 
--
- 	if (reason != TASK_SWITCH_IRET) {
- 		int cpl;
- 
-@@ -3528,8 +3506,7 @@ int kvm_task_switch(struct kvm_vcpu *vcpu, u16 tss_selector, int reason)
- 
- 	if (reason == TASK_SWITCH_IRET || reason == TASK_SWITCH_JMP) {
- 		cseg_desc.type &= ~(1 << 1); //clear the B flag
--		save_guest_segment_descriptor(vcpu, tr_seg.selector,
--					      &cseg_desc);
-+		save_guest_segment_descriptor(vcpu, old_tss_sel, &cseg_desc);
- 	}
- 
- 	if (reason == TASK_SWITCH_IRET) {
-@@ -3541,10 +3518,10 @@ int kvm_task_switch(struct kvm_vcpu *vcpu, u16 tss_selector, int reason)
- 	kvm_x86_ops->cache_regs(vcpu);
- 
- 	if (nseg_desc.type & 8)
--		ret = kvm_task_switch_32(vcpu, tss_selector, &cseg_desc,
-+		ret = kvm_task_switch_32(vcpu, tss_selector, old_tss_base,
- 					 &nseg_desc);
- 	else
--		ret = kvm_task_switch_16(vcpu, tss_selector, &cseg_desc,
-+		ret = kvm_task_switch_16(vcpu, tss_selector, old_tss_base,
- 					 &nseg_desc);
- 
- 	if (reason == TASK_SWITCH_CALL || reason == TASK_SWITCH_GATE) {
-diff --git a/arch/x86/pci/k8-bus_64.c b/arch/x86/pci/k8-bus_64.c
-index 5c2799c..bfefdf0 100644
---- a/arch/x86/pci/k8-bus_64.c
-+++ b/arch/x86/pci/k8-bus_64.c
-@@ -384,7 +384,7 @@ static int __init early_fill_mp_bus_info(void)
- 	/* need to take out [0, TOM) for RAM*/
- 	address = MSR_K8_TOP_MEM1;
- 	rdmsrl(address, val);
--	end = (val & 0xffffff8000000ULL);
-+	end = (val & 0xffffff800000ULL);
- 	printk(KERN_INFO "TOM: %016lx aka %ldM\n", end, end>>20);
- 	if (end < (1ULL<<32))
- 		update_range(range, 0, end - 1);
-@@ -478,7 +478,7 @@ static int __init early_fill_mp_bus_info(void)
- 		/* TOP_MEM2 */
- 		address = MSR_K8_TOP_MEM2;
- 		rdmsrl(address, val);
--		end = (val & 0xffffff8000000ULL);
-+		end = (val & 0xffffff800000ULL);
- 		printk(KERN_INFO "TOM2: %016lx aka %ldM\n", end, end>>20);
- 		update_range(range, 1ULL<<32, end - 1);
- 	}
-diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
-index 78199c0..f1d2e8a 100644
---- a/block/scsi_ioctl.c
-+++ b/block/scsi_ioctl.c
-@@ -629,7 +629,7 @@ int scsi_cmd_ioctl(struct file *file, struct request_queue *q,
- 			hdr.sbp = cgc.sense;
- 			if (hdr.sbp)
- 				hdr.mx_sb_len = sizeof(struct request_sense);
--			hdr.timeout = cgc.timeout;
-+			hdr.timeout = jiffies_to_msecs(cgc.timeout);
- 			hdr.cmdp = ((struct cdrom_generic_command __user*) arg)->cmd;
- 			hdr.cmd_len = sizeof(cgc.cmd);
- 
-diff --git a/drivers/char/hw_random/via-rng.c b/drivers/char/hw_random/via-rng.c
-index f7feae4..128202e 100644
---- a/drivers/char/hw_random/via-rng.c
-+++ b/drivers/char/hw_random/via-rng.c
-@@ -31,6 +31,7 @@
- #include <asm/io.h>
- #include <asm/msr.h>
- #include <asm/cpufeature.h>
-+#include <asm/i387.h>
- 
- 
- #define PFX	KBUILD_MODNAME ": "
-@@ -67,16 +68,23 @@ enum {
-  * Another possible performance boost may come from simply buffering
-  * until we have 4 bytes, thus returning a u32 at a time,
-  * instead of the current u8-at-a-time.
-+ *
-+ * Padlock instructions can generate a spurious DNA fault, so
-+ * we have to call them in the context of irq_ts_save/restore()
-  */
- 
- static inline u32 xstore(u32 *addr, u32 edx_in)
- {
- 	u32 eax_out;
-+	int ts_state;
-+
-+	ts_state = irq_ts_save();
- 
- 	asm(".byte 0x0F,0xA7,0xC0 /* xstore %%edi (addr=%0) */"
- 		:"=m"(*addr), "=a"(eax_out)
- 		:"D"(addr), "d"(edx_in));
- 
-+	irq_ts_restore(ts_state);
- 	return eax_out;
- }
- 
-diff --git a/drivers/crypto/padlock-aes.c b/drivers/crypto/padlock-aes.c
-index bb30eb9..2a5c2db 100644
---- a/drivers/crypto/padlock-aes.c
-+++ b/drivers/crypto/padlock-aes.c
-@@ -16,6 +16,7 @@
- #include <linux/interrupt.h>
- #include <linux/kernel.h>
- #include <asm/byteorder.h>
-+#include <asm/i387.h>
- #include "padlock.h"
- 
- /* Control word. */
-@@ -141,6 +142,12 @@ static inline void padlock_reset_key(void)
- 	asm volatile ("pushfl; popfl");
- }
- 
-+/*
-+ * While the padlock instructions don't use FP/SSE registers, they
-+ * generate a spurious DNA fault when cr0.ts is '1'. These instructions
-+ * should be used only inside the irq_ts_save/restore() context
-+ */
-+
- static inline void padlock_xcrypt(const u8 *input, u8 *output, void *key,
- 				  void *control_word)
- {
-@@ -205,15 +212,23 @@ static inline u8 *padlock_xcrypt_cbc(const u8 *input, u8 *output, void *key,
- static void aes_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
- {
- 	struct aes_ctx *ctx = aes_ctx(tfm);
-+	int ts_state;
- 	padlock_reset_key();
-+
-+	ts_state = irq_ts_save();
- 	aes_crypt(in, out, ctx->E, &ctx->cword.encrypt);
-+	irq_ts_restore(ts_state);
- }
- 
- static void aes_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
- {
- 	struct aes_ctx *ctx = aes_ctx(tfm);
-+	int ts_state;
- 	padlock_reset_key();
-+
-+	ts_state = irq_ts_save();
- 	aes_crypt(in, out, ctx->D, &ctx->cword.decrypt);
-+	irq_ts_restore(ts_state);
- }
- 
- static struct crypto_alg aes_alg = {
-@@ -244,12 +259,14 @@ static int ecb_aes_encrypt(struct blkcipher_desc *desc,
- 	struct aes_ctx *ctx = blk_aes_ctx(desc->tfm);
- 	struct blkcipher_walk walk;
- 	int err;
-+	int ts_state;
- 
- 	padlock_reset_key();
- 
- 	blkcipher_walk_init(&walk, dst, src, nbytes);
- 	err = blkcipher_walk_virt(desc, &walk);
- 
-+	ts_state = irq_ts_save();
- 	while ((nbytes = walk.nbytes)) {
- 		padlock_xcrypt_ecb(walk.src.virt.addr, walk.dst.virt.addr,
- 				   ctx->E, &ctx->cword.encrypt,
-@@ -257,6 +274,7 @@ static int ecb_aes_encrypt(struct blkcipher_desc *desc,
- 		nbytes &= AES_BLOCK_SIZE - 1;
- 		err = blkcipher_walk_done(desc, &walk, nbytes);
- 	}
-+	irq_ts_restore(ts_state);
- 
- 	return err;
- }
-@@ -268,12 +286,14 @@ static int ecb_aes_decrypt(struct blkcipher_desc *desc,
- 	struct aes_ctx *ctx = blk_aes_ctx(desc->tfm);
- 	struct blkcipher_walk walk;
- 	int err;
-+	int ts_state;
- 
- 	padlock_reset_key();
- 
- 	blkcipher_walk_init(&walk, dst, src, nbytes);
- 	err = blkcipher_walk_virt(desc, &walk);
- 
-+	ts_state = irq_ts_save();
- 	while ((nbytes = walk.nbytes)) {
- 		padlock_xcrypt_ecb(walk.src.virt.addr, walk.dst.virt.addr,
- 				   ctx->D, &ctx->cword.decrypt,
-@@ -281,7 +301,7 @@ static int ecb_aes_decrypt(struct blkcipher_desc *desc,
- 		nbytes &= AES_BLOCK_SIZE - 1;
- 		err = blkcipher_walk_done(desc, &walk, nbytes);
- 	}
--
-+	irq_ts_restore(ts_state);
- 	return err;
- }
- 
-@@ -314,12 +334,14 @@ static int cbc_aes_encrypt(struct blkcipher_desc *desc,
- 	struct aes_ctx *ctx = blk_aes_ctx(desc->tfm);
- 	struct blkcipher_walk walk;
- 	int err;
-+	int ts_state;
- 
- 	padlock_reset_key();
- 
- 	blkcipher_walk_init(&walk, dst, src, nbytes);
- 	err = blkcipher_walk_virt(desc, &walk);
- 
-+	ts_state = irq_ts_save();
- 	while ((nbytes = walk.nbytes)) {
- 		u8 *iv = padlock_xcrypt_cbc(walk.src.virt.addr,
- 					    walk.dst.virt.addr, ctx->E,
-@@ -329,6 +351,7 @@ static int cbc_aes_encrypt(struct blkcipher_desc *desc,
- 		nbytes &= AES_BLOCK_SIZE - 1;
- 		err = blkcipher_walk_done(desc, &walk, nbytes);
- 	}
-+	irq_ts_restore(ts_state);
- 
- 	return err;
- }
-@@ -340,12 +363,14 @@ static int cbc_aes_decrypt(struct blkcipher_desc *desc,
- 	struct aes_ctx *ctx = blk_aes_ctx(desc->tfm);
- 	struct blkcipher_walk walk;
- 	int err;
-+	int ts_state;
- 
- 	padlock_reset_key();
- 
- 	blkcipher_walk_init(&walk, dst, src, nbytes);
- 	err = blkcipher_walk_virt(desc, &walk);
- 
-+	ts_state = irq_ts_save();
- 	while ((nbytes = walk.nbytes)) {
- 		padlock_xcrypt_cbc(walk.src.virt.addr, walk.dst.virt.addr,
- 				   ctx->D, walk.iv, &ctx->cword.decrypt,
-@@ -354,6 +379,7 @@ static int cbc_aes_decrypt(struct blkcipher_desc *desc,
- 		err = blkcipher_walk_done(desc, &walk, nbytes);
- 	}
- 
-+	irq_ts_restore(ts_state);
- 	return err;
- }
- 
-diff --git a/drivers/crypto/padlock-sha.c b/drivers/crypto/padlock-sha.c
-index c666b4e..355f8c6 100644
---- a/drivers/crypto/padlock-sha.c
-+++ b/drivers/crypto/padlock-sha.c
-@@ -22,6 +22,7 @@
- #include <linux/interrupt.h>
- #include <linux/kernel.h>
- #include <linux/scatterlist.h>
-+#include <asm/i387.h>
- #include "padlock.h"
- 
- #define SHA1_DEFAULT_FALLBACK	"sha1-generic"
-@@ -102,6 +103,7 @@ static void padlock_do_sha1(const char *in, char *out, int count)
- 	 *     PadLock microcode needs it that big. */
- 	char buf[128+16];
- 	char *result = NEAREST_ALIGNED(buf);
-+	int ts_state;
- 
- 	((uint32_t *)result)[0] = SHA1_H0;
- 	((uint32_t *)result)[1] = SHA1_H1;
-@@ -109,9 +111,12 @@ static void padlock_do_sha1(const char *in, char *out, int count)
- 	((uint32_t *)result)[3] = SHA1_H3;
- 	((uint32_t *)result)[4] = SHA1_H4;
-  
-+	/* prevent taking the spurious DNA fault with padlock. */
-+	ts_state = irq_ts_save();
- 	asm volatile (".byte 0xf3,0x0f,0xa6,0xc8" /* rep xsha1 */
- 		      : "+S"(in), "+D"(result)
- 		      : "c"(count), "a"(0));
-+	irq_ts_restore(ts_state);
- 
- 	padlock_output_block((uint32_t *)result, (uint32_t *)out, 5);
- }
-@@ -123,6 +128,7 @@ static void padlock_do_sha256(const char *in, char *out, int count)
- 	 *     PadLock microcode needs it that big. */
- 	char buf[128+16];
- 	char *result = NEAREST_ALIGNED(buf);
-+	int ts_state;
- 
- 	((uint32_t *)result)[0] = SHA256_H0;
- 	((uint32_t *)result)[1] = SHA256_H1;
-@@ -133,9 +139,12 @@ static void padlock_do_sha256(const char *in, char *out, int count)
- 	((uint32_t *)result)[6] = SHA256_H6;
- 	((uint32_t *)result)[7] = SHA256_H7;
- 
-+	/* prevent taking the spurious DNA fault with padlock. */
-+	ts_state = irq_ts_save();
- 	asm volatile (".byte 0xf3,0x0f,0xa6,0xd0" /* rep xsha256 */
- 		      : "+S"(in), "+D"(result)
- 		      : "c"(count), "a"(0));
-+	irq_ts_restore(ts_state);
- 
- 	padlock_output_block((uint32_t *)result, (uint32_t *)out, 8);
- }
-diff --git a/drivers/i2c/Kconfig b/drivers/i2c/Kconfig
-index 9686734..711ca08 100644
---- a/drivers/i2c/Kconfig
-+++ b/drivers/i2c/Kconfig
-@@ -38,6 +38,20 @@ config I2C_CHARDEV
- 	  This support is also available as a module.  If so, the module 
- 	  will be called i2c-dev.
- 
-+config I2C_HELPER_AUTO
-+	bool "Autoselect pertinent helper modules"
-+	default y
-+	help
-+	  Some I2C bus drivers require so-called "I2C algorithm" modules
-+	  to work. These are basically software-only abstractions of generic
-+	  I2C interfaces. This option will autoselect them so that you don't
-+	  have to care.
-+
-+	  Unselect this only if you need to enable additional helper
-+	  modules, for example for use with external I2C bus drivers.
-+
-+	  In doubt, say Y.
-+
- source drivers/i2c/algos/Kconfig
- source drivers/i2c/busses/Kconfig
- source drivers/i2c/chips/Kconfig
-diff --git a/drivers/i2c/algos/Kconfig b/drivers/i2c/algos/Kconfig
-index 7137a17..b788579 100644
---- a/drivers/i2c/algos/Kconfig
-+++ b/drivers/i2c/algos/Kconfig
-@@ -2,15 +2,20 @@
- # I2C algorithm drivers configuration
- #
- 
-+menu "I2C Algorithms"
-+	depends on !I2C_HELPER_AUTO
-+
- config I2C_ALGOBIT
--	tristate
-+	tristate "I2C bit-banging interfaces"
- 
- config I2C_ALGOPCF
--	tristate
-+	tristate "I2C PCF 8584 interfaces"
- 
- config I2C_ALGOPCA
--	tristate
-+	tristate "I2C PCA 9564 interfaces"
- 
- config I2C_ALGO_SGI
- 	tristate
- 	depends on SGI_IP22 || SGI_IP32 || X86_VISWS
-+
-+endmenu
-diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
-index d0175f4..08a7384 100644
---- a/drivers/i2c/i2c-core.c
-+++ b/drivers/i2c/i2c-core.c
-@@ -1196,9 +1196,11 @@ i2c_new_probed_device(struct i2c_adapter *adap,
- 		if ((addr_list[i] & ~0x07) == 0x30
- 		 || (addr_list[i] & ~0x0f) == 0x50
- 		 || !i2c_check_functionality(adap, I2C_FUNC_SMBUS_QUICK)) {
-+			union i2c_smbus_data data;
-+
- 			if (i2c_smbus_xfer(adap, addr_list[i], 0,
- 					   I2C_SMBUS_READ, 0,
--					   I2C_SMBUS_BYTE, NULL) >= 0)
-+					   I2C_SMBUS_BYTE, &data) >= 0)
- 				break;
- 		} else {
- 			if (i2c_smbus_xfer(adap, addr_list[i], 0,
-diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
-index 0cc854e..614f9ce 100644
---- a/drivers/ide/ide-cd.c
-+++ b/drivers/ide/ide-cd.c
-@@ -1298,6 +1298,7 @@ static int cdrom_read_capacity(ide_drive_t *drive, unsigned long *capacity,
- 
- 	int stat;
- 	struct request req;
-+	u32 blocklen;
- 
- 	ide_cd_init_rq(drive, &req);
- 
-@@ -1314,23 +1315,24 @@ static int cdrom_read_capacity(ide_drive_t *drive, unsigned long *capacity,
- 	/*
- 	 * Sanity check the given block size
- 	 */
--	switch (capbuf.blocklen) {
--	case __constant_cpu_to_be32(512):
--	case __constant_cpu_to_be32(1024):
--	case __constant_cpu_to_be32(2048):
--	case __constant_cpu_to_be32(4096):
-+	blocklen = be32_to_cpu(capbuf.blocklen);
-+	switch (blocklen) {
-+	case 512:
-+	case 1024:
-+	case 2048:
-+	case 4096:
- 		break;
- 	default:
- 		printk(KERN_ERR "%s: weird block size %u\n",
--			drive->name, capbuf.blocklen);
-+			drive->name, blocklen);
- 		printk(KERN_ERR "%s: default to 2kb block size\n",
- 			drive->name);
--		capbuf.blocklen = __constant_cpu_to_be32(2048);
-+		blocklen = 2048;
- 		break;
- 	}
- 
- 	*capacity = 1 + be32_to_cpu(capbuf.lba);
--	*sectors_per_frame = be32_to_cpu(capbuf.blocklen) >> SECTOR_BITS;
-+	*sectors_per_frame = blocklen >> SECTOR_BITS;
- 	return 0;
- }
- 
-diff --git a/drivers/ide/pci/cs5520.c b/drivers/ide/pci/cs5520.c
-index 992b1cf..0cfddf4 100644
---- a/drivers/ide/pci/cs5520.c
-+++ b/drivers/ide/pci/cs5520.c
-@@ -123,6 +123,7 @@ static const struct ide_dma_ops cs5520_dma_ops = {
- #define DECLARE_CS_DEV(name_str)				\
- 	{							\
- 		.name		= name_str,			\
-+		.enablebits	= { {0x60, 0x01, 0x01}, {0x60, 0x02, 0x02} }, \
- 		.port_ops	= &cs5520_port_ops,		\
- 		.dma_ops	= &cs5520_dma_ops,		\
- 		.host_flags	= IDE_HFLAG_ISA_PORTS |		\
-diff --git a/drivers/ide/pci/it821x.c b/drivers/ide/pci/it821x.c
-index 6ab0411..cbf6472 100644
---- a/drivers/ide/pci/it821x.c
-+++ b/drivers/ide/pci/it821x.c
-@@ -512,8 +512,14 @@ static void __devinit it821x_quirkproc(ide_drive_t *drive)
- }
- 
- static struct ide_dma_ops it821x_pass_through_dma_ops = {
-+	.dma_host_set		= ide_dma_host_set,
-+	.dma_setup		= ide_dma_setup,
-+	.dma_exec_cmd		= ide_dma_exec_cmd,
- 	.dma_start		= it821x_dma_start,
- 	.dma_end		= it821x_dma_end,
-+	.dma_test_irq		= ide_dma_test_irq,
-+	.dma_timeout		= ide_dma_timeout,
-+	.dma_lost_irq		= ide_dma_lost_irq,
- };
- 
- /**
-diff --git a/drivers/misc/acer-wmi.c b/drivers/misc/acer-wmi.c
-index dd13a37..3a3e4c1 100644
---- a/drivers/misc/acer-wmi.c
-+++ b/drivers/misc/acer-wmi.c
-@@ -742,11 +742,30 @@ static acpi_status get_u32(u32 *value, u32 cap)
- 
- static acpi_status set_u32(u32 value, u32 cap)
- {
-+	acpi_status status;
-+
- 	if (interface->capability & cap) {
- 		switch (interface->type) {
- 		case ACER_AMW0:
- 			return AMW0_set_u32(value, cap, interface);
- 		case ACER_AMW0_V2:
-+			if (cap == ACER_CAP_MAILLED)
-+				return AMW0_set_u32(value, cap, interface);
-+
-+			/*
-+			 * On some models, some WMID methods don't toggle
-+			 * properly. For those cases, we want to run the AMW0
-+			 * method afterwards to be certain we've really toggled
-+			 * the device state.
-+			 */
-+			if (cap == ACER_CAP_WIRELESS ||
-+				cap == ACER_CAP_BLUETOOTH) {
-+				status = WMID_set_u32(value, cap, interface);
-+				if (ACPI_FAILURE(status))
-+					return status;
-+
-+				return AMW0_set_u32(value, cap, interface);
-+			}
- 		case ACER_WMID:
- 			return WMID_set_u32(value, cap, interface);
- 		default:
-diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
-index 6572425..42d7c0a 100644
---- a/drivers/net/r8169.c
-+++ b/drivers/net/r8169.c
-@@ -1438,8 +1438,10 @@ static void rtl8169_init_phy(struct net_device *dev, struct rtl8169_private *tp)
- 
- 	rtl_hw_phy_config(dev);
- 
--	dprintk("Set MAC Reg C+CR Offset 0x82h = 0x01h\n");
--	RTL_W8(0x82, 0x01);
-+	if (tp->mac_version <= RTL_GIGA_MAC_VER_06) {
-+		dprintk("Set MAC Reg C+CR Offset 0x82h = 0x01h\n");
-+		RTL_W8(0x82, 0x01);
-+	}
- 
- 	pci_write_config_byte(tp->pci_dev, PCI_LATENCY_TIMER, 0x40);
- 
-diff --git a/drivers/net/wireless/rtl8187.h b/drivers/net/wireless/rtl8187.h
-index 076d88b..aefd4f6 100644
---- a/drivers/net/wireless/rtl8187.h
-+++ b/drivers/net/wireless/rtl8187.h
-@@ -67,6 +67,10 @@ struct rtl8187_priv {
- 	const struct rtl818x_rf_ops *rf;
- 	struct ieee80211_vif *vif;
- 	int mode;
-+	/* The mutex protects the TX loopback state.
-+	 * Any attempt to set channels concurrently locks the device.
-+	 */
-+	struct mutex conf_mutex;
- 
- 	/* rtl8187 specific */
- 	struct ieee80211_channel channels[14];
-diff --git a/drivers/net/wireless/rtl8187_dev.c b/drivers/net/wireless/rtl8187_dev.c
-index 9223ada..d49d1c6 100644
---- a/drivers/net/wireless/rtl8187_dev.c
-+++ b/drivers/net/wireless/rtl8187_dev.c
-@@ -580,6 +580,7 @@ static int rtl8187_config(struct ieee80211_hw *dev, struct ieee80211_conf *conf)
- 	struct rtl8187_priv *priv = dev->priv;
- 	u32 reg;
- 
-+	mutex_lock(&priv->conf_mutex);
- 	reg = rtl818x_ioread32(priv, &priv->map->TX_CONF);
- 	/* Enable TX loopback on MAC level to avoid TX during channel
- 	 * changes, as this has be seen to causes problems and the
-@@ -610,6 +611,7 @@ static int rtl8187_config(struct ieee80211_hw *dev, struct ieee80211_conf *conf)
- 	rtl818x_iowrite16(priv, &priv->map->ATIMTR_INTERVAL, 100);
- 	rtl818x_iowrite16(priv, &priv->map->BEACON_INTERVAL, 100);
- 	rtl818x_iowrite16(priv, &priv->map->BEACON_INTERVAL_TIME, 100);
-+	mutex_unlock(&priv->conf_mutex);
- 	return 0;
- }
- 
-@@ -814,6 +816,7 @@ static int __devinit rtl8187_probe(struct usb_interface *intf,
- 		printk(KERN_ERR "rtl8187: Cannot register device\n");
- 		goto err_free_dev;
- 	}
-+	mutex_init(&priv->conf_mutex);
- 
- 	printk(KERN_INFO "%s: hwaddr %s, rtl8187 V%d + %s\n",
- 	       wiphy_name(dev->wiphy), print_mac(mac, dev->wiphy->perm_addr),
-diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
-index 338a3f9..c14de8e 100644
---- a/drivers/pci/quirks.c
-+++ b/drivers/pci/quirks.c
-@@ -1683,9 +1683,14 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_VIA, 0x324e, quirk_via_cx700_pci_parking_c
-  */
- static void __devinit quirk_brcm_570x_limit_vpd(struct pci_dev *dev)
- {
--	/*  Only disable the VPD capability for 5706, 5708, and 5709 rev. A */
-+	/*
-+	 * Only disable the VPD capability for 5706, 5706S, 5708,
-+	 * 5708S and 5709 rev. A
-+	 */
- 	if ((dev->device == PCI_DEVICE_ID_NX2_5706) ||
-+	    (dev->device == PCI_DEVICE_ID_NX2_5706S) ||
- 	    (dev->device == PCI_DEVICE_ID_NX2_5708) ||
-+  	    (dev->device == PCI_DEVICE_ID_NX2_5708S) ||
- 	    ((dev->device == PCI_DEVICE_ID_NX2_5709) &&
- 	     (dev->revision & 0xf0) == 0x0)) {
- 		if (dev->vpd)
-diff --git a/drivers/scsi/hptiop.c b/drivers/scsi/hptiop.c
-index da876d3..74d12b5 100644
---- a/drivers/scsi/hptiop.c
-+++ b/drivers/scsi/hptiop.c
-@@ -1249,6 +1249,13 @@ static struct pci_device_id hptiop_id_table[] = {
- 	{ PCI_VDEVICE(TTI, 0x3522), (kernel_ulong_t)&hptiop_itl_ops },
- 	{ PCI_VDEVICE(TTI, 0x3410), (kernel_ulong_t)&hptiop_itl_ops },
- 	{ PCI_VDEVICE(TTI, 0x3540), (kernel_ulong_t)&hptiop_itl_ops },
-+	{ PCI_VDEVICE(TTI, 0x3530), (kernel_ulong_t)&hptiop_itl_ops },
-+	{ PCI_VDEVICE(TTI, 0x3560), (kernel_ulong_t)&hptiop_itl_ops },
-+	{ PCI_VDEVICE(TTI, 0x4322), (kernel_ulong_t)&hptiop_itl_ops },
-+	{ PCI_VDEVICE(TTI, 0x4210), (kernel_ulong_t)&hptiop_itl_ops },
-+	{ PCI_VDEVICE(TTI, 0x4211), (kernel_ulong_t)&hptiop_itl_ops },
-+	{ PCI_VDEVICE(TTI, 0x4310), (kernel_ulong_t)&hptiop_itl_ops },
-+	{ PCI_VDEVICE(TTI, 0x4311), (kernel_ulong_t)&hptiop_itl_ops },
- 	{ PCI_VDEVICE(TTI, 0x3120), (kernel_ulong_t)&hptiop_mv_ops },
- 	{ PCI_VDEVICE(TTI, 0x3122), (kernel_ulong_t)&hptiop_mv_ops },
- 	{ PCI_VDEVICE(TTI, 0x3020), (kernel_ulong_t)&hptiop_mv_ops },
-diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
-index 8dd88fc..8728e87 100644
---- a/drivers/scsi/qla2xxx/qla_attr.c
-+++ b/drivers/scsi/qla2xxx/qla_attr.c
-@@ -972,26 +972,39 @@ qla2x00_get_starget_port_id(struct scsi_target *starget)
- }
- 
- static void
--qla2x00_get_rport_loss_tmo(struct fc_rport *rport)
-+qla2x00_set_rport_loss_tmo(struct fc_rport *rport, uint32_t timeout)
- {
--	struct Scsi_Host *host = rport_to_shost(rport);
--	scsi_qla_host_t *ha = shost_priv(host);
--
--	rport->dev_loss_tmo = ha->port_down_retry_count + 5;
-+	if (timeout)
-+		rport->dev_loss_tmo = timeout;
-+	else
-+		rport->dev_loss_tmo = 1;
- }
- 
- static void
--qla2x00_set_rport_loss_tmo(struct fc_rport *rport, uint32_t timeout)
-+qla2x00_dev_loss_tmo_callbk(struct fc_rport *rport)
- {
- 	struct Scsi_Host *host = rport_to_shost(rport);
--	scsi_qla_host_t *ha = shost_priv(host);
-+	fc_port_t *fcport = *(fc_port_t **)rport->dd_data;
-+
-+	qla2x00_abort_fcport_cmds(fcport);
-+
-+	/*
-+	 * Transport has effectively 'deleted' the rport, clear
-+	 * all local references.
-+	 */
-+	spin_lock_irq(host->host_lock);
-+	fcport->rport = NULL;
-+	*((fc_port_t **)rport->dd_data) = NULL;
-+	spin_unlock_irq(host->host_lock);
-+}
- 
--	if (timeout)
--		ha->port_down_retry_count = timeout;
--	else
--		ha->port_down_retry_count = 1;
-+static void
-+qla2x00_terminate_rport_io(struct fc_rport *rport)
-+{
-+	fc_port_t *fcport = *(fc_port_t **)rport->dd_data;
- 
--	rport->dev_loss_tmo = ha->port_down_retry_count + 5;
-+	qla2x00_abort_fcport_cmds(fcport);
-+	scsi_target_unblock(&rport->dev);
- }
- 
- static int
-@@ -1248,11 +1261,12 @@ struct fc_function_template qla2xxx_transport_functions = {
- 	.get_starget_port_id  = qla2x00_get_starget_port_id,
- 	.show_starget_port_id = 1,
- 
--	.get_rport_dev_loss_tmo = qla2x00_get_rport_loss_tmo,
- 	.set_rport_dev_loss_tmo = qla2x00_set_rport_loss_tmo,
- 	.show_rport_dev_loss_tmo = 1,
- 
- 	.issue_fc_host_lip = qla2x00_issue_lip,
-+	.dev_loss_tmo_callbk = qla2x00_dev_loss_tmo_callbk,
-+	.terminate_rport_io = qla2x00_terminate_rport_io,
- 	.get_fc_host_stats = qla2x00_get_fc_host_stats,
- 
- 	.vport_create = qla24xx_vport_create,
-@@ -1291,11 +1305,12 @@ struct fc_function_template qla2xxx_transport_vport_functions = {
- 	.get_starget_port_id  = qla2x00_get_starget_port_id,
- 	.show_starget_port_id = 1,
- 
--	.get_rport_dev_loss_tmo = qla2x00_get_rport_loss_tmo,
- 	.set_rport_dev_loss_tmo = qla2x00_set_rport_loss_tmo,
- 	.show_rport_dev_loss_tmo = 1,
- 
- 	.issue_fc_host_lip = qla2x00_issue_lip,
-+	.dev_loss_tmo_callbk = qla2x00_dev_loss_tmo_callbk,
-+	.terminate_rport_io = qla2x00_terminate_rport_io,
- 	.get_fc_host_stats = qla2x00_get_fc_host_stats,
- };
- 
-diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
-index 8dd6000..7b0ddc8 100644
---- a/drivers/scsi/qla2xxx/qla_def.h
-+++ b/drivers/scsi/qla2xxx/qla_def.h
-@@ -1544,7 +1544,6 @@ typedef struct fc_port {
- 	int login_retry;
- 	atomic_t port_down_timer;
- 
--	spinlock_t rport_lock;
- 	struct fc_rport *rport, *drport;
- 	u32 supported_classes;
- 
-diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
-index 9b4bebe..5a50fb7 100644
---- a/drivers/scsi/qla2xxx/qla_gbl.h
-+++ b/drivers/scsi/qla2xxx/qla_gbl.h
-@@ -71,6 +71,8 @@ extern int qla2x00_post_aen_work(struct scsi_qla_host *, enum
- extern int qla2x00_post_hwe_work(struct scsi_qla_host *, uint16_t , uint16_t,
-     uint16_t, uint16_t);
- 
-+extern void qla2x00_abort_fcport_cmds(fc_port_t *);
-+
- /*
-  * Global Functions in qla_mid.c source file.
-  */
-diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
-index bbbc5a6..c7388fa 100644
---- a/drivers/scsi/qla2xxx/qla_init.c
-+++ b/drivers/scsi/qla2xxx/qla_init.c
-@@ -1864,12 +1864,11 @@ qla2x00_rport_del(void *data)
- {
- 	fc_port_t *fcport = data;
- 	struct fc_rport *rport;
--	unsigned long flags;
- 
--	spin_lock_irqsave(&fcport->rport_lock, flags);
-+	spin_lock_irq(fcport->ha->host->host_lock);
- 	rport = fcport->drport;
- 	fcport->drport = NULL;
--	spin_unlock_irqrestore(&fcport->rport_lock, flags);
-+	spin_unlock_irq(fcport->ha->host->host_lock);
- 	if (rport)
- 		fc_remote_port_delete(rport);
- }
-@@ -1898,7 +1897,6 @@ qla2x00_alloc_fcport(scsi_qla_host_t *ha, gfp_t flags)
- 	atomic_set(&fcport->state, FCS_UNCONFIGURED);
- 	fcport->flags = FCF_RLC_SUPPORT;
- 	fcport->supported_classes = FC_COS_UNSPECIFIED;
--	spin_lock_init(&fcport->rport_lock);
- 
- 	return fcport;
- }
-@@ -2243,28 +2241,24 @@ qla2x00_reg_remote_port(scsi_qla_host_t *ha, fc_port_t *fcport)
- {
- 	struct fc_rport_identifiers rport_ids;
- 	struct fc_rport *rport;
--	unsigned long flags;
- 
- 	if (fcport->drport)
- 		qla2x00_rport_del(fcport);
--	if (fcport->rport)
--		return;
- 
- 	rport_ids.node_name = wwn_to_u64(fcport->node_name);
- 	rport_ids.port_name = wwn_to_u64(fcport->port_name);
- 	rport_ids.port_id = fcport->d_id.b.domain << 16 |
- 	    fcport->d_id.b.area << 8 | fcport->d_id.b.al_pa;
- 	rport_ids.roles = FC_RPORT_ROLE_UNKNOWN;
--	rport = fc_remote_port_add(ha->host, 0, &rport_ids);
-+	fcport->rport = rport = fc_remote_port_add(ha->host, 0, &rport_ids);
- 	if (!rport) {
- 		qla_printk(KERN_WARNING, ha,
- 		    "Unable to allocate fc remote port!\n");
- 		return;
- 	}
--	spin_lock_irqsave(&fcport->rport_lock, flags);
--	fcport->rport = rport;
-+	spin_lock_irq(fcport->ha->host->host_lock);
- 	*((fc_port_t **)rport->dd_data) = fcport;
--	spin_unlock_irqrestore(&fcport->rport_lock, flags);
-+	spin_unlock_irq(fcport->ha->host->host_lock);
- 
- 	rport->supported_classes = fcport->supported_classes;
- 
-diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
-index 48eaa3b..047ee64 100644
---- a/drivers/scsi/qla2xxx/qla_os.c
-+++ b/drivers/scsi/qla2xxx/qla_os.c
-@@ -388,7 +388,7 @@ qla2x00_queuecommand(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *))
- 	}
- 
- 	/* Close window on fcport/rport state-transitioning. */
--	if (!*(fc_port_t **)rport->dd_data) {
-+	if (fcport->drport) {
- 		cmd->result = DID_IMM_RETRY << 16;
- 		goto qc_fail_command;
- 	}
-@@ -455,7 +455,7 @@ qla24xx_queuecommand(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *))
- 	}
- 
- 	/* Close window on fcport/rport state-transitioning. */
--	if (!*(fc_port_t **)rport->dd_data) {
-+	if (fcport->drport) {
- 		cmd->result = DID_IMM_RETRY << 16;
- 		goto qc24_fail_command;
- 	}
-@@ -617,6 +617,40 @@ qla2x00_wait_for_loop_ready(scsi_qla_host_t *ha)
- 	return (return_status);
- }
- 
-+void
-+qla2x00_abort_fcport_cmds(fc_port_t *fcport)
-+{
-+	int cnt;
-+	unsigned long flags;
-+	srb_t *sp;
-+	scsi_qla_host_t *ha = fcport->ha;
-+	scsi_qla_host_t *pha = to_qla_parent(ha);
-+
-+	spin_lock_irqsave(&pha->hardware_lock, flags);
-+	for (cnt = 1; cnt < MAX_OUTSTANDING_COMMANDS; cnt++) {
-+		sp = pha->outstanding_cmds[cnt];
-+		if (!sp)
-+			continue;
-+		if (sp->fcport != fcport)
-+			continue;
-+
-+		spin_unlock_irqrestore(&pha->hardware_lock, flags);
-+		if (ha->isp_ops->abort_command(ha, sp)) {
-+			DEBUG2(qla_printk(KERN_WARNING, ha,
-+			    "Abort failed --  %lx\n", sp->cmd->serial_number));
-+		} else {
-+			if (qla2x00_eh_wait_on_command(ha, sp->cmd) !=
-+			    QLA_SUCCESS)
-+				DEBUG2(qla_printk(KERN_WARNING, ha,
-+				    "Abort failed while waiting --  %lx\n",
-+				    sp->cmd->serial_number));
-+
-+		}
-+		spin_lock_irqsave(&pha->hardware_lock, flags);
-+	}
-+	spin_unlock_irqrestore(&pha->hardware_lock, flags);
-+}
-+
- static void
- qla2x00_block_error_handler(struct scsi_cmnd *cmnd)
- {
-@@ -1073,7 +1107,7 @@ qla2xxx_slave_configure(struct scsi_device *sdev)
- 	else
- 		scsi_deactivate_tcq(sdev, ha->max_q_depth);
- 
--	rport->dev_loss_tmo = ha->port_down_retry_count + 5;
-+	rport->dev_loss_tmo = ha->port_down_retry_count;
- 
- 	return 0;
- }
-@@ -1813,7 +1847,6 @@ static inline void
- qla2x00_schedule_rport_del(struct scsi_qla_host *ha, fc_port_t *fcport,
-     int defer)
- {
--	unsigned long flags;
- 	struct fc_rport *rport;
- 
- 	if (!fcport->rport)
-@@ -1821,19 +1854,13 @@ qla2x00_schedule_rport_del(struct scsi_qla_host *ha, fc_port_t *fcport,
- 
- 	rport = fcport->rport;
- 	if (defer) {
--		spin_lock_irqsave(&fcport->rport_lock, flags);
-+		spin_lock_irq(ha->host->host_lock);
- 		fcport->drport = rport;
--		fcport->rport = NULL;
--		*(fc_port_t **)rport->dd_data = NULL;
--		spin_unlock_irqrestore(&fcport->rport_lock, flags);
-+		spin_unlock_irq(ha->host->host_lock);
- 		set_bit(FCPORT_UPDATE_NEEDED, &ha->dpc_flags);
--	} else {
--		spin_lock_irqsave(&fcport->rport_lock, flags);
--		fcport->rport = NULL;
--		*(fc_port_t **)rport->dd_data = NULL;
--		spin_unlock_irqrestore(&fcport->rport_lock, flags);
-+		qla2xxx_wake_dpc(ha);
-+	} else
- 		fc_remote_port_delete(rport);
--	}
- }
- 
- /*
-diff --git a/drivers/scsi/scsi_transport_spi.c b/drivers/scsi/scsi_transport_spi.c
-index 75a64a6..b29360e 100644
---- a/drivers/scsi/scsi_transport_spi.c
-+++ b/drivers/scsi/scsi_transport_spi.c
-@@ -366,12 +366,14 @@ spi_transport_rd_attr(rti, "%d\n");
- spi_transport_rd_attr(pcomp_en, "%d\n");
- spi_transport_rd_attr(hold_mcs, "%d\n");
- 
--/* we only care about the first child device so we return 1 */
-+/* we only care about the first child device that's a real SCSI device
-+ * so we return 1 to terminate the iteration when we find it */
- static int child_iter(struct device *dev, void *data)
- {
--	struct scsi_device *sdev = to_scsi_device(dev);
-+	if (!scsi_is_sdev_device(dev))
-+		return 0;
- 
--	spi_dv_device(sdev);
-+	spi_dv_device(to_scsi_device(dev));
- 	return 1;
- }
- 
-diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
-index 0fe031f..1bcf3c3 100644
---- a/drivers/scsi/ses.c
-+++ b/drivers/scsi/ses.c
-@@ -345,14 +345,14 @@ static int ses_enclosure_find_by_addr(struct enclosure_device *edev,
- 	return 0;
- }
- 
--#define VPD_INQUIRY_SIZE 512
-+#define VPD_INQUIRY_SIZE 36
- 
- static void ses_match_to_enclosure(struct enclosure_device *edev,
- 				   struct scsi_device *sdev)
- {
- 	unsigned char *buf = kmalloc(VPD_INQUIRY_SIZE, GFP_KERNEL);
- 	unsigned char *desc;
--	int len;
-+	u16 vpd_len;
- 	struct efd efd = {
- 		.addr = 0,
- 	};
-@@ -372,9 +372,19 @@ static void ses_match_to_enclosure(struct enclosure_device *edev,
- 			     VPD_INQUIRY_SIZE, NULL, SES_TIMEOUT, SES_RETRIES))
- 		goto free;
- 
--	len = (buf[2] << 8) + buf[3];
-+	vpd_len = (buf[2] << 8) + buf[3];
-+	kfree(buf);
-+	buf = kmalloc(vpd_len, GFP_KERNEL);
-+	if (!buf)
-+		return;
-+	cmd[3] = vpd_len >> 8;
-+	cmd[4] = vpd_len & 0xff;
-+	if (scsi_execute_req(sdev, cmd, DMA_FROM_DEVICE, buf,
-+			     vpd_len, NULL, SES_TIMEOUT, SES_RETRIES))
-+		goto free;
-+
- 	desc = buf + 4;
--	while (desc < buf + len) {
-+	while (desc < buf + vpd_len) {
- 		enum scsi_protocol proto = desc[0] >> 4;
- 		u8 code_set = desc[0] & 0x0f;
- 		u8 piv = desc[1] & 0x80;
-diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
-index fe47d14..2fdbc10 100644
---- a/drivers/usb/core/message.c
-+++ b/drivers/usb/core/message.c
-@@ -1091,8 +1091,8 @@ void usb_disable_device(struct usb_device *dev, int skip_ep0)
- 				continue;
- 			dev_dbg(&dev->dev, "unregistering interface %s\n",
- 				interface->dev.bus_id);
--			device_del(&interface->dev);
- 			usb_remove_sysfs_intf_files(interface);
-+			device_del(&interface->dev);
- 		}
- 
- 		/* Now that the interfaces are unbound, nobody should
-diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
-index 0ff4a39..7ee2abc 100644
---- a/drivers/usb/serial/ftdi_sio.c
-+++ b/drivers/usb/serial/ftdi_sio.c
-@@ -553,6 +553,7 @@ static struct usb_device_id id_table_combined [] = {
- 	{ USB_DEVICE(FTDI_VID, FTDI_ELV_FHZ1300PC_PID) },
- 	{ USB_DEVICE(FTDI_VID, FTDI_ELV_EM1010PC_PID) },
- 	{ USB_DEVICE(FTDI_VID, FTDI_ELV_WS500_PID) },
-+	{ USB_DEVICE(FTDI_VID, FTDI_ELV_HS485_PID) },
- 	{ USB_DEVICE(FTDI_VID, LINX_SDMUSBQSS_PID) },
- 	{ USB_DEVICE(FTDI_VID, LINX_MASTERDEVEL2_PID) },
- 	{ USB_DEVICE(FTDI_VID, LINX_FUTURE_0_PID) },
-@@ -636,6 +637,10 @@ static struct usb_device_id id_table_combined [] = {
- 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
- 	{ USB_DEVICE(FTDI_VID, FTDI_OOCDLINK_PID),
- 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-+	{ USB_DEVICE(FTDI_VID, LMI_LM3S_DEVEL_BOARD_PID),
-+		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-+	{ USB_DEVICE(FTDI_VID, LMI_LM3S_EVAL_BOARD_PID),
-+		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
- 	{ USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_USB60F) },
- 	{ USB_DEVICE(FTDI_VID, FTDI_REU_TINY_PID) },
- 	{ },					/* Optional parameter entry */
-diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
-index 8302eca..ac23a3a 100644
---- a/drivers/usb/serial/ftdi_sio.h
-+++ b/drivers/usb/serial/ftdi_sio.h
-@@ -524,6 +524,7 @@
- #define FTDI_ELV_WS300PC_PID	0xE0F6	/* PC-Wetterstation (WS 300 PC) */
- #define FTDI_ELV_FHZ1300PC_PID	0xE0E8	/* FHZ 1300 PC */
- #define FTDI_ELV_WS500_PID	0xE0E9	/* PC-Wetterstation (WS 500) */
-+#define FTDI_ELV_HS485_PID	0xE0EA	/* USB to RS-485 adapter */
- #define FTDI_ELV_EM1010PC_PID	0xE0EF	/* Engery monitor EM 1010 PC */
- 
- /*
-@@ -815,6 +816,11 @@
- #define OLIMEX_VID			0x15BA
- #define OLIMEX_ARM_USB_OCD_PID		0x0003
- 
-+/* Luminary Micro Stellaris Boards, VID = FTDI_VID */
-+/* FTDI 2332C Dual channel device, side A=245 FIFO (JTAG), Side B=RS232 UART */
-+#define LMI_LM3S_DEVEL_BOARD_PID	0xbcd8
-+#define LMI_LM3S_EVAL_BOARD_PID		0xbcd9
-+
- /* www.elsterelectricity.com Elster Unicom III Optical Probe */
- #define FTDI_ELSTER_UNICOM_PID		0xE700 /* Product Id */
- 
-diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
-index 2a0dd1b..63287ad 100644
---- a/drivers/usb/serial/pl2303.c
-+++ b/drivers/usb/serial/pl2303.c
-@@ -89,7 +89,6 @@ static struct usb_device_id id_table [] = {
- 	{ USB_DEVICE(ALCOR_VENDOR_ID, ALCOR_PRODUCT_ID) },
- 	{ USB_DEVICE(WS002IN_VENDOR_ID, WS002IN_PRODUCT_ID) },
- 	{ USB_DEVICE(COREGA_VENDOR_ID, COREGA_PRODUCT_ID) },
--	{ USB_DEVICE(HL340_VENDOR_ID, HL340_PRODUCT_ID) },
- 	{ USB_DEVICE(YCCABLE_VENDOR_ID, YCCABLE_PRODUCT_ID) },
- 	{ }					/* Terminating entry */
- };
-diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
-index 6ac3bbc..a3bd039 100644
---- a/drivers/usb/serial/pl2303.h
-+++ b/drivers/usb/serial/pl2303.h
-@@ -107,10 +107,6 @@
- #define COREGA_VENDOR_ID	0x07aa
- #define COREGA_PRODUCT_ID	0x002a
- 
--/* HL HL-340 (ID: 4348:5523) */
--#define HL340_VENDOR_ID		0x4348
--#define HL340_PRODUCT_ID	0x5523
--
- /* Y.C. Cable U.S.A., Inc - USB to RS-232 */
- #define YCCABLE_VENDOR_ID	0x05ad
- #define YCCABLE_PRODUCT_ID	0x0fba
-diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
-index db1db4c..38034e2 100644
---- a/drivers/usb/serial/usb-serial.c
-+++ b/drivers/usb/serial/usb-serial.c
-@@ -119,9 +119,6 @@ static void return_serial(struct usb_serial *serial)
- 
- 	dbg("%s", __func__);
- 
--	if (serial == NULL)
--		return;
--
- 	for (i = 0; i < serial->num_ports; ++i) {
- 		serial_table[serial->minor + i] = NULL;
- 	}
-@@ -140,7 +137,8 @@ static void destroy_serial(struct kref *kref)
- 	serial->type->shutdown(serial);
- 
- 	/* return the minor range that this device had */
--	return_serial(serial);
-+	if (serial->minor != SERIAL_TTY_NO_MINOR)
-+		return_serial(serial);
- 
- 	for (i = 0; i < serial->num_ports; ++i)
- 		serial->port[i]->open_count = 0;
-@@ -562,6 +560,7 @@ static struct usb_serial * create_serial (struct usb_device *dev,
- 	serial->interface = interface;
- 	kref_init(&serial->kref);
- 	mutex_init(&serial->disc_mutex);
-+	serial->minor = SERIAL_TTY_NO_MINOR;
- 
- 	return serial;
- }
-diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
-index 3fcde9f..d8d6633 100644
---- a/drivers/usb/storage/scsiglue.c
-+++ b/drivers/usb/storage/scsiglue.c
-@@ -73,7 +73,6 @@ static const char* host_info(struct Scsi_Host *host)
- static int slave_alloc (struct scsi_device *sdev)
- {
- 	struct us_data *us = host_to_us(sdev->host);
--	struct usb_host_endpoint *bulk_in_ep;
- 
- 	/*
- 	 * Set the INQUIRY transfer length to 36.  We don't use any of
-@@ -82,16 +81,22 @@ static int slave_alloc (struct scsi_device *sdev)
- 	 */
- 	sdev->inquiry_len = 36;
- 
--	/* Scatter-gather buffers (all but the last) must have a length
--	 * divisible by the bulk maxpacket size.  Otherwise a data packet
--	 * would end up being short, causing a premature end to the data
--	 * transfer.  We'll use the maxpacket value of the bulk-IN pipe
--	 * to set the SCSI device queue's DMA alignment mask.
-+	/* USB has unusual DMA-alignment requirements: Although the
-+	 * starting address of each scatter-gather element doesn't matter,
-+	 * the length of each element except the last must be divisible
-+	 * by the Bulk maxpacket value.  There's currently no way to
-+	 * express this by block-layer constraints, so we'll cop out
-+	 * and simply require addresses to be aligned at 512-byte
-+	 * boundaries.  This is okay since most block I/O involves
-+	 * hardware sectors that are multiples of 512 bytes in length,
-+	 * and since host controllers up through USB 2.0 have maxpacket
-+	 * values no larger than 512.
-+	 *
-+	 * But it doesn't suffice for Wireless USB, where Bulk maxpacket
-+	 * values can be as large as 2048.  To make that work properly
-+	 * will require changes to the block layer.
- 	 */
--	bulk_in_ep = us->pusb_dev->ep_in[usb_pipeendpoint(us->recv_bulk_pipe)];
--	blk_queue_update_dma_alignment(sdev->request_queue,
--			le16_to_cpu(bulk_in_ep->desc.wMaxPacketSize) - 1);
--			/* wMaxPacketSize must be a power of 2 */
-+	blk_queue_update_dma_alignment(sdev->request_queue, (512 - 1));
- 
- 	/*
- 	 * The UFI spec treates the Peripheral Qualifier bits in an
-diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c
-index 6610d2d..f2062e1 100644
---- a/drivers/usb/storage/transport.c
-+++ b/drivers/usb/storage/transport.c
-@@ -1034,8 +1034,21 @@ int usb_stor_Bulk_transport(struct scsi_cmnd *srb, struct us_data *us)
- 
- 	/* try to compute the actual residue, based on how much data
- 	 * was really transferred and what the device tells us */
--	if (residue) {
--		if (!(us->flags & US_FL_IGNORE_RESIDUE)) {
-+	if (residue && !(us->flags & US_FL_IGNORE_RESIDUE)) {
-+
-+		/* Heuristically detect devices that generate bogus residues
-+		 * by seeing what happens with INQUIRY and READ CAPACITY
-+		 * commands.
-+		 */
-+		if (bcs->Status == US_BULK_STAT_OK &&
-+				scsi_get_resid(srb) == 0 &&
-+					((srb->cmnd[0] == INQUIRY &&
-+						transfer_length == 36) ||
-+					(srb->cmnd[0] == READ_CAPACITY &&
-+						transfer_length == 8))) {
-+			us->flags |= US_FL_IGNORE_RESIDUE;
-+
-+		} else {
- 			residue = min(residue, transfer_length);
- 			scsi_set_resid(srb, max(scsi_get_resid(srb),
- 			                                       (int) residue));
-diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
-index 39a7c11..6a04476 100644
---- a/drivers/usb/storage/unusual_devs.h
-+++ b/drivers/usb/storage/unusual_devs.h
-@@ -358,14 +358,14 @@ UNUSUAL_DEV(  0x04b0, 0x040f, 0x0100, 0x0200,
- 		US_FL_FIX_CAPACITY),
- 
- /* Reported by Emil Larsson <emil@××××.net> */
--UNUSUAL_DEV(  0x04b0, 0x0411, 0x0100, 0x0110,
-+UNUSUAL_DEV(  0x04b0, 0x0411, 0x0100, 0x0111,
- 		"NIKON",
- 		"NIKON DSC D80",
- 		US_SC_DEVICE, US_PR_DEVICE, NULL,
- 		US_FL_FIX_CAPACITY),
- 
- /* Reported by Ortwin Glueck <odi@×××.ch> */
--UNUSUAL_DEV(  0x04b0, 0x0413, 0x0110, 0x0110,
-+UNUSUAL_DEV(  0x04b0, 0x0413, 0x0110, 0x0111,
- 		"NIKON",
- 		"NIKON DSC D40",
- 		US_SC_DEVICE, US_PR_DEVICE, NULL,
-@@ -1187,6 +1187,13 @@ UNUSUAL_DEV(  0x07c4, 0xa400, 0x0000, 0xffff,
- 		US_SC_DEVICE, US_PR_DEVICE, NULL,
- 		US_FL_FIX_INQUIRY ),
- 
-+/* Reported by Rauch Wolke <rauchwolke@×××.net> */
-+UNUSUAL_DEV(  0x07c4, 0xa4a5, 0x0000, 0xffff,
-+		"Simple Tech/Datafab",
-+		"CF+SM Reader",
-+		US_SC_DEVICE, US_PR_DEVICE, NULL,
-+		US_FL_IGNORE_RESIDUE ),
-+
- /* Casio QV 2x00/3x00/4000/8000 digital still cameras are not conformant
-  * to the USB storage specification in two ways:
-  * - They tell us they are using transport protocol CBI. In reality they
-@@ -1758,6 +1765,13 @@ UNUSUAL_DEV(  0x2770, 0x915d, 0x0010, 0x0010,
- 		US_SC_DEVICE, US_PR_DEVICE, NULL,
- 		US_FL_FIX_CAPACITY ),
- 
-+/* Reported by Andrey Rahmatullin <wrar@××××××××.org> */
-+UNUSUAL_DEV(  0x4102, 0x1020, 0x0100,  0x0100,
-+		"iRiver",
-+		"MP3 T10",
-+		US_SC_DEVICE, US_PR_DEVICE, NULL,
-+		US_FL_IGNORE_RESIDUE ),
-+
- /*
-  * David Härdeman <david@××××.com>
-  * The key makes the SCSI stack print confusing (but harmless) messages
-diff --git a/drivers/video/arkfb.c b/drivers/video/arkfb.c
-index 5001bd4..21d61b3 100644
---- a/drivers/video/arkfb.c
-+++ b/drivers/video/arkfb.c
-@@ -958,20 +958,20 @@ static int __devinit ark_pci_probe(struct pci_dev *dev, const struct pci_device_
- 	/* Prepare PCI device */
- 	rc = pci_enable_device(dev);
- 	if (rc < 0) {
--		dev_err(info->dev, "cannot enable PCI device\n");
-+		dev_err(info->device, "cannot enable PCI device\n");
- 		goto err_enable_device;
- 	}
- 
- 	rc = pci_request_regions(dev, "arkfb");
- 	if (rc < 0) {
--		dev_err(info->dev, "cannot reserve framebuffer region\n");
-+		dev_err(info->device, "cannot reserve framebuffer region\n");
- 		goto err_request_regions;
- 	}
- 
- 	par->dac = ics5342_init(ark_dac_read_regs, ark_dac_write_regs, info);
- 	if (! par->dac) {
- 		rc = -ENOMEM;
--		dev_err(info->dev, "RAMDAC initialization failed\n");
-+		dev_err(info->device, "RAMDAC initialization failed\n");
- 		goto err_dac;
- 	}
- 
-@@ -982,7 +982,7 @@ static int __devinit ark_pci_probe(struct pci_dev *dev, const struct pci_device_
- 	info->screen_base = pci_iomap(dev, 0, 0);
- 	if (! info->screen_base) {
- 		rc = -ENOMEM;
--		dev_err(info->dev, "iomap for framebuffer failed\n");
-+		dev_err(info->device, "iomap for framebuffer failed\n");
- 		goto err_iomap;
- 	}
- 
-@@ -1004,19 +1004,19 @@ static int __devinit ark_pci_probe(struct pci_dev *dev, const struct pci_device_
- 	rc = fb_find_mode(&(info->var), info, mode_option, NULL, 0, NULL, 8);
- 	if (! ((rc == 1) || (rc == 2))) {
- 		rc = -EINVAL;
--		dev_err(info->dev, "mode %s not found\n", mode_option);
-+		dev_err(info->device, "mode %s not found\n", mode_option);
- 		goto err_find_mode;
- 	}
- 
- 	rc = fb_alloc_cmap(&info->cmap, 256, 0);
- 	if (rc < 0) {
--		dev_err(info->dev, "cannot allocate colormap\n");
-+		dev_err(info->device, "cannot allocate colormap\n");
- 		goto err_alloc_cmap;
- 	}
- 
- 	rc = register_framebuffer(info);
- 	if (rc < 0) {
--		dev_err(info->dev, "cannot register framebugger\n");
-+		dev_err(info->device, "cannot register framebugger\n");
- 		goto err_reg_fb;
- 	}
- 
-@@ -1090,7 +1090,7 @@ static int ark_pci_suspend (struct pci_dev* dev, pm_message_t state)
- 	struct fb_info *info = pci_get_drvdata(dev);
- 	struct arkfb_info *par = info->par;
- 
--	dev_info(info->dev, "suspend\n");
-+	dev_info(info->device, "suspend\n");
- 
- 	acquire_console_sem();
- 	mutex_lock(&(par->open_lock));
-@@ -1121,7 +1121,7 @@ static int ark_pci_resume (struct pci_dev* dev)
- 	struct fb_info *info = pci_get_drvdata(dev);
- 	struct arkfb_info *par = info->par;
- 
--	dev_info(info->dev, "resume\n");
-+	dev_info(info->device, "resume\n");
- 
- 	acquire_console_sem();
- 	mutex_lock(&(par->open_lock));
-diff --git a/drivers/video/aty/radeon_accel.c b/drivers/video/aty/radeon_accel.c
-index 3ca27cb..aa95f83 100644
---- a/drivers/video/aty/radeon_accel.c
-+++ b/drivers/video/aty/radeon_accel.c
-@@ -55,6 +55,10 @@ static void radeonfb_prim_fillrect(struct radeonfb_info *rinfo,
- 	OUTREG(DP_WRITE_MSK, 0xffffffff);
- 	OUTREG(DP_CNTL, (DST_X_LEFT_TO_RIGHT | DST_Y_TOP_TO_BOTTOM));
- 
-+	radeon_fifo_wait(2);
-+	OUTREG(DSTCACHE_CTLSTAT, RB2D_DC_FLUSH_ALL);
-+	OUTREG(WAIT_UNTIL, (WAIT_2D_IDLECLEAN | WAIT_DMA_GUI_IDLE));
-+
- 	radeon_fifo_wait(2);  
- 	OUTREG(DST_Y_X, (region->dy << 16) | region->dx);
- 	OUTREG(DST_WIDTH_HEIGHT, (region->width << 16) | region->height);
-@@ -116,6 +120,10 @@ static void radeonfb_prim_copyarea(struct radeonfb_info *rinfo,
- 	OUTREG(DP_CNTL, (xdir>=0 ? DST_X_LEFT_TO_RIGHT : 0)
- 			| (ydir>=0 ? DST_Y_TOP_TO_BOTTOM : 0));
- 
-+	radeon_fifo_wait(2);
-+	OUTREG(DSTCACHE_CTLSTAT, RB2D_DC_FLUSH_ALL);
-+	OUTREG(WAIT_UNTIL, (WAIT_2D_IDLECLEAN | WAIT_DMA_GUI_IDLE));
-+
- 	radeon_fifo_wait(3);
- 	OUTREG(SRC_Y_X, (sy << 16) | sx);
- 	OUTREG(DST_Y_X, (dy << 16) | dx);
-@@ -241,8 +249,8 @@ void radeonfb_engine_reset(struct radeonfb_info *rinfo)
- 	INREG(HOST_PATH_CNTL);
- 	OUTREG(HOST_PATH_CNTL, host_path_cntl);
- 
--	if (rinfo->family != CHIP_FAMILY_R300 ||
--	    rinfo->family != CHIP_FAMILY_R350 ||
-+	if (rinfo->family != CHIP_FAMILY_R300 &&
-+	    rinfo->family != CHIP_FAMILY_R350 &&
- 	    rinfo->family != CHIP_FAMILY_RV350)
- 		OUTREG(RBBM_SOFT_RESET, rbbm_soft_reset);
- 
-diff --git a/drivers/video/matrox/matroxfb_maven.c b/drivers/video/matrox/matroxfb_maven.c
-index 89da27b..2ad06b0 100644
---- a/drivers/video/matrox/matroxfb_maven.c
-+++ b/drivers/video/matrox/matroxfb_maven.c
-@@ -1266,7 +1266,7 @@ static int maven_detect_client(struct i2c_adapter* adapter, int address, int kin
- ERROR4:;
- 	i2c_detach_client(new_client);
- ERROR3:;
--	kfree(new_client);
-+	kfree(data);
- ERROR0:;
- 	return err;
- }
-diff --git a/drivers/video/s3fb.c b/drivers/video/s3fb.c
-index 2972f11..8361bd0 100644
---- a/drivers/video/s3fb.c
-+++ b/drivers/video/s3fb.c
-@@ -903,13 +903,13 @@ static int __devinit s3_pci_probe(struct pci_dev *dev, const struct pci_device_i
- 	/* Prepare PCI device */
- 	rc = pci_enable_device(dev);
- 	if (rc < 0) {
--		dev_err(info->dev, "cannot enable PCI device\n");
-+		dev_err(info->device, "cannot enable PCI device\n");
- 		goto err_enable_device;
- 	}
- 
- 	rc = pci_request_regions(dev, "s3fb");
- 	if (rc < 0) {
--		dev_err(info->dev, "cannot reserve framebuffer region\n");
-+		dev_err(info->device, "cannot reserve framebuffer region\n");
- 		goto err_request_regions;
- 	}
- 
-@@ -921,7 +921,7 @@ static int __devinit s3_pci_probe(struct pci_dev *dev, const struct pci_device_i
- 	info->screen_base = pci_iomap(dev, 0, 0);
- 	if (! info->screen_base) {
- 		rc = -ENOMEM;
--		dev_err(info->dev, "iomap for framebuffer failed\n");
-+		dev_err(info->device, "iomap for framebuffer failed\n");
- 		goto err_iomap;
- 	}
- 
-@@ -965,19 +965,19 @@ static int __devinit s3_pci_probe(struct pci_dev *dev, const struct pci_device_i
- 	rc = fb_find_mode(&(info->var), info, mode_option, NULL, 0, NULL, 8);
- 	if (! ((rc == 1) || (rc == 2))) {
- 		rc = -EINVAL;
--		dev_err(info->dev, "mode %s not found\n", mode_option);
-+		dev_err(info->device, "mode %s not found\n", mode_option);
- 		goto err_find_mode;
- 	}
- 
- 	rc = fb_alloc_cmap(&info->cmap, 256, 0);
- 	if (rc < 0) {
--		dev_err(info->dev, "cannot allocate colormap\n");
-+		dev_err(info->device, "cannot allocate colormap\n");
- 		goto err_alloc_cmap;
- 	}
- 
- 	rc = register_framebuffer(info);
- 	if (rc < 0) {
--		dev_err(info->dev, "cannot register framebuffer\n");
-+		dev_err(info->device, "cannot register framebuffer\n");
- 		goto err_reg_fb;
- 	}
- 
-@@ -1053,7 +1053,7 @@ static int s3_pci_suspend(struct pci_dev* dev, pm_message_t state)
- 	struct fb_info *info = pci_get_drvdata(dev);
- 	struct s3fb_info *par = info->par;
- 
--	dev_info(info->dev, "suspend\n");
-+	dev_info(info->device, "suspend\n");
- 
- 	acquire_console_sem();
- 	mutex_lock(&(par->open_lock));
-@@ -1085,7 +1085,7 @@ static int s3_pci_resume(struct pci_dev* dev)
- 	struct s3fb_info *par = info->par;
- 	int err;
- 
--	dev_info(info->dev, "resume\n");
-+	dev_info(info->device, "resume\n");
- 
- 	acquire_console_sem();
- 	mutex_lock(&(par->open_lock));
-@@ -1102,7 +1102,7 @@ static int s3_pci_resume(struct pci_dev* dev)
- 	if (err) {
- 		mutex_unlock(&(par->open_lock));
- 		release_console_sem();
--		dev_err(info->dev, "error %d enabling device for resume\n", err);
-+		dev_err(info->device, "error %d enabling device for resume\n", err);
- 		return err;
- 	}
- 	pci_set_master(dev);
-diff --git a/drivers/video/vt8623fb.c b/drivers/video/vt8623fb.c
-index 536ab11..f5f282d 100644
---- a/drivers/video/vt8623fb.c
-+++ b/drivers/video/vt8623fb.c
-@@ -677,13 +677,13 @@ static int __devinit vt8623_pci_probe(struct pci_dev *dev, const struct pci_devi
- 
- 	rc = pci_enable_device(dev);
- 	if (rc < 0) {
--		dev_err(info->dev, "cannot enable PCI device\n");
-+		dev_err(info->device, "cannot enable PCI device\n");
- 		goto err_enable_device;
- 	}
- 
- 	rc = pci_request_regions(dev, "vt8623fb");
- 	if (rc < 0) {
--		dev_err(info->dev, "cannot reserve framebuffer region\n");
-+		dev_err(info->device, "cannot reserve framebuffer region\n");
- 		goto err_request_regions;
- 	}
- 
-@@ -696,14 +696,14 @@ static int __devinit vt8623_pci_probe(struct pci_dev *dev, const struct pci_devi
- 	info->screen_base = pci_iomap(dev, 0, 0);
- 	if (! info->screen_base) {
- 		rc = -ENOMEM;
--		dev_err(info->dev, "iomap for framebuffer failed\n");
-+		dev_err(info->device, "iomap for framebuffer failed\n");
- 		goto err_iomap_1;
- 	}
- 
- 	par->mmio_base = pci_iomap(dev, 1, 0);
- 	if (! par->mmio_base) {
- 		rc = -ENOMEM;
--		dev_err(info->dev, "iomap for MMIO failed\n");
-+		dev_err(info->device, "iomap for MMIO failed\n");
- 		goto err_iomap_2;
- 	}
- 
-@@ -714,7 +714,7 @@ static int __devinit vt8623_pci_probe(struct pci_dev *dev, const struct pci_devi
- 	if ((16 <= memsize1) && (memsize1 <= 64) && (memsize1 == memsize2))
- 		info->screen_size = memsize1 << 20;
- 	else {
--		dev_err(info->dev, "memory size detection failed (%x %x), suppose 16 MB\n", memsize1, memsize2);
-+		dev_err(info->device, "memory size detection failed (%x %x), suppose 16 MB\n", memsize1, memsize2);
- 		info->screen_size = 16 << 20;
- 	}
- 
-@@ -731,19 +731,19 @@ static int __devinit vt8623_pci_probe(struct pci_dev *dev, const struct pci_devi
- 	rc = fb_find_mode(&(info->var), info, mode_option, NULL, 0, NULL, 8);
- 	if (! ((rc == 1) || (rc == 2))) {
- 		rc = -EINVAL;
--		dev_err(info->dev, "mode %s not found\n", mode_option);
-+		dev_err(info->device, "mode %s not found\n", mode_option);
- 		goto err_find_mode;
- 	}
- 
- 	rc = fb_alloc_cmap(&info->cmap, 256, 0);
- 	if (rc < 0) {
--		dev_err(info->dev, "cannot allocate colormap\n");
-+		dev_err(info->device, "cannot allocate colormap\n");
- 		goto err_alloc_cmap;
- 	}
- 
- 	rc = register_framebuffer(info);
- 	if (rc < 0) {
--		dev_err(info->dev, "cannot register framebugger\n");
-+		dev_err(info->device, "cannot register framebugger\n");
- 		goto err_reg_fb;
- 	}
- 
-@@ -817,7 +817,7 @@ static int vt8623_pci_suspend(struct pci_dev* dev, pm_message_t state)
- 	struct fb_info *info = pci_get_drvdata(dev);
- 	struct vt8623fb_info *par = info->par;
- 
--	dev_info(info->dev, "suspend\n");
-+	dev_info(info->device, "suspend\n");
- 
- 	acquire_console_sem();
- 	mutex_lock(&(par->open_lock));
-@@ -848,7 +848,7 @@ static int vt8623_pci_resume(struct pci_dev* dev)
- 	struct fb_info *info = pci_get_drvdata(dev);
- 	struct vt8623fb_info *par = info->par;
- 
--	dev_info(info->dev, "resume\n");
-+	dev_info(info->device, "resume\n");
- 
- 	acquire_console_sem();
- 	mutex_lock(&(par->open_lock));
-diff --git a/fs/cifs/asn1.c b/fs/cifs/asn1.c
-index f58e41d..4276546 100644
---- a/fs/cifs/asn1.c
-+++ b/fs/cifs/asn1.c
-@@ -400,7 +400,7 @@ asn1_oid_decode(struct asn1_ctx *ctx,
- 	size = eoc - ctx->pointer + 1;
- 
- 	/* first subid actually encodes first two subids */
--	if (size < 2 || size > ULONG_MAX/sizeof(unsigned long))
-+	if (size < 2 || size > UINT_MAX/sizeof(unsigned long))
- 		return 0;
- 
- 	*oid = kmalloc(size * sizeof(unsigned long), GFP_ATOMIC);
-diff --git a/fs/cifs/cifs_spnego.c b/fs/cifs/cifs_spnego.c
-index 7013aaf..2434ab0 100644
---- a/fs/cifs/cifs_spnego.c
-+++ b/fs/cifs/cifs_spnego.c
-@@ -66,8 +66,8 @@ struct key_type cifs_spnego_key_type = {
- 	.describe	= user_describe,
- };
- 
--#define MAX_VER_STR_LEN   9 /* length of longest version string e.g.
--				strlen(";ver=0xFF") */
-+#define MAX_VER_STR_LEN   8 /* length of longest version string e.g.
-+				strlen("ver=0xFF") */
- #define MAX_MECH_STR_LEN 13 /* length of longest security mechanism name, eg
- 			       in future could have strlen(";sec=ntlmsspi") */
- #define MAX_IPV6_ADDR_LEN 42 /* eg FEDC:BA98:7654:3210:FEDC:BA98:7654:3210/60 */
-@@ -81,11 +81,15 @@ cifs_get_spnego_key(struct cifsSesInfo *sesInfo)
- 	struct key *spnego_key;
- 	const char *hostname = server->hostname;
- 
--	/* BB: come up with better scheme for determining length */
--	/* length of fields (with semicolons): ver=0xyz ipv4= ipaddress host=
--	   hostname sec=mechanism uid=0x uid */
--	desc_len = MAX_VER_STR_LEN + 5 + MAX_IPV6_ADDR_LEN + 1 + 6 +
--		  strlen(hostname) + MAX_MECH_STR_LEN + 8 + (sizeof(uid_t) * 2);
-+	/* length of fields (with semicolons): ver=0xyz ip4=ipaddress
-+	   host=hostname sec=mechanism uid=0xFF user=username */
-+	desc_len = MAX_VER_STR_LEN +
-+		   6 /* len of "host=" */ + strlen(hostname) +
-+		   5 /* len of ";ipv4=" */ + MAX_IPV6_ADDR_LEN +
-+		   MAX_MECH_STR_LEN +
-+		   7 /* len of ";uid=0x" */ + (sizeof(uid_t) * 2) +
-+		   6 /* len of ";user=" */ + strlen(sesInfo->userName) + 1;
-+
- 	spnego_key = ERR_PTR(-ENOMEM);
- 	description = kzalloc(desc_len, GFP_KERNEL);
- 	if (description == NULL)
-diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
-index 86b4d5f..6203609 100644
---- a/fs/cifs/cifsfs.c
-+++ b/fs/cifs/cifsfs.c
-@@ -175,6 +175,8 @@ out_no_root:
- 	if (inode)
- 		iput(inode);
- 
-+	cifs_umount(sb, cifs_sb);
-+
- out_mount_failed:
- 	if (cifs_sb) {
- #ifdef CONFIG_CIFS_DFS_UPCALL
-diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
-index 2e904bd..227c553 100644
---- a/fs/cifs/inode.c
-+++ b/fs/cifs/inode.c
-@@ -649,6 +649,7 @@ struct inode *cifs_iget(struct super_block *sb, unsigned long ino)
- 		inode->i_fop = &simple_dir_operations;
- 		inode->i_uid = cifs_sb->mnt_uid;
- 		inode->i_gid = cifs_sb->mnt_gid;
-+	} else if (rc) {
- 		_FreeXid(xid);
- 		iget_failed(inode);
- 		return ERR_PTR(rc);
-diff --git a/include/asm-sparc64/futex.h b/include/asm-sparc64/futex.h
-index d837893..47f9583 100644
---- a/include/asm-sparc64/futex.h
-+++ b/include/asm-sparc64/futex.h
-@@ -59,7 +59,7 @@ static inline int futex_atomic_op_inuser(int encoded_op, int __user *uaddr)
- 		__futex_cas_op("or\t%2, %4, %1", ret, oldval, uaddr, oparg);
- 		break;
- 	case FUTEX_OP_ANDN:
--		__futex_cas_op("and\t%2, %4, %1", ret, oldval, uaddr, oparg);
-+		__futex_cas_op("andn\t%2, %4, %1", ret, oldval, uaddr, oparg);
- 		break;
- 	case FUTEX_OP_XOR:
- 		__futex_cas_op("xor\t%2, %4, %1", ret, oldval, uaddr, oparg);
-diff --git a/include/asm-sparc64/irq.h b/include/asm-sparc64/irq.h
-index 0bb9bf5..630eb4e 100644
---- a/include/asm-sparc64/irq.h
-+++ b/include/asm-sparc64/irq.h
-@@ -90,4 +90,8 @@ static inline unsigned long get_softint(void)
- 	return retval;
- }
- 
-+extern void *hardirq_stack[NR_CPUS];
-+extern void *softirq_stack[NR_CPUS];
-+#define __ARCH_HAS_DO_SOFTIRQ
-+
- #endif
-diff --git a/include/asm-sparc64/ptrace.h b/include/asm-sparc64/ptrace.h
-index b163da7..4f18096 100644
---- a/include/asm-sparc64/ptrace.h
-+++ b/include/asm-sparc64/ptrace.h
-@@ -134,9 +134,9 @@ struct global_reg_snapshot {
- 	unsigned long		tnpc;
- 	unsigned long		o7;
- 	unsigned long		i7;
-+	unsigned long		rpc;
- 	struct thread_info	*thread;
- 	unsigned long		pad1;
--	unsigned long		pad2;
- };
- 
- #define __ARCH_WANT_COMPAT_SYS_PTRACE
-@@ -314,9 +314,9 @@ extern void __show_regs(struct pt_regs *);
- #define GR_SNAP_TNPC	0x10
- #define GR_SNAP_O7	0x18
- #define GR_SNAP_I7	0x20
--#define GR_SNAP_THREAD	0x28
--#define GR_SNAP_PAD1	0x30
--#define GR_SNAP_PAD2	0x38
-+#define GR_SNAP_RPC	0x28
-+#define GR_SNAP_THREAD	0x30
-+#define GR_SNAP_PAD1	0x38
- 
- #endif  /*  __KERNEL__  */
- 
-diff --git a/include/asm-x86/i387.h b/include/asm-x86/i387.h
-index 37672f7..4b683af 100644
---- a/include/asm-x86/i387.h
-+++ b/include/asm-x86/i387.h
-@@ -13,6 +13,7 @@
- #include <linux/sched.h>
- #include <linux/kernel_stat.h>
- #include <linux/regset.h>
-+#include <linux/hardirq.h>
- #include <asm/asm.h>
- #include <asm/processor.h>
- #include <asm/sigcontext.h>
-@@ -290,6 +291,37 @@ static inline void kernel_fpu_end(void)
- 	preempt_enable();
- }
- 
-+/*
-+ * Some instructions like VIA's padlock instructions generate a spurious
-+ * DNA fault but don't modify SSE registers. And these instructions
-+ * get used from interrupt context aswell. To prevent these kernel instructions
-+ * in interrupt context interact wrongly with other user/kernel fpu usage, we
-+ * should use them only in the context of irq_ts_save/restore()
-+ */
-+static inline int irq_ts_save(void)
-+{
-+	/*
-+	 * If we are in process context, we are ok to take a spurious DNA fault.
-+	 * Otherwise, doing clts() in process context require pre-emption to
-+	 * be disabled or some heavy lifting like kernel_fpu_begin()
-+	 */
-+	if (!in_interrupt())
-+		return 0;
-+
-+	if (read_cr0() & X86_CR0_TS) {
-+		clts();
-+		return 1;
-+	}
-+
-+	return 0;
-+}
-+
-+static inline void irq_ts_restore(int TS_state)
-+{
-+	if (TS_state)
-+		stts();
-+}
-+
- #ifdef CONFIG_X86_64
- 
- static inline void save_init_fpu(struct task_struct *tsk)
-diff --git a/include/asm-x86/spinlock.h b/include/asm-x86/spinlock.h
-index 21e89bf..bf2a3d2 100644
---- a/include/asm-x86/spinlock.h
-+++ b/include/asm-x86/spinlock.h
-@@ -65,7 +65,7 @@ static inline int __raw_spin_is_contended(raw_spinlock_t *lock)
- {
- 	int tmp = ACCESS_ONCE(lock->slock);
- 
--	return (((tmp >> 8) & 0xff) - (tmp & 0xff)) > 1;
-+	return (((tmp >> 8) - tmp) & 0xff) > 1;
- }
- 
- static __always_inline void __raw_spin_lock(raw_spinlock_t *lock)
-@@ -129,7 +129,7 @@ static inline int __raw_spin_is_contended(raw_spinlock_t *lock)
- {
- 	int tmp = ACCESS_ONCE(lock->slock);
- 
--	return (((tmp >> 16) & 0xffff) - (tmp & 0xffff)) > 1;
-+	return (((tmp >> 16) - tmp) & 0xffff) > 1;
- }
- 
- static __always_inline void __raw_spin_lock(raw_spinlock_t *lock)
-diff --git a/include/linux/usb/serial.h b/include/linux/usb/serial.h
-index 8f891cb..4a6583d 100644
---- a/include/linux/usb/serial.h
-+++ b/include/linux/usb/serial.h
-@@ -17,7 +17,8 @@
- #include <linux/mutex.h>
- 
- #define SERIAL_TTY_MAJOR	188	/* Nice legal number now */
--#define SERIAL_TTY_MINORS	255	/* loads of devices :) */
-+#define SERIAL_TTY_MINORS	254	/* loads of devices :) */
-+#define SERIAL_TTY_NO_MINOR	255	/* No minor was assigned */
- 
- /* The maximum number of ports one device can grab at once */
- #define MAX_NUM_PORTS		8
-diff --git a/include/video/radeon.h b/include/video/radeon.h
-index 83467e1..099ffa5 100644
---- a/include/video/radeon.h
-+++ b/include/video/radeon.h
-@@ -527,8 +527,9 @@
- 
- 
- /* DSTCACHE_CTLSTAT bit constants */
--#define RB2D_DC_FLUSH				   (3 << 0)
--#define RB2D_DC_FLUSH_ALL			   0xf
-+#define RB2D_DC_FLUSH_2D			   (1 << 0)
-+#define RB2D_DC_FREE_2D				   (1 << 2)
-+#define RB2D_DC_FLUSH_ALL			   (RB2D_DC_FLUSH_2D | RB2D_DC_FREE_2D)
- #define RB2D_DC_BUSY				   (1 << 31)
- 
- 
-@@ -741,6 +742,10 @@
- #define SOFT_RESET_RB           		   (1 <<  6)
- #define SOFT_RESET_HDP          		   (1 <<  7)
- 
-+/* WAIT_UNTIL bit constants */
-+#define WAIT_DMA_GUI_IDLE			   (1 << 9)
-+#define WAIT_2D_IDLECLEAN			   (1 << 16)
-+
- /* SURFACE_CNTL bit consants */
- #define SURF_TRANSLATION_DIS			   (1 << 8)
- #define NONSURF_AP0_SWP_16BPP			   (1 << 20)
-diff --git a/kernel/posix-timers.c b/kernel/posix-timers.c
-index dbd8398..0ffaeb0 100644
---- a/kernel/posix-timers.c
-+++ b/kernel/posix-timers.c
-@@ -289,21 +289,29 @@ void do_schedule_next_timer(struct siginfo *info)
- 		else
- 			schedule_next_timer(timr);
- 
--		info->si_overrun = timr->it_overrun_last;
-+		info->si_overrun += timr->it_overrun_last;
- 	}
- 
- 	if (timr)
- 		unlock_timer(timr, flags);
- }
- 
--int posix_timer_event(struct k_itimer *timr,int si_private)
-+int posix_timer_event(struct k_itimer *timr, int si_private)
- {
--	memset(&timr->sigq->info, 0, sizeof(siginfo_t));
-+	/*
-+	 * FIXME: if ->sigq is queued we can race with
-+	 * dequeue_signal()->do_schedule_next_timer().
-+	 *
-+	 * If dequeue_signal() sees the "right" value of
-+	 * si_sys_private it calls do_schedule_next_timer().
-+	 * We re-queue ->sigq and drop ->it_lock().
-+	 * do_schedule_next_timer() locks the timer
-+	 * and re-schedules it while ->sigq is pending.
-+	 * Not really bad, but not that we want.
-+	 */
- 	timr->sigq->info.si_sys_private = si_private;
--	/* Send signal to the process that owns this timer.*/
- 
- 	timr->sigq->info.si_signo = timr->it_sigev_signo;
--	timr->sigq->info.si_errno = 0;
- 	timr->sigq->info.si_code = SI_TIMER;
- 	timr->sigq->info.si_tid = timr->it_id;
- 	timr->sigq->info.si_value = timr->it_sigev_value;
-@@ -435,6 +443,7 @@ static struct k_itimer * alloc_posix_timer(void)
- 		kmem_cache_free(posix_timers_cache, tmr);
- 		tmr = NULL;
- 	}
-+	memset(&tmr->sigq->info, 0, sizeof(siginfo_t));
- 	return tmr;
- }
- 
-diff --git a/kernel/relay.c b/kernel/relay.c
-index 7de644c..f5a5a96 100644
---- a/kernel/relay.c
-+++ b/kernel/relay.c
-@@ -832,6 +832,10 @@ static void relay_file_read_consume(struct rchan_buf *buf,
- 	size_t n_subbufs = buf->chan->n_subbufs;
- 	size_t read_subbuf;
- 
-+	if (buf->subbufs_produced == buf->subbufs_consumed &&
-+	    buf->offset == buf->bytes_consumed)
-+		return;
-+
- 	if (buf->bytes_consumed + bytes_consumed > subbuf_size) {
- 		relay_subbufs_consumed(buf->chan, buf->cpu, 1);
- 		buf->bytes_consumed = 0;
-@@ -863,6 +867,8 @@ static int relay_file_read_avail(struct rchan_buf *buf, size_t read_pos)
- 
- 	relay_file_read_consume(buf, read_pos, 0);
- 
-+	consumed = buf->subbufs_consumed;
-+
- 	if (unlikely(buf->offset > subbuf_size)) {
- 		if (produced == consumed)
- 			return 0;
-@@ -881,8 +887,12 @@ static int relay_file_read_avail(struct rchan_buf *buf, size_t read_pos)
- 	if (consumed > produced)
- 		produced += n_subbufs * subbuf_size;
- 
--	if (consumed == produced)
-+	if (consumed == produced) {
-+		if (buf->offset == subbuf_size &&
-+		    buf->subbufs_produced > buf->subbufs_consumed)
-+			return 1;
- 		return 0;
-+	}
- 
- 	return 1;
- }
-diff --git a/kernel/signal.c b/kernel/signal.c
-index 6c0958e..c5bf0c0 100644
---- a/kernel/signal.c
-+++ b/kernel/signal.c
-@@ -1319,6 +1319,7 @@ int send_sigqueue(struct sigqueue *q, struct task_struct *t, int group)
- 		q->info.si_overrun++;
- 		goto out;
- 	}
-+	q->info.si_overrun = 0;
- 
- 	signalfd_notify(t, sig);
- 	pending = group ? &t->signal->shared_pending : &t->pending;
-diff --git a/lib/random32.c b/lib/random32.c
-index ca87d86..217d5c4 100644
---- a/lib/random32.c
-+++ b/lib/random32.c
-@@ -56,23 +56,12 @@ static u32 __random32(struct rnd_state *state)
- 	return (state->s1 ^ state->s2 ^ state->s3);
- }
- 
--static void __set_random32(struct rnd_state *state, unsigned long s)
-+/*
-+ * Handle minimum values for seeds
-+ */
-+static inline u32 __seed(u32 x, u32 m)
- {
--	if (s == 0)
--		s = 1;      /* default seed is 1 */
--
--#define LCG(n) (69069 * n)
--	state->s1 = LCG(s);
--	state->s2 = LCG(state->s1);
--	state->s3 = LCG(state->s2);
--
--	/* "warm it up" */
--	__random32(state);
--	__random32(state);
--	__random32(state);
--	__random32(state);
--	__random32(state);
--	__random32(state);
-+	return (x < m) ? x + m : x;
- }
- 
- /**
-@@ -107,7 +96,7 @@ void srandom32(u32 entropy)
- 	 */
- 	for_each_possible_cpu (i) {
- 		struct rnd_state *state = &per_cpu(net_rand_state, i);
--		__set_random32(state, state->s1 ^ entropy);
-+		state->s1 = __seed(state->s1 ^ entropy, 1);
- 	}
- }
- EXPORT_SYMBOL(srandom32);
-@@ -122,7 +111,19 @@ static int __init random32_init(void)
- 
- 	for_each_possible_cpu(i) {
- 		struct rnd_state *state = &per_cpu(net_rand_state,i);
--		__set_random32(state, i + jiffies);
-+
-+#define LCG(x)	((x) * 69069)	/* super-duper LCG */
-+		state->s1 = __seed(LCG(i + jiffies), 1);
-+		state->s2 = __seed(LCG(state->s1), 7);
-+		state->s3 = __seed(LCG(state->s2), 15);
-+
-+		/* "warm it up" */
-+		__random32(state);
-+		__random32(state);
-+		__random32(state);
-+		__random32(state);
-+		__random32(state);
-+		__random32(state);
- 	}
- 	return 0;
- }
-@@ -135,13 +136,18 @@ core_initcall(random32_init);
- static int __init random32_reseed(void)
- {
- 	int i;
--	unsigned long seed;
- 
- 	for_each_possible_cpu(i) {
- 		struct rnd_state *state = &per_cpu(net_rand_state,i);
-+		u32 seeds[3];
-+
-+		get_random_bytes(&seeds, sizeof(seeds));
-+		state->s1 = __seed(seeds[0], 1);
-+		state->s2 = __seed(seeds[1], 7);
-+		state->s3 = __seed(seeds[2], 15);
- 
--		get_random_bytes(&seed, sizeof(seed));
--		__set_random32(state, seed);
-+		/* mix it in */
-+		__random32(state);
- 	}
- 	return 0;
- }
-diff --git a/mm/memory.c b/mm/memory.c
-index 2302d22..0755c52 100644
---- a/mm/memory.c
-+++ b/mm/memory.c
-@@ -2748,16 +2748,26 @@ int make_pages_present(unsigned long addr, unsigned long end)
- 
- 	vma = find_vma(current->mm, addr);
- 	if (!vma)
--		return -1;
-+		return -ENOMEM;
- 	write = (vma->vm_flags & VM_WRITE) != 0;
- 	BUG_ON(addr >= end);
- 	BUG_ON(end > vma->vm_end);
- 	len = DIV_ROUND_UP(end, PAGE_SIZE) - addr/PAGE_SIZE;
- 	ret = get_user_pages(current, current->mm, addr,
- 			len, write, 0, NULL, NULL);
--	if (ret < 0)
-+	if (ret < 0) {
-+		/*
-+		   SUS require strange return value to mlock
-+		    - invalid addr generate to ENOMEM.
-+		    - out of memory should generate EAGAIN.
-+		*/
-+		if (ret == -EFAULT)
-+			ret = -ENOMEM;
-+		else if (ret == -ENOMEM)
-+			ret = -EAGAIN;
- 		return ret;
--	return ret == len ? 0 : -1;
-+	}
-+	return ret == len ? 0 : -ENOMEM;
- }
- 
- #if !defined(__HAVE_ARCH_GATE_AREA)
-diff --git a/mm/mlock.c b/mm/mlock.c
-index 7b26560..01fbe93 100644
---- a/mm/mlock.c
-+++ b/mm/mlock.c
-@@ -78,8 +78,6 @@ success:
- 
- 	mm->locked_vm -= pages;
- out:
--	if (ret == -ENOMEM)
--		ret = -EAGAIN;
- 	return ret;
- }
- 
-diff --git a/net/dccp/proto.c b/net/dccp/proto.c
-index 9dfe247..ebfd56b 100644
---- a/net/dccp/proto.c
-+++ b/net/dccp/proto.c
-@@ -476,6 +476,11 @@ static int dccp_setsockopt_change(struct sock *sk, int type,
- 
- 	if (copy_from_user(&opt, optval, sizeof(opt)))
- 		return -EFAULT;
-+	/*
-+	 * rfc4340: 6.1. Change Options
-+	 */
-+	if (opt.dccpsf_len < 1)
-+		return -EINVAL;
- 
- 	val = kmalloc(opt.dccpsf_len, GFP_KERNEL);
- 	if (!val)
-diff --git a/net/ipv4/ipvs/ip_vs_est.c b/net/ipv4/ipvs/ip_vs_est.c
-index dfa0d71..f97ffc5 100644
---- a/net/ipv4/ipvs/ip_vs_est.c
-+++ b/net/ipv4/ipvs/ip_vs_est.c
-@@ -172,8 +172,11 @@ void ip_vs_kill_estimator(struct ip_vs_stats *stats)
- 		kfree(est);
- 		killed++;
- 	}
--	if (killed && est_list == NULL)
--		del_timer_sync(&est_timer);
-+	while (killed && !est_list && try_to_del_timer_sync(&est_timer) < 0) {
-+		write_unlock_bh(&est_lock);
-+		cpu_relax();
-+		write_lock_bh(&est_lock);
-+	}
- 	write_unlock_bh(&est_lock);
- }
- 
-diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
-index d182a2a..3872d4d 100644
---- a/net/ipv4/syncookies.c
-+++ b/net/ipv4/syncookies.c
-@@ -301,6 +301,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
- 	ireq->rmt_port		= th->source;
- 	ireq->loc_addr		= ip_hdr(skb)->daddr;
- 	ireq->rmt_addr		= ip_hdr(skb)->saddr;
-+	ireq->ecn_ok		= 0;
- 	ireq->snd_wscale	= tcp_opt.snd_wscale;
- 	ireq->rcv_wscale	= tcp_opt.rcv_wscale;
- 	ireq->sack_ok		= tcp_opt.sack_ok;
-diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
-index 48cdce9..4019770 100644
---- a/net/ipv6/ip6_output.c
-+++ b/net/ipv6/ip6_output.c
-@@ -231,6 +231,10 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
- 	skb_reset_network_header(skb);
- 	hdr = ipv6_hdr(skb);
- 
-+	/* Allow local fragmentation. */
-+	if (ipfragok)
-+		skb->local_df = 1;
-+
- 	/*
- 	 *	Fill in the IPv6 header
- 	 */
-diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
-index 3ecc115..c8d84e3 100644
---- a/net/ipv6/syncookies.c
-+++ b/net/ipv6/syncookies.c
-@@ -223,6 +223,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
- 
- 	req->expires = 0UL;
- 	req->retrans = 0;
-+	ireq->ecn_ok		= 0;
- 	ireq->snd_wscale	= tcp_opt.snd_wscale;
- 	ireq->rcv_wscale	= tcp_opt.rcv_wscale;
- 	ireq->sack_ok		= tcp_opt.sack_ok;
-diff --git a/sound/soc/fsl/fsl_dma.c b/sound/soc/fsl/fsl_dma.c
-index 78de716..9596331 100644
---- a/sound/soc/fsl/fsl_dma.c
-+++ b/sound/soc/fsl/fsl_dma.c
-@@ -132,12 +132,17 @@ struct fsl_dma_private {
-  * Since each link descriptor has a 32-bit byte count field, we set
-  * period_bytes_max to the largest 32-bit number.  We also have no maximum
-  * number of periods.
-+ *
-+ * Note that we specify SNDRV_PCM_INFO_JOINT_DUPLEX here, but only because a
-+ * limitation in the SSI driver requires the sample rates for playback and
-+ * capture to be the same.
-  */
- static const struct snd_pcm_hardware fsl_dma_hardware = {
- 
- 	.info   		= SNDRV_PCM_INFO_INTERLEAVED |
- 				  SNDRV_PCM_INFO_MMAP |
--				  SNDRV_PCM_INFO_MMAP_VALID,
-+				  SNDRV_PCM_INFO_MMAP_VALID |
-+				  SNDRV_PCM_INFO_JOINT_DUPLEX,
- 	.formats		= FSLDMA_PCM_FORMATS,
- 	.rates  		= FSLDMA_PCM_RATES,
- 	.rate_min       	= 5512,
-@@ -322,14 +327,75 @@ static int fsl_dma_new(struct snd_card *card, struct snd_soc_codec_dai *dai,
-  * fsl_dma_open: open a new substream.
-  *
-  * Each substream has its own DMA buffer.
-+ *
-+ * ALSA divides the DMA buffer into N periods.  We create NUM_DMA_LINKS link
-+ * descriptors that ping-pong from one period to the next.  For example, if
-+ * there are six periods and two link descriptors, this is how they look
-+ * before playback starts:
-+ *
-+ *      	   The last link descriptor
-+ *   ____________  points back to the first
-+ *  |   	 |
-+ *  V   	 |
-+ *  ___    ___   |
-+ * |   |->|   |->|
-+ * |___|  |___|
-+ *   |      |
-+ *   |      |
-+ *   V      V
-+ *  _________________________________________
-+ * |      |      |      |      |      |      |  The DMA buffer is
-+ * |      |      |      |      |      |      |    divided into 6 parts
-+ * |______|______|______|______|______|______|
-+ *
-+ * and here's how they look after the first period is finished playing:
-+ *
-+ *   ____________
-+ *  |   	 |
-+ *  V   	 |
-+ *  ___    ___   |
-+ * |   |->|   |->|
-+ * |___|  |___|
-+ *   |      |
-+ *   |______________
-+ *          |       |
-+ *          V       V
-+ *  _________________________________________
-+ * |      |      |      |      |      |      |
-+ * |      |      |      |      |      |      |
-+ * |______|______|______|______|______|______|
-+ *
-+ * The first link descriptor now points to the third period.  The DMA
-+ * controller is currently playing the second period.  When it finishes, it
-+ * will jump back to the first descriptor and play the third period.
-+ *
-+ * There are four reasons we do this:
-+ *
-+ * 1. The only way to get the DMA controller to automatically restart the
-+ *    transfer when it gets to the end of the buffer is to use chaining
-+ *    mode.  Basic direct mode doesn't offer that feature.
-+ * 2. We need to receive an interrupt at the end of every period.  The DMA
-+ *    controller can generate an interrupt at the end of every link transfer
-+ *    (aka segment).  Making each period into a DMA segment will give us the
-+ *    interrupts we need.
-+ * 3. By creating only two link descriptors, regardless of the number of
-+ *    periods, we do not need to reallocate the link descriptors if the
-+ *    number of periods changes.
-+ * 4. All of the audio data is still stored in a single, contiguous DMA
-+ *    buffer, which is what ALSA expects.  We're just dividing it into
-+ *    contiguous parts, and creating a link descriptor for each one.
-  */
- static int fsl_dma_open(struct snd_pcm_substream *substream)
- {
- 	struct snd_pcm_runtime *runtime = substream->runtime;
- 	struct fsl_dma_private *dma_private;
-+	struct ccsr_dma_channel __iomem *dma_channel;
- 	dma_addr_t ld_buf_phys;
-+	u64 temp_link;  	/* Pointer to next link descriptor */
-+	u32 mr;
- 	unsigned int channel;
- 	int ret = 0;
-+	unsigned int i;
- 
- 	/*
- 	 * Reject any DMA buffer whose size is not a multiple of the period
-@@ -390,68 +456,74 @@ static int fsl_dma_open(struct snd_pcm_substream *substream)
- 	snd_soc_set_runtime_hwparams(substream, &fsl_dma_hardware);
- 	runtime->private_data = dma_private;
- 
-+	/* Program the fixed DMA controller parameters */
-+
-+	dma_channel = dma_private->dma_channel;
-+
-+	temp_link = dma_private->ld_buf_phys +
-+		sizeof(struct fsl_dma_link_descriptor);
-+
-+	for (i = 0; i < NUM_DMA_LINKS; i++) {
-+		struct fsl_dma_link_descriptor *link = &dma_private->link[i];
-+
-+		link->source_attr = cpu_to_be32(CCSR_DMA_ATR_SNOOP);
-+		link->dest_attr = cpu_to_be32(CCSR_DMA_ATR_SNOOP);
-+		link->next = cpu_to_be64(temp_link);
-+
-+		temp_link += sizeof(struct fsl_dma_link_descriptor);
-+	}
-+	/* The last link descriptor points to the first */
-+	dma_private->link[i - 1].next = cpu_to_be64(dma_private->ld_buf_phys);
-+
-+	/* Tell the DMA controller where the first link descriptor is */
-+	out_be32(&dma_channel->clndar,
-+		CCSR_DMA_CLNDAR_ADDR(dma_private->ld_buf_phys));
-+	out_be32(&dma_channel->eclndar,
-+		CCSR_DMA_ECLNDAR_ADDR(dma_private->ld_buf_phys));
-+
-+	/* The manual says the BCR must be clear before enabling EMP */
-+	out_be32(&dma_channel->bcr, 0);
-+
-+	/*
-+	 * Program the mode register for interrupts, external master control,
-+	 * and source/destination hold.  Also clear the Channel Abort bit.
-+	 */
-+	mr = in_be32(&dma_channel->mr) &
-+		~(CCSR_DMA_MR_CA | CCSR_DMA_MR_DAHE | CCSR_DMA_MR_SAHE);
-+
-+	/*
-+	 * We want External Master Start and External Master Pause enabled,
-+	 * because the SSI is controlling the DMA controller.  We want the DMA
-+	 * controller to be set up in advance, and then we signal only the SSI
-+	 * to start transferring.
-+	 *
-+	 * We want End-Of-Segment Interrupts enabled, because this will generate
-+	 * an interrupt at the end of each segment (each link descriptor
-+	 * represents one segment).  Each DMA segment is the same thing as an
-+	 * ALSA period, so this is how we get an interrupt at the end of every
-+	 * period.
-+	 *
-+	 * We want Error Interrupt enabled, so that we can get an error if
-+	 * the DMA controller is mis-programmed somehow.
-+	 */
-+	mr |= CCSR_DMA_MR_EOSIE | CCSR_DMA_MR_EIE | CCSR_DMA_MR_EMP_EN |
-+		CCSR_DMA_MR_EMS_EN;
-+
-+	/* For playback, we want the destination address to be held.  For
-+	   capture, set the source address to be held. */
-+	mr |= (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) ?
-+		CCSR_DMA_MR_DAHE : CCSR_DMA_MR_SAHE;
-+
-+	out_be32(&dma_channel->mr, mr);
-+
- 	return 0;
- }
- 
- /**
-- * fsl_dma_hw_params: allocate the DMA buffer and the DMA link descriptors.
-+ * fsl_dma_hw_params: continue initializing the DMA links
-  *
-- * ALSA divides the DMA buffer into N periods.  We create NUM_DMA_LINKS link
-- * descriptors that ping-pong from one period to the next.  For example, if
-- * there are six periods and two link descriptors, this is how they look
-- * before playback starts:
-- *
-- *      	   The last link descriptor
-- *   ____________  points back to the first
-- *  |   	 |
-- *  V   	 |
-- *  ___    ___   |
-- * |   |->|   |->|
-- * |___|  |___|
-- *   |      |
-- *   |      |
-- *   V      V
-- *  _________________________________________
-- * |      |      |      |      |      |      |  The DMA buffer is
-- * |      |      |      |      |      |      |    divided into 6 parts
-- * |______|______|______|______|______|______|
-- *
-- * and here's how they look after the first period is finished playing:
-- *
-- *   ____________
-- *  |   	 |
-- *  V   	 |
-- *  ___    ___   |
-- * |   |->|   |->|
-- * |___|  |___|
-- *   |      |
-- *   |______________
-- *          |       |
-- *          V       V
-- *  _________________________________________
-- * |      |      |      |      |      |      |
-- * |      |      |      |      |      |      |
-- * |______|______|______|______|______|______|
-- *
-- * The first link descriptor now points to the third period.  The DMA
-- * controller is currently playing the second period.  When it finishes, it
-- * will jump back to the first descriptor and play the third period.
-- *
-- * There are four reasons we do this:
-- *
-- * 1. The only way to get the DMA controller to automatically restart the
-- *    transfer when it gets to the end of the buffer is to use chaining
-- *    mode.  Basic direct mode doesn't offer that feature.
-- * 2. We need to receive an interrupt at the end of every period.  The DMA
-- *    controller can generate an interrupt at the end of every link transfer
-- *    (aka segment).  Making each period into a DMA segment will give us the
-- *    interrupts we need.
-- * 3. By creating only two link descriptors, regardless of the number of
-- *    periods, we do not need to reallocate the link descriptors if the
-- *    number of periods changes.
-- * 4. All of the audio data is still stored in a single, contiguous DMA
-- *    buffer, which is what ALSA expects.  We're just dividing it into
-- *    contiguous parts, and creating a link descriptor for each one.
-+ * This function obtains hardware parameters about the opened stream and
-+ * programs the DMA controller accordingly.
-  *
-  * Note that due to a quirk of the SSI's STX register, the target address
-  * for the DMA operations depends on the sample size.  So we don't program
-@@ -463,11 +535,8 @@ static int fsl_dma_hw_params(struct snd_pcm_substream *substream,
- {
- 	struct snd_pcm_runtime *runtime = substream->runtime;
- 	struct fsl_dma_private *dma_private = runtime->private_data;
--	struct ccsr_dma_channel __iomem *dma_channel = dma_private->dma_channel;
- 
- 	dma_addr_t temp_addr;   /* Pointer to next period */
--	u64 temp_link;  	/* Pointer to next link descriptor */
--	u32 mr; 		/* Temporary variable for MR register */
- 
- 	unsigned int i;
- 
-@@ -485,8 +554,6 @@ static int fsl_dma_hw_params(struct snd_pcm_substream *substream,
- 		dma_private->dma_buf_next = dma_private->dma_buf_phys;
- 
- 	/*
--	 * Initialize each link descriptor.
--	 *
- 	 * The actual address in STX0 (destination for playback, source for
- 	 * capture) is based on the sample size, but we don't know the sample
- 	 * size in this function, so we'll have to adjust that later.  See
-@@ -502,16 +569,11 @@ static int fsl_dma_hw_params(struct snd_pcm_substream *substream,
- 	 * buffer itself.
- 	 */
- 	temp_addr = substream->dma_buffer.addr;
--	temp_link = dma_private->ld_buf_phys +
--		sizeof(struct fsl_dma_link_descriptor);
- 
- 	for (i = 0; i < NUM_DMA_LINKS; i++) {
- 		struct fsl_dma_link_descriptor *link = &dma_private->link[i];
- 
- 		link->count = cpu_to_be32(period_size);
--		link->source_attr = cpu_to_be32(CCSR_DMA_ATR_SNOOP);
--		link->dest_attr = cpu_to_be32(CCSR_DMA_ATR_SNOOP);
--		link->next = cpu_to_be64(temp_link);
- 
- 		if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
- 			link->source_addr = cpu_to_be32(temp_addr);
-@@ -519,51 +581,7 @@ static int fsl_dma_hw_params(struct snd_pcm_substream *substream,
- 			link->dest_addr = cpu_to_be32(temp_addr);
- 
- 		temp_addr += period_size;
--		temp_link += sizeof(struct fsl_dma_link_descriptor);
- 	}
--	/* The last link descriptor points to the first */
--	dma_private->link[i - 1].next = cpu_to_be64(dma_private->ld_buf_phys);
--
--	/* Tell the DMA controller where the first link descriptor is */
--	out_be32(&dma_channel->clndar,
--		CCSR_DMA_CLNDAR_ADDR(dma_private->ld_buf_phys));
--	out_be32(&dma_channel->eclndar,
--		CCSR_DMA_ECLNDAR_ADDR(dma_private->ld_buf_phys));
--
--	/* The manual says the BCR must be clear before enabling EMP */
--	out_be32(&dma_channel->bcr, 0);
--
--	/*
--	 * Program the mode register for interrupts, external master control,
--	 * and source/destination hold.  Also clear the Channel Abort bit.
--	 */
--	mr = in_be32(&dma_channel->mr) &
--		~(CCSR_DMA_MR_CA | CCSR_DMA_MR_DAHE | CCSR_DMA_MR_SAHE);
--
--	/*
--	 * We want External Master Start and External Master Pause enabled,
--	 * because the SSI is controlling the DMA controller.  We want the DMA
--	 * controller to be set up in advance, and then we signal only the SSI
--	 * to start transfering.
--	 *
--	 * We want End-Of-Segment Interrupts enabled, because this will generate
--	 * an interrupt at the end of each segment (each link descriptor
--	 * represents one segment).  Each DMA segment is the same thing as an
--	 * ALSA period, so this is how we get an interrupt at the end of every
--	 * period.
--	 *
--	 * We want Error Interrupt enabled, so that we can get an error if
--	 * the DMA controller is mis-programmed somehow.
--	 */
--	mr |= CCSR_DMA_MR_EOSIE | CCSR_DMA_MR_EIE | CCSR_DMA_MR_EMP_EN |
--		CCSR_DMA_MR_EMS_EN;
--
--	/* For playback, we want the destination address to be held.  For
--	   capture, set the source address to be held. */
--	mr |= (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) ?
--		CCSR_DMA_MR_DAHE : CCSR_DMA_MR_SAHE;
--
--	out_be32(&dma_channel->mr, mr);
- 
- 	return 0;
- }
-diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c
-index f588545..94f8567 100644
---- a/sound/soc/fsl/fsl_ssi.c
-+++ b/sound/soc/fsl/fsl_ssi.c
-@@ -67,6 +67,8 @@
-  * @ssi: pointer to the SSI's registers
-  * @ssi_phys: physical address of the SSI registers
-  * @irq: IRQ of this SSI
-+ * @first_stream: pointer to the stream that was opened first
-+ * @second_stream: pointer to second stream
-  * @dev: struct device pointer
-  * @playback: the number of playback streams opened
-  * @capture: the number of capture streams opened
-@@ -79,6 +81,8 @@ struct fsl_ssi_private {
- 	struct ccsr_ssi __iomem *ssi;
- 	dma_addr_t ssi_phys;
- 	unsigned int irq;
-+	struct snd_pcm_substream *first_stream;
-+	struct snd_pcm_substream *second_stream;
- 	struct device *dev;
- 	unsigned int playback;
- 	unsigned int capture;
-@@ -342,6 +346,49 @@ static int fsl_ssi_startup(struct snd_pcm_substream *substream)
- 		 */
- 	}
- 
-+	if (!ssi_private->first_stream)
-+		ssi_private->first_stream = substream;
-+	else {
-+		/* This is the second stream open, so we need to impose sample
-+		 * rate and maybe sample size constraints.  Note that this can
-+		 * cause a race condition if the second stream is opened before
-+		 * the first stream is fully initialized.
-+		 *
-+		 * We provide some protection by checking to make sure the first
-+		 * stream is initialized, but it's not perfect.  ALSA sometimes
-+		 * re-initializes the driver with a different sample rate or
-+		 * size.  If the second stream is opened before the first stream
-+		 * has received its final parameters, then the second stream may
-+		 * be constrained to the wrong sample rate or size.
-+		 *
-+		 * FIXME: This code does not handle opening and closing streams
-+		 * repeatedly.  If you open two streams and then close the first
-+		 * one, you may not be able to open another stream until you
-+		 * close the second one as well.
-+		 */
-+		struct snd_pcm_runtime *first_runtime =
-+			ssi_private->first_stream->runtime;
-+
-+		if (!first_runtime->rate || !first_runtime->sample_bits) {
-+			dev_err(substream->pcm->card->dev,
-+				"set sample rate and size in %s stream first\n",
-+				substream->stream == SNDRV_PCM_STREAM_PLAYBACK
-+				? "capture" : "playback");
-+			return -EAGAIN;
-+		}
-+
-+		snd_pcm_hw_constraint_minmax(substream->runtime,
-+			SNDRV_PCM_HW_PARAM_RATE,
-+			first_runtime->rate, first_runtime->rate);
-+
-+		snd_pcm_hw_constraint_minmax(substream->runtime,
-+			SNDRV_PCM_HW_PARAM_SAMPLE_BITS,
-+			first_runtime->sample_bits,
-+			first_runtime->sample_bits);
-+
-+		ssi_private->second_stream = substream;
-+	}
-+
- 	if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
- 		ssi_private->playback++;
- 
-@@ -371,18 +418,16 @@ static int fsl_ssi_prepare(struct snd_pcm_substream *substream)
- 	struct fsl_ssi_private *ssi_private = rtd->dai->cpu_dai->private_data;
- 
- 	struct ccsr_ssi __iomem *ssi = ssi_private->ssi;
--	u32 wl;
- 
--	wl = CCSR_SSI_SxCCR_WL(snd_pcm_format_width(runtime->format));
-+	if (substream == ssi_private->first_stream) {
-+		u32 wl;
- 
--	clrbits32(&ssi->scr, CCSR_SSI_SCR_SSIEN);
-+		/* The SSI should always be disabled at this points (SSIEN=0) */
-+		wl = CCSR_SSI_SxCCR_WL(snd_pcm_format_width(runtime->format));
- 
--	if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
-+		/* In synchronous mode, the SSI uses STCCR for capture */
- 		clrsetbits_be32(&ssi->stccr, CCSR_SSI_SxCCR_WL_MASK, wl);
--	else
--		clrsetbits_be32(&ssi->srccr, CCSR_SSI_SxCCR_WL_MASK, wl);
--
--	setbits32(&ssi->scr, CCSR_SSI_SCR_SSIEN);
-+	}
- 
- 	return 0;
- }
-@@ -407,9 +452,13 @@ static int fsl_ssi_trigger(struct snd_pcm_substream *substream, int cmd)
- 	case SNDRV_PCM_TRIGGER_RESUME:
- 	case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
- 		if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
--			setbits32(&ssi->scr, CCSR_SSI_SCR_TE);
-+			clrbits32(&ssi->scr, CCSR_SSI_SCR_SSIEN);
-+			setbits32(&ssi->scr,
-+				CCSR_SSI_SCR_SSIEN | CCSR_SSI_SCR_TE);
- 		} else {
--			setbits32(&ssi->scr, CCSR_SSI_SCR_RE);
-+			clrbits32(&ssi->scr, CCSR_SSI_SCR_SSIEN);
-+			setbits32(&ssi->scr,
-+				CCSR_SSI_SCR_SSIEN | CCSR_SSI_SCR_RE);
- 
- 			/*
- 			 * I think we need this delay to allow time for the SSI
-@@ -452,6 +501,11 @@ static void fsl_ssi_shutdown(struct snd_pcm_substream *substream)
- 	if (substream->stream == SNDRV_PCM_STREAM_CAPTURE)
- 		ssi_private->capture--;
- 
-+	if (ssi_private->first_stream == substream)
-+		ssi_private->first_stream = ssi_private->second_stream;
-+
-+	ssi_private->second_stream = NULL;
-+
- 	/*
- 	 * If this is the last active substream, disable the SSI and release
- 	 * the IRQ.

Deleted: genpatches-2.6/trunk/2.6.27/1003_linux-2.6.26.4.patch
===================================================================
--- genpatches-2.6/trunk/2.6.27/1003_linux-2.6.26.4.patch	2008-10-10 23:58:26 UTC (rev 1350)
+++ genpatches-2.6/trunk/2.6.27/1003_linux-2.6.26.4.patch	2008-10-11 00:00:47 UTC (rev 1351)
@@ -1,1952 +0,0 @@
-diff --git a/arch/sparc64/mm/init.c b/arch/sparc64/mm/init.c
-index e289a98..387d3f6 100644
---- a/arch/sparc64/mm/init.c
-+++ b/arch/sparc64/mm/init.c
-@@ -842,6 +842,9 @@ static unsigned long nid_range(unsigned long start, unsigned long end,
- 		start += PAGE_SIZE;
- 	}
- 
-+	if (start > end)
-+		start = end;
-+
- 	return start;
- }
- #else
-@@ -1769,8 +1772,7 @@ void __init paging_init(void)
- 
- 	find_ramdisk(phys_base);
- 
--	if (cmdline_memory_size)
--		lmb_enforce_memory_limit(phys_base + cmdline_memory_size);
-+	lmb_enforce_memory_limit(cmdline_memory_size);
- 
- 	lmb_analyze();
- 	lmb_dump_all();
-@@ -2007,6 +2009,15 @@ void __init mem_init(void)
- void free_initmem(void)
- {
- 	unsigned long addr, initend;
-+	int do_free = 1;
-+
-+	/* If the physical memory maps were trimmed by kernel command
-+	 * line options, don't even try freeing this initmem stuff up.
-+	 * The kernel image could have been in the trimmed out region
-+	 * and if so the freeing below will free invalid page structs.
-+	 */
-+	if (cmdline_memory_size)
-+		do_free = 0;
- 
- 	/*
- 	 * The init section is aligned to 8k in vmlinux.lds. Page align for >8k pagesizes.
-@@ -2021,13 +2032,16 @@ void free_initmem(void)
- 			((unsigned long) __va(kern_base)) -
- 			((unsigned long) KERNBASE));
- 		memset((void *)addr, POISON_FREE_INITMEM, PAGE_SIZE);
--		p = virt_to_page(page);
- 
--		ClearPageReserved(p);
--		init_page_count(p);
--		__free_page(p);
--		num_physpages++;
--		totalram_pages++;
-+		if (do_free) {
-+			p = virt_to_page(page);
-+
-+			ClearPageReserved(p);
-+			init_page_count(p);
-+			__free_page(p);
-+			num_physpages++;
-+			totalram_pages++;
-+		}
- 	}
- }
- 
-diff --git a/arch/x86/kernel/cpu/cyrix.c b/arch/x86/kernel/cpu/cyrix.c
-index 3fd7a67..e710a21 100644
---- a/arch/x86/kernel/cpu/cyrix.c
-+++ b/arch/x86/kernel/cpu/cyrix.c
-@@ -134,23 +134,6 @@ static void __cpuinit set_cx86_memwb(void)
- 	setCx86(CX86_CCR2, getCx86(CX86_CCR2) | 0x14);
- }
- 
--static void __cpuinit set_cx86_inc(void)
--{
--	unsigned char ccr3;
--
--	printk(KERN_INFO "Enable Incrementor on Cyrix/NSC processor.\n");
--
--	ccr3 = getCx86(CX86_CCR3);
--	setCx86(CX86_CCR3, (ccr3 & 0x0f) | 0x10); /* enable MAPEN */
--	/* PCR1 -- Performance Control */
--	/* Incrementor on, whatever that is */
--	setCx86(CX86_PCR1, getCx86(CX86_PCR1) | 0x02);
--	/* PCR0 -- Performance Control */
--	/* Incrementor Margin 10 */
--	setCx86(CX86_PCR0, getCx86(CX86_PCR0) | 0x04);
--	setCx86(CX86_CCR3, ccr3);	/* disable MAPEN */
--}
--
- /*
-  *	Configure later MediaGX and/or Geode processor.
-  */
-@@ -174,7 +157,6 @@ static void __cpuinit geode_configure(void)
- 
- 	set_cx86_memwb();
- 	set_cx86_reorder();
--	set_cx86_inc();
- 
- 	local_irq_restore(flags);
- }
-diff --git a/arch/x86/kernel/cpu/mtrr/generic.c b/arch/x86/kernel/cpu/mtrr/generic.c
-index 75b14b1..745b974 100644
---- a/arch/x86/kernel/cpu/mtrr/generic.c
-+++ b/arch/x86/kernel/cpu/mtrr/generic.c
-@@ -365,6 +365,7 @@ static void generic_get_mtrr(unsigned int reg, unsigned long *base,
- 			     unsigned long *size, mtrr_type *type)
- {
- 	unsigned int mask_lo, mask_hi, base_lo, base_hi;
-+	unsigned int tmp, hi;
- 
- 	rdmsr(MTRRphysMask_MSR(reg), mask_lo, mask_hi);
- 	if ((mask_lo & 0x800) == 0) {
-@@ -378,8 +379,23 @@ static void generic_get_mtrr(unsigned int reg, unsigned long *base,
- 	rdmsr(MTRRphysBase_MSR(reg), base_lo, base_hi);
- 
- 	/* Work out the shifted address mask. */
--	mask_lo = size_or_mask | mask_hi << (32 - PAGE_SHIFT)
--	    | mask_lo >> PAGE_SHIFT;
-+	tmp = mask_hi << (32 - PAGE_SHIFT) | mask_lo >> PAGE_SHIFT;
-+	mask_lo = size_or_mask | tmp;
-+	/* Expand tmp with high bits to all 1s*/
-+	hi = fls(tmp);
-+	if (hi > 0) {
-+		tmp |= ~((1<<(hi - 1)) - 1);
-+
-+		if (tmp != mask_lo) {
-+			static int once = 1;
-+
-+			if (once) {
-+				printk(KERN_INFO "mtrr: your BIOS has set up an incorrect mask, fixing it up.\n");
-+				once = 0;
-+			}
-+			mask_lo = tmp;
-+		}
-+	}
- 
- 	/* This works correctly if size is a power of two, i.e. a
- 	   contiguous range. */
-diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
-index 934c7b6..d333a74 100644
---- a/arch/x86/kvm/paging_tmpl.h
-+++ b/arch/x86/kvm/paging_tmpl.h
-@@ -343,7 +343,7 @@ static u64 *FNAME(fetch)(struct kvm_vcpu *vcpu, gva_t addr,
- 		shadow_addr = __pa(shadow_page->spt);
- 		shadow_pte = shadow_addr | PT_PRESENT_MASK | PT_ACCESSED_MASK
- 			| PT_WRITABLE_MASK | PT_USER_MASK;
--		*shadow_ent = shadow_pte;
-+		set_shadow_pte(shadow_ent, shadow_pte);
- 	}
- 
- 	mmu_set_spte(vcpu, shadow_ent, access, walker->pte_access & access,
-diff --git a/crypto/authenc.c b/crypto/authenc.c
-index 4b22676..fd9f06c 100644
---- a/crypto/authenc.c
-+++ b/crypto/authenc.c
-@@ -174,8 +174,9 @@ static int crypto_authenc_genicv(struct aead_request *req, u8 *iv,
- static void crypto_authenc_encrypt_done(struct crypto_async_request *req,
- 					int err)
- {
-+	struct aead_request *areq = req->data;
-+
- 	if (!err) {
--		struct aead_request *areq = req->data;
- 		struct crypto_aead *authenc = crypto_aead_reqtfm(areq);
- 		struct crypto_authenc_ctx *ctx = crypto_aead_ctx(authenc);
- 		struct ablkcipher_request *abreq = aead_request_ctx(areq);
-@@ -185,7 +186,7 @@ static void crypto_authenc_encrypt_done(struct crypto_async_request *req,
- 		err = crypto_authenc_genicv(areq, iv, 0);
- 	}
- 
--	aead_request_complete(req->data, err);
-+	aead_request_complete(areq, err);
- }
- 
- static int crypto_authenc_encrypt(struct aead_request *req)
-@@ -216,14 +217,15 @@ static int crypto_authenc_encrypt(struct aead_request *req)
- static void crypto_authenc_givencrypt_done(struct crypto_async_request *req,
- 					   int err)
- {
-+	struct aead_request *areq = req->data;
-+
- 	if (!err) {
--		struct aead_request *areq = req->data;
- 		struct skcipher_givcrypt_request *greq = aead_request_ctx(areq);
- 
- 		err = crypto_authenc_genicv(areq, greq->giv, 0);
- 	}
- 
--	aead_request_complete(req->data, err);
-+	aead_request_complete(areq, err);
- }
- 
- static int crypto_authenc_givencrypt(struct aead_givcrypt_request *req)
-diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
-index ad169ff..80c655f 100644
---- a/drivers/ata/sata_mv.c
-+++ b/drivers/ata/sata_mv.c
-@@ -1134,30 +1134,16 @@ static int mv_qc_defer(struct ata_queued_cmd *qc)
- 	if (ap->nr_active_links == 0)
- 		return 0;
- 
--	if (pp->pp_flags & MV_PP_FLAG_EDMA_EN) {
--		/*
--		 * The port is operating in host queuing mode (EDMA).
--		 * It can accomodate a new qc if the qc protocol
--		 * is compatible with the current host queue mode.
--		 */
--		if (pp->pp_flags & MV_PP_FLAG_NCQ_EN) {
--			/*
--			 * The host queue (EDMA) is in NCQ mode.
--			 * If the new qc is also an NCQ command,
--			 * then allow the new qc.
--			 */
--			if (qc->tf.protocol == ATA_PROT_NCQ)
--				return 0;
--		} else {
--			/*
--			 * The host queue (EDMA) is in non-NCQ, DMA mode.
--			 * If the new qc is also a non-NCQ, DMA command,
--			 * then allow the new qc.
--			 */
--			if (qc->tf.protocol == ATA_PROT_DMA)
--				return 0;
--		}
--	}
-+	/*
-+	 * The port is operating in host queuing mode (EDMA) with NCQ
-+	 * enabled, allow multiple NCQ commands.  EDMA also allows
-+	 * queueing multiple DMA commands but libata core currently
-+	 * doesn't allow it.
-+	 */
-+	if ((pp->pp_flags & MV_PP_FLAG_EDMA_EN) &&
-+	    (pp->pp_flags & MV_PP_FLAG_NCQ_EN) && ata_is_ncq(qc->tf.protocol))
-+		return 0;
-+
- 	return ATA_DEFER_PORT;
- }
- 
-diff --git a/drivers/char/random.c b/drivers/char/random.c
-index 0cf98bd..71320d2 100644
---- a/drivers/char/random.c
-+++ b/drivers/char/random.c
-@@ -406,7 +406,7 @@ struct entropy_store {
- 	/* read-write data: */
- 	spinlock_t lock;
- 	unsigned add_ptr;
--	int entropy_count;
-+	int entropy_count;	/* Must at no time exceed ->POOLBITS! */
- 	int input_rotate;
- };
- 
-@@ -519,6 +519,7 @@ static void mix_pool_bytes(struct entropy_store *r, const void *in, int bytes)
- static void credit_entropy_bits(struct entropy_store *r, int nbits)
- {
- 	unsigned long flags;
-+	int entropy_count;
- 
- 	if (!nbits)
- 		return;
-@@ -526,20 +527,20 @@ static void credit_entropy_bits(struct entropy_store *r, int nbits)
- 	spin_lock_irqsave(&r->lock, flags);
- 
- 	DEBUG_ENT("added %d entropy credits to %s\n", nbits, r->name);
--	r->entropy_count += nbits;
--	if (r->entropy_count < 0) {
-+	entropy_count = r->entropy_count;
-+	entropy_count += nbits;
-+	if (entropy_count < 0) {
- 		DEBUG_ENT("negative entropy/overflow\n");
--		r->entropy_count = 0;
--	} else if (r->entropy_count > r->poolinfo->POOLBITS)
--		r->entropy_count = r->poolinfo->POOLBITS;
-+		entropy_count = 0;
-+	} else if (entropy_count > r->poolinfo->POOLBITS)
-+		entropy_count = r->poolinfo->POOLBITS;
-+	r->entropy_count = entropy_count;
- 
- 	/* should we wake readers? */
--	if (r == &input_pool &&
--	    r->entropy_count >= random_read_wakeup_thresh) {
-+	if (r == &input_pool && entropy_count >= random_read_wakeup_thresh) {
- 		wake_up_interruptible(&random_read_wait);
- 		kill_fasync(&fasync, SIGIO, POLL_IN);
- 	}
--
- 	spin_unlock_irqrestore(&r->lock, flags);
- }
- 
-diff --git a/drivers/misc/eeepc-laptop.c b/drivers/misc/eeepc-laptop.c
-index 6d72760..3f3abf9 100644
---- a/drivers/misc/eeepc-laptop.c
-+++ b/drivers/misc/eeepc-laptop.c
-@@ -553,9 +553,9 @@ static void eeepc_hwmon_exit(void)
- 	hwmon = eeepc_hwmon_device;
- 	if (!hwmon)
- 		return ;
--	hwmon_device_unregister(hwmon);
- 	sysfs_remove_group(&hwmon->kobj,
- 			   &hwmon_attribute_group);
-+	hwmon_device_unregister(hwmon);
- 	eeepc_hwmon_device = NULL;
- }
- 
-diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c
-index 3c798ae..8fe0a49 100644
---- a/drivers/net/atlx/atl1.c
-+++ b/drivers/net/atlx/atl1.c
-@@ -3019,7 +3019,6 @@ static int __devinit atl1_probe(struct pci_dev *pdev,
- 	netdev->features = NETIF_F_HW_CSUM;
- 	netdev->features |= NETIF_F_SG;
- 	netdev->features |= (NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX);
--	netdev->features |= NETIF_F_TSO;
- 	netdev->features |= NETIF_F_LLTX;
- 
- 	/*
-diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
-index 20d4fe9..1652f10 100644
---- a/drivers/net/forcedeth.c
-+++ b/drivers/net/forcedeth.c
-@@ -5420,7 +5420,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
- 	if (id->driver_data & DEV_HAS_CHECKSUM) {
- 		np->rx_csum = 1;
- 		np->txrxctl_bits |= NVREG_TXRXCTL_RXCHECK;
--		dev->features |= NETIF_F_HW_CSUM | NETIF_F_SG;
-+		dev->features |= NETIF_F_IP_CSUM | NETIF_F_SG;
- 		dev->features |= NETIF_F_TSO;
- 	}
- 
-@@ -5728,7 +5728,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
- 
- 	dev_printk(KERN_INFO, &pci_dev->dev, "%s%s%s%s%s%s%s%s%s%sdesc-v%u\n",
- 		   dev->features & NETIF_F_HIGHDMA ? "highdma " : "",
--		   dev->features & (NETIF_F_HW_CSUM | NETIF_F_SG) ?
-+		   dev->features & (NETIF_F_IP_CSUM | NETIF_F_SG) ?
- 		   	"csum " : "",
- 		   dev->features & (NETIF_F_HW_VLAN_RX | NETIF_F_HW_VLAN_TX) ?
- 		   	"vlan " : "",
-diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
-index 42d7c0a..0e4eb15 100644
---- a/drivers/net/r8169.c
-+++ b/drivers/net/r8169.c
-@@ -2822,7 +2822,7 @@ static int rtl8169_rx_interrupt(struct net_device *dev,
- 					pkt_size, PCI_DMA_FROMDEVICE);
- 				rtl8169_mark_to_asic(desc, tp->rx_buf_sz);
- 			} else {
--				pci_unmap_single(pdev, addr, pkt_size,
-+				pci_unmap_single(pdev, addr, tp->rx_buf_sz,
- 						 PCI_DMA_FROMDEVICE);
- 				tp->Rx_skbuff[entry] = NULL;
- 			}
-diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
-index cc4bde8..1710e49 100644
---- a/drivers/net/tg3.c
-+++ b/drivers/net/tg3.c
-@@ -1672,15 +1672,43 @@ static int tg3_set_power_state(struct tg3 *tp, pci_power_t state)
- }
- 
- /* tp->lock is held. */
-+static inline void tg3_generate_fw_event(struct tg3 *tp)
-+{
-+	u32 val;
-+
-+	val = tr32(GRC_RX_CPU_EVENT);
-+	val |= GRC_RX_CPU_DRIVER_EVENT;
-+	tw32_f(GRC_RX_CPU_EVENT, val);
-+
-+	tp->last_event_jiffies = jiffies;
-+}
-+
-+#define TG3_FW_EVENT_TIMEOUT_USEC 2500
-+
-+/* tp->lock is held. */
- static void tg3_wait_for_event_ack(struct tg3 *tp)
- {
- 	int i;
-+	unsigned int delay_cnt;
-+	long time_remain;
-+
-+	/* If enough time has passed, no wait is necessary. */
-+	time_remain = (long)(tp->last_event_jiffies + 1 +
-+		      usecs_to_jiffies(TG3_FW_EVENT_TIMEOUT_USEC)) -
-+		      (long)jiffies;
-+	if (time_remain < 0)
-+		return;
- 
--	/* Wait for up to 2.5 milliseconds */
--	for (i = 0; i < 250000; i++) {
-+	/* Check if we can shorten the wait time. */
-+	delay_cnt = jiffies_to_usecs(time_remain);
-+	if (delay_cnt > TG3_FW_EVENT_TIMEOUT_USEC)
-+		delay_cnt = TG3_FW_EVENT_TIMEOUT_USEC;
-+	delay_cnt = (delay_cnt >> 3) + 1;
-+
-+	for (i = 0; i < delay_cnt; i++) {
- 		if (!(tr32(GRC_RX_CPU_EVENT) & GRC_RX_CPU_DRIVER_EVENT))
- 			break;
--		udelay(10);
-+		udelay(8);
- 	}
- }
- 
-@@ -1729,9 +1757,7 @@ static void tg3_ump_link_report(struct tg3 *tp)
- 		val = 0;
- 	tg3_write_mem(tp, NIC_SRAM_FW_CMD_DATA_MBOX + 12, val);
- 
--	val = tr32(GRC_RX_CPU_EVENT);
--	val |= GRC_RX_CPU_DRIVER_EVENT;
--	tw32_f(GRC_RX_CPU_EVENT, val);
-+	tg3_generate_fw_event(tp);
- }
- 
- static void tg3_link_report(struct tg3 *tp)
-@@ -5565,6 +5591,7 @@ static int tg3_chip_reset(struct tg3 *tp)
- 		tg3_read_mem(tp, NIC_SRAM_DATA_CFG, &nic_cfg);
- 		if (nic_cfg & NIC_SRAM_DATA_CFG_ASF_ENABLE) {
- 			tp->tg3_flags |= TG3_FLAG_ENABLE_ASF;
-+			tp->last_event_jiffies = jiffies;
- 			if (tp->tg3_flags2 & TG3_FLG2_5750_PLUS)
- 				tp->tg3_flags2 |= TG3_FLG2_ASF_NEW_HANDSHAKE;
- 		}
-@@ -5578,15 +5605,12 @@ static void tg3_stop_fw(struct tg3 *tp)
- {
- 	if ((tp->tg3_flags & TG3_FLAG_ENABLE_ASF) &&
- 	   !(tp->tg3_flags3 & TG3_FLG3_ENABLE_APE)) {
--		u32 val;
--
- 		/* Wait for RX cpu to ACK the previous event. */
- 		tg3_wait_for_event_ack(tp);
- 
- 		tg3_write_mem(tp, NIC_SRAM_FW_CMD_MBOX, FWCMD_NICDRV_PAUSE_FW);
--		val = tr32(GRC_RX_CPU_EVENT);
--		val |= GRC_RX_CPU_DRIVER_EVENT;
--		tw32(GRC_RX_CPU_EVENT, val);
-+
-+		tg3_generate_fw_event(tp);
- 
- 		/* Wait for RX cpu to ACK this event. */
- 		tg3_wait_for_event_ack(tp);
-@@ -7477,8 +7501,6 @@ static void tg3_timer(unsigned long __opaque)
- 	 */
- 	if (!--tp->asf_counter) {
- 		if (tp->tg3_flags & TG3_FLAG_ENABLE_ASF) {
--			u32 val;
--
- 			tg3_wait_for_event_ack(tp);
- 
- 			tg3_write_mem(tp, NIC_SRAM_FW_CMD_MBOX,
-@@ -7486,9 +7508,8 @@ static void tg3_timer(unsigned long __opaque)
- 			tg3_write_mem(tp, NIC_SRAM_FW_CMD_LEN_MBOX, 4);
- 			/* 5 seconds timeout */
- 			tg3_write_mem(tp, NIC_SRAM_FW_CMD_DATA_MBOX, 5);
--			val = tr32(GRC_RX_CPU_EVENT);
--			val |= GRC_RX_CPU_DRIVER_EVENT;
--			tw32_f(GRC_RX_CPU_EVENT, val);
-+
-+			tg3_generate_fw_event(tp);
- 		}
- 		tp->asf_counter = tp->asf_multiplier;
- 	}
-diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
-index 0404f93..d68b579 100644
---- a/drivers/net/tg3.h
-+++ b/drivers/net/tg3.h
-@@ -2404,7 +2404,10 @@ struct tg3 {
- 	struct tg3_ethtool_stats	estats;
- 	struct tg3_ethtool_stats	estats_prev;
- 
-+	union {
- 	unsigned long			phy_crc_errors;
-+	unsigned long			last_event_jiffies;
-+	};
- 
- 	u32				rx_offset;
- 	u32				tg3_flags;
-diff --git a/drivers/pci/search.c b/drivers/pci/search.c
-index 217814f..3b3b5f1 100644
---- a/drivers/pci/search.c
-+++ b/drivers/pci/search.c
-@@ -280,6 +280,8 @@ static struct pci_dev *pci_get_dev_by_id(const struct pci_device_id *id,
- 			      match_pci_dev_by_id);
- 	if (dev)
- 		pdev = to_pci_dev(dev);
-+	if (from)
-+		pci_dev_put(from);
- 	return pdev;
- }
- 
-diff --git a/drivers/rtc/rtc-lib.c b/drivers/rtc/rtc-lib.c
-index 9f996ec..dd70bf7 100644
---- a/drivers/rtc/rtc-lib.c
-+++ b/drivers/rtc/rtc-lib.c
-@@ -51,10 +51,11 @@ EXPORT_SYMBOL(rtc_year_days);
-  */
- void rtc_time_to_tm(unsigned long time, struct rtc_time *tm)
- {
--	unsigned int days, month, year;
-+	unsigned int month, year;
-+	int days;
- 
- 	days = time / 86400;
--	time -= days * 86400;
-+	time -= (unsigned int) days * 86400;
- 
- 	/* day of the week, 1970-01-01 was a Thursday */
- 	tm->tm_wday = (days + 4) % 7;
-diff --git a/drivers/s390/block/dasd_eckd.h b/drivers/s390/block/dasd_eckd.h
-index fc2509c..a466820 100644
---- a/drivers/s390/block/dasd_eckd.h
-+++ b/drivers/s390/block/dasd_eckd.h
-@@ -379,7 +379,7 @@ struct dasd_psf_prssd_data {
- 	unsigned char flags;
- 	unsigned char reserved[4];
- 	unsigned char suborder;
--	unsigned char varies[9];
-+	unsigned char varies[5];
- } __attribute__ ((packed));
- 
- /*
-diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c
-index be95e55..4050845 100644
---- a/drivers/serial/8250.c
-+++ b/drivers/serial/8250.c
-@@ -1895,15 +1895,23 @@ static int serial8250_startup(struct uart_port *port)
- 		 * kick the UART on a regular basis.
- 		 */
- 		if (!(iir1 & UART_IIR_NO_INT) && (iir & UART_IIR_NO_INT)) {
-+			up->bugs |= UART_BUG_THRE;
- 			pr_debug("ttyS%d - using backup timer\n", port->line);
--			up->timer.function = serial8250_backup_timeout;
--			up->timer.data = (unsigned long)up;
--			mod_timer(&up->timer, jiffies +
--				poll_timeout(up->port.timeout) + HZ / 5);
- 		}
- 	}
- 
- 	/*
-+	 * The above check will only give an accurate result the first time
-+	 * the port is opened so this value needs to be preserved.
-+	 */
-+	if (up->bugs & UART_BUG_THRE) {
-+		up->timer.function = serial8250_backup_timeout;
-+		up->timer.data = (unsigned long)up;
-+		mod_timer(&up->timer, jiffies +
-+			  poll_timeout(up->port.timeout) + HZ / 5);
-+	}
-+
-+	/*
- 	 * If the "interrupt" for this port doesn't correspond with any
- 	 * hardware interrupt, we use a timer-based system.  The original
- 	 * driver used to do this with IRQ0.
-diff --git a/drivers/serial/8250.h b/drivers/serial/8250.h
-index 91bd28f..245288d 100644
---- a/drivers/serial/8250.h
-+++ b/drivers/serial/8250.h
-@@ -49,6 +49,7 @@ struct serial8250_config {
- #define UART_BUG_QUOT	(1 << 0)	/* UART has buggy quot LSB */
- #define UART_BUG_TXEN	(1 << 1)	/* UART has buggy TX IIR status */
- #define UART_BUG_NOMSR	(1 << 2)	/* UART has buggy MSR status bits (Au1x00) */
-+#define UART_BUG_THRE	(1 << 3)	/* UART has buggy THRE reassertion */
- 
- #define PROBE_RSA	(1 << 0)
- #define PROBE_ANY	(~0)
-diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
-index c3201af..560337a 100644
---- a/drivers/usb/class/cdc-acm.c
-+++ b/drivers/usb/class/cdc-acm.c
-@@ -525,8 +525,8 @@ static int acm_tty_open(struct tty_struct *tty, struct file *filp)
- 	tasklet_schedule(&acm->urb_task);
- 
- done:
--err_out:
- 	mutex_unlock(&acm->mutex);
-+err_out:
- 	mutex_unlock(&open_mutex);
- 	return rv;
- 
-diff --git a/drivers/video/fb_defio.c b/drivers/video/fb_defio.c
-index 59df132..4835bdc 100644
---- a/drivers/video/fb_defio.c
-+++ b/drivers/video/fb_defio.c
-@@ -114,6 +114,17 @@ static struct vm_operations_struct fb_deferred_io_vm_ops = {
- 	.page_mkwrite	= fb_deferred_io_mkwrite,
- };
- 
-+static int fb_deferred_io_set_page_dirty(struct page *page)
-+{
-+	if (!PageDirty(page))
-+		SetPageDirty(page);
-+	return 0;
-+}
-+
-+static const struct address_space_operations fb_deferred_io_aops = {
-+	.set_page_dirty = fb_deferred_io_set_page_dirty,
-+};
-+
- static int fb_deferred_io_mmap(struct fb_info *info, struct vm_area_struct *vma)
- {
- 	vma->vm_ops = &fb_deferred_io_vm_ops;
-@@ -163,6 +174,14 @@ void fb_deferred_io_init(struct fb_info *info)
- }
- EXPORT_SYMBOL_GPL(fb_deferred_io_init);
- 
-+void fb_deferred_io_open(struct fb_info *info,
-+			 struct inode *inode,
-+			 struct file *file)
-+{
-+	file->f_mapping->a_ops = &fb_deferred_io_aops;
-+}
-+EXPORT_SYMBOL_GPL(fb_deferred_io_open);
-+
- void fb_deferred_io_cleanup(struct fb_info *info)
- {
- 	void *screen_base = (void __force *) info->screen_base;
-diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
-index 776f7fc..ce6b5da 100644
---- a/drivers/video/fbmem.c
-+++ b/drivers/video/fbmem.c
-@@ -1340,6 +1340,10 @@ fb_open(struct inode *inode, struct file *file)
- 		if (res)
- 			module_put(info->fbops->owner);
- 	}
-+#ifdef CONFIG_FB_DEFERRED_IO
-+	if (info->fbdefio)
-+		fb_deferred_io_open(info, inode, file);
-+#endif
- 	return res;
- }
- 
-diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c
-index 7191306..a0a7157 100644
---- a/fs/binfmt_misc.c
-+++ b/fs/binfmt_misc.c
-@@ -119,8 +119,6 @@ static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs)
- 	if (bprm->misc_bang)
- 		goto _ret;
- 
--	bprm->misc_bang = 1;
--
- 	/* to keep locking time low, we copy the interpreter string */
- 	read_lock(&entries_lock);
- 	fmt = check_file(bprm);
-@@ -198,6 +196,8 @@ static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs)
- 	if (retval < 0)
- 		goto _error;
- 
-+	bprm->misc_bang = 1;
-+
- 	retval = search_binary_handler (bprm, regs);
- 	if (retval < 0)
- 		goto _error;
-diff --git a/fs/bio.c b/fs/bio.c
-index 7856257..7db618c 100644
---- a/fs/bio.c
-+++ b/fs/bio.c
-@@ -464,20 +464,21 @@ static void bio_free_map_data(struct bio_map_data *bmd)
- 	kfree(bmd);
- }
- 
--static struct bio_map_data *bio_alloc_map_data(int nr_segs, int iov_count)
-+static struct bio_map_data *bio_alloc_map_data(int nr_segs, int iov_count,
-+					       gfp_t gfp_mask)
- {
--	struct bio_map_data *bmd = kmalloc(sizeof(*bmd), GFP_KERNEL);
-+	struct bio_map_data *bmd = kmalloc(sizeof(*bmd), gfp_mask);
- 
- 	if (!bmd)
- 		return NULL;
- 
--	bmd->iovecs = kmalloc(sizeof(struct bio_vec) * nr_segs, GFP_KERNEL);
-+	bmd->iovecs = kmalloc(sizeof(struct bio_vec) * nr_segs, gfp_mask);
- 	if (!bmd->iovecs) {
- 		kfree(bmd);
- 		return NULL;
- 	}
- 
--	bmd->sgvecs = kmalloc(sizeof(struct sg_iovec) * iov_count, GFP_KERNEL);
-+	bmd->sgvecs = kmalloc(sizeof(struct sg_iovec) * iov_count, gfp_mask);
- 	if (bmd->sgvecs)
- 		return bmd;
- 
-@@ -486,8 +487,8 @@ static struct bio_map_data *bio_alloc_map_data(int nr_segs, int iov_count)
- 	return NULL;
- }
- 
--static int __bio_copy_iov(struct bio *bio, struct sg_iovec *iov, int iov_count,
--			  int uncopy)
-+static int __bio_copy_iov(struct bio *bio, struct bio_vec *iovecs,
-+			  struct sg_iovec *iov, int iov_count, int uncopy)
- {
- 	int ret = 0, i;
- 	struct bio_vec *bvec;
-@@ -497,7 +498,7 @@ static int __bio_copy_iov(struct bio *bio, struct sg_iovec *iov, int iov_count,
- 
- 	__bio_for_each_segment(bvec, bio, i, 0) {
- 		char *bv_addr = page_address(bvec->bv_page);
--		unsigned int bv_len = bvec->bv_len;
-+		unsigned int bv_len = iovecs[i].bv_len;
- 
- 		while (bv_len && iov_idx < iov_count) {
- 			unsigned int bytes;
-@@ -549,7 +550,7 @@ int bio_uncopy_user(struct bio *bio)
- 	struct bio_map_data *bmd = bio->bi_private;
- 	int ret;
- 
--	ret = __bio_copy_iov(bio, bmd->sgvecs, bmd->nr_sgvecs, 1);
-+	ret = __bio_copy_iov(bio, bmd->iovecs, bmd->sgvecs, bmd->nr_sgvecs, 1);
- 
- 	bio_free_map_data(bmd);
- 	bio_put(bio);
-@@ -591,7 +592,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q, struct sg_iovec *iov,
- 		len += iov[i].iov_len;
- 	}
- 
--	bmd = bio_alloc_map_data(nr_pages, iov_count);
-+	bmd = bio_alloc_map_data(nr_pages, iov_count, GFP_KERNEL);
- 	if (!bmd)
- 		return ERR_PTR(-ENOMEM);
- 
-@@ -628,7 +629,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q, struct sg_iovec *iov,
- 	 * success
- 	 */
- 	if (!write_to_vm) {
--		ret = __bio_copy_iov(bio, iov, iov_count, 0);
-+		ret = __bio_copy_iov(bio, bio->bi_io_vec, iov, iov_count, 0);
- 		if (ret)
- 			goto cleanup;
- 	}
-@@ -941,19 +942,22 @@ static void bio_copy_kern_endio(struct bio *bio, int err)
- {
- 	struct bio_vec *bvec;
- 	const int read = bio_data_dir(bio) == READ;
--	char *p = bio->bi_private;
-+	struct bio_map_data *bmd = bio->bi_private;
- 	int i;
-+	char *p = bmd->sgvecs[0].iov_base;
- 
- 	__bio_for_each_segment(bvec, bio, i, 0) {
- 		char *addr = page_address(bvec->bv_page);
-+		int len = bmd->iovecs[i].bv_len;
- 
- 		if (read && !err)
--			memcpy(p, addr, bvec->bv_len);
-+			memcpy(p, addr, len);
- 
- 		__free_page(bvec->bv_page);
--		p += bvec->bv_len;
-+		p += len;
- 	}
- 
-+	bio_free_map_data(bmd);
- 	bio_put(bio);
- }
- 
-@@ -977,11 +981,21 @@ struct bio *bio_copy_kern(struct request_queue *q, void *data, unsigned int len,
- 	const int nr_pages = end - start;
- 	struct bio *bio;
- 	struct bio_vec *bvec;
-+	struct bio_map_data *bmd;
- 	int i, ret;
-+	struct sg_iovec iov;
-+
-+	iov.iov_base = data;
-+	iov.iov_len = len;
-+
-+	bmd = bio_alloc_map_data(nr_pages, 1, gfp_mask);
-+	if (!bmd)
-+		return ERR_PTR(-ENOMEM);
- 
-+	ret = -ENOMEM;
- 	bio = bio_alloc(gfp_mask, nr_pages);
- 	if (!bio)
--		return ERR_PTR(-ENOMEM);
-+		goto out_bmd;
- 
- 	while (len) {
- 		struct page *page;
-@@ -1015,14 +1029,18 @@ struct bio *bio_copy_kern(struct request_queue *q, void *data, unsigned int len,
- 		}
- 	}
- 
--	bio->bi_private = data;
-+	bio->bi_private = bmd;
- 	bio->bi_end_io = bio_copy_kern_endio;
-+
-+	bio_set_map_data(bmd, bio, &iov, 1);
- 	return bio;
- cleanup:
- 	bio_for_each_segment(bvec, bio, i)
- 		__free_page(bvec->bv_page);
- 
- 	bio_put(bio);
-+out_bmd:
-+	bio_free_map_data(bmd);
- 
- 	return ERR_PTR(ret);
- }
-diff --git a/fs/cifs/file.c b/fs/cifs/file.c
-index 0aac824..8da903b 100644
---- a/fs/cifs/file.c
-+++ b/fs/cifs/file.c
-@@ -832,6 +832,10 @@ ssize_t cifs_user_write(struct file *file, const char __user *write_data,
- 		return -EBADF;
- 	open_file = (struct cifsFileInfo *) file->private_data;
- 
-+	rc = generic_write_checks(file, poffset, &write_size, 0);
-+	if (rc)
-+		return rc;
-+
- 	xid = GetXid();
- 
- 	if (*poffset > file->f_path.dentry->d_inode->i_size)
-diff --git a/fs/cramfs/inode.c b/fs/cramfs/inode.c
-index 0c3b618..f40423e 100644
---- a/fs/cramfs/inode.c
-+++ b/fs/cramfs/inode.c
-@@ -43,58 +43,13 @@ static DEFINE_MUTEX(read_mutex);
- static int cramfs_iget5_test(struct inode *inode, void *opaque)
- {
- 	struct cramfs_inode *cramfs_inode = opaque;
--
--	if (inode->i_ino != CRAMINO(cramfs_inode))
--		return 0; /* does not match */
--
--	if (inode->i_ino != 1)
--		return 1;
--
--	/* all empty directories, char, block, pipe, and sock, share inode #1 */
--
--	if ((inode->i_mode != cramfs_inode->mode) ||
--	    (inode->i_gid != cramfs_inode->gid) ||
--	    (inode->i_uid != cramfs_inode->uid))
--		return 0; /* does not match */
--
--	if ((S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode)) &&
--	    (inode->i_rdev != old_decode_dev(cramfs_inode->size)))
--		return 0; /* does not match */
--
--	return 1; /* matches */
-+	return inode->i_ino == CRAMINO(cramfs_inode) && inode->i_ino != 1;
- }
- 
- static int cramfs_iget5_set(struct inode *inode, void *opaque)
- {
--	static struct timespec zerotime;
- 	struct cramfs_inode *cramfs_inode = opaque;
--	inode->i_mode = cramfs_inode->mode;
--	inode->i_uid = cramfs_inode->uid;
--	inode->i_size = cramfs_inode->size;
--	inode->i_blocks = (cramfs_inode->size - 1) / 512 + 1;
--	inode->i_gid = cramfs_inode->gid;
--	/* Struct copy intentional */
--	inode->i_mtime = inode->i_atime = inode->i_ctime = zerotime;
- 	inode->i_ino = CRAMINO(cramfs_inode);
--	/* inode->i_nlink is left 1 - arguably wrong for directories,
--	   but it's the best we can do without reading the directory
--           contents.  1 yields the right result in GNU find, even
--	   without -noleaf option. */
--	if (S_ISREG(inode->i_mode)) {
--		inode->i_fop = &generic_ro_fops;
--		inode->i_data.a_ops = &cramfs_aops;
--	} else if (S_ISDIR(inode->i_mode)) {
--		inode->i_op = &cramfs_dir_inode_operations;
--		inode->i_fop = &cramfs_directory_operations;
--	} else if (S_ISLNK(inode->i_mode)) {
--		inode->i_op = &page_symlink_inode_operations;
--		inode->i_data.a_ops = &cramfs_aops;
--	} else {
--		inode->i_size = 0;
--		inode->i_blocks = 0;
--		init_special_inode(inode, inode->i_mode,
--			old_decode_dev(cramfs_inode->size));
--	}
- 	return 0;
- }
- 
-@@ -104,12 +59,48 @@ static struct inode *get_cramfs_inode(struct super_block *sb,
- 	struct inode *inode = iget5_locked(sb, CRAMINO(cramfs_inode),
- 					    cramfs_iget5_test, cramfs_iget5_set,
- 					    cramfs_inode);
-+	static struct timespec zerotime;
-+
- 	if (inode && (inode->i_state & I_NEW)) {
-+		inode->i_mode = cramfs_inode->mode;
-+		inode->i_uid = cramfs_inode->uid;
-+		inode->i_size = cramfs_inode->size;
-+		inode->i_blocks = (cramfs_inode->size - 1) / 512 + 1;
-+		inode->i_gid = cramfs_inode->gid;
-+		/* Struct copy intentional */
-+		inode->i_mtime = inode->i_atime = inode->i_ctime = zerotime;
-+		/* inode->i_nlink is left 1 - arguably wrong for directories,
-+		   but it's the best we can do without reading the directory
-+		   contents.  1 yields the right result in GNU find, even
-+		   without -noleaf option. */
-+		if (S_ISREG(inode->i_mode)) {
-+			inode->i_fop = &generic_ro_fops;
-+			inode->i_data.a_ops = &cramfs_aops;
-+		} else if (S_ISDIR(inode->i_mode)) {
-+			inode->i_op = &cramfs_dir_inode_operations;
-+			inode->i_fop = &cramfs_directory_operations;
-+		} else if (S_ISLNK(inode->i_mode)) {
-+			inode->i_op = &page_symlink_inode_operations;
-+			inode->i_data.a_ops = &cramfs_aops;
-+		} else {
-+			inode->i_size = 0;
-+			inode->i_blocks = 0;
-+			init_special_inode(inode, inode->i_mode,
-+				old_decode_dev(cramfs_inode->size));
-+		}
- 		unlock_new_inode(inode);
- 	}
- 	return inode;
- }
- 
-+static void cramfs_drop_inode(struct inode *inode)
-+{
-+	if (inode->i_ino == 1)
-+		generic_delete_inode(inode);
-+	else
-+		generic_drop_inode(inode);
-+}
-+
- /*
-  * We have our own block cache: don't fill up the buffer cache
-  * with the rom-image, because the way the filesystem is set
-@@ -534,6 +525,7 @@ static const struct super_operations cramfs_ops = {
- 	.put_super	= cramfs_put_super,
- 	.remount_fs	= cramfs_remount,
- 	.statfs		= cramfs_statfs,
-+	.drop_inode	= cramfs_drop_inode,
- };
- 
- static int cramfs_get_sb(struct file_system_type *fs_type,
-diff --git a/fs/nfsd/nfs4acl.c b/fs/nfsd/nfs4acl.c
-index b6ed383..54b8b41 100644
---- a/fs/nfsd/nfs4acl.c
-+++ b/fs/nfsd/nfs4acl.c
-@@ -443,7 +443,7 @@ init_state(struct posix_acl_state *state, int cnt)
- 	 * enough space for either:
- 	 */
- 	alloc = sizeof(struct posix_ace_state_array)
--		+ cnt*sizeof(struct posix_ace_state);
-+		+ cnt*sizeof(struct posix_user_ace_state);
- 	state->users = kzalloc(alloc, GFP_KERNEL);
- 	if (!state->users)
- 		return -ENOMEM;
-diff --git a/include/linux/Kbuild b/include/linux/Kbuild
-index 71d70d1..27af0b8 100644
---- a/include/linux/Kbuild
-+++ b/include/linux/Kbuild
-@@ -293,7 +293,6 @@ unifdef-y += parport.h
- unifdef-y += patchkey.h
- unifdef-y += pci.h
- unifdef-y += personality.h
--unifdef-y += pim.h
- unifdef-y += pktcdvd.h
- unifdef-y += pmu.h
- unifdef-y += poll.h
-diff --git a/include/linux/fb.h b/include/linux/fb.h
-index 72295b0..dd82c76 100644
---- a/include/linux/fb.h
-+++ b/include/linux/fb.h
-@@ -973,6 +973,9 @@ static inline void __fb_pad_aligned_buffer(u8 *dst, u32 d_pitch,
- 
- /* drivers/video/fb_defio.c */
- extern void fb_deferred_io_init(struct fb_info *info);
-+extern void fb_deferred_io_open(struct fb_info *info,
-+				struct inode *inode,
-+				struct file *file);
- extern void fb_deferred_io_cleanup(struct fb_info *info);
- extern int fb_deferred_io_fsync(struct file *file, struct dentry *dentry,
- 				int datasync);
-diff --git a/include/linux/mroute.h b/include/linux/mroute.h
-index de4decf..35a8277 100644
---- a/include/linux/mroute.h
-+++ b/include/linux/mroute.h
-@@ -2,11 +2,7 @@
- #define __LINUX_MROUTE_H
- 
- #include <linux/sockios.h>
--#include <linux/types.h>
--#ifdef __KERNEL__
- #include <linux/in.h>
--#endif
--#include <linux/pim.h>
- 
- /*
-  *	Based on the MROUTING 3.5 defines primarily to keep
-@@ -214,6 +210,27 @@ struct mfc_cache
- #define IGMPMSG_WHOLEPKT	3		/* For PIM Register processing */
- 
- #ifdef __KERNEL__
-+
-+#define PIM_V1_VERSION		__constant_htonl(0x10000000)
-+#define PIM_V1_REGISTER		1
-+
-+#define PIM_VERSION		2
-+#define PIM_REGISTER		1
-+
-+#define PIM_NULL_REGISTER	__constant_htonl(0x40000000)
-+
-+/* PIMv2 register message header layout (ietf-draft-idmr-pimvsm-v2-00.ps */
-+
-+struct pimreghdr
-+{
-+	__u8	type;
-+	__u8	reserved;
-+	__be16	csum;
-+	__be32	flags;
-+};
-+
-+extern int pim_rcv_v1(struct sk_buff *);
-+
- struct rtmsg;
- extern int ipmr_get_route(struct sk_buff *skb, struct rtmsg *rtm, int nowait);
- #endif
-diff --git a/include/linux/pim.h b/include/linux/pim.h
-deleted file mode 100644
-index 236ffd3..0000000
---- a/include/linux/pim.h
-+++ /dev/null
-@@ -1,45 +0,0 @@
--#ifndef __LINUX_PIM_H
--#define __LINUX_PIM_H
--
--#include <asm/byteorder.h>
--
--#ifndef __KERNEL__
--struct pim {
--#if defined(__LITTLE_ENDIAN_BITFIELD)
--	__u8	pim_type:4,		/* PIM message type */
--		pim_ver:4;		/* PIM version */
--#elif defined(__BIG_ENDIAN_BITFIELD)
--	__u8	pim_ver:4;		/* PIM version */
--		pim_type:4;		/* PIM message type */
--#endif
--	__u8	pim_rsv;		/* Reserved */
--	__be16	pim_cksum;		/* Checksum */
--};
--
--#define PIM_MINLEN		8
--#endif
--
--/* Message types - V1 */
--#define PIM_V1_VERSION		__constant_htonl(0x10000000)
--#define PIM_V1_REGISTER		1
--
--/* Message types - V2 */
--#define PIM_VERSION		2
--#define PIM_REGISTER		1
--
--#if defined(__KERNEL__)
--#define PIM_NULL_REGISTER	__constant_htonl(0x40000000)
--
--/* PIMv2 register message header layout (ietf-draft-idmr-pimvsm-v2-00.ps */
--struct pimreghdr
--{
--	__u8	type;
--	__u8	reserved;
--	__be16	csum;
--	__be32	flags;
--};
--
--struct sk_buff;
--extern int pim_rcv_v1(struct sk_buff *);
--#endif
--#endif
-diff --git a/include/net/addrconf.h b/include/net/addrconf.h
-index bbd3d58..99ca7cd 100644
---- a/include/net/addrconf.h
-+++ b/include/net/addrconf.h
-@@ -80,7 +80,8 @@ extern struct inet6_ifaddr      *ipv6_get_ifaddr(struct net *net,
- 						 struct net_device *dev,
- 						 int strict);
- 
--extern int			ipv6_dev_get_saddr(struct net_device *dev, 
-+extern int			ipv6_dev_get_saddr(struct net *net,
-+					       struct net_device *dev,
- 					       const struct in6_addr *daddr,
- 					       unsigned int srcprefs,
- 					       struct in6_addr *saddr);
-diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
-index 9313491..03462e5 100644
---- a/include/net/ip6_route.h
-+++ b/include/net/ip6_route.h
-@@ -112,6 +112,7 @@ struct rt6_rtnl_dump_arg
- {
- 	struct sk_buff *skb;
- 	struct netlink_callback *cb;
-+	struct net *net;
- };
- 
- extern int rt6_dump_route(struct rt6_info *rt, void *p_arg);
-diff --git a/mm/page_alloc.c b/mm/page_alloc.c
-index f32fae3..0d520dc 100644
---- a/mm/page_alloc.c
-+++ b/mm/page_alloc.c
-@@ -693,6 +693,9 @@ int move_freepages(struct zone *zone,
- #endif
- 
- 	for (page = start_page; page <= end_page;) {
-+		/* Make sure we are not inadvertently changing nodes */
-+		VM_BUG_ON(page_to_nid(page) != zone_to_nid(zone));
-+
- 		if (!pfn_valid_within(page_to_pfn(page))) {
- 			page++;
- 			continue;
-@@ -2475,6 +2478,10 @@ static void setup_zone_migrate_reserve(struct zone *zone)
- 			continue;
- 		page = pfn_to_page(pfn);
- 
-+		/* Watch out for overlapping nodes */
-+		if (page_to_nid(page) != zone_to_nid(zone))
-+			continue;
-+
- 		/* Blocks with reserved pages will never free, skip them. */
- 		if (PageReserved(page))
- 			continue;
-diff --git a/net/ax25/sysctl_net_ax25.c b/net/ax25/sysctl_net_ax25.c
-index f597987..f288fc4 100644
---- a/net/ax25/sysctl_net_ax25.c
-+++ b/net/ax25/sysctl_net_ax25.c
-@@ -36,6 +36,7 @@ static struct ctl_path ax25_path[] = {
- 	{ .procname = "ax25", .ctl_name = NET_AX25, },
- 	{ }
- };
-+
- static const ctl_table ax25_param_table[] = {
- 	{
- 		.ctl_name	= NET_AX25_IP_DEFAULT_MODE,
-@@ -167,6 +168,7 @@ static const ctl_table ax25_param_table[] = {
- 		.extra1		= &min_proto,
- 		.extra2		= &max_proto
- 	},
-+#ifdef CONFIG_AX25_DAMA_SLAVE
- 	{
- 		.ctl_name	= NET_AX25_DAMA_SLAVE_TIMEOUT,
- 		.procname	= "dama_slave_timeout",
-@@ -177,6 +179,8 @@ static const ctl_table ax25_param_table[] = {
- 		.extra1		= &min_ds_timeout,
- 		.extra2		= &max_ds_timeout
- 	},
-+#endif
-+
- 	{ .ctl_name = 0 }	/* that's all, folks! */
- };
- 
-@@ -210,16 +214,6 @@ void ax25_register_sysctl(void)
- 		ax25_table[n].procname     = ax25_dev->dev->name;
- 		ax25_table[n].mode         = 0555;
- 
--#ifndef CONFIG_AX25_DAMA_SLAVE
--		/*
--		 * We do not wish to have a representation of this parameter
--		 * in /proc/sys/ when configured *not* to include the
--		 * AX.25 DAMA slave code, do we?
--		 */
--
--		child[AX25_VALUES_DS_TIMEOUT].procname = NULL;
--#endif
--
- 		child[AX25_MAX_VALUES].ctl_name = 0;	/* just in case... */
- 
- 		for (k = 0; k < AX25_MAX_VALUES; k++)
-diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
-index 9f3f7ba..b6e7ec0 100644
---- a/net/ipv4/udp.c
-+++ b/net/ipv4/udp.c
-@@ -988,7 +988,9 @@ int udp_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
- 		    up->encap_rcv != NULL) {
- 			int ret;
- 
-+			bh_unlock_sock(sk);
- 			ret = (*up->encap_rcv)(sk, skb);
-+			bh_lock_sock(sk);
- 			if (ret <= 0) {
- 				UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS,
- 						 is_udplite);
-@@ -1087,7 +1089,7 @@ static int __udp4_lib_mcast_deliver(struct sk_buff *skb,
- 			if (skb1) {
- 				int ret = 0;
- 
--				bh_lock_sock_nested(sk);
-+				bh_lock_sock(sk);
- 				if (!sock_owned_by_user(sk))
- 					ret = udp_queue_rcv_skb(sk, skb1);
- 				else
-@@ -1187,7 +1189,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],
- 
- 	if (sk != NULL) {
- 		int ret = 0;
--		bh_lock_sock_nested(sk);
-+		bh_lock_sock(sk);
- 		if (!sock_owned_by_user(sk))
- 			ret = udp_queue_rcv_skb(sk, skb);
- 		else
-diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
-index ff61a5c..1a1d494 100644
---- a/net/ipv6/addrconf.c
-+++ b/net/ipv6/addrconf.c
-@@ -1076,13 +1076,12 @@ out:
- 	return ret;
- }
- 
--int ipv6_dev_get_saddr(struct net_device *dst_dev,
-+int ipv6_dev_get_saddr(struct net *net, struct net_device *dst_dev,
- 		       const struct in6_addr *daddr, unsigned int prefs,
- 		       struct in6_addr *saddr)
- {
- 	struct ipv6_saddr_score scores[2],
- 				*score = &scores[0], *hiscore = &scores[1];
--	struct net *net = dev_net(dst_dev);
- 	struct ipv6_saddr_dst dst;
- 	struct net_device *dev;
- 	int dst_type;
-diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
-index 8d05527..f5de3f9 100644
---- a/net/ipv6/fib6_rules.c
-+++ b/net/ipv6/fib6_rules.c
-@@ -93,7 +93,8 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
- 			if (flags & RT6_LOOKUP_F_SRCPREF_COA)
- 				srcprefs |= IPV6_PREFER_SRC_COA;
- 
--			if (ipv6_dev_get_saddr(ip6_dst_idev(&rt->u.dst)->dev,
-+			if (ipv6_dev_get_saddr(net,
-+					       ip6_dst_idev(&rt->u.dst)->dev,
- 					       &flp->fl6_dst, srcprefs,
- 					       &saddr))
- 				goto again;
-diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
-index 918fde4..fe80171 100644
---- a/net/ipv6/ip6_fib.c
-+++ b/net/ipv6/ip6_fib.c
-@@ -380,6 +380,7 @@ static int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
- 
- 	arg.skb = skb;
- 	arg.cb = cb;
-+	arg.net = net;
- 	w->args = &arg;
- 
- 	for (h = s_h; h < FIB_TABLE_HASHSZ; h++, s_e = 0) {
-diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
-index 4019770..d99f094 100644
---- a/net/ipv6/ip6_output.c
-+++ b/net/ipv6/ip6_output.c
-@@ -925,7 +925,7 @@ static int ip6_dst_lookup_tail(struct sock *sk,
- 		goto out_err_release;
- 
- 	if (ipv6_addr_any(&fl->fl6_src)) {
--		err = ipv6_dev_get_saddr(ip6_dst_idev(*dst)->dev,
-+		err = ipv6_dev_get_saddr(net, ip6_dst_idev(*dst)->dev,
- 					 &fl->fl6_dst,
- 					 sk ? inet6_sk(sk)->srcprefs : 0,
- 					 &fl->fl6_src);
-diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
-index 282fdb3..efa84ae 100644
---- a/net/ipv6/ndisc.c
-+++ b/net/ipv6/ndisc.c
-@@ -549,7 +549,7 @@ static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
- 			override = 0;
- 		in6_ifa_put(ifp);
- 	} else {
--		if (ipv6_dev_get_saddr(dev, daddr,
-+		if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr,
- 				       inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs,
- 				       &tmpaddr))
- 			return;
-diff --git a/net/ipv6/route.c b/net/ipv6/route.c
-index 7ff6870..9deee59 100644
---- a/net/ipv6/route.c
-+++ b/net/ipv6/route.c
-@@ -2098,7 +2098,8 @@ static inline size_t rt6_nlmsg_size(void)
- 	       + nla_total_size(sizeof(struct rta_cacheinfo));
- }
- 
--static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
-+static int rt6_fill_node(struct net *net,
-+			 struct sk_buff *skb, struct rt6_info *rt,
- 			 struct in6_addr *dst, struct in6_addr *src,
- 			 int iif, int type, u32 pid, u32 seq,
- 			 int prefix, int nowait, unsigned int flags)
-@@ -2179,8 +2180,9 @@ static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
- #endif
- 			NLA_PUT_U32(skb, RTA_IIF, iif);
- 	} else if (dst) {
-+		struct inet6_dev *idev = ip6_dst_idev(&rt->u.dst);
- 		struct in6_addr saddr_buf;
--		if (ipv6_dev_get_saddr(ip6_dst_idev(&rt->u.dst)->dev,
-+		if (ipv6_dev_get_saddr(net, idev ? idev->dev : NULL,
- 				       dst, 0, &saddr_buf) == 0)
- 			NLA_PUT(skb, RTA_PREFSRC, 16, &saddr_buf);
- 	}
-@@ -2225,7 +2227,8 @@ int rt6_dump_route(struct rt6_info *rt, void *p_arg)
- 	} else
- 		prefix = 0;
- 
--	return rt6_fill_node(arg->skb, rt, NULL, NULL, 0, RTM_NEWROUTE,
-+	return rt6_fill_node(arg->net,
-+		     arg->skb, rt, NULL, NULL, 0, RTM_NEWROUTE,
- 		     NETLINK_CB(arg->cb->skb).pid, arg->cb->nlh->nlmsg_seq,
- 		     prefix, 0, NLM_F_MULTI);
- }
-@@ -2291,7 +2294,7 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
- 	rt = (struct rt6_info*) ip6_route_output(net, NULL, &fl);
- 	skb->dst = &rt->u.dst;
- 
--	err = rt6_fill_node(skb, rt, &fl.fl6_dst, &fl.fl6_src, iif,
-+	err = rt6_fill_node(net, skb, rt, &fl.fl6_dst, &fl.fl6_src, iif,
- 			    RTM_NEWROUTE, NETLINK_CB(in_skb).pid,
- 			    nlh->nlmsg_seq, 0, 0, 0);
- 	if (err < 0) {
-@@ -2318,7 +2321,7 @@ void inet6_rt_notify(int event, struct rt6_info *rt, struct nl_info *info)
- 	if (skb == NULL)
- 		goto errout;
- 
--	err = rt6_fill_node(skb, rt, NULL, NULL, 0,
-+	err = rt6_fill_node(net, skb, rt, NULL, NULL, 0,
- 				event, info->pid, seq, 0, 0, 0);
- 	if (err < 0) {
- 		/* -EMSGSIZE implies BUG in rt6_nlmsg_size() */
-diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
-index dd30962..e14aa66 100644
---- a/net/ipv6/udp.c
-+++ b/net/ipv6/udp.c
-@@ -376,7 +376,7 @@ static int __udp6_lib_mcast_deliver(struct sk_buff *skb, struct in6_addr *saddr,
- 					uh->source, saddr, dif))) {
- 		struct sk_buff *buff = skb_clone(skb, GFP_ATOMIC);
- 		if (buff) {
--			bh_lock_sock_nested(sk2);
-+			bh_lock_sock(sk2);
- 			if (!sock_owned_by_user(sk2))
- 				udpv6_queue_rcv_skb(sk2, buff);
- 			else
-@@ -384,7 +384,7 @@ static int __udp6_lib_mcast_deliver(struct sk_buff *skb, struct in6_addr *saddr,
- 			bh_unlock_sock(sk2);
- 		}
- 	}
--	bh_lock_sock_nested(sk);
-+	bh_lock_sock(sk);
- 	if (!sock_owned_by_user(sk))
- 		udpv6_queue_rcv_skb(sk, skb);
- 	else
-@@ -502,7 +502,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],
- 
- 	/* deliver */
- 
--	bh_lock_sock_nested(sk);
-+	bh_lock_sock(sk);
- 	if (!sock_owned_by_user(sk))
- 		udpv6_queue_rcv_skb(sk, skb);
- 	else
-diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
-index 8f1e054..08e4cbb 100644
---- a/net/ipv6/xfrm6_policy.c
-+++ b/net/ipv6/xfrm6_policy.c
-@@ -52,12 +52,14 @@ static struct dst_entry *xfrm6_dst_lookup(int tos, xfrm_address_t *saddr,
- static int xfrm6_get_saddr(xfrm_address_t *saddr, xfrm_address_t *daddr)
- {
- 	struct dst_entry *dst;
-+	struct net_device *dev;
- 
- 	dst = xfrm6_dst_lookup(0, NULL, daddr);
- 	if (IS_ERR(dst))
- 		return -EHOSTUNREACH;
- 
--	ipv6_dev_get_saddr(ip6_dst_idev(dst)->dev,
-+	dev = ip6_dst_idev(dst)->dev;
-+	ipv6_dev_get_saddr(dev_net(dev), dev,
- 			   (struct in6_addr *)&daddr->a6, 0,
- 			   (struct in6_addr *)&saddr->a6);
- 	dst_release(dst);
-diff --git a/net/sched/act_api.c b/net/sched/act_api.c
-index 74e662c..b5e116c 100644
---- a/net/sched/act_api.c
-+++ b/net/sched/act_api.c
-@@ -205,10 +205,9 @@ struct tcf_common *tcf_hash_check(u32 index, struct tc_action *a, int bind,
- {
- 	struct tcf_common *p = NULL;
- 	if (index && (p = tcf_hash_lookup(index, hinfo)) != NULL) {
--		if (bind) {
-+		if (bind)
- 			p->tcfc_bindcnt++;
--			p->tcfc_refcnt++;
--		}
-+		p->tcfc_refcnt++;
- 		a->priv = p;
- 	}
- 	return p;
-diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
-index 3fb58f4..51c3f68 100644
---- a/net/sched/sch_htb.c
-+++ b/net/sched/sch_htb.c
-@@ -595,11 +595,13 @@ static int htb_enqueue(struct sk_buff *skb, struct Qdisc *sch)
- 		kfree_skb(skb);
- 		return ret;
- #endif
--	} else if (cl->un.leaf.q->enqueue(skb, cl->un.leaf.q) !=
-+	} else if ((ret = cl->un.leaf.q->enqueue(skb, cl->un.leaf.q)) !=
- 		   NET_XMIT_SUCCESS) {
--		sch->qstats.drops++;
--		cl->qstats.drops++;
--		return NET_XMIT_DROP;
-+		if (ret == NET_XMIT_DROP) {
-+			sch->qstats.drops++;
-+			cl->qstats.drops++;
-+		}
-+		return ret;
- 	} else {
- 		cl->bstats.packets +=
- 			skb_is_gso(skb)?skb_shinfo(skb)->gso_segs:1;
-@@ -639,11 +641,13 @@ static int htb_requeue(struct sk_buff *skb, struct Qdisc *sch)
- 		kfree_skb(skb);
- 		return ret;
- #endif
--	} else if (cl->un.leaf.q->ops->requeue(skb, cl->un.leaf.q) !=
-+	} else if ((ret = cl->un.leaf.q->ops->requeue(skb, cl->un.leaf.q)) !=
- 		   NET_XMIT_SUCCESS) {
--		sch->qstats.drops++;
--		cl->qstats.drops++;
--		return NET_XMIT_DROP;
-+		if (ret == NET_XMIT_DROP) {
-+			sch->qstats.drops++;
-+			cl->qstats.drops++;
-+		}
-+		return ret;
- 	} else
- 		htb_activate(q, cl);
- 
-diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
-index 5532f10..ec0c921 100644
---- a/net/sched/sch_prio.c
-+++ b/net/sched/sch_prio.c
-@@ -228,14 +228,20 @@ static int prio_tune(struct Qdisc *sch, struct nlattr *opt)
- {
- 	struct prio_sched_data *q = qdisc_priv(sch);
- 	struct tc_prio_qopt *qopt;
--	struct nlattr *tb[TCA_PRIO_MAX + 1];
-+	struct nlattr *tb[TCA_PRIO_MAX + 1] = {0};
- 	int err;
- 	int i;
- 
--	err = nla_parse_nested_compat(tb, TCA_PRIO_MAX, opt, NULL, qopt,
--				      sizeof(*qopt));
--	if (err < 0)
--		return err;
-+	qopt = nla_data(opt);
-+	if (nla_len(opt) < sizeof(*qopt))
-+		return -1;
-+
-+	if (nla_len(opt) >= sizeof(*qopt) + sizeof(struct nlattr)) {
-+		err = nla_parse_nested(tb, TCA_PRIO_MAX,
-+				       (struct nlattr *) (qopt + 1), NULL);
-+		if (err < 0)
-+			return err;
-+	}
- 
- 	q->bands = qopt->bands;
- 	/* If we're multiqueue, make sure the number of incoming bands
-diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
-index 0b7d78f..fc6f8f3 100644
---- a/net/sched/sch_tbf.c
-+++ b/net/sched/sch_tbf.c
-@@ -123,15 +123,8 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc* sch)
- 	struct tbf_sched_data *q = qdisc_priv(sch);
- 	int ret;
- 
--	if (skb->len > q->max_size) {
--		sch->qstats.drops++;
--#ifdef CONFIG_NET_CLS_ACT
--		if (sch->reshape_fail == NULL || sch->reshape_fail(skb, sch))
--#endif
--			kfree_skb(skb);
--
--		return NET_XMIT_DROP;
--	}
-+	if (skb->len > q->max_size)
-+		return qdisc_reshape_fail(skb, sch);
- 
- 	if ((ret = q->qdisc->enqueue(skb, q->qdisc)) != 0) {
- 		sch->qstats.drops++;
-diff --git a/net/sctp/auth.c b/net/sctp/auth.c
-index 675a5c3..52db5f6 100644
---- a/net/sctp/auth.c
-+++ b/net/sctp/auth.c
-@@ -80,6 +80,10 @@ static struct sctp_auth_bytes *sctp_auth_create_key(__u32 key_len, gfp_t gfp)
- {
- 	struct sctp_auth_bytes *key;
- 
-+	/* Verify that we are not going to overflow INT_MAX */
-+	if ((INT_MAX - key_len) < sizeof(struct sctp_auth_bytes))
-+		return NULL;
-+
- 	/* Allocate the shared key */
- 	key = kmalloc(sizeof(struct sctp_auth_bytes) + key_len, gfp);
- 	if (!key)
-@@ -782,6 +786,9 @@ int sctp_auth_ep_set_hmacs(struct sctp_endpoint *ep,
- 	for (i = 0; i < hmacs->shmac_num_idents; i++) {
- 		id = hmacs->shmac_idents[i];
- 
-+		if (id > SCTP_AUTH_HMAC_ID_MAX)
-+			return -EOPNOTSUPP;
-+
- 		if (SCTP_AUTH_HMAC_ID_SHA1 == id)
- 			has_sha1 = 1;
- 
-diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
-index e39a0cd..4c8d9f4 100644
---- a/net/sctp/endpointola.c
-+++ b/net/sctp/endpointola.c
-@@ -103,6 +103,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
- 
- 		/* Initialize the CHUNKS parameter */
- 		auth_chunks->param_hdr.type = SCTP_PARAM_CHUNKS;
-+		auth_chunks->param_hdr.length = htons(sizeof(sctp_paramhdr_t));
- 
- 		/* If the Add-IP functionality is enabled, we must
- 		 * authenticate, ASCONF and ASCONF-ACK chunks
-@@ -110,8 +111,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
- 		if (sctp_addip_enable) {
- 			auth_chunks->chunks[0] = SCTP_CID_ASCONF;
- 			auth_chunks->chunks[1] = SCTP_CID_ASCONF_ACK;
--			auth_chunks->param_hdr.length =
--					htons(sizeof(sctp_paramhdr_t) + 2);
-+			auth_chunks->param_hdr.length += htons(2);
- 		}
- 	}
- 
-diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
-index a2f4d4d..38a5d80 100644
---- a/net/sctp/ipv6.c
-+++ b/net/sctp/ipv6.c
-@@ -317,7 +317,8 @@ static void sctp_v6_get_saddr(struct sctp_sock *sk,
- 			  __func__, asoc, dst, NIP6(daddr->v6.sin6_addr));
- 
- 	if (!asoc) {
--		ipv6_dev_get_saddr(dst ? ip6_dst_idev(dst)->dev : NULL,
-+		ipv6_dev_get_saddr(sock_net(sctp_opt2sk(sk)),
-+				   dst ? ip6_dst_idev(dst)->dev : NULL,
- 				   &daddr->v6.sin6_addr,
- 				   inet6_sk(&sk->inet.sk)->srcprefs,
- 				   &saddr->v6.sin6_addr);
-diff --git a/net/sctp/socket.c b/net/sctp/socket.c
-index 0dbcde6..700d27d 100644
---- a/net/sctp/socket.c
-+++ b/net/sctp/socket.c
-@@ -2965,6 +2965,9 @@ static int sctp_setsockopt_auth_chunk(struct sock *sk,
- {
- 	struct sctp_authchunk val;
- 
-+	if (!sctp_auth_enable)
-+		return -EACCES;
-+
- 	if (optlen != sizeof(struct sctp_authchunk))
- 		return -EINVAL;
- 	if (copy_from_user(&val, optval, optlen))
-@@ -2993,8 +2996,12 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk,
- 				    int optlen)
- {
- 	struct sctp_hmacalgo *hmacs;
-+	u32 idents;
- 	int err;
- 
-+	if (!sctp_auth_enable)
-+		return -EACCES;
-+
- 	if (optlen < sizeof(struct sctp_hmacalgo))
- 		return -EINVAL;
- 
-@@ -3007,8 +3014,9 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk,
- 		goto out;
- 	}
- 
--	if (hmacs->shmac_num_idents == 0 ||
--	    hmacs->shmac_num_idents > SCTP_AUTH_NUM_HMACS) {
-+	idents = hmacs->shmac_num_idents;
-+	if (idents == 0 || idents > SCTP_AUTH_NUM_HMACS ||
-+	    (idents * sizeof(u16)) > (optlen - sizeof(struct sctp_hmacalgo))) {
- 		err = -EINVAL;
- 		goto out;
- 	}
-@@ -3033,6 +3041,9 @@ static int sctp_setsockopt_auth_key(struct sock *sk,
- 	struct sctp_association *asoc;
- 	int ret;
- 
-+	if (!sctp_auth_enable)
-+		return -EACCES;
-+
- 	if (optlen <= sizeof(struct sctp_authkey))
- 		return -EINVAL;
- 
-@@ -3045,6 +3056,11 @@ static int sctp_setsockopt_auth_key(struct sock *sk,
- 		goto out;
- 	}
- 
-+	if (authkey->sca_keylength > optlen - sizeof(struct sctp_authkey)) {
-+		ret = -EINVAL;
-+		goto out;
-+	}
-+
- 	asoc = sctp_id2assoc(sk, authkey->sca_assoc_id);
- 	if (!asoc && authkey->sca_assoc_id && sctp_style(sk, UDP)) {
- 		ret = -EINVAL;
-@@ -3070,6 +3086,9 @@ static int sctp_setsockopt_active_key(struct sock *sk,
- 	struct sctp_authkeyid val;
- 	struct sctp_association *asoc;
- 
-+	if (!sctp_auth_enable)
-+		return -EACCES;
-+
- 	if (optlen != sizeof(struct sctp_authkeyid))
- 		return -EINVAL;
- 	if (copy_from_user(&val, optval, optlen))
-@@ -3095,6 +3114,9 @@ static int sctp_setsockopt_del_key(struct sock *sk,
- 	struct sctp_authkeyid val;
- 	struct sctp_association *asoc;
- 
-+	if (!sctp_auth_enable)
-+		return -EACCES;
-+
- 	if (optlen != sizeof(struct sctp_authkeyid))
- 		return -EINVAL;
- 	if (copy_from_user(&val, optval, optlen))
-@@ -5053,19 +5075,29 @@ static int sctp_getsockopt_maxburst(struct sock *sk, int len,
- static int sctp_getsockopt_hmac_ident(struct sock *sk, int len,
- 				    char __user *optval, int __user *optlen)
- {
-+	struct sctp_hmacalgo  __user *p = (void __user *)optval;
- 	struct sctp_hmac_algo_param *hmacs;
--	__u16 param_len;
-+	__u16 data_len = 0;
-+	u32 num_idents;
-+
-+	if (!sctp_auth_enable)
-+		return -EACCES;
- 
- 	hmacs = sctp_sk(sk)->ep->auth_hmacs_list;
--	param_len = ntohs(hmacs->param_hdr.length);
-+	data_len = ntohs(hmacs->param_hdr.length) - sizeof(sctp_paramhdr_t);
- 
--	if (len < param_len)
-+	if (len < sizeof(struct sctp_hmacalgo) + data_len)
- 		return -EINVAL;
-+
-+	len = sizeof(struct sctp_hmacalgo) + data_len;
-+	num_idents = data_len / sizeof(u16);
-+
- 	if (put_user(len, optlen))
- 		return -EFAULT;
--	if (copy_to_user(optval, hmacs->hmac_ids, len))
-+	if (put_user(num_idents, &p->shmac_num_idents))
-+		return -EFAULT;
-+	if (copy_to_user(p->shmac_idents, hmacs->hmac_ids, data_len))
- 		return -EFAULT;
--
- 	return 0;
- }
- 
-@@ -5075,6 +5107,9 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len,
- 	struct sctp_authkeyid val;
- 	struct sctp_association *asoc;
- 
-+	if (!sctp_auth_enable)
-+		return -EACCES;
-+
- 	if (len < sizeof(struct sctp_authkeyid))
- 		return -EINVAL;
- 	if (copy_from_user(&val, optval, sizeof(struct sctp_authkeyid)))
-@@ -5089,6 +5124,12 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len,
- 	else
- 		val.scact_keynumber = sctp_sk(sk)->ep->active_key_id;
- 
-+	len = sizeof(struct sctp_authkeyid);
-+	if (put_user(len, optlen))
-+		return -EFAULT;
-+	if (copy_to_user(optval, &val, len))
-+		return -EFAULT;
-+
- 	return 0;
- }
- 
-@@ -5099,13 +5140,16 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len,
- 	struct sctp_authchunks val;
- 	struct sctp_association *asoc;
- 	struct sctp_chunks_param *ch;
--	u32    num_chunks;
-+	u32    num_chunks = 0;
- 	char __user *to;
- 
--	if (len <= sizeof(struct sctp_authchunks))
-+	if (!sctp_auth_enable)
-+		return -EACCES;
-+
-+	if (len < sizeof(struct sctp_authchunks))
- 		return -EINVAL;
- 
--	if (copy_from_user(&val, p, sizeof(struct sctp_authchunks)))
-+	if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks)))
- 		return -EFAULT;
- 
- 	to = p->gauth_chunks;
-@@ -5114,20 +5158,21 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len,
- 		return -EINVAL;
- 
- 	ch = asoc->peer.peer_chunks;
-+	if (!ch)
-+		goto num;
- 
- 	/* See if the user provided enough room for all the data */
- 	num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t);
- 	if (len < num_chunks)
- 		return -EINVAL;
- 
--	len = num_chunks;
--	if (put_user(len, optlen))
-+	if (copy_to_user(to, ch->chunks, num_chunks))
- 		return -EFAULT;
-+num:
-+	len = sizeof(struct sctp_authchunks) + num_chunks;
-+	if (put_user(len, optlen)) return -EFAULT;
- 	if (put_user(num_chunks, &p->gauth_number_of_chunks))
- 		return -EFAULT;
--	if (copy_to_user(to, ch->chunks, len))
--		return -EFAULT;
--
- 	return 0;
- }
- 
-@@ -5138,13 +5183,16 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
- 	struct sctp_authchunks val;
- 	struct sctp_association *asoc;
- 	struct sctp_chunks_param *ch;
--	u32    num_chunks;
-+	u32    num_chunks = 0;
- 	char __user *to;
- 
--	if (len <= sizeof(struct sctp_authchunks))
-+	if (!sctp_auth_enable)
-+		return -EACCES;
-+
-+	if (len < sizeof(struct sctp_authchunks))
- 		return -EINVAL;
- 
--	if (copy_from_user(&val, p, sizeof(struct sctp_authchunks)))
-+	if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks)))
- 		return -EFAULT;
- 
- 	to = p->gauth_chunks;
-@@ -5157,17 +5205,21 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
- 	else
- 		ch = sctp_sk(sk)->ep->auth_chunk_list;
- 
-+	if (!ch)
-+		goto num;
-+
- 	num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t);
--	if (len < num_chunks)
-+	if (len < sizeof(struct sctp_authchunks) + num_chunks)
- 		return -EINVAL;
- 
--	len = num_chunks;
-+	if (copy_to_user(to, ch->chunks, num_chunks))
-+		return -EFAULT;
-+num:
-+	len = sizeof(struct sctp_authchunks) + num_chunks;
- 	if (put_user(len, optlen))
- 		return -EFAULT;
- 	if (put_user(num_chunks, &p->gauth_number_of_chunks))
- 		return -EFAULT;
--	if (copy_to_user(to, ch->chunks, len))
--		return -EFAULT;
- 
- 	return 0;
- }
-diff --git a/net/sunrpc/sysctl.c b/net/sunrpc/sysctl.c
-index 0f8c439..5231f7a 100644
---- a/net/sunrpc/sysctl.c
-+++ b/net/sunrpc/sysctl.c
-@@ -60,24 +60,14 @@ static int proc_do_xprt(ctl_table *table, int write, struct file *file,
- 			void __user *buffer, size_t *lenp, loff_t *ppos)
- {
- 	char tmpbuf[256];
--	int len;
-+	size_t len;
-+
- 	if ((*ppos && !write) || !*lenp) {
- 		*lenp = 0;
- 		return 0;
- 	}
--	if (write)
--		return -EINVAL;
--	else {
--		len = svc_print_xprts(tmpbuf, sizeof(tmpbuf));
--		if (!access_ok(VERIFY_WRITE, buffer, len))
--			return -EFAULT;
--
--		if (__copy_to_user(buffer, tmpbuf, len))
--			return -EFAULT;
--	}
--	*lenp -= len;
--	*ppos += len;
--	return 0;
-+	len = svc_print_xprts(tmpbuf, sizeof(tmpbuf));
-+	return simple_read_from_buffer(buffer, *lenp, ppos, tmpbuf, len);
- }
- 
- static int
-diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
-index 72fddaf..391f456 100644
---- a/net/xfrm/xfrm_state.c
-+++ b/net/xfrm/xfrm_state.c
-@@ -780,11 +780,13 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
- {
- 	unsigned int h;
- 	struct hlist_node *entry;
--	struct xfrm_state *x, *x0;
-+	struct xfrm_state *x, *x0, *to_put;
- 	int acquire_in_progress = 0;
- 	int error = 0;
- 	struct xfrm_state *best = NULL;
- 
-+	to_put = NULL;
-+
- 	spin_lock_bh(&xfrm_state_lock);
- 	h = xfrm_dst_hash(daddr, saddr, tmpl->reqid, family);
- 	hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
-@@ -833,7 +835,7 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
- 		if (tmpl->id.spi &&
- 		    (x0 = __xfrm_state_lookup(daddr, tmpl->id.spi,
- 					      tmpl->id.proto, family)) != NULL) {
--			xfrm_state_put(x0);
-+			to_put = x0;
- 			error = -EEXIST;
- 			goto out;
- 		}
-@@ -849,7 +851,7 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
- 		error = security_xfrm_state_alloc_acquire(x, pol->security, fl->secid);
- 		if (error) {
- 			x->km.state = XFRM_STATE_DEAD;
--			xfrm_state_put(x);
-+			to_put = x;
- 			x = NULL;
- 			goto out;
- 		}
-@@ -870,7 +872,7 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
- 			xfrm_hash_grow_check(x->bydst.next != NULL);
- 		} else {
- 			x->km.state = XFRM_STATE_DEAD;
--			xfrm_state_put(x);
-+			to_put = x;
- 			x = NULL;
- 			error = -ESRCH;
- 		}
-@@ -881,6 +883,8 @@ out:
- 	else
- 		*err = acquire_in_progress ? -EAGAIN : error;
- 	spin_unlock_bh(&xfrm_state_lock);
-+	if (to_put)
-+		xfrm_state_put(to_put);
- 	return x;
- }
- 
-@@ -1067,18 +1071,20 @@ static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq);
- 
- int xfrm_state_add(struct xfrm_state *x)
- {
--	struct xfrm_state *x1;
-+	struct xfrm_state *x1, *to_put;
- 	int family;
- 	int err;
- 	int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
- 
- 	family = x->props.family;
- 
-+	to_put = NULL;
-+
- 	spin_lock_bh(&xfrm_state_lock);
- 
- 	x1 = __xfrm_state_locate(x, use_spi, family);
- 	if (x1) {
--		xfrm_state_put(x1);
-+		to_put = x1;
- 		x1 = NULL;
- 		err = -EEXIST;
- 		goto out;
-@@ -1088,7 +1094,7 @@ int xfrm_state_add(struct xfrm_state *x)
- 		x1 = __xfrm_find_acq_byseq(x->km.seq);
- 		if (x1 && ((x1->id.proto != x->id.proto) ||
- 		    xfrm_addr_cmp(&x1->id.daddr, &x->id.daddr, family))) {
--			xfrm_state_put(x1);
-+			to_put = x1;
- 			x1 = NULL;
- 		}
- 	}
-@@ -1110,6 +1116,9 @@ out:
- 		xfrm_state_put(x1);
- 	}
- 
-+	if (to_put)
-+		xfrm_state_put(to_put);
-+
- 	return err;
- }
- EXPORT_SYMBOL(xfrm_state_add);
-@@ -1269,10 +1278,12 @@ EXPORT_SYMBOL(xfrm_state_migrate);
- 
- int xfrm_state_update(struct xfrm_state *x)
- {
--	struct xfrm_state *x1;
-+	struct xfrm_state *x1, *to_put;
- 	int err;
- 	int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
- 
-+	to_put = NULL;
-+
- 	spin_lock_bh(&xfrm_state_lock);
- 	x1 = __xfrm_state_locate(x, use_spi, x->props.family);
- 
-@@ -1281,7 +1292,7 @@ int xfrm_state_update(struct xfrm_state *x)
- 		goto out;
- 
- 	if (xfrm_state_kern(x1)) {
--		xfrm_state_put(x1);
-+		to_put = x1;
- 		err = -EEXIST;
- 		goto out;
- 	}
-@@ -1295,6 +1306,9 @@ int xfrm_state_update(struct xfrm_state *x)
- out:
- 	spin_unlock_bh(&xfrm_state_lock);
- 
-+	if (to_put)
-+		xfrm_state_put(to_put);
-+
- 	if (err)
- 		return err;
- 
-diff --git a/sound/pci/oxygen/oxygen_mixer.c b/sound/pci/oxygen/oxygen_mixer.c
-index 6facac5..05eb899 100644
---- a/sound/pci/oxygen/oxygen_mixer.c
-+++ b/sound/pci/oxygen/oxygen_mixer.c
-@@ -512,9 +512,12 @@ static int ac97_switch_get(struct snd_kcontrol *ctl,
- 
- static void mute_ac97_ctl(struct oxygen *chip, unsigned int control)
- {
--	unsigned int priv_idx = chip->controls[control]->private_value & 0xff;
-+	unsigned int priv_idx;
- 	u16 value;
- 
-+	if (!chip->controls[control])
-+		return;
-+	priv_idx = chip->controls[control]->private_value & 0xff;
- 	value = oxygen_read_ac97(chip, 0, priv_idx);
- 	if (!(value & 0x8000)) {
- 		oxygen_write_ac97(chip, 0, priv_idx, value | 0x8000);

Deleted: genpatches-2.6/trunk/2.6.27/1004_linux-2.6.26.5.patch
===================================================================
--- genpatches-2.6/trunk/2.6.27/1004_linux-2.6.26.5.patch	2008-10-10 23:58:26 UTC (rev 1350)
+++ genpatches-2.6/trunk/2.6.27/1004_linux-2.6.26.5.patch	2008-10-11 00:00:47 UTC (rev 1351)
@@ -1,96 +0,0 @@
-diff --git a/include/linux/mroute.h b/include/linux/mroute.h
-index 35a8277..5e30ac3 100644
---- a/include/linux/mroute.h
-+++ b/include/linux/mroute.h
-@@ -2,7 +2,10 @@
- #define __LINUX_MROUTE_H
- 
- #include <linux/sockios.h>
-+#include <linux/types.h>
-+#ifdef __KERNEL__
- #include <linux/in.h>
-+#endif
- 
- /*
-  *	Based on the MROUTING 3.5 defines primarily to keep
-@@ -126,6 +129,7 @@ struct igmpmsg
-  */
- 
- #ifdef __KERNEL__
-+#include <linux/pim.h>
- #include <net/sock.h>
- 
- #ifdef CONFIG_IP_MROUTE
-@@ -210,27 +214,6 @@ struct mfc_cache
- #define IGMPMSG_WHOLEPKT	3		/* For PIM Register processing */
- 
- #ifdef __KERNEL__
--
--#define PIM_V1_VERSION		__constant_htonl(0x10000000)
--#define PIM_V1_REGISTER		1
--
--#define PIM_VERSION		2
--#define PIM_REGISTER		1
--
--#define PIM_NULL_REGISTER	__constant_htonl(0x40000000)
--
--/* PIMv2 register message header layout (ietf-draft-idmr-pimvsm-v2-00.ps */
--
--struct pimreghdr
--{
--	__u8	type;
--	__u8	reserved;
--	__be16	csum;
--	__be32	flags;
--};
--
--extern int pim_rcv_v1(struct sk_buff *);
--
- struct rtmsg;
- extern int ipmr_get_route(struct sk_buff *skb, struct rtmsg *rtm, int nowait);
- #endif
-diff --git a/include/linux/mroute6.h b/include/linux/mroute6.h
-index e798959..90010dd 100644
---- a/include/linux/mroute6.h
-+++ b/include/linux/mroute6.h
-@@ -115,6 +115,7 @@ struct sioc_mif_req6
- 
- #ifdef __KERNEL__
- 
-+#include <linux/pim.h>
- #include <linux/skbuff.h>	/* for struct sk_buff_head */
- 
- #ifdef CONFIG_IPV6_MROUTE
-diff --git a/include/linux/pim.h b/include/linux/pim.h
-new file mode 100644
-index 0000000..1ba0661
---- /dev/null
-+++ b/include/linux/pim.h
-@@ -0,0 +1,27 @@
-+#ifndef __LINUX_PIM_H
-+#define __LINUX_PIM_H
-+
-+#include <asm/byteorder.h>
-+
-+/* Message types - V1 */
-+#define PIM_V1_VERSION		__constant_htonl(0x10000000)
-+#define PIM_V1_REGISTER		1
-+
-+/* Message types - V2 */
-+#define PIM_VERSION		2
-+#define PIM_REGISTER		1
-+
-+#define PIM_NULL_REGISTER	__constant_htonl(0x40000000)
-+
-+/* PIMv2 register message header layout (ietf-draft-idmr-pimvsm-v2-00.ps */
-+struct pimreghdr
-+{
-+	__u8	type;
-+	__u8	reserved;
-+	__be16	csum;
-+	__be32	flags;
-+};
-+
-+struct sk_buff;
-+extern int pim_rcv_v1(struct sk_buff *);
-+#endif

Deleted: genpatches-2.6/trunk/2.6.27/1005_linux-2.6.26.6.patch
===================================================================
--- genpatches-2.6/trunk/2.6.27/1005_linux-2.6.26.6.patch	2008-10-10 23:58:26 UTC (rev 1350)
+++ genpatches-2.6/trunk/2.6.27/1005_linux-2.6.26.6.patch	2008-10-11 00:00:47 UTC (rev 1351)
@@ -1,3097 +0,0 @@
-diff --git a/arch/s390/kernel/compat_ptrace.h b/arch/s390/kernel/compat_ptrace.h
-index 419aef9..7731b82 100644
---- a/arch/s390/kernel/compat_ptrace.h
-+++ b/arch/s390/kernel/compat_ptrace.h
-@@ -42,6 +42,7 @@ struct user_regs_struct32
- 	u32 gprs[NUM_GPRS];
- 	u32 acrs[NUM_ACRS];
- 	u32 orig_gpr2;
-+	/* nb: there's a 4-byte hole here */
- 	s390_fp_regs fp_regs;
- 	/*
- 	 * These per registers are in here so that gdb can modify them
-diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
-index 35827b9..75fea19 100644
---- a/arch/s390/kernel/ptrace.c
-+++ b/arch/s390/kernel/ptrace.c
-@@ -177,6 +177,13 @@ peek_user(struct task_struct *child, addr_t addr, addr_t data)
- 		 */
- 		tmp = (addr_t) task_pt_regs(child)->orig_gpr2;
- 
-+	} else if (addr < (addr_t) &dummy->regs.fp_regs) {
-+		/*
-+		 * prevent reads of padding hole between
-+		 * orig_gpr2 and fp_regs on s390.
-+		 */
-+		tmp = 0;
-+
- 	} else if (addr < (addr_t) (&dummy->regs.fp_regs + 1)) {
- 		/* 
- 		 * floating point regs. are stored in the thread structure
-@@ -268,6 +275,13 @@ poke_user(struct task_struct *child, addr_t addr, addr_t data)
- 		 */
- 		task_pt_regs(child)->orig_gpr2 = data;
- 
-+	} else if (addr < (addr_t) &dummy->regs.fp_regs) {
-+		/*
-+		 * prevent writes of padding hole between
-+		 * orig_gpr2 and fp_regs on s390.
-+		 */
-+		return 0;
-+
- 	} else if (addr < (addr_t) (&dummy->regs.fp_regs + 1)) {
- 		/*
- 		 * floating point regs. are stored in the thread structure
-@@ -409,6 +423,13 @@ peek_user_emu31(struct task_struct *child, addr_t addr, addr_t data)
- 		 */
- 		tmp = *(__u32*)((addr_t) &task_pt_regs(child)->orig_gpr2 + 4);
- 
-+	} else if (addr < (addr_t) &dummy32->regs.fp_regs) {
-+		/*
-+		 * prevent reads of padding hole between
-+		 * orig_gpr2 and fp_regs on s390.
-+		 */
-+		tmp = 0;
-+
- 	} else if (addr < (addr_t) (&dummy32->regs.fp_regs + 1)) {
- 		/*
- 		 * floating point regs. are stored in the thread structure 
-@@ -488,6 +509,13 @@ poke_user_emu31(struct task_struct *child, addr_t addr, addr_t data)
- 		 */
- 		*(__u32*)((addr_t) &task_pt_regs(child)->orig_gpr2 + 4) = tmp;
- 
-+	} else if (addr < (addr_t) &dummy32->regs.fp_regs) {
-+		/*
-+		 * prevent writess of padding hole between
-+		 * orig_gpr2 and fp_regs on s390.
-+		 */
-+		return 0;
-+
- 	} else if (addr < (addr_t) (&dummy32->regs.fp_regs + 1)) {
- 		/*
- 		 * floating point regs. are stored in the thread structure 
-diff --git a/arch/sparc64/kernel/of_device.c b/arch/sparc64/kernel/of_device.c
-index d569f60..b456609 100644
---- a/arch/sparc64/kernel/of_device.c
-+++ b/arch/sparc64/kernel/of_device.c
-@@ -170,7 +170,7 @@ static unsigned int of_bus_default_get_flags(const u32 *addr)
- 
- static int of_bus_pci_match(struct device_node *np)
- {
--	if (!strcmp(np->type, "pci") || !strcmp(np->type, "pciex")) {
-+	if (!strcmp(np->name, "pci")) {
- 		const char *model = of_get_property(np, "model", NULL);
- 
- 		if (model && !strcmp(model, "SUNW,simba"))
-@@ -201,7 +201,7 @@ static int of_bus_simba_match(struct device_node *np)
- 	/* Treat PCI busses lacking ranges property just like
- 	 * simba.
- 	 */
--	if (!strcmp(np->type, "pci") || !strcmp(np->type, "pciex")) {
-+	if (!strcmp(np->name, "pci")) {
- 		if (!of_find_property(np, "ranges", NULL))
- 			return 1;
- 	}
-@@ -426,7 +426,7 @@ static int __init use_1to1_mapping(struct device_node *pp)
- 	 * it lacks a ranges property, and this will include
- 	 * cases like Simba.
- 	 */
--	if (!strcmp(pp->type, "pci") || !strcmp(pp->type, "pciex"))
-+	if (!strcmp(pp->name, "pci"))
- 		return 0;
- 
- 	return 1;
-@@ -709,8 +709,7 @@ static unsigned int __init build_one_device_irq(struct of_device *op,
- 				break;
- 			}
- 		} else {
--			if (!strcmp(pp->type, "pci") ||
--			    !strcmp(pp->type, "pciex")) {
-+			if (!strcmp(pp->name, "pci")) {
- 				unsigned int this_orig_irq = irq;
- 
- 				irq = pci_irq_swizzle(dp, pp, irq);
-diff --git a/arch/sparc64/kernel/pci.c b/arch/sparc64/kernel/pci.c
-index 112b09f..2db2148 100644
---- a/arch/sparc64/kernel/pci.c
-+++ b/arch/sparc64/kernel/pci.c
-@@ -425,7 +425,7 @@ struct pci_dev *of_create_pci_dev(struct pci_pbm_info *pbm,
- 	dev->current_state = 4;		/* unknown power state */
- 	dev->error_state = pci_channel_io_normal;
- 
--	if (!strcmp(type, "pci") || !strcmp(type, "pciex")) {
-+	if (!strcmp(node->name, "pci")) {
- 		/* a PCI-PCI bridge */
- 		dev->hdr_type = PCI_HEADER_TYPE_BRIDGE;
- 		dev->rom_base_reg = PCI_ROM_ADDRESS1;
-diff --git a/arch/sparc64/kernel/pci_psycho.c b/arch/sparc64/kernel/pci_psycho.c
-index 994dbe0..21128cf 100644
---- a/arch/sparc64/kernel/pci_psycho.c
-+++ b/arch/sparc64/kernel/pci_psycho.c
-@@ -575,7 +575,7 @@ static irqreturn_t psycho_pcierr_intr_other(struct pci_pbm_info *pbm, int is_pbm
- {
- 	unsigned long csr_reg, csr, csr_error_bits;
- 	irqreturn_t ret = IRQ_NONE;
--	u16 stat;
-+	u16 stat, *addr;
- 
- 	if (is_pbm_a) {
- 		csr_reg = pbm->controller_regs + PSYCHO_PCIA_CTRL;
-@@ -597,7 +597,9 @@ static irqreturn_t psycho_pcierr_intr_other(struct pci_pbm_info *pbm, int is_pbm
- 			printk("%s: PCI SERR signal asserted.\n", pbm->name);
- 		ret = IRQ_HANDLED;
- 	}
--	pci_read_config_word(pbm->pci_bus->self, PCI_STATUS, &stat);
-+	addr = psycho_pci_config_mkaddr(pbm, pbm->pci_first_busno,
-+					0, PCI_STATUS);
-+	pci_config_read16(addr, &stat);
- 	if (stat & (PCI_STATUS_PARITY |
- 		    PCI_STATUS_SIG_TARGET_ABORT |
- 		    PCI_STATUS_REC_TARGET_ABORT |
-@@ -605,7 +607,7 @@ static irqreturn_t psycho_pcierr_intr_other(struct pci_pbm_info *pbm, int is_pbm
- 		    PCI_STATUS_SIG_SYSTEM_ERROR)) {
- 		printk("%s: PCI bus error, PCI_STATUS[%04x]\n",
- 		       pbm->name, stat);
--		pci_write_config_word(pbm->pci_bus->self, PCI_STATUS, 0xffff);
-+		pci_config_write16(addr, 0xffff);
- 		ret = IRQ_HANDLED;
- 	}
- 	return ret;
-@@ -744,16 +746,16 @@ static void psycho_register_error_handlers(struct pci_pbm_info *pbm)
- 	 * the second will just error out since we do not pass in
- 	 * IRQF_SHARED.
- 	 */
--	err = request_irq(op->irqs[1], psycho_ue_intr, 0,
-+	err = request_irq(op->irqs[1], psycho_ue_intr, IRQF_SHARED,
- 			  "PSYCHO_UE", pbm);
--	err = request_irq(op->irqs[2], psycho_ce_intr, 0,
-+	err = request_irq(op->irqs[2], psycho_ce_intr, IRQF_SHARED,
- 			  "PSYCHO_CE", pbm);
- 
- 	/* This one, however, ought not to fail.  We can just warn
- 	 * about it since the system can still operate properly even
- 	 * if this fails.
- 	 */
--	err = request_irq(op->irqs[0], psycho_pcierr_intr, 0,
-+	err = request_irq(op->irqs[0], psycho_pcierr_intr, IRQF_SHARED,
- 			  "PSYCHO_PCIERR", pbm);
- 	if (err)
- 		printk(KERN_WARNING "%s: Could not register PCIERR, "
-diff --git a/arch/sparc64/kernel/prom.c b/arch/sparc64/kernel/prom.c
-index ed03a18..a72f793 100644
---- a/arch/sparc64/kernel/prom.c
-+++ b/arch/sparc64/kernel/prom.c
-@@ -156,55 +156,11 @@ static unsigned long psycho_pcislot_imap_offset(unsigned long ino)
- 		return PSYCHO_IMAP_B_SLOT0 + (slot * 8);
- }
- 
--#define PSYCHO_IMAP_SCSI	0x1000UL
--#define PSYCHO_IMAP_ETH		0x1008UL
--#define PSYCHO_IMAP_BPP		0x1010UL
--#define PSYCHO_IMAP_AU_REC	0x1018UL
--#define PSYCHO_IMAP_AU_PLAY	0x1020UL
--#define PSYCHO_IMAP_PFAIL	0x1028UL
--#define PSYCHO_IMAP_KMS		0x1030UL
--#define PSYCHO_IMAP_FLPY	0x1038UL
--#define PSYCHO_IMAP_SHW		0x1040UL
--#define PSYCHO_IMAP_KBD		0x1048UL
--#define PSYCHO_IMAP_MS		0x1050UL
--#define PSYCHO_IMAP_SER		0x1058UL
--#define PSYCHO_IMAP_TIM0	0x1060UL
--#define PSYCHO_IMAP_TIM1	0x1068UL
--#define PSYCHO_IMAP_UE		0x1070UL
--#define PSYCHO_IMAP_CE		0x1078UL
--#define PSYCHO_IMAP_A_ERR	0x1080UL
--#define PSYCHO_IMAP_B_ERR	0x1088UL
--#define PSYCHO_IMAP_PMGMT	0x1090UL
--#define PSYCHO_IMAP_GFX		0x1098UL
--#define PSYCHO_IMAP_EUPA	0x10a0UL
--
--static unsigned long __psycho_onboard_imap_off[] = {
--/*0x20*/	PSYCHO_IMAP_SCSI,
--/*0x21*/	PSYCHO_IMAP_ETH,
--/*0x22*/	PSYCHO_IMAP_BPP,
--/*0x23*/	PSYCHO_IMAP_AU_REC,
--/*0x24*/	PSYCHO_IMAP_AU_PLAY,
--/*0x25*/	PSYCHO_IMAP_PFAIL,
--/*0x26*/	PSYCHO_IMAP_KMS,
--/*0x27*/	PSYCHO_IMAP_FLPY,
--/*0x28*/	PSYCHO_IMAP_SHW,
--/*0x29*/	PSYCHO_IMAP_KBD,
--/*0x2a*/	PSYCHO_IMAP_MS,
--/*0x2b*/	PSYCHO_IMAP_SER,
--/*0x2c*/	PSYCHO_IMAP_TIM0,
--/*0x2d*/	PSYCHO_IMAP_TIM1,
--/*0x2e*/	PSYCHO_IMAP_UE,
--/*0x2f*/	PSYCHO_IMAP_CE,
--/*0x30*/	PSYCHO_IMAP_A_ERR,
--/*0x31*/	PSYCHO_IMAP_B_ERR,
--/*0x32*/	PSYCHO_IMAP_PMGMT,
--/*0x33*/	PSYCHO_IMAP_GFX,
--/*0x34*/	PSYCHO_IMAP_EUPA,
--};
-+#define PSYCHO_OBIO_IMAP_BASE	0x1000UL
-+
- #define PSYCHO_ONBOARD_IRQ_BASE		0x20
--#define PSYCHO_ONBOARD_IRQ_LAST		0x34
- #define psycho_onboard_imap_offset(__ino) \
--	__psycho_onboard_imap_off[(__ino) - PSYCHO_ONBOARD_IRQ_BASE]
-+	(PSYCHO_OBIO_IMAP_BASE + (((__ino) & 0x1f) << 3))
- 
- #define PSYCHO_ICLR_A_SLOT0	0x1400UL
- #define PSYCHO_ICLR_SCSI	0x1800UL
-@@ -228,10 +184,6 @@ static unsigned int psycho_irq_build(struct device_node *dp,
- 		imap_off = psycho_pcislot_imap_offset(ino);
- 	} else {
- 		/* Onboard device */
--		if (ino > PSYCHO_ONBOARD_IRQ_LAST) {
--			prom_printf("psycho_irq_build: Wacky INO [%x]\n", ino);
--			prom_halt();
--		}
- 		imap_off = psycho_onboard_imap_offset(ino);
- 	}
- 
-@@ -318,23 +270,6 @@ static void sabre_wsync_handler(unsigned int ino, void *_arg1, void *_arg2)
- 
- #define SABRE_IMAP_A_SLOT0	0x0c00UL
- #define SABRE_IMAP_B_SLOT0	0x0c20UL
--#define SABRE_IMAP_SCSI		0x1000UL
--#define SABRE_IMAP_ETH		0x1008UL
--#define SABRE_IMAP_BPP		0x1010UL
--#define SABRE_IMAP_AU_REC	0x1018UL
--#define SABRE_IMAP_AU_PLAY	0x1020UL
--#define SABRE_IMAP_PFAIL	0x1028UL
--#define SABRE_IMAP_KMS		0x1030UL
--#define SABRE_IMAP_FLPY		0x1038UL
--#define SABRE_IMAP_SHW		0x1040UL
--#define SABRE_IMAP_KBD		0x1048UL
--#define SABRE_IMAP_MS		0x1050UL
--#define SABRE_IMAP_SER		0x1058UL
--#define SABRE_IMAP_UE		0x1070UL
--#define SABRE_IMAP_CE		0x1078UL
--#define SABRE_IMAP_PCIERR	0x1080UL
--#define SABRE_IMAP_GFX		0x1098UL
--#define SABRE_IMAP_EUPA		0x10a0UL
- #define SABRE_ICLR_A_SLOT0	0x1400UL
- #define SABRE_ICLR_B_SLOT0	0x1480UL
- #define SABRE_ICLR_SCSI		0x1800UL
-@@ -364,33 +299,10 @@ static unsigned long sabre_pcislot_imap_offset(unsigned long ino)
- 		return SABRE_IMAP_B_SLOT0 + (slot * 8);
- }
- 
--static unsigned long __sabre_onboard_imap_off[] = {
--/*0x20*/	SABRE_IMAP_SCSI,
--/*0x21*/	SABRE_IMAP_ETH,
--/*0x22*/	SABRE_IMAP_BPP,
--/*0x23*/	SABRE_IMAP_AU_REC,
--/*0x24*/	SABRE_IMAP_AU_PLAY,
--/*0x25*/	SABRE_IMAP_PFAIL,
--/*0x26*/	SABRE_IMAP_KMS,
--/*0x27*/	SABRE_IMAP_FLPY,
--/*0x28*/	SABRE_IMAP_SHW,
--/*0x29*/	SABRE_IMAP_KBD,
--/*0x2a*/	SABRE_IMAP_MS,
--/*0x2b*/	SABRE_IMAP_SER,
--/*0x2c*/	0 /* reserved */,
--/*0x2d*/	0 /* reserved */,
--/*0x2e*/	SABRE_IMAP_UE,
--/*0x2f*/	SABRE_IMAP_CE,
--/*0x30*/	SABRE_IMAP_PCIERR,
--/*0x31*/	0 /* reserved */,
--/*0x32*/	0 /* reserved */,
--/*0x33*/	SABRE_IMAP_GFX,
--/*0x34*/	SABRE_IMAP_EUPA,
--};
--#define SABRE_ONBOARD_IRQ_BASE		0x20
--#define SABRE_ONBOARD_IRQ_LAST		0x30
-+#define SABRE_OBIO_IMAP_BASE	0x1000UL
-+#define SABRE_ONBOARD_IRQ_BASE	0x20
- #define sabre_onboard_imap_offset(__ino) \
--	__sabre_onboard_imap_off[(__ino) - SABRE_ONBOARD_IRQ_BASE]
-+	(SABRE_OBIO_IMAP_BASE + (((__ino) & 0x1f) << 3))
- 
- #define sabre_iclr_offset(ino)					      \
- 	((ino & 0x20) ? (SABRE_ICLR_SCSI + (((ino) & 0x1f) << 3)) :  \
-@@ -453,10 +365,6 @@ static unsigned int sabre_irq_build(struct device_node *dp,
- 		imap_off = sabre_pcislot_imap_offset(ino);
- 	} else {
- 		/* onboard device */
--		if (ino > SABRE_ONBOARD_IRQ_LAST) {
--			prom_printf("sabre_irq_build: Wacky INO [%x]\n", ino);
--			prom_halt();
--		}
- 		imap_off = sabre_onboard_imap_offset(ino);
- 	}
- 
-diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
-index 65c7857..d5ccf42 100644
---- a/arch/x86/kernel/alternative.c
-+++ b/arch/x86/kernel/alternative.c
-@@ -1,6 +1,6 @@
- #include <linux/module.h>
- #include <linux/sched.h>
--#include <linux/spinlock.h>
-+#include <linux/mutex.h>
- #include <linux/list.h>
- #include <linux/kprobes.h>
- #include <linux/mm.h>
-@@ -279,7 +279,7 @@ struct smp_alt_module {
- 	struct list_head next;
- };
- static LIST_HEAD(smp_alt_modules);
--static DEFINE_SPINLOCK(smp_alt);
-+static DEFINE_MUTEX(smp_alt);
- static int smp_mode = 1;	/* protected by smp_alt */
- 
- void alternatives_smp_module_add(struct module *mod, char *name,
-@@ -312,12 +312,12 @@ void alternatives_smp_module_add(struct module *mod, char *name,
- 		__func__, smp->locks, smp->locks_end,
- 		smp->text, smp->text_end, smp->name);
- 
--	spin_lock(&smp_alt);
-+	mutex_lock(&smp_alt);
- 	list_add_tail(&smp->next, &smp_alt_modules);
- 	if (boot_cpu_has(X86_FEATURE_UP))
- 		alternatives_smp_unlock(smp->locks, smp->locks_end,
- 					smp->text, smp->text_end);
--	spin_unlock(&smp_alt);
-+	mutex_unlock(&smp_alt);
- }
- 
- void alternatives_smp_module_del(struct module *mod)
-@@ -327,17 +327,17 @@ void alternatives_smp_module_del(struct module *mod)
- 	if (smp_alt_once || noreplace_smp)
- 		return;
- 
--	spin_lock(&smp_alt);
-+	mutex_lock(&smp_alt);
- 	list_for_each_entry(item, &smp_alt_modules, next) {
- 		if (mod != item->mod)
- 			continue;
- 		list_del(&item->next);
--		spin_unlock(&smp_alt);
-+		mutex_unlock(&smp_alt);
- 		DPRINTK("%s: %s\n", __func__, item->name);
- 		kfree(item);
- 		return;
- 	}
--	spin_unlock(&smp_alt);
-+	mutex_unlock(&smp_alt);
- }
- 
- void alternatives_smp_switch(int smp)
-@@ -359,7 +359,7 @@ void alternatives_smp_switch(int smp)
- 		return;
- 	BUG_ON(!smp && (num_online_cpus() > 1));
- 
--	spin_lock(&smp_alt);
-+	mutex_lock(&smp_alt);
- 
- 	/*
- 	 * Avoid unnecessary switches because it forces JIT based VMs to
-@@ -383,7 +383,7 @@ void alternatives_smp_switch(int smp)
- 						mod->text, mod->text_end);
- 	}
- 	smp_mode = smp;
--	spin_unlock(&smp_alt);
-+	mutex_unlock(&smp_alt);
- }
- 
- #endif
-diff --git a/arch/x86/kernel/apic_32.c b/arch/x86/kernel/apic_32.c
-index 4b99b1b..c17fdb0 100644
---- a/arch/x86/kernel/apic_32.c
-+++ b/arch/x86/kernel/apic_32.c
-@@ -552,8 +552,31 @@ void __init setup_boot_APIC_clock(void)
- 	setup_APIC_timer();
- }
- 
--void __devinit setup_secondary_APIC_clock(void)
-+/*
-+ * AMD C1E enabled CPUs have a real nasty problem: Some BIOSes set the
-+ * C1E flag only in the secondary CPU, so when we detect the wreckage
-+ * we already have enabled the boot CPU local apic timer. Check, if
-+ * disable_apic_timer is set and the DUMMY flag is cleared. If yes,
-+ * set the DUMMY flag again and force the broadcast mode in the
-+ * clockevents layer.
-+ */
-+static void __cpuinit check_boot_apic_timer_broadcast(void)
- {
-+	if (!local_apic_timer_disabled ||
-+	    (lapic_clockevent.features & CLOCK_EVT_FEAT_DUMMY))
-+		return;
-+
-+	lapic_clockevent.features |= CLOCK_EVT_FEAT_DUMMY;
-+
-+	local_irq_enable();
-+	clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_FORCE,
-+			   &boot_cpu_physical_apicid);
-+	local_irq_disable();
-+}
-+
-+void __cpuinit setup_secondary_APIC_clock(void)
-+{
-+	check_boot_apic_timer_broadcast();
- 	setup_APIC_timer();
- }
- 
-@@ -1513,6 +1536,9 @@ void __cpuinit generic_processor_info(int apicid, int version)
- 		 */
- 		cpu = 0;
- 
-+	if (apicid > max_physical_apicid)
-+		max_physical_apicid = apicid;
-+
- 	/*
- 	 * Would be preferable to switch to bigsmp when CONFIG_HOTPLUG_CPU=y
- 	 * but we need to work other dependencies like SMP_SUSPEND etc
-@@ -1520,7 +1546,7 @@ void __cpuinit generic_processor_info(int apicid, int version)
- 	 * if (CPU_HOTPLUG_ENABLED || num_processors > 8)
- 	 *       - Ashok Raj <ashok.raj@×××××.com>
- 	 */
--	if (num_processors > 8) {
-+	if (max_physical_apicid >= 8) {
- 		switch (boot_cpu_data.x86_vendor) {
- 		case X86_VENDOR_INTEL:
- 			if (!APIC_XAPIC(version)) {
-diff --git a/arch/x86/kernel/apic_64.c b/arch/x86/kernel/apic_64.c
-index 0633cfd..8472bdf 100644
---- a/arch/x86/kernel/apic_64.c
-+++ b/arch/x86/kernel/apic_64.c
-@@ -1090,6 +1090,9 @@ void __cpuinit generic_processor_info(int apicid, int version)
- 		 */
- 		cpu = 0;
- 	}
-+	if (apicid > max_physical_apicid)
-+		max_physical_apicid = apicid;
-+
- 	/* are we being called early in kernel startup? */
- 	if (x86_cpu_to_apicid_early_ptr) {
- 		u16 *cpu_to_apicid = x86_cpu_to_apicid_early_ptr;
-diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
-index 170d2f5..912a84b 100644
---- a/arch/x86/kernel/cpu/bugs.c
-+++ b/arch/x86/kernel/cpu/bugs.c
-@@ -50,6 +50,8 @@ static double __initdata y = 3145727.0;
-  */
- static void __init check_fpu(void)
- {
-+	s32 fdiv_bug;
-+
- 	if (!boot_cpu_data.hard_math) {
- #ifndef CONFIG_MATH_EMULATION
- 		printk(KERN_EMERG "No coprocessor found and no math emulation present.\n");
-@@ -70,8 +72,10 @@ static void __init check_fpu(void)
- 		"fistpl %0\n\t"
- 		"fwait\n\t"
- 		"fninit"
--		: "=m" (*&boot_cpu_data.fdiv_bug)
-+		: "=m" (*&fdiv_bug)
- 		: "m" (*&x), "m" (*&y));
-+
-+	boot_cpu_data.fdiv_bug = fdiv_bug;
- 	if (boot_cpu_data.fdiv_bug)
- 		printk("Hmm, FPU with FDIV bug.\n");
- }
-diff --git a/arch/x86/kernel/e820_32.c b/arch/x86/kernel/e820_32.c
-index ed733e7..a540c4e 100644
---- a/arch/x86/kernel/e820_32.c
-+++ b/arch/x86/kernel/e820_32.c
-@@ -697,7 +697,7 @@ static int __init parse_memmap(char *arg)
- 	if (!arg)
- 		return -EINVAL;
- 
--	if (strcmp(arg, "exactmap") == 0) {
-+	if (strncmp(arg, "exactmap", 8) == 0) {
- #ifdef CONFIG_CRASH_DUMP
- 		/* If we are doing a crash dump, we
- 		 * still need to know the real mem
-diff --git a/arch/x86/kernel/e820_64.c b/arch/x86/kernel/e820_64.c
-index 124480c..4da8e2b 100644
---- a/arch/x86/kernel/e820_64.c
-+++ b/arch/x86/kernel/e820_64.c
-@@ -776,7 +776,7 @@ static int __init parse_memmap_opt(char *p)
- 	char *oldp;
- 	unsigned long long start_at, mem_size;
- 
--	if (!strcmp(p, "exactmap")) {
-+	if (!strncmp(p, "exactmap", 8)) {
- #ifdef CONFIG_CRASH_DUMP
- 		/*
- 		 * If we are doing a crash dump, we still need to know
-diff --git a/arch/x86/kernel/genapic_64.c b/arch/x86/kernel/genapic_64.c
-index cbaaf69..1fa8be5 100644
---- a/arch/x86/kernel/genapic_64.c
-+++ b/arch/x86/kernel/genapic_64.c
-@@ -51,7 +51,7 @@ void __init setup_apic_routing(void)
- 	else
- #endif
- 
--	if (num_possible_cpus() <= 8)
-+	if (max_physical_apicid < 8)
- 		genapic = &apic_flat;
- 	else
- 		genapic = &apic_physflat;
-diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
-index e25c57b..d946c37 100644
---- a/arch/x86/kernel/head64.c
-+++ b/arch/x86/kernel/head64.c
-@@ -135,6 +135,7 @@ void __init x86_64_start_kernel(char * real_mode_data)
- 	BUILD_BUG_ON(!(MODULES_VADDR > __START_KERNEL));
- 	BUILD_BUG_ON(!(((MODULES_END - 1) & PGDIR_MASK) ==
- 				(__START_KERNEL & PGDIR_MASK)));
-+	BUILD_BUG_ON(__fix_to_virt(__end_of_fixed_addresses) <= MODULES_END);
- 
- 	/* clear bss before set_intr_gate with early_idt_handler */
- 	clear_bss();
-diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c
-index 9b5cfcd..0f3e379 100644
---- a/arch/x86/kernel/hpet.c
-+++ b/arch/x86/kernel/hpet.c
-@@ -223,8 +223,8 @@ static void hpet_legacy_clockevent_register(void)
- 	/* Calculate the min / max delta */
- 	hpet_clockevent.max_delta_ns = clockevent_delta2ns(0x7FFFFFFF,
- 							   &hpet_clockevent);
--	hpet_clockevent.min_delta_ns = clockevent_delta2ns(0x30,
--							   &hpet_clockevent);
-+	/* 5 usec minimum reprogramming delta. */
-+	hpet_clockevent.min_delta_ns = 5000;
- 
- 	/*
- 	 * Start hpet with the boot cpu mask and make it
-@@ -283,15 +283,22 @@ static void hpet_legacy_set_mode(enum clock_event_mode mode,
- }
- 
- static int hpet_legacy_next_event(unsigned long delta,
--			   struct clock_event_device *evt)
-+				  struct clock_event_device *evt)
- {
--	unsigned long cnt;
-+	u32 cnt;
- 
- 	cnt = hpet_readl(HPET_COUNTER);
--	cnt += delta;
-+	cnt += (u32) delta;
- 	hpet_writel(cnt, HPET_T0_CMP);
- 
--	return ((long)(hpet_readl(HPET_COUNTER) - cnt ) > 0) ? -ETIME : 0;
-+	/*
-+	 * We need to read back the CMP register to make sure that
-+	 * what we wrote hit the chip before we compare it to the
-+	 * counter.
-+	 */
-+	WARN_ON((u32)hpet_readl(HPET_T0_CMP) != cnt);
-+
-+	return (s32)((u32)hpet_readl(HPET_COUNTER) - cnt) >= 0 ? -ETIME : 0;
- }
- 
- /*
-diff --git a/arch/x86/kernel/io_delay.c b/arch/x86/kernel/io_delay.c
-index 1c3a66a..720d260 100644
---- a/arch/x86/kernel/io_delay.c
-+++ b/arch/x86/kernel/io_delay.c
-@@ -92,6 +92,14 @@ static struct dmi_system_id __initdata io_delay_0xed_port_dmi_table[] = {
- 			DMI_MATCH(DMI_BOARD_NAME, "30BF")
- 		}
- 	},
-+	{
-+		.callback	= dmi_io_delay_0xed_port,
-+		.ident		= "Presario F700",
-+		.matches	= {
-+			DMI_MATCH(DMI_BOARD_VENDOR, "Quanta"),
-+			DMI_MATCH(DMI_BOARD_NAME, "30D3")
-+		}
-+	},
- 	{ }
- };
- 
-diff --git a/arch/x86/kernel/mpparse.c b/arch/x86/kernel/mpparse.c
-index 404683b..d5b8691 100644
---- a/arch/x86/kernel/mpparse.c
-+++ b/arch/x86/kernel/mpparse.c
-@@ -402,6 +402,11 @@ static int __init smp_read_mpc(struct mp_config_table *mpc, unsigned early)
- 		++mpc_record;
- #endif
- 	}
-+
-+#ifdef CONFIG_X86_GENERICARCH
-+       generic_bigsmp_probe();
-+#endif
-+
- 	setup_apic_routing();
- 	if (!num_processors)
- 		printk(KERN_ERR "MPTABLE: no processors registered!\n");
-diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
-index 6f80b85..03e357a 100644
---- a/arch/x86/kernel/setup.c
-+++ b/arch/x86/kernel/setup.c
-@@ -17,6 +17,7 @@ unsigned int num_processors;
- unsigned disabled_cpus __cpuinitdata;
- /* Processor that is doing the boot up */
- unsigned int boot_cpu_physical_apicid = -1U;
-+unsigned int max_physical_apicid;
- EXPORT_SYMBOL(boot_cpu_physical_apicid);
- 
- DEFINE_PER_CPU(u16, x86_cpu_to_apicid) = BAD_APICID;
-diff --git a/arch/x86/kernel/setup_32.c b/arch/x86/kernel/setup_32.c
-index 5a2f8e0..3bf22f0 100644
---- a/arch/x86/kernel/setup_32.c
-+++ b/arch/x86/kernel/setup_32.c
-@@ -914,6 +914,12 @@ void __init setup_arch(char **cmdline_p)
- 
- #ifdef CONFIG_ACPI
- 	acpi_boot_init();
-+#endif
-+
-+#ifdef CONFIG_X86_LOCAL_APIC
-+	if (smp_found_config)
-+		get_smp_config();
-+#endif
- 
- #if defined(CONFIG_SMP) && defined(CONFIG_X86_PC)
- 	if (def_to_bigsmp)
-@@ -921,11 +927,6 @@ void __init setup_arch(char **cmdline_p)
- 			"CONFIG_X86_PC cannot handle it.\nUse "
- 			"CONFIG_X86_GENERICARCH or CONFIG_X86_BIGSMP.\n");
- #endif
--#endif
--#ifdef CONFIG_X86_LOCAL_APIC
--	if (smp_found_config)
--		get_smp_config();
--#endif
- 
- 	e820_register_memory();
- 	e820_mark_nosave_regions();
-diff --git a/arch/x86/kernel/signal_64.c b/arch/x86/kernel/signal_64.c
-index e53b267..c56034d 100644
---- a/arch/x86/kernel/signal_64.c
-+++ b/arch/x86/kernel/signal_64.c
-@@ -53,6 +53,68 @@ sys_sigaltstack(const stack_t __user *uss, stack_t __user *uoss,
- 	return do_sigaltstack(uss, uoss, regs->sp);
- }
- 
-+/*
-+ * Signal frame handlers.
-+ */
-+
-+static inline int save_i387(struct _fpstate __user *buf)
-+{
-+	struct task_struct *tsk = current;
-+	int err = 0;
-+
-+	BUILD_BUG_ON(sizeof(struct user_i387_struct) !=
-+			sizeof(tsk->thread.xstate->fxsave));
-+
-+	if ((unsigned long)buf % 16)
-+		printk("save_i387: bad fpstate %p\n", buf);
-+
-+	if (!used_math())
-+		return 0;
-+	clear_used_math(); /* trigger finit */
-+	if (task_thread_info(tsk)->status & TS_USEDFPU) {
-+		err = save_i387_checking((struct i387_fxsave_struct __user *)
-+					 buf);
-+		if (err)
-+			return err;
-+		task_thread_info(tsk)->status &= ~TS_USEDFPU;
-+		stts();
-+	} else {
-+		if (__copy_to_user(buf, &tsk->thread.xstate->fxsave,
-+				   sizeof(struct i387_fxsave_struct)))
-+			return -1;
-+	}
-+	return 1;
-+}
-+
-+/*
-+ * This restores directly out of user space. Exceptions are handled.
-+ */
-+static inline int restore_i387(struct _fpstate __user *buf)
-+{
-+	struct task_struct *tsk = current;
-+	int err;
-+
-+	if (!used_math()) {
-+		err = init_fpu(tsk);
-+		if (err)
-+			return err;
-+	}
-+
-+	if (!(task_thread_info(current)->status & TS_USEDFPU)) {
-+		clts();
-+		task_thread_info(current)->status |= TS_USEDFPU;
-+	}
-+	err = restore_fpu_checking((__force struct i387_fxsave_struct *)buf);
-+	if (unlikely(err)) {
-+		/*
-+		 * Encountered an error while doing the restore from the
-+		 * user buffer, clear the fpu state.
-+		 */
-+		clear_fpu(tsk);
-+		clear_used_math();
-+	}
-+	return err;
-+}
- 
- /*
-  * Do a signal return; undo the signal stack.
-diff --git a/arch/x86/kernel/traps_64.c b/arch/x86/kernel/traps_64.c
-index adff76e..9e26f39 100644
---- a/arch/x86/kernel/traps_64.c
-+++ b/arch/x86/kernel/traps_64.c
-@@ -1141,7 +1141,14 @@ asmlinkage void math_state_restore(void)
- 	}
- 
- 	clts();			/* Allow maths ops (or we recurse) */
--	restore_fpu_checking(&me->thread.xstate->fxsave);
-+ 	/*
-+ 	 * Paranoid restore. send a SIGSEGV if we fail to restore the state.
-+ 	 */
-+ 	if (unlikely(restore_fpu_checking(&me->thread.xstate->fxsave))) {
-+ 		stts();
-+ 		force_sig(SIGSEGV, me);
-+ 		return;
-+ 	}
- 	task_thread_info(me)->status |= TS_USEDFPU;
- 	me->fpu_counter++;
- }
-diff --git a/arch/x86/kernel/vmi_32.c b/arch/x86/kernel/vmi_32.c
-index 956f389..9b3e795 100644
---- a/arch/x86/kernel/vmi_32.c
-+++ b/arch/x86/kernel/vmi_32.c
-@@ -234,7 +234,7 @@ static void vmi_write_ldt_entry(struct desc_struct *dt, int entry,
- 				const void *desc)
- {
- 	u32 *ldt_entry = (u32 *)desc;
--	vmi_ops.write_idt_entry(dt, entry, ldt_entry[0], ldt_entry[1]);
-+	vmi_ops.write_ldt_entry(dt, entry, ldt_entry[0], ldt_entry[1]);
- }
- 
- static void vmi_load_sp0(struct tss_struct *tss,
-diff --git a/arch/x86/kernel/vsmp_64.c b/arch/x86/kernel/vsmp_64.c
-index ba8c0b7..a3c9869 100644
---- a/arch/x86/kernel/vsmp_64.c
-+++ b/arch/x86/kernel/vsmp_64.c
-@@ -58,7 +58,7 @@ static void vsmp_irq_enable(void)
- 	native_restore_fl((flags | X86_EFLAGS_IF) & (~X86_EFLAGS_AC));
- }
- 
--static unsigned __init vsmp_patch(u8 type, u16 clobbers, void *ibuf,
-+static unsigned __init_or_module vsmp_patch(u8 type, u16 clobbers, void *ibuf,
- 				  unsigned long addr, unsigned len)
- {
- 	switch (type) {
-diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
-index 7d6071d..45e2280 100644
---- a/arch/x86/kvm/svm.c
-+++ b/arch/x86/kvm/svm.c
-@@ -60,6 +60,7 @@ static int npt = 1;
- module_param(npt, int, S_IRUGO);
- 
- static void kvm_reput_irq(struct vcpu_svm *svm);
-+static void svm_flush_tlb(struct kvm_vcpu *vcpu);
- 
- static inline struct vcpu_svm *to_svm(struct kvm_vcpu *vcpu)
- {
-@@ -879,6 +880,10 @@ set:
- static void svm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
- {
- 	unsigned long host_cr4_mce = read_cr4() & X86_CR4_MCE;
-+	unsigned long old_cr4 = to_svm(vcpu)->vmcb->save.cr4;
-+
-+	if (npt_enabled && ((old_cr4 ^ cr4) & X86_CR4_PGE))
-+		force_new_asid(vcpu);
- 
- 	vcpu->arch.cr4 = cr4;
- 	if (!npt_enabled)
-@@ -1017,6 +1022,15 @@ static int pf_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
- 
- 	fault_address  = svm->vmcb->control.exit_info_2;
- 	error_code = svm->vmcb->control.exit_info_1;
-+
-+	/*
-+	 * FIXME: Tis shouldn't be necessary here, but there is a flush
-+	 * missing in the MMU code. Until we find this bug, flush the
-+	 * complete TLB here on an NPF
-+	 */
-+	if (npt_enabled)
-+		svm_flush_tlb(&svm->vcpu);
-+
- 	if (event_injection)
- 		kvm_mmu_unprotect_page_virt(&svm->vcpu, fault_address);
- 	return kvm_mmu_page_fault(&svm->vcpu, fault_address, error_code);
-diff --git a/arch/x86/mach-generic/bigsmp.c b/arch/x86/mach-generic/bigsmp.c
-index 95fc463..2a24301 100644
---- a/arch/x86/mach-generic/bigsmp.c
-+++ b/arch/x86/mach-generic/bigsmp.c
-@@ -48,7 +48,7 @@ static const struct dmi_system_id bigsmp_dmi_table[] = {
- static int probe_bigsmp(void)
- {
- 	if (def_to_bigsmp)
--	dmi_bigsmp = 1;
-+		dmi_bigsmp = 1;
- 	else
- 		dmi_check_system(bigsmp_dmi_table);
- 	return dmi_bigsmp;
-diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
-index 60bcb5b..b384297 100644
---- a/arch/x86/mm/pageattr.c
-+++ b/arch/x86/mm/pageattr.c
-@@ -789,7 +789,7 @@ int set_memory_uc(unsigned long addr, int numpages)
- 	/*
- 	 * for now UC MINUS. see comments in ioremap_nocache()
- 	 */
--	if (reserve_memtype(addr, addr + numpages * PAGE_SIZE,
-+	if (reserve_memtype(__pa(addr), __pa(addr) + numpages * PAGE_SIZE,
- 			    _PAGE_CACHE_UC_MINUS, NULL))
- 		return -EINVAL;
- 
-@@ -808,7 +808,7 @@ int set_memory_wc(unsigned long addr, int numpages)
- 	if (!pat_wc_enabled)
- 		return set_memory_uc(addr, numpages);
- 
--	if (reserve_memtype(addr, addr + numpages * PAGE_SIZE,
-+	if (reserve_memtype(__pa(addr), __pa(addr) + numpages * PAGE_SIZE,
- 		_PAGE_CACHE_WC, NULL))
- 		return -EINVAL;
- 
-@@ -824,7 +824,7 @@ int _set_memory_wb(unsigned long addr, int numpages)
- 
- int set_memory_wb(unsigned long addr, int numpages)
- {
--	free_memtype(addr, addr + numpages * PAGE_SIZE);
-+	free_memtype(__pa(addr), __pa(addr) + numpages * PAGE_SIZE);
- 
- 	return _set_memory_wb(addr, numpages);
- }
-diff --git a/arch/x86/oprofile/nmi_int.c b/arch/x86/oprofile/nmi_int.c
-index cc48d3f..d38d5d0 100644
---- a/arch/x86/oprofile/nmi_int.c
-+++ b/arch/x86/oprofile/nmi_int.c
-@@ -15,6 +15,7 @@
- #include <linux/slab.h>
- #include <linux/moduleparam.h>
- #include <linux/kdebug.h>
-+#include <linux/cpu.h>
- #include <asm/nmi.h>
- #include <asm/msr.h>
- #include <asm/apic.h>
-@@ -28,23 +29,48 @@ static DEFINE_PER_CPU(unsigned long, saved_lvtpc);
- 
- static int nmi_start(void);
- static void nmi_stop(void);
-+static void nmi_cpu_start(void *dummy);
-+static void nmi_cpu_stop(void *dummy);
- 
- /* 0 == registered but off, 1 == registered and on */
- static int nmi_enabled = 0;
- 
-+#ifdef CONFIG_SMP
-+static int oprofile_cpu_notifier(struct notifier_block *b, unsigned long action,
-+				 void *data)
-+{
-+	int cpu = (unsigned long)data;
-+	switch (action) {
-+	case CPU_DOWN_FAILED:
-+	case CPU_ONLINE:
-+		smp_call_function_single(cpu, nmi_cpu_start, NULL, 0, 0);
-+		break;
-+	case CPU_DOWN_PREPARE:
-+		smp_call_function_single(cpu, nmi_cpu_stop, NULL, 0, 1);
-+		break;
-+	}
-+	return NOTIFY_DONE;
-+}
-+
-+static struct notifier_block oprofile_cpu_nb = {
-+	.notifier_call = oprofile_cpu_notifier
-+};
-+#endif
-+
- #ifdef CONFIG_PM
- 
- static int nmi_suspend(struct sys_device *dev, pm_message_t state)
- {
-+	/* Only one CPU left, just stop that one */
- 	if (nmi_enabled == 1)
--		nmi_stop();
-+		nmi_cpu_stop(NULL);
- 	return 0;
- }
- 
- static int nmi_resume(struct sys_device *dev)
- {
- 	if (nmi_enabled == 1)
--		nmi_start();
-+		nmi_cpu_start(NULL);
- 	return 0;
- }
- 
-@@ -448,6 +474,9 @@ int __init op_nmi_init(struct oprofile_operations *ops)
- 	}
- 
- 	init_sysfs();
-+#ifdef CONFIG_SMP
-+	register_cpu_notifier(&oprofile_cpu_nb);
-+#endif
- 	using_nmi = 1;
- 	ops->create_files = nmi_create_files;
- 	ops->setup = nmi_setup;
-@@ -461,6 +490,10 @@ int __init op_nmi_init(struct oprofile_operations *ops)
- 
- void op_nmi_exit(void)
- {
--	if (using_nmi)
-+	if (using_nmi) {
- 		exit_sysfs();
-+#ifdef CONFIG_SMP
-+		unregister_cpu_notifier(&oprofile_cpu_nb);
-+#endif
-+	}
- }
-diff --git a/crypto/async_tx/async_tx.c b/crypto/async_tx/async_tx.c
-index c6e772f..bfffb3d 100644
---- a/crypto/async_tx/async_tx.c
-+++ b/crypto/async_tx/async_tx.c
-@@ -136,7 +136,8 @@ async_tx_run_dependencies(struct dma_async_tx_descriptor *tx)
- 		spin_lock_bh(&next->lock);
- 		next->parent = NULL;
- 		_next = next->next;
--		next->next = NULL;
-+		if (_next && _next->chan == chan)
-+			next->next = NULL;
- 		spin_unlock_bh(&next->lock);
- 
- 		next->tx_submit(next);
-diff --git a/drivers/accessibility/braille/braille_console.c b/drivers/accessibility/braille/braille_console.c
-index 0a5f6b2..d672cfe 100644
---- a/drivers/accessibility/braille/braille_console.c
-+++ b/drivers/accessibility/braille/braille_console.c
-@@ -376,6 +376,8 @@ int braille_register_console(struct console *console, int index,
- 	console->flags |= CON_ENABLED;
- 	console->index = index;
- 	braille_co = console;
-+	register_keyboard_notifier(&keyboard_notifier_block);
-+	register_vt_notifier(&vt_notifier_block);
- 	return 0;
- }
- 
-@@ -383,15 +385,8 @@ int braille_unregister_console(struct console *console)
- {
- 	if (braille_co != console)
- 		return -EINVAL;
-+	unregister_keyboard_notifier(&keyboard_notifier_block);
-+	unregister_vt_notifier(&vt_notifier_block);
- 	braille_co = NULL;
- 	return 0;
- }
--
--static int __init braille_init(void)
--{
--	register_keyboard_notifier(&keyboard_notifier_block);
--	register_vt_notifier(&vt_notifier_block);
--	return 0;
--}
--
--console_initcall(braille_init);
-diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
-index 5622aee..5670178 100644
---- a/drivers/acpi/ec.c
-+++ b/drivers/acpi/ec.c
-@@ -196,6 +196,8 @@ static int acpi_ec_wait(struct acpi_ec *ec, enum ec_event event, int force_poll)
- 				return 0;
- 			msleep(1);
- 		}
-+		if (acpi_ec_check_status(ec,event))
-+			return 0;
- 	}
- 	pr_err(PREFIX "acpi_ec_wait timeout, status = 0x%2.2x, event = %s\n",
- 		acpi_ec_read_status(ec),
-diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c
-index 8c06a53..6f4a5e1 100644
---- a/drivers/acpi/processor_perflib.c
-+++ b/drivers/acpi/processor_perflib.c
-@@ -70,7 +70,7 @@ static DEFINE_MUTEX(performance_mutex);
-  *  0 -> cpufreq low level drivers initialized -> consider _PPC values
-  *  1 -> ignore _PPC totally -> forced by user through boot param
-  */
--static unsigned int ignore_ppc = -1;
-+static int ignore_ppc = -1;
- module_param(ignore_ppc, uint, 0644);
- MODULE_PARM_DESC(ignore_ppc, "If the frequency of your machine gets wrongly" \
- 		 "limited by BIOS, this should help");
-diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
-index d34c14c..436c7e1 100644
---- a/drivers/i2c/i2c-dev.c
-+++ b/drivers/i2c/i2c-dev.c
-@@ -581,8 +581,10 @@ static int __init i2c_dev_init(void)
- 		goto out;
- 
- 	i2c_dev_class = class_create(THIS_MODULE, "i2c-dev");
--	if (IS_ERR(i2c_dev_class))
-+	if (IS_ERR(i2c_dev_class)) {
-+		res = PTR_ERR(i2c_dev_class);
- 		goto out_unreg_chrdev;
-+	}
- 
- 	res = i2c_add_driver(&i2cdev_driver);
- 	if (res)
-diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
-index f9ad960..55a104d 100644
---- a/drivers/mmc/card/block.c
-+++ b/drivers/mmc/card/block.c
-@@ -103,8 +103,10 @@ static int mmc_blk_open(struct inode *inode, struct file *filp)
- 			check_disk_change(inode->i_bdev);
- 		ret = 0;
- 
--		if ((filp->f_mode & FMODE_WRITE) && md->read_only)
-+		if ((filp->f_mode & FMODE_WRITE) && md->read_only) {
-+			mmc_blk_put(md);
- 			ret = -EROFS;
-+		}
- 	}
- 
- 	return ret;
-diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
-index e248f80..6fbfaf0 100644
---- a/drivers/net/ixgbe/ixgbe_main.c
-+++ b/drivers/net/ixgbe/ixgbe_main.c
-@@ -2258,6 +2258,12 @@ static int __devinit ixgbe_set_interrupt_capability(struct ixgbe_adapter
- 	int vector, v_budget;
- 
- 	/*
-+	 * Set the default interrupt throttle rate.
-+	 */
-+	adapter->rx_eitr = (1000000 / IXGBE_DEFAULT_ITR_RX_USECS);
-+	adapter->tx_eitr = (1000000 / IXGBE_DEFAULT_ITR_TX_USECS);
-+
-+	/*
- 	 * It's easy to be greedy for MSI-X vectors, but it really
- 	 * doesn't do us much good if we have a lot more vectors
- 	 * than CPU's.  So let's be conservative and only ask for
-diff --git a/drivers/net/niu.c b/drivers/net/niu.c
-index 918f802..78d90eb 100644
---- a/drivers/net/niu.c
-+++ b/drivers/net/niu.c
-@@ -5978,6 +5978,56 @@ static void niu_netif_start(struct niu *np)
- 	niu_enable_interrupts(np, 1);
- }
- 
-+static void niu_reset_buffers(struct niu *np)
-+{
-+	int i, j, k, err;
-+
-+	if (np->rx_rings) {
-+		for (i = 0; i < np->num_rx_rings; i++) {
-+			struct rx_ring_info *rp = &np->rx_rings[i];
-+
-+			for (j = 0, k = 0; j < MAX_RBR_RING_SIZE; j++) {
-+				struct page *page;
-+
-+				page = rp->rxhash[j];
-+				while (page) {
-+					struct page *next =
-+						(struct page *) page->mapping;
-+					u64 base = page->index;
-+					base = base >> RBR_DESCR_ADDR_SHIFT;
-+					rp->rbr[k++] = cpu_to_le32(base);
-+					page = next;
-+				}
-+			}
-+			for (; k < MAX_RBR_RING_SIZE; k++) {
-+				err = niu_rbr_add_page(np, rp, GFP_ATOMIC, k);
-+				if (unlikely(err))
-+					break;
-+			}
-+
-+			rp->rbr_index = rp->rbr_table_size - 1;
-+			rp->rcr_index = 0;
-+			rp->rbr_pending = 0;
-+			rp->rbr_refill_pending = 0;
-+		}
-+	}
-+	if (np->tx_rings) {
-+		for (i = 0; i < np->num_tx_rings; i++) {
-+			struct tx_ring_info *rp = &np->tx_rings[i];
-+
-+			for (j = 0; j < MAX_TX_RING_SIZE; j++) {
-+				if (rp->tx_buffs[j].skb)
-+					(void) release_tx_packet(np, rp, j);
-+			}
-+
-+			rp->pending = MAX_TX_RING_SIZE;
-+			rp->prod = 0;
-+			rp->cons = 0;
-+			rp->wrap_bit = 0;
-+		}
-+	}
-+}
-+
- static void niu_reset_task(struct work_struct *work)
- {
- 	struct niu *np = container_of(work, struct niu, reset_task);
-@@ -6000,6 +6050,12 @@ static void niu_reset_task(struct work_struct *work)
- 
- 	niu_stop_hw(np);
- 
-+	spin_unlock_irqrestore(&np->lock, flags);
-+
-+	niu_reset_buffers(np);
-+
-+	spin_lock_irqsave(&np->lock, flags);
-+
- 	err = niu_init_hw(np);
- 	if (!err) {
- 		np->timer.expires = jiffies + HZ;
-diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
-index b4bf1e0..10c92bd 100644
---- a/drivers/net/wireless/rt2x00/rt2x00.h
-+++ b/drivers/net/wireless/rt2x00/rt2x00.h
-@@ -820,8 +820,10 @@ struct rt2x00_dev {
- 
- 	/*
- 	 * Scheduled work.
-+	 * NOTE: intf_work will use ieee80211_iterate_active_interfaces()
-+	 * which means it cannot be placed on the hw->workqueue
-+	 * due to RTNL locking requirements.
- 	 */
--	struct workqueue_struct *workqueue;
- 	struct work_struct intf_work;
- 	struct work_struct filter_work;
- 
-diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
-index c997d4f..78fa714 100644
---- a/drivers/net/wireless/rt2x00/rt2x00dev.c
-+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
-@@ -75,7 +75,7 @@ static void rt2x00lib_start_link_tuner(struct rt2x00_dev *rt2x00dev)
- 
- 	rt2x00lib_reset_link_tuner(rt2x00dev);
- 
--	queue_delayed_work(rt2x00dev->workqueue,
-+	queue_delayed_work(rt2x00dev->hw->workqueue,
- 			   &rt2x00dev->link.work, LINK_TUNE_INTERVAL);
- }
- 
-@@ -390,7 +390,7 @@ static void rt2x00lib_link_tuner(struct work_struct *work)
- 	 * Increase tuner counter, and reschedule the next link tuner run.
- 	 */
- 	rt2x00dev->link.count++;
--	queue_delayed_work(rt2x00dev->workqueue,
-+	queue_delayed_work(rt2x00dev->hw->workqueue,
- 			   &rt2x00dev->link.work, LINK_TUNE_INTERVAL);
- }
- 
-@@ -488,7 +488,7 @@ void rt2x00lib_beacondone(struct rt2x00_dev *rt2x00dev)
- 						   rt2x00lib_beacondone_iter,
- 						   rt2x00dev);
- 
--	queue_work(rt2x00dev->workqueue, &rt2x00dev->intf_work);
-+	schedule_work(&rt2x00dev->intf_work);
- }
- EXPORT_SYMBOL_GPL(rt2x00lib_beacondone);
- 
-@@ -1131,10 +1131,6 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
- 	/*
- 	 * Initialize configuration work.
- 	 */
--	rt2x00dev->workqueue = create_singlethread_workqueue("rt2x00lib");
--	if (!rt2x00dev->workqueue)
--		goto exit;
--
- 	INIT_WORK(&rt2x00dev->intf_work, rt2x00lib_intf_scheduled);
- 	INIT_WORK(&rt2x00dev->filter_work, rt2x00lib_packetfilter_scheduled);
- 	INIT_DELAYED_WORK(&rt2x00dev->link.work, rt2x00lib_link_tuner);
-@@ -1195,13 +1191,6 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
- 	rt2x00leds_unregister(rt2x00dev);
- 
- 	/*
--	 * Stop all queued work. Note that most tasks will already be halted
--	 * during rt2x00lib_disable_radio() and rt2x00lib_uninitialize().
--	 */
--	flush_workqueue(rt2x00dev->workqueue);
--	destroy_workqueue(rt2x00dev->workqueue);
--
--	/*
- 	 * Free ieee80211_hw memory.
- 	 */
- 	rt2x00lib_remove_hw(rt2x00dev);
-diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
-index 9cb023e..802ddba 100644
---- a/drivers/net/wireless/rt2x00/rt2x00mac.c
-+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
-@@ -428,7 +428,7 @@ void rt2x00mac_configure_filter(struct ieee80211_hw *hw,
- 	if (!test_bit(DRIVER_REQUIRE_SCHEDULED, &rt2x00dev->flags))
- 		rt2x00dev->ops->lib->config_filter(rt2x00dev, *total_flags);
- 	else
--		queue_work(rt2x00dev->workqueue, &rt2x00dev->filter_work);
-+		queue_work(rt2x00dev->hw->workqueue, &rt2x00dev->filter_work);
- }
- EXPORT_SYMBOL_GPL(rt2x00mac_configure_filter);
- 
-@@ -509,7 +509,7 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
- 	memcpy(&intf->conf, bss_conf, sizeof(*bss_conf));
- 	if (delayed) {
- 		intf->delayed_flags |= delayed;
--		queue_work(rt2x00dev->workqueue, &rt2x00dev->intf_work);
-+		schedule_work(&rt2x00dev->intf_work);
- 	}
- 	spin_unlock(&intf->lock);
- }
-diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
-index e407754..7d82315 100644
---- a/drivers/pcmcia/ds.c
-+++ b/drivers/pcmcia/ds.c
-@@ -428,6 +428,18 @@ static int pcmcia_device_probe(struct device * dev)
- 	p_drv = to_pcmcia_drv(dev->driver);
- 	s = p_dev->socket;
- 
-+	/* The PCMCIA code passes the match data in via dev->driver_data
-+	 * which is an ugly hack. Once the driver probe is called it may
-+	 * and often will overwrite the match data so we must save it first
-+	 *
-+	 * handle pseudo multifunction devices:
-+	 * there are at most two pseudo multifunction devices.
-+	 * if we're matching against the first, schedule a
-+	 * call which will then check whether there are two
-+	 * pseudo devices, and if not, add the second one.
-+	 */
-+	did = p_dev->dev.driver_data;
-+
- 	ds_dbg(1, "trying to bind %s to %s\n", p_dev->dev.bus_id,
- 	       p_drv->drv.name);
- 
-@@ -456,21 +468,14 @@ static int pcmcia_device_probe(struct device * dev)
- 		goto put_module;
- 	}
- 
--	/* handle pseudo multifunction devices:
--	 * there are at most two pseudo multifunction devices.
--	 * if we're matching against the first, schedule a
--	 * call which will then check whether there are two
--	 * pseudo devices, and if not, add the second one.
--	 */
--	did = p_dev->dev.driver_data;
- 	if (did && (did->match_flags & PCMCIA_DEV_ID_MATCH_DEVICE_NO) &&
- 	    (p_dev->socket->device_count == 1) && (p_dev->device_no == 0))
- 		pcmcia_add_device_later(p_dev->socket, 0);
- 
-- put_module:
-+put_module:
- 	if (ret)
- 		module_put(p_drv->owner);
-- put_dev:
-+put_dev:
- 	if (ret)
- 		put_device(dev);
- 	return (ret);
-diff --git a/drivers/rtc/rtc-dev.c b/drivers/rtc/rtc-dev.c
-index 90dfa0d..846582b 100644
---- a/drivers/rtc/rtc-dev.c
-+++ b/drivers/rtc/rtc-dev.c
-@@ -401,6 +401,12 @@ static int rtc_dev_ioctl(struct inode *inode, struct file *file,
- 	return err;
- }
- 
-+static int rtc_dev_fasync(int fd, struct file *file, int on)
-+{
-+	struct rtc_device *rtc = file->private_data;
-+	return fasync_helper(fd, file, on, &rtc->async_queue);
-+}
-+
- static int rtc_dev_release(struct inode *inode, struct file *file)
- {
- 	struct rtc_device *rtc = file->private_data;
-@@ -411,16 +417,13 @@ static int rtc_dev_release(struct inode *inode, struct file *file)
- 	if (rtc->ops->release)
- 		rtc->ops->release(rtc->dev.parent);
- 
-+	if (file->f_flags & FASYNC)
-+		rtc_dev_fasync(-1, file, 0);
-+
- 	clear_bit_unlock(RTC_DEV_BUSY, &rtc->flags);
- 	return 0;
- }
- 
--static int rtc_dev_fasync(int fd, struct file *file, int on)
--{
--	struct rtc_device *rtc = file->private_data;
--	return fasync_helper(fd, file, on, &rtc->async_queue);
--}
--
- static const struct file_operations rtc_dev_fops = {
- 	.owner		= THIS_MODULE,
- 	.llseek		= no_llseek,
-diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
-index ec63b79..d191cec 100644
---- a/drivers/scsi/qla2xxx/qla_isr.c
-+++ b/drivers/scsi/qla2xxx/qla_isr.c
-@@ -1838,7 +1838,6 @@ clear_risc_ints:
- 		WRT_REG_WORD(&reg->isp.hccr, HCCR_CLR_HOST_INT);
- 	}
- 	spin_unlock_irq(&ha->hardware_lock);
--	ha->isp_ops->enable_intrs(ha);
- 
- fail:
- 	return ret;
-diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
-index 047ee64..4c6b902 100644
---- a/drivers/scsi/qla2xxx/qla_os.c
-+++ b/drivers/scsi/qla2xxx/qla_os.c
-@@ -1740,6 +1740,8 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
- 	if (ret)
- 		goto probe_failed;
- 
-+	ha->isp_ops->enable_intrs(ha);
-+
- 	scsi_scan_host(host);
- 
- 	qla2x00_alloc_sysfs_attr(ha);
-diff --git a/drivers/spi/pxa2xx_spi.c b/drivers/spi/pxa2xx_spi.c
-index 0c452c4..2b7ba85 100644
---- a/drivers/spi/pxa2xx_spi.c
-+++ b/drivers/spi/pxa2xx_spi.c
-@@ -48,9 +48,10 @@ MODULE_ALIAS("platform:pxa2xx-spi");
- 
- #define MAX_BUSES 3
- 
--#define DMA_INT_MASK (DCSR_ENDINTR | DCSR_STARTINTR | DCSR_BUSERR)
--#define RESET_DMA_CHANNEL (DCSR_NODESC | DMA_INT_MASK)
--#define IS_DMA_ALIGNED(x) (((u32)(x)&0x07)==0)
-+#define DMA_INT_MASK		(DCSR_ENDINTR | DCSR_STARTINTR | DCSR_BUSERR)
-+#define RESET_DMA_CHANNEL	(DCSR_NODESC | DMA_INT_MASK)
-+#define IS_DMA_ALIGNED(x)	((((u32)(x)) & 0x07) == 0)
-+#define MAX_DMA_LEN		8191
- 
- /*
-  * for testing SSCR1 changes that require SSP restart, basically
-@@ -145,7 +146,6 @@ struct driver_data {
- 	size_t tx_map_len;
- 	u8 n_bytes;
- 	u32 dma_width;
--	int cs_change;
- 	int (*write)(struct driver_data *drv_data);
- 	int (*read)(struct driver_data *drv_data);
- 	irqreturn_t (*transfer_handler)(struct driver_data *drv_data);
-@@ -407,8 +407,45 @@ static void giveback(struct driver_data *drv_data)
- 					struct spi_transfer,
- 					transfer_list);
- 
-+	/* Delay if requested before any change in chip select */
-+	if (last_transfer->delay_usecs)
-+		udelay(last_transfer->delay_usecs);
-+
-+	/* Drop chip select UNLESS cs_change is true or we are returning
-+	 * a message with an error, or next message is for another chip
-+	 */
- 	if (!last_transfer->cs_change)
- 		drv_data->cs_control(PXA2XX_CS_DEASSERT);
-+	else {
-+		struct spi_message *next_msg;
-+
-+		/* Holding of cs was hinted, but we need to make sure
-+		 * the next message is for the same chip.  Don't waste
-+		 * time with the following tests unless this was hinted.
-+		 *
-+		 * We cannot postpone this until pump_messages, because
-+		 * after calling msg->complete (below) the driver that
-+		 * sent the current message could be unloaded, which
-+		 * could invalidate the cs_control() callback...
-+		 */
-+
-+		/* get a pointer to the next message, if any */
-+		spin_lock_irqsave(&drv_data->lock, flags);
-+		if (list_empty(&drv_data->queue))
-+			next_msg = NULL;
-+		else
-+			next_msg = list_entry(drv_data->queue.next,
-+					struct spi_message, queue);
-+		spin_unlock_irqrestore(&drv_data->lock, flags);
-+
-+		/* see if the next and current messages point
-+		 * to the same chip
-+		 */
-+		if (next_msg && next_msg->spi != msg->spi)
-+			next_msg = NULL;
-+		if (!next_msg || msg->state == ERROR_STATE)
-+			drv_data->cs_control(PXA2XX_CS_DEASSERT);
-+	}
- 
- 	msg->state = NULL;
- 	if (msg->complete)
-@@ -491,10 +528,9 @@ static void dma_transfer_complete(struct driver_data *drv_data)
- 	msg->actual_length += drv_data->len -
- 				(drv_data->rx_end - drv_data->rx);
- 
--	/* Release chip select if requested, transfer delays are
--	 * handled in pump_transfers */
--	if (drv_data->cs_change)
--		drv_data->cs_control(PXA2XX_CS_DEASSERT);
-+	/* Transfer delays and chip select release are
-+	 * handled in pump_transfers or giveback
-+	 */
- 
- 	/* Move to next transfer */
- 	msg->state = next_transfer(drv_data);
-@@ -603,10 +639,9 @@ static void int_transfer_complete(struct driver_data *drv_data)
- 	drv_data->cur_msg->actual_length += drv_data->len -
- 				(drv_data->rx_end - drv_data->rx);
- 
--	/* Release chip select if requested, transfer delays are
--	 * handled in pump_transfers */
--	if (drv_data->cs_change)
--		drv_data->cs_control(PXA2XX_CS_DEASSERT);
-+	/* Transfer delays and chip select release are
-+	 * handled in pump_transfers or giveback
-+	 */
- 
- 	/* Move to next transfer */
- 	drv_data->cur_msg->state = next_transfer(drv_data);
-@@ -841,23 +876,40 @@ static void pump_transfers(unsigned long data)
- 		return;
- 	}
- 
--	/* Delay if requested at end of transfer*/
-+	/* Delay if requested at end of transfer before CS change */
- 	if (message->state == RUNNING_STATE) {
- 		previous = list_entry(transfer->transfer_list.prev,
- 					struct spi_transfer,
- 					transfer_list);
- 		if (previous->delay_usecs)
- 			udelay(previous->delay_usecs);
-+
-+		/* Drop chip select only if cs_change is requested */
-+		if (previous->cs_change)
-+			drv_data->cs_control(PXA2XX_CS_DEASSERT);
- 	}
- 
--	/* Check transfer length */
--	if (transfer->len > 8191)
--	{
--		dev_warn(&drv_data->pdev->dev, "pump_transfers: transfer "
--				"length greater than 8191\n");
--		message->status = -EINVAL;
--		giveback(drv_data);
--		return;
-+	/* Check for transfers that need multiple DMA segments */
-+	if (transfer->len > MAX_DMA_LEN && chip->enable_dma) {
-+
-+		/* reject already-mapped transfers; PIO won't always work */
-+		if (message->is_dma_mapped
-+				|| transfer->rx_dma || transfer->tx_dma) {
-+			dev_err(&drv_data->pdev->dev,
-+				"pump_transfers: mapped transfer length "
-+				"of %u is greater than %d\n",
-+				transfer->len, MAX_DMA_LEN);
-+			message->status = -EINVAL;
-+			giveback(drv_data);
-+			return;
-+		}
-+
-+		/* warn ... we force this to PIO mode */
-+		if (printk_ratelimit())
-+			dev_warn(&message->spi->dev, "pump_transfers: "
-+				"DMA disabled for transfer length %ld "
-+				"greater than %d\n",
-+				(long)drv_data->len, MAX_DMA_LEN);
- 	}
- 
- 	/* Setup the transfer state based on the type of transfer */
-@@ -879,7 +931,6 @@ static void pump_transfers(unsigned long data)
- 	drv_data->len = transfer->len & DCMD_LENGTH;
- 	drv_data->write = drv_data->tx ? chip->write : null_writer;
- 	drv_data->read = drv_data->rx ? chip->read : null_reader;
--	drv_data->cs_change = transfer->cs_change;
- 
- 	/* Change speed and bit per word on a per transfer */
- 	cr0 = chip->cr0;
-@@ -926,7 +977,7 @@ static void pump_transfers(unsigned long data)
- 							&dma_thresh))
- 				if (printk_ratelimit())
- 					dev_warn(&message->spi->dev,
--						"pump_transfer: "
-+						"pump_transfers: "
- 						"DMA burst size reduced to "
- 						"match bits_per_word\n");
- 		}
-@@ -940,8 +991,23 @@ static void pump_transfers(unsigned long data)
- 
- 	message->state = RUNNING_STATE;
- 
--	/* Try to map dma buffer and do a dma transfer if successful */
--	if ((drv_data->dma_mapped = map_dma_buffers(drv_data))) {
-+	/* Try to map dma buffer and do a dma transfer if successful, but
-+	 * only if the length is non-zero and less than MAX_DMA_LEN.
-+	 *
-+	 * Zero-length non-descriptor DMA is illegal on PXA2xx; force use
-+	 * of PIO instead.  Care is needed above because the transfer may
-+	 * have have been passed with buffers that are already dma mapped.
-+	 * A zero-length transfer in PIO mode will not try to write/read
-+	 * to/from the buffers
-+	 *
-+	 * REVISIT large transfers are exactly where we most want to be
-+	 * using DMA.  If this happens much, split those transfers into
-+	 * multiple DMA segments rather than forcing PIO.
-+	 */
-+	drv_data->dma_mapped = 0;
-+	if (drv_data->len > 0 && drv_data->len <= MAX_DMA_LEN)
-+		drv_data->dma_mapped = map_dma_buffers(drv_data);
-+	if (drv_data->dma_mapped) {
- 
- 		/* Ensure we have the correct interrupt handler */
- 		drv_data->transfer_handler = dma_transfer;
-diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
-index 42a4364..7e6130a 100644
---- a/drivers/usb/core/hcd.c
-+++ b/drivers/usb/core/hcd.c
-@@ -1885,7 +1885,8 @@ int usb_add_hcd(struct usb_hcd *hcd,
- 		 * with IRQF_SHARED. As usb_hcd_irq() will always disable
- 		 * interrupts we can remove it here.
- 		 */
--		irqflags &= ~IRQF_DISABLED;
-+		if (irqflags & IRQF_SHARED)
-+			irqflags &= ~IRQF_DISABLED;
- 
- 		snprintf(hcd->irq_descr, sizeof(hcd->irq_descr), "%s:usb%d",
- 				hcd->driver->description, hcd->self.busnum);
-diff --git a/drivers/video/console/fbcon.h b/drivers/video/console/fbcon.h
-index 0135e03..e3437c4 100644
---- a/drivers/video/console/fbcon.h
-+++ b/drivers/video/console/fbcon.h
-@@ -110,7 +110,7 @@ static inline int mono_col(const struct fb_info *info)
- 	__u32 max_len;
- 	max_len = max(info->var.green.length, info->var.red.length);
- 	max_len = max(info->var.blue.length, max_len);
--	return ~(0xfff << (max_len & 0xff));
-+	return (~(0xfff << max_len)) & 0xff;
- }
- 
- static inline int attr_col_ec(int shift, struct vc_data *vc,
-diff --git a/fs/buffer.c b/fs/buffer.c
-index 0f51c0f..42d2104 100644
---- a/fs/buffer.c
-+++ b/fs/buffer.c
-@@ -2868,14 +2868,17 @@ int submit_bh(int rw, struct buffer_head * bh)
- 	BUG_ON(!buffer_mapped(bh));
- 	BUG_ON(!bh->b_end_io);
- 
--	if (buffer_ordered(bh) && (rw == WRITE))
--		rw = WRITE_BARRIER;
-+	/*
-+	 * Mask in barrier bit for a write (could be either a WRITE or a
-+	 * WRITE_SYNC
-+	 */
-+	if (buffer_ordered(bh) && (rw & WRITE))
-+		rw |= WRITE_BARRIER;
- 
- 	/*
--	 * Only clear out a write error when rewriting, should this
--	 * include WRITE_SYNC as well?
-+	 * Only clear out a write error when rewriting
- 	 */
--	if (test_set_buffer_req(bh) && (rw == WRITE || rw == WRITE_BARRIER))
-+	if (test_set_buffer_req(bh) && (rw & WRITE))
- 		clear_buffer_write_io_error(bh);
- 
- 	/*
-diff --git a/fs/exec.c b/fs/exec.c
-index fd92343..85e9948 100644
---- a/fs/exec.c
-+++ b/fs/exec.c
-@@ -740,11 +740,11 @@ static int exec_mmap(struct mm_struct *mm)
- 	tsk->active_mm = mm;
- 	activate_mm(active_mm, mm);
- 	task_unlock(tsk);
--	mm_update_next_owner(old_mm);
- 	arch_pick_mmap_layout(mm);
- 	if (old_mm) {
- 		up_read(&old_mm->mmap_sem);
- 		BUG_ON(active_mm != old_mm);
-+		mm_update_next_owner(old_mm);
- 		mmput(old_mm);
- 		return 0;
- 	}
-diff --git a/fs/ocfs2/stackglue.c b/fs/ocfs2/stackglue.c
-index 10e149a..07f348b 100644
---- a/fs/ocfs2/stackglue.c
-+++ b/fs/ocfs2/stackglue.c
-@@ -97,13 +97,14 @@ static int ocfs2_stack_driver_request(const char *stack_name,
- 		goto out;
- 	}
- 
--	/* Ok, the stack is pinned */
--	p->sp_count++;
- 	active_stack = p;
--
- 	rc = 0;
- 
- out:
-+	/* If we found it, pin it */
-+	if (!rc)
-+		active_stack->sp_count++;
-+
- 	spin_unlock(&ocfs2_stack_lock);
- 	return rc;
- }
-diff --git a/fs/proc/array.c b/fs/proc/array.c
-index 797d775..0b2a88c 100644
---- a/fs/proc/array.c
-+++ b/fs/proc/array.c
-@@ -332,65 +332,6 @@ int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
- 	return 0;
- }
- 
--/*
-- * Use precise platform statistics if available:
-- */
--#ifdef CONFIG_VIRT_CPU_ACCOUNTING
--static cputime_t task_utime(struct task_struct *p)
--{
--	return p->utime;
--}
--
--static cputime_t task_stime(struct task_struct *p)
--{
--	return p->stime;
--}
--#else
--static cputime_t task_utime(struct task_struct *p)
--{
--	clock_t utime = cputime_to_clock_t(p->utime),
--		total = utime + cputime_to_clock_t(p->stime);
--	u64 temp;
--
--	/*
--	 * Use CFS's precise accounting:
--	 */
--	temp = (u64)nsec_to_clock_t(p->se.sum_exec_runtime);
--
--	if (total) {
--		temp *= utime;
--		do_div(temp, total);
--	}
--	utime = (clock_t)temp;
--
--	p->prev_utime = max(p->prev_utime, clock_t_to_cputime(utime));
--	return p->prev_utime;
--}
--
--static cputime_t task_stime(struct task_struct *p)
--{
--	clock_t stime;
--
--	/*
--	 * Use CFS's precise accounting. (we subtract utime from
--	 * the total, to make sure the total observed by userspace
--	 * grows monotonically - apps rely on that):
--	 */
--	stime = nsec_to_clock_t(p->se.sum_exec_runtime) -
--			cputime_to_clock_t(task_utime(p));
--
--	if (stime >= 0)
--		p->prev_stime = max(p->prev_stime, clock_t_to_cputime(stime));
--
--	return p->prev_stime;
--}
--#endif
--
--static cputime_t task_gtime(struct task_struct *p)
--{
--	return p->gtime;
--}
--
- static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
- 			struct pid *pid, struct task_struct *task, int whole)
- {
-diff --git a/include/asm-generic/rtc.h b/include/asm-generic/rtc.h
-index be4af00..71ef3f0 100644
---- a/include/asm-generic/rtc.h
-+++ b/include/asm-generic/rtc.h
-@@ -15,6 +15,7 @@
- #include <linux/mc146818rtc.h>
- #include <linux/rtc.h>
- #include <linux/bcd.h>
-+#include <linux/delay.h>
- 
- #define RTC_PIE 0x40		/* periodic interrupt enable */
- #define RTC_AIE 0x20		/* alarm interrupt enable */
-@@ -43,7 +44,6 @@ static inline unsigned char rtc_is_updating(void)
- 
- static inline unsigned int get_rtc_time(struct rtc_time *time)
- {
--	unsigned long uip_watchdog = jiffies;
- 	unsigned char ctrl;
- 	unsigned long flags;
- 
-@@ -53,19 +53,15 @@ static inline unsigned int get_rtc_time(struct rtc_time *time)
- 
- 	/*
- 	 * read RTC once any update in progress is done. The update
--	 * can take just over 2ms. We wait 10 to 20ms. There is no need to
-+	 * can take just over 2ms. We wait 20ms. There is no need to
- 	 * to poll-wait (up to 1s - eeccch) for the falling edge of RTC_UIP.
- 	 * If you need to know *exactly* when a second has started, enable
- 	 * periodic update complete interrupts, (via ioctl) and then 
- 	 * immediately read /dev/rtc which will block until you get the IRQ.
- 	 * Once the read clears, read the RTC time (again via ioctl). Easy.
- 	 */
--
--	if (rtc_is_updating() != 0)
--		while (jiffies - uip_watchdog < 2*HZ/100) {
--			barrier();
--			cpu_relax();
--		}
-+	if (rtc_is_updating())
-+		mdelay(20);
- 
- 	/*
- 	 * Only the values that we read from the RTC are set. We leave
-diff --git a/include/asm-x86/i387.h b/include/asm-x86/i387.h
-index 4b683af..56d00e3 100644
---- a/include/asm-x86/i387.h
-+++ b/include/asm-x86/i387.h
-@@ -63,8 +63,6 @@ static inline int restore_fpu_checking(struct i387_fxsave_struct *fx)
- #else
- 		     : [fx] "cdaSDb" (fx), "m" (*fx), "0" (0));
- #endif
--	if (unlikely(err))
--		init_fpu(current);
- 	return err;
- }
- 
-@@ -138,60 +136,6 @@ static inline void __save_init_fpu(struct task_struct *tsk)
- 	task_thread_info(tsk)->status &= ~TS_USEDFPU;
- }
- 
--/*
-- * Signal frame handlers.
-- */
--
--static inline int save_i387(struct _fpstate __user *buf)
--{
--	struct task_struct *tsk = current;
--	int err = 0;
--
--	BUILD_BUG_ON(sizeof(struct user_i387_struct) !=
--			sizeof(tsk->thread.xstate->fxsave));
--
--	if ((unsigned long)buf % 16)
--		printk("save_i387: bad fpstate %p\n", buf);
--
--	if (!used_math())
--		return 0;
--	clear_used_math(); /* trigger finit */
--	if (task_thread_info(tsk)->status & TS_USEDFPU) {
--		err = save_i387_checking((struct i387_fxsave_struct __user *)
--					 buf);
--		if (err)
--			return err;
--		task_thread_info(tsk)->status &= ~TS_USEDFPU;
--		stts();
--	} else {
--		if (__copy_to_user(buf, &tsk->thread.xstate->fxsave,
--				   sizeof(struct i387_fxsave_struct)))
--			return -1;
--	}
--	return 1;
--}
--
--/*
-- * This restores directly out of user space. Exceptions are handled.
-- */
--static inline int restore_i387(struct _fpstate __user *buf)
--{
--	struct task_struct *tsk = current;
--	int err;
--
--	if (!used_math()) {
--		err = init_fpu(tsk);
--		if (err)
--			return err;
--	}
--
--	if (!(task_thread_info(current)->status & TS_USEDFPU)) {
--		clts();
--		task_thread_info(current)->status |= TS_USEDFPU;
--	}
--	return restore_fpu_checking((__force struct i387_fxsave_struct *)buf);
--}
--
- #else  /* CONFIG_X86_32 */
- 
- extern void finit(void);
-diff --git a/include/asm-x86/mpspec.h b/include/asm-x86/mpspec.h
-index 57a991b..4c75587 100644
---- a/include/asm-x86/mpspec.h
-+++ b/include/asm-x86/mpspec.h
-@@ -35,6 +35,7 @@ extern DECLARE_BITMAP(mp_bus_not_pci, MAX_MP_BUSSES);
- extern int mp_bus_id_to_pci_bus[MAX_MP_BUSSES];
- 
- extern unsigned int boot_cpu_physical_apicid;
-+extern unsigned int max_physical_apicid;
- extern int smp_found_config;
- extern int mpc_default_type;
- extern unsigned long mp_lapic_addr;
-diff --git a/include/asm-x86/pgtable_64.h b/include/asm-x86/pgtable_64.h
-index 1cc50d2..3922eca 100644
---- a/include/asm-x86/pgtable_64.h
-+++ b/include/asm-x86/pgtable_64.h
-@@ -146,7 +146,7 @@ static inline void native_pgd_clear(pgd_t *pgd)
- #define VMALLOC_END      _AC(0xffffe1ffffffffff, UL)
- #define VMEMMAP_START	 _AC(0xffffe20000000000, UL)
- #define MODULES_VADDR    _AC(0xffffffffa0000000, UL)
--#define MODULES_END      _AC(0xfffffffffff00000, UL)
-+#define MODULES_END      _AC(0xffffffffff000000, UL)
- #define MODULES_LEN   (MODULES_END - MODULES_VADDR)
- 
- #ifndef __ASSEMBLY__
-diff --git a/include/linux/clockchips.h b/include/linux/clockchips.h
-index c33b0dc..ed3a5d4 100644
---- a/include/linux/clockchips.h
-+++ b/include/linux/clockchips.h
-@@ -127,6 +127,8 @@ extern int clockevents_register_notifier(struct notifier_block *nb);
- extern int clockevents_program_event(struct clock_event_device *dev,
- 				     ktime_t expires, ktime_t now);
- 
-+extern void clockevents_handle_noop(struct clock_event_device *dev);
-+
- #ifdef CONFIG_GENERIC_CLOCKEVENTS
- extern void clockevents_notify(unsigned long reason, void *arg);
- #else
-diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
-index 443bc7c..428328a 100644
---- a/include/linux/mmzone.h
-+++ b/include/linux/mmzone.h
-@@ -751,8 +751,9 @@ static inline int zonelist_node_idx(struct zoneref *zoneref)
-  *
-  * This function returns the next zone at or below a given zone index that is
-  * within the allowed nodemask using a cursor as the starting point for the
-- * search. The zoneref returned is a cursor that is used as the next starting
-- * point for future calls to next_zones_zonelist().
-+ * search. The zoneref returned is a cursor that represents the current zone
-+ * being examined. It should be advanced by one before calling
-+ * next_zones_zonelist again.
-  */
- struct zoneref *next_zones_zonelist(struct zoneref *z,
- 					enum zone_type highest_zoneidx,
-@@ -768,9 +769,8 @@ struct zoneref *next_zones_zonelist(struct zoneref *z,
-  *
-  * This function returns the first zone at or below a given zone index that is
-  * within the allowed nodemask. The zoneref returned is a cursor that can be
-- * used to iterate the zonelist with next_zones_zonelist. The cursor should
-- * not be used by the caller as it does not match the value of the zone
-- * returned.
-+ * used to iterate the zonelist with next_zones_zonelist by advancing it by
-+ * one before calling.
-  */
- static inline struct zoneref *first_zones_zonelist(struct zonelist *zonelist,
- 					enum zone_type highest_zoneidx,
-@@ -795,7 +795,7 @@ static inline struct zoneref *first_zones_zonelist(struct zonelist *zonelist,
- #define for_each_zone_zonelist_nodemask(zone, z, zlist, highidx, nodemask) \
- 	for (z = first_zones_zonelist(zlist, highidx, nodemask, &zone);	\
- 		zone;							\
--		z = next_zones_zonelist(z, highidx, nodemask, &zone))	\
-+		z = next_zones_zonelist(++z, highidx, nodemask, &zone))	\
- 
- /**
-  * for_each_zone_zonelist - helper macro to iterate over valid zones in a zonelist at or below a given zone index
-diff --git a/include/linux/rmap.h b/include/linux/rmap.h
-index 1383692..0e889fa 100644
---- a/include/linux/rmap.h
-+++ b/include/linux/rmap.h
-@@ -94,7 +94,7 @@ int try_to_unmap(struct page *, int ignore_refs);
-  * Called from mm/filemap_xip.c to unmap empty zero page
-  */
- pte_t *page_check_address(struct page *, struct mm_struct *,
--				unsigned long, spinlock_t **);
-+				unsigned long, spinlock_t **, int);
- 
- /*
-  * Used by swapoff to help locate where page is expected in vma.
-diff --git a/include/linux/sched.h b/include/linux/sched.h
-index c5d3f84..2103c73 100644
---- a/include/linux/sched.h
-+++ b/include/linux/sched.h
-@@ -1477,6 +1477,10 @@ static inline void put_task_struct(struct task_struct *t)
- 		__put_task_struct(t);
- }
- 
-+extern cputime_t task_utime(struct task_struct *p);
-+extern cputime_t task_stime(struct task_struct *p);
-+extern cputime_t task_gtime(struct task_struct *p);
-+
- /*
-  * Per process flags
-  */
-diff --git a/include/linux/smb.h b/include/linux/smb.h
-index caa43b2..82fefdd 100644
---- a/include/linux/smb.h
-+++ b/include/linux/smb.h
-@@ -11,7 +11,9 @@
- 
- #include <linux/types.h>
- #include <linux/magic.h>
-+#ifdef __KERNEL__
- #include <linux/time.h>
-+#endif
- 
- enum smb_protocol { 
- 	SMB_PROTOCOL_NONE, 
-diff --git a/include/net/netlink.h b/include/net/netlink.h
-index dfc3701..6a5fdd8 100644
---- a/include/net/netlink.h
-+++ b/include/net/netlink.h
-@@ -702,7 +702,7 @@ static inline int nla_len(const struct nlattr *nla)
-  */
- static inline int nla_ok(const struct nlattr *nla, int remaining)
- {
--	return remaining >= sizeof(*nla) &&
-+	return remaining >= (int) sizeof(*nla) &&
- 	       nla->nla_len >= sizeof(*nla) &&
- 	       nla->nla_len <= remaining;
- }
-diff --git a/kernel/cgroup.c b/kernel/cgroup.c
-index 15ac0e1..d53caaa 100644
---- a/kernel/cgroup.c
-+++ b/kernel/cgroup.c
-@@ -2761,14 +2761,15 @@ void cgroup_fork_callbacks(struct task_struct *child)
-  */
- void cgroup_mm_owner_callbacks(struct task_struct *old, struct task_struct *new)
- {
--	struct cgroup *oldcgrp, *newcgrp;
-+	struct cgroup *oldcgrp, *newcgrp = NULL;
- 
- 	if (need_mm_owner_callback) {
- 		int i;
- 		for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
- 			struct cgroup_subsys *ss = subsys[i];
- 			oldcgrp = task_cgroup(old, ss->subsys_id);
--			newcgrp = task_cgroup(new, ss->subsys_id);
-+			if (new)
-+				newcgrp = task_cgroup(new, ss->subsys_id);
- 			if (oldcgrp == newcgrp)
- 				continue;
- 			if (ss->mm_owner_changed)
-diff --git a/kernel/exit.c b/kernel/exit.c
-index 8f6185e..f68b081 100644
---- a/kernel/exit.c
-+++ b/kernel/exit.c
-@@ -111,9 +111,9 @@ static void __exit_signal(struct task_struct *tsk)
- 		 * We won't ever get here for the group leader, since it
- 		 * will have been the last reference on the signal_struct.
- 		 */
--		sig->utime = cputime_add(sig->utime, tsk->utime);
--		sig->stime = cputime_add(sig->stime, tsk->stime);
--		sig->gtime = cputime_add(sig->gtime, tsk->gtime);
-+		sig->utime = cputime_add(sig->utime, task_utime(tsk));
-+		sig->stime = cputime_add(sig->stime, task_stime(tsk));
-+		sig->gtime = cputime_add(sig->gtime, task_gtime(tsk));
- 		sig->min_flt += tsk->min_flt;
- 		sig->maj_flt += tsk->maj_flt;
- 		sig->nvcsw += tsk->nvcsw;
-@@ -577,8 +577,6 @@ mm_need_new_owner(struct mm_struct *mm, struct task_struct *p)
- 	 * If there are other users of the mm and the owner (us) is exiting
- 	 * we need to find a new owner to take on the responsibility.
- 	 */
--	if (!mm)
--		return 0;
- 	if (atomic_read(&mm->mm_users) <= 1)
- 		return 0;
- 	if (mm->owner != p)
-@@ -621,6 +619,16 @@ retry:
- 	} while_each_thread(g, c);
- 
- 	read_unlock(&tasklist_lock);
-+	/*
-+	 * We found no owner yet mm_users > 1: this implies that we are
-+	 * most likely racing with swapoff (try_to_unuse()) or /proc or
-+	 * ptrace or page migration (get_task_mm()).  Mark owner as NULL,
-+	 * so that subsystems can understand the callback and take action.
-+	 */
-+	down_write(&mm->mmap_sem);
-+	cgroup_mm_owner_callbacks(mm->owner, NULL);
-+	mm->owner = NULL;
-+	up_write(&mm->mmap_sem);
- 	return;
- 
- assign_new_owner:
-diff --git a/kernel/sched.c b/kernel/sched.c
-index 4e2f603..0a50ee4 100644
---- a/kernel/sched.c
-+++ b/kernel/sched.c
-@@ -3995,6 +3995,65 @@ void account_steal_time(struct task_struct *p, cputime_t steal)
- }
- 
- /*
-+ * Use precise platform statistics if available:
-+ */
-+#ifdef CONFIG_VIRT_CPU_ACCOUNTING
-+cputime_t task_utime(struct task_struct *p)
-+{
-+	return p->utime;
-+}
-+
-+cputime_t task_stime(struct task_struct *p)
-+{
-+	return p->stime;
-+}
-+#else
-+cputime_t task_utime(struct task_struct *p)
-+{
-+	clock_t utime = cputime_to_clock_t(p->utime),
-+		total = utime + cputime_to_clock_t(p->stime);
-+	u64 temp;
-+
-+	/*
-+	 * Use CFS's precise accounting:
-+	 */
-+	temp = (u64)nsec_to_clock_t(p->se.sum_exec_runtime);
-+
-+	if (total) {
-+		temp *= utime;
-+		do_div(temp, total);
-+	}
-+	utime = (clock_t)temp;
-+
-+	p->prev_utime = max(p->prev_utime, clock_t_to_cputime(utime));
-+	return p->prev_utime;
-+}
-+
-+cputime_t task_stime(struct task_struct *p)
-+{
-+	clock_t stime;
-+
-+	/*
-+	 * Use CFS's precise accounting. (we subtract utime from
-+	 * the total, to make sure the total observed by userspace
-+	 * grows monotonically - apps rely on that):
-+	 */
-+	stime = nsec_to_clock_t(p->se.sum_exec_runtime) -
-+			cputime_to_clock_t(task_utime(p));
-+
-+	if (stime >= 0)
-+		p->prev_stime = max(p->prev_stime, clock_t_to_cputime(stime));
-+
-+	return p->prev_stime;
-+}
-+#endif
-+
-+inline cputime_t task_gtime(struct task_struct *p)
-+{
-+	return p->gtime;
-+}
-+
-+/*
-  * This function gets called by the timer code, with HZ frequency.
-  * We call it with interrupts disabled.
-  *
-diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c
-index 3d1e3e1..1876b52 100644
---- a/kernel/time/clockevents.c
-+++ b/kernel/time/clockevents.c
-@@ -177,7 +177,7 @@ void clockevents_register_device(struct clock_event_device *dev)
- /*
-  * Noop handler when we shut down an event device
-  */
--static void clockevents_handle_noop(struct clock_event_device *dev)
-+void clockevents_handle_noop(struct clock_event_device *dev)
- {
- }
- 
-@@ -199,7 +199,6 @@ void clockevents_exchange_device(struct clock_event_device *old,
- 	 * released list and do a notify add later.
- 	 */
- 	if (old) {
--		old->event_handler = clockevents_handle_noop;
- 		clockevents_set_mode(old, CLOCK_EVT_MODE_UNUSED);
- 		list_del(&old->list);
- 		list_add(&old->list, &clockevents_released);
-diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
-index 5125ddd..1ad46f3 100644
---- a/kernel/time/ntp.c
-+++ b/kernel/time/ntp.c
-@@ -245,7 +245,7 @@ static void sync_cmos_clock(unsigned long dummy)
- 	if (abs(now.tv_nsec - (NSEC_PER_SEC / 2)) <= tick_nsec / 2)
- 		fail = update_persistent_clock(now);
- 
--	next.tv_nsec = (NSEC_PER_SEC / 2) - now.tv_nsec;
-+	next.tv_nsec = (NSEC_PER_SEC / 2) - now.tv_nsec - (TICK_NSEC / 2);
- 	if (next.tv_nsec <= 0)
- 		next.tv_nsec += NSEC_PER_SEC;
- 
-diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
-index 57a1f02..e20a365 100644
---- a/kernel/time/tick-broadcast.c
-+++ b/kernel/time/tick-broadcast.c
-@@ -174,6 +174,8 @@ static void tick_do_periodic_broadcast(void)
-  */
- static void tick_handle_periodic_broadcast(struct clock_event_device *dev)
- {
-+	ktime_t next;
-+
- 	tick_do_periodic_broadcast();
- 
- 	/*
-@@ -184,10 +186,13 @@ static void tick_handle_periodic_broadcast(struct clock_event_device *dev)
- 
- 	/*
- 	 * Setup the next period for devices, which do not have
--	 * periodic mode:
-+	 * periodic mode. We read dev->next_event first and add to it
-+	 * when the event alrady expired. clockevents_program_event()
-+	 * sets dev->next_event only when the event is really
-+	 * programmed to the device.
- 	 */
--	for (;;) {
--		ktime_t next = ktime_add(dev->next_event, tick_period);
-+	for (next = dev->next_event; ;) {
-+		next = ktime_add(next, tick_period);
- 
- 		if (!clockevents_program_event(dev, next, ktime_get()))
- 			return;
-@@ -204,7 +209,7 @@ static void tick_do_broadcast_on_off(void *why)
- 	struct clock_event_device *bc, *dev;
- 	struct tick_device *td;
- 	unsigned long flags, *reason = why;
--	int cpu;
-+	int cpu, bc_stopped;
- 
- 	spin_lock_irqsave(&tick_broadcast_lock, flags);
- 
-@@ -222,6 +227,8 @@ static void tick_do_broadcast_on_off(void *why)
- 	if (!tick_device_is_functional(dev))
- 		goto out;
- 
-+	bc_stopped = cpus_empty(tick_broadcast_mask);
-+
- 	switch (*reason) {
- 	case CLOCK_EVT_NOTIFY_BROADCAST_ON:
- 	case CLOCK_EVT_NOTIFY_BROADCAST_FORCE:
-@@ -243,9 +250,10 @@ static void tick_do_broadcast_on_off(void *why)
- 		break;
- 	}
- 
--	if (cpus_empty(tick_broadcast_mask))
--		clockevents_set_mode(bc, CLOCK_EVT_MODE_SHUTDOWN);
--	else {
-+	if (cpus_empty(tick_broadcast_mask)) {
-+		if (!bc_stopped)
-+			clockevents_set_mode(bc, CLOCK_EVT_MODE_SHUTDOWN);
-+	} else if (bc_stopped) {
- 		if (tick_broadcast_device.mode == TICKDEV_MODE_PERIODIC)
- 			tick_broadcast_start_periodic(bc);
- 		else
-@@ -362,16 +370,8 @@ cpumask_t *tick_get_broadcast_oneshot_mask(void)
- static int tick_broadcast_set_event(ktime_t expires, int force)
- {
- 	struct clock_event_device *bc = tick_broadcast_device.evtdev;
--	ktime_t now = ktime_get();
--	int res;
--
--	for(;;) {
--		res = clockevents_program_event(bc, expires, now);
--		if (!res || !force)
--			return res;
--		now = ktime_get();
--		expires = ktime_add(now, ktime_set(0, bc->min_delta_ns));
--	}
-+
-+	return tick_dev_program_event(bc, expires, force);
- }
- 
- int tick_resume_broadcast_oneshot(struct clock_event_device *bc)
-@@ -490,14 +490,52 @@ static void tick_broadcast_clear_oneshot(int cpu)
- 	cpu_clear(cpu, tick_broadcast_oneshot_mask);
- }
- 
-+static void tick_broadcast_init_next_event(cpumask_t *mask, ktime_t expires)
-+{
-+	struct tick_device *td;
-+	int cpu;
-+
-+	for_each_cpu_mask_nr(cpu, *mask) {
-+		td = &per_cpu(tick_cpu_device, cpu);
-+		if (td->evtdev)
-+			td->evtdev->next_event = expires;
-+	}
-+}
-+
- /**
-  * tick_broadcast_setup_oneshot - setup the broadcast device
-  */
- void tick_broadcast_setup_oneshot(struct clock_event_device *bc)
- {
--	bc->event_handler = tick_handle_oneshot_broadcast;
--	clockevents_set_mode(bc, CLOCK_EVT_MODE_ONESHOT);
--	bc->next_event.tv64 = KTIME_MAX;
-+	/* Set it up only once ! */
-+	if (bc->event_handler != tick_handle_oneshot_broadcast) {
-+		int was_periodic = bc->mode == CLOCK_EVT_MODE_PERIODIC;
-+		int cpu = smp_processor_id();
-+		cpumask_t mask;
-+
-+		bc->event_handler = tick_handle_oneshot_broadcast;
-+		clockevents_set_mode(bc, CLOCK_EVT_MODE_ONESHOT);
-+
-+		/* Take the do_timer update */
-+		tick_do_timer_cpu = cpu;
-+
-+		/*
-+		 * We must be careful here. There might be other CPUs
-+		 * waiting for periodic broadcast. We need to set the
-+		 * oneshot_mask bits for those and program the
-+		 * broadcast device to fire.
-+		 */
-+		mask = tick_broadcast_mask;
-+		cpu_clear(cpu, mask);
-+		cpus_or(tick_broadcast_oneshot_mask,
-+			tick_broadcast_oneshot_mask, mask);
-+
-+		if (was_periodic && !cpus_empty(mask)) {
-+			tick_broadcast_init_next_event(&mask, tick_next_period);
-+			tick_broadcast_set_event(tick_next_period, 1);
-+		} else
-+			bc->next_event.tv64 = KTIME_MAX;
-+	}
- }
- 
- /*
-diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
-index 4f38865..5471cba 100644
---- a/kernel/time/tick-common.c
-+++ b/kernel/time/tick-common.c
-@@ -161,6 +161,7 @@ static void tick_setup_device(struct tick_device *td,
- 	} else {
- 		handler = td->evtdev->event_handler;
- 		next_event = td->evtdev->next_event;
-+		td->evtdev->event_handler = clockevents_handle_noop;
- 	}
- 
- 	td->evtdev = newdev;
-diff --git a/kernel/time/tick-internal.h b/kernel/time/tick-internal.h
-index f13f2b7..0ffc291 100644
---- a/kernel/time/tick-internal.h
-+++ b/kernel/time/tick-internal.h
-@@ -17,6 +17,8 @@ extern void tick_handle_periodic(struct clock_event_device *dev);
- extern void tick_setup_oneshot(struct clock_event_device *newdev,
- 			       void (*handler)(struct clock_event_device *),
- 			       ktime_t nextevt);
-+extern int tick_dev_program_event(struct clock_event_device *dev,
-+				  ktime_t expires, int force);
- extern int tick_program_event(ktime_t expires, int force);
- extern void tick_oneshot_notify(void);
- extern int tick_switch_to_oneshot(void (*handler)(struct clock_event_device *));
-diff --git a/kernel/time/tick-oneshot.c b/kernel/time/tick-oneshot.c
-index 450c049..2e8de67 100644
---- a/kernel/time/tick-oneshot.c
-+++ b/kernel/time/tick-oneshot.c
-@@ -23,24 +23,56 @@
- #include "tick-internal.h"
- 
- /**
-- * tick_program_event
-+ * tick_program_event internal worker function
-  */
--int tick_program_event(ktime_t expires, int force)
-+int tick_dev_program_event(struct clock_event_device *dev, ktime_t expires,
-+			   int force)
- {
--	struct clock_event_device *dev = __get_cpu_var(tick_cpu_device).evtdev;
- 	ktime_t now = ktime_get();
-+	int i;
- 
--	while (1) {
-+	for (i = 0;;) {
- 		int ret = clockevents_program_event(dev, expires, now);
- 
- 		if (!ret || !force)
- 			return ret;
-+
-+		/*
-+		 * We tried 2 times to program the device with the given
-+		 * min_delta_ns. If that's not working then we double it
-+		 * and emit a warning.
-+		 */
-+		if (++i > 2) {
-+			/* Increase the min. delta and try again */
-+			if (!dev->min_delta_ns)
-+				dev->min_delta_ns = 5000;
-+			else
-+				dev->min_delta_ns += dev->min_delta_ns >> 1;
-+
-+			printk(KERN_WARNING
-+			       "CE: %s increasing min_delta_ns to %lu nsec\n",
-+			       dev->name ? dev->name : "?",
-+			       dev->min_delta_ns << 1);
-+
-+			i = 0;
-+		}
-+
- 		now = ktime_get();
--		expires = ktime_add(now, ktime_set(0, dev->min_delta_ns));
-+		expires = ktime_add_ns(now, dev->min_delta_ns);
- 	}
- }
- 
- /**
-+ * tick_program_event
-+ */
-+int tick_program_event(ktime_t expires, int force)
-+{
-+	struct clock_event_device *dev = __get_cpu_var(tick_cpu_device).evtdev;
-+
-+	return tick_dev_program_event(dev, expires, force);
-+}
-+
-+/**
-  * tick_resume_onshot - resume oneshot mode
-  */
- void tick_resume_oneshot(void)
-@@ -61,7 +93,7 @@ void tick_setup_oneshot(struct clock_event_device *newdev,
- {
- 	newdev->event_handler = handler;
- 	clockevents_set_mode(newdev, CLOCK_EVT_MODE_ONESHOT);
--	clockevents_program_event(newdev, next_event, ktime_get());
-+	tick_dev_program_event(newdev, next_event, 1);
- }
- 
- /**
-diff --git a/lib/scatterlist.c b/lib/scatterlist.c
-index b80c211..8c11004 100644
---- a/lib/scatterlist.c
-+++ b/lib/scatterlist.c
-@@ -312,8 +312,9 @@ static size_t sg_copy_buffer(struct scatterlist *sgl, unsigned int nents,
- 	struct scatterlist *sg;
- 	size_t buf_off = 0;
- 	int i;
-+	unsigned long flags;
- 
--	WARN_ON(!irqs_disabled());
-+	local_irq_save(flags);
- 
- 	for_each_sg(sgl, sg, nents, i) {
- 		struct page *page;
-@@ -358,6 +359,8 @@ static size_t sg_copy_buffer(struct scatterlist *sgl, unsigned int nents,
- 			break;
- 	}
- 
-+	local_irq_restore(flags);
-+
- 	return buf_off;
- }
- 
-diff --git a/mm/filemap_xip.c b/mm/filemap_xip.c
-index 3e744ab..4e8bd50 100644
---- a/mm/filemap_xip.c
-+++ b/mm/filemap_xip.c
-@@ -184,7 +184,7 @@ __xip_unmap (struct address_space * mapping,
- 		address = vma->vm_start +
- 			((pgoff - vma->vm_pgoff) << PAGE_SHIFT);
- 		BUG_ON(address < vma->vm_start || address >= vma->vm_end);
--		pte = page_check_address(page, mm, address, &ptl);
-+		pte = page_check_address(page, mm, address, &ptl, 1);
- 		if (pte) {
- 			/* Nuke the page table entry. */
- 			flush_cache_page(vma, address, pte_pfn(*pte));
-diff --git a/mm/memcontrol.c b/mm/memcontrol.c
-index e46451e..ed1cfb1 100644
---- a/mm/memcontrol.c
-+++ b/mm/memcontrol.c
-@@ -250,6 +250,14 @@ static struct mem_cgroup *mem_cgroup_from_cont(struct cgroup *cont)
- 
- struct mem_cgroup *mem_cgroup_from_task(struct task_struct *p)
- {
-+	/*
-+	 * mm_update_next_owner() may clear mm->owner to NULL
-+	 * if it races with swapoff, page migration, etc.
-+	 * So this can be called with p == NULL.
-+	 */
-+	if (unlikely(!p))
-+		return NULL;
-+
- 	return container_of(task_subsys_state(p, mem_cgroup_subsys_id),
- 				struct mem_cgroup, css);
- }
-@@ -574,6 +582,11 @@ retry:
- 
- 	rcu_read_lock();
- 	mem = mem_cgroup_from_task(rcu_dereference(mm->owner));
-+	if (unlikely(!mem)) {
-+		rcu_read_unlock();
-+		kmem_cache_free(page_cgroup_cache, pc);
-+		return 0;
-+	}
- 	/*
- 	 * For every charge from the cgroup, increment reference count
- 	 */
-diff --git a/mm/mmzone.c b/mm/mmzone.c
-index 486ed59..16ce8b9 100644
---- a/mm/mmzone.c
-+++ b/mm/mmzone.c
-@@ -69,6 +69,6 @@ struct zoneref *next_zones_zonelist(struct zoneref *z,
- 				(z->zone && !zref_in_nodemask(z, nodes)))
- 			z++;
- 
--	*zone = zonelist_zone(z++);
-+	*zone = zonelist_zone(z);
- 	return z;
- }
-diff --git a/mm/rmap.c b/mm/rmap.c
-index bf0a5b7..ded8f9e 100644
---- a/mm/rmap.c
-+++ b/mm/rmap.c
-@@ -223,10 +223,14 @@ unsigned long page_address_in_vma(struct page *page, struct vm_area_struct *vma)
- /*
-  * Check that @page is mapped at @address into @mm.
-  *
-+ * If @sync is false, page_check_address may perform a racy check to avoid
-+ * the page table lock when the pte is not present (helpful when reclaiming
-+ * highly shared pages).
-+ *
-  * On success returns with pte mapped and locked.
-  */
- pte_t *page_check_address(struct page *page, struct mm_struct *mm,
--			  unsigned long address, spinlock_t **ptlp)
-+			  unsigned long address, spinlock_t **ptlp, int sync)
- {
- 	pgd_t *pgd;
- 	pud_t *pud;
-@@ -248,7 +252,7 @@ pte_t *page_check_address(struct page *page, struct mm_struct *mm,
- 
- 	pte = pte_offset_map(pmd, address);
- 	/* Make a quick check before getting the lock */
--	if (!pte_present(*pte)) {
-+	if (!sync && !pte_present(*pte)) {
- 		pte_unmap(pte);
- 		return NULL;
- 	}
-@@ -280,7 +284,7 @@ static int page_referenced_one(struct page *page,
- 	if (address == -EFAULT)
- 		goto out;
- 
--	pte = page_check_address(page, mm, address, &ptl);
-+	pte = page_check_address(page, mm, address, &ptl, 0);
- 	if (!pte)
- 		goto out;
- 
-@@ -449,7 +453,7 @@ static int page_mkclean_one(struct page *page, struct vm_area_struct *vma)
- 	if (address == -EFAULT)
- 		goto out;
- 
--	pte = page_check_address(page, mm, address, &ptl);
-+	pte = page_check_address(page, mm, address, &ptl, 1);
- 	if (!pte)
- 		goto out;
- 
-@@ -707,7 +711,7 @@ static int try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
- 	if (address == -EFAULT)
- 		goto out;
- 
--	pte = page_check_address(page, mm, address, &ptl);
-+	pte = page_check_address(page, mm, address, &ptl, 0);
- 	if (!pte)
- 		goto out;
- 
-diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
-index b6e7ec0..9ca32e6 100644
---- a/net/ipv4/udp.c
-+++ b/net/ipv4/udp.c
-@@ -950,6 +950,27 @@ int udp_disconnect(struct sock *sk, int flags)
- 	return 0;
- }
- 
-+static int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
-+{
-+	int is_udplite = IS_UDPLITE(sk);
-+	int rc;
-+
-+	if ((rc = sock_queue_rcv_skb(sk, skb)) < 0) {
-+		/* Note that an ENOMEM error is charged twice */
-+		if (rc == -ENOMEM)
-+			UDP_INC_STATS_BH(UDP_MIB_RCVBUFERRORS,
-+					 is_udplite);
-+		goto drop;
-+	}
-+
-+	return 0;
-+
-+drop:
-+	UDP_INC_STATS_BH(UDP_MIB_INERRORS, is_udplite);
-+	kfree_skb(skb);
-+	return -1;
-+}
-+
- /* returns:
-  *  -1: error
-  *   0: success
-@@ -988,9 +1009,7 @@ int udp_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
- 		    up->encap_rcv != NULL) {
- 			int ret;
- 
--			bh_unlock_sock(sk);
- 			ret = (*up->encap_rcv)(sk, skb);
--			bh_lock_sock(sk);
- 			if (ret <= 0) {
- 				UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS,
- 						 is_udplite);
-@@ -1042,14 +1061,16 @@ int udp_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
- 			goto drop;
- 	}
- 
--	if ((rc = sock_queue_rcv_skb(sk,skb)) < 0) {
--		/* Note that an ENOMEM error is charged twice */
--		if (rc == -ENOMEM)
--			UDP_INC_STATS_BH(UDP_MIB_RCVBUFERRORS, is_udplite);
--		goto drop;
--	}
-+	rc = 0;
- 
--	return 0;
-+	bh_lock_sock(sk);
-+	if (!sock_owned_by_user(sk))
-+		rc = __udp_queue_rcv_skb(sk, skb);
-+	else
-+		sk_add_backlog(sk, skb);
-+	bh_unlock_sock(sk);
-+
-+	return rc;
- 
- drop:
- 	UDP_INC_STATS_BH(UDP_MIB_INERRORS, is_udplite);
-@@ -1087,15 +1108,7 @@ static int __udp4_lib_mcast_deliver(struct sk_buff *skb,
- 				skb1 = skb_clone(skb, GFP_ATOMIC);
- 
- 			if (skb1) {
--				int ret = 0;
--
--				bh_lock_sock(sk);
--				if (!sock_owned_by_user(sk))
--					ret = udp_queue_rcv_skb(sk, skb1);
--				else
--					sk_add_backlog(sk, skb1);
--				bh_unlock_sock(sk);
--
-+				int ret = udp_queue_rcv_skb(sk, skb1);
- 				if (ret > 0)
- 					/* we should probably re-process instead
- 					 * of dropping packets here. */
-@@ -1188,13 +1201,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],
- 			uh->dest, inet_iif(skb), udptable);
- 
- 	if (sk != NULL) {
--		int ret = 0;
--		bh_lock_sock(sk);
--		if (!sock_owned_by_user(sk))
--			ret = udp_queue_rcv_skb(sk, skb);
--		else
--			sk_add_backlog(sk, skb);
--		bh_unlock_sock(sk);
-+		int ret = udp_queue_rcv_skb(sk, skb);
- 		sock_put(sk);
- 
- 		/* a return value > 0 means to resubmit the input, but
-@@ -1487,7 +1494,7 @@ struct proto udp_prot = {
- 	.sendmsg	   = udp_sendmsg,
- 	.recvmsg	   = udp_recvmsg,
- 	.sendpage	   = udp_sendpage,
--	.backlog_rcv	   = udp_queue_rcv_skb,
-+	.backlog_rcv	   = __udp_queue_rcv_skb,
- 	.hash		   = udp_lib_hash,
- 	.unhash		   = udp_lib_unhash,
- 	.get_port	   = udp_v4_get_port,
-diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
-index d99f094..c3f6687 100644
---- a/net/ipv6/ip6_output.c
-+++ b/net/ipv6/ip6_output.c
-@@ -934,39 +934,39 @@ static int ip6_dst_lookup_tail(struct sock *sk,
- 	}
- 
- #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
--		/*
--		 * Here if the dst entry we've looked up
--		 * has a neighbour entry that is in the INCOMPLETE
--		 * state and the src address from the flow is
--		 * marked as OPTIMISTIC, we release the found
--		 * dst entry and replace it instead with the
--		 * dst entry of the nexthop router
--		 */
--		if (!((*dst)->neighbour->nud_state & NUD_VALID)) {
--			struct inet6_ifaddr *ifp;
--			struct flowi fl_gw;
--			int redirect;
--
--			ifp = ipv6_get_ifaddr(net, &fl->fl6_src,
--					      (*dst)->dev, 1);
--
--			redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC);
--			if (ifp)
--				in6_ifa_put(ifp);
--
--			if (redirect) {
--				/*
--				 * We need to get the dst entry for the
--				 * default router instead
--				 */
--				dst_release(*dst);
--				memcpy(&fl_gw, fl, sizeof(struct flowi));
--				memset(&fl_gw.fl6_dst, 0, sizeof(struct in6_addr));
--				*dst = ip6_route_output(net, sk, &fl_gw);
--				if ((err = (*dst)->error))
--					goto out_err_release;
--			}
-+	/*
-+	 * Here if the dst entry we've looked up
-+	 * has a neighbour entry that is in the INCOMPLETE
-+	 * state and the src address from the flow is
-+	 * marked as OPTIMISTIC, we release the found
-+	 * dst entry and replace it instead with the
-+	 * dst entry of the nexthop router
-+	 */
-+	if ((*dst)->neighbour && !((*dst)->neighbour->nud_state & NUD_VALID)) {
-+		struct inet6_ifaddr *ifp;
-+		struct flowi fl_gw;
-+		int redirect;
-+
-+		ifp = ipv6_get_ifaddr(net, &fl->fl6_src,
-+				      (*dst)->dev, 1);
-+
-+		redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC);
-+		if (ifp)
-+			in6_ifa_put(ifp);
-+
-+		if (redirect) {
-+			/*
-+			 * We need to get the dst entry for the
-+			 * default router instead
-+			 */
-+			dst_release(*dst);
-+			memcpy(&fl_gw, fl, sizeof(struct flowi));
-+			memset(&fl_gw.fl6_dst, 0, sizeof(struct in6_addr));
-+			*dst = ip6_route_output(net, sk, &fl_gw);
-+			if ((err = (*dst)->error))
-+				goto out_err_release;
- 		}
-+	}
- #endif
- 
- 	return 0;
-diff --git a/net/ipv6/route.c b/net/ipv6/route.c
-index 9deee59..990fef2 100644
---- a/net/ipv6/route.c
-+++ b/net/ipv6/route.c
-@@ -2718,6 +2718,8 @@ int __init ip6_route_init(void)
- 	if (ret)
- 		goto out_kmem_cache;
- 
-+	ip6_dst_blackhole_ops.kmem_cachep = ip6_dst_ops_template.kmem_cachep;
-+
- 	/* Registering of the loopback is done before this portion of code,
- 	 * the loopback reference in rt6_info will not be taken, do it
- 	 * manually for init_net */
-diff --git a/net/key/af_key.c b/net/key/af_key.c
-index 7470e36..49805ec 100644
---- a/net/key/af_key.c
-+++ b/net/key/af_key.c
-@@ -73,22 +73,18 @@ static int pfkey_can_dump(struct sock *sk)
- 	return 0;
- }
- 
--static int pfkey_do_dump(struct pfkey_sock *pfk)
-+static void pfkey_terminate_dump(struct pfkey_sock *pfk)
- {
--	int rc;
--
--	rc = pfk->dump.dump(pfk);
--	if (rc == -ENOBUFS)
--		return 0;
--
--	pfk->dump.done(pfk);
--	pfk->dump.dump = NULL;
--	pfk->dump.done = NULL;
--	return rc;
-+	if (pfk->dump.dump) {
-+		pfk->dump.done(pfk);
-+		pfk->dump.dump = NULL;
-+		pfk->dump.done = NULL;
-+	}
- }
- 
- static void pfkey_sock_destruct(struct sock *sk)
- {
-+	pfkey_terminate_dump(pfkey_sk(sk));
- 	skb_queue_purge(&sk->sk_receive_queue);
- 
- 	if (!sock_flag(sk, SOCK_DEAD)) {
-@@ -310,6 +306,18 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
- 	return err;
- }
- 
-+static int pfkey_do_dump(struct pfkey_sock *pfk)
-+{
-+	int rc;
-+
-+	rc = pfk->dump.dump(pfk);
-+	if (rc == -ENOBUFS)
-+		return 0;
-+
-+	pfkey_terminate_dump(pfk);
-+	return rc;
-+}
-+
- static inline void pfkey_hdr_dup(struct sadb_msg *new, struct sadb_msg *orig)
- {
- 	*new = *orig;
-diff --git a/net/sctp/associola.c b/net/sctp/associola.c
-index 024c3eb..31ca4f4 100644
---- a/net/sctp/associola.c
-+++ b/net/sctp/associola.c
-@@ -597,11 +597,12 @@ struct sctp_transport *sctp_assoc_add_peer(struct sctp_association *asoc,
- 	/* Check to see if this is a duplicate. */
- 	peer = sctp_assoc_lookup_paddr(asoc, addr);
- 	if (peer) {
-+		/* An UNKNOWN state is only set on transports added by
-+		 * user in sctp_connectx() call.  Such transports should be
-+		 * considered CONFIRMED per RFC 4960, Section 5.4.
-+		 */
- 		if (peer->state == SCTP_UNKNOWN) {
--			if (peer_state == SCTP_ACTIVE)
--				peer->state = SCTP_ACTIVE;
--			if (peer_state == SCTP_UNCONFIRMED)
--				peer->state = SCTP_UNCONFIRMED;
-+			peer->state = SCTP_ACTIVE;
- 		}
- 		return peer;
- 	}
-diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
-index bbc7107..650f759 100644
---- a/net/sctp/sm_make_chunk.c
-+++ b/net/sctp/sm_make_chunk.c
-@@ -1886,11 +1886,13 @@ static void sctp_process_ext_param(struct sctp_association *asoc,
- 			    /* if the peer reports AUTH, assume that he
- 			     * supports AUTH.
- 			     */
--			    asoc->peer.auth_capable = 1;
-+			    if (sctp_auth_enable)
-+				    asoc->peer.auth_capable = 1;
- 			    break;
- 		    case SCTP_CID_ASCONF:
- 		    case SCTP_CID_ASCONF_ACK:
--			    asoc->peer.asconf_capable = 1;
-+			    if (sctp_addip_enable)
-+				    asoc->peer.asconf_capable = 1;
- 			    break;
- 		    default:
- 			    break;
-@@ -2319,12 +2321,10 @@ clean_up:
- 	/* Release the transport structures. */
- 	list_for_each_safe(pos, temp, &asoc->peer.transport_addr_list) {
- 		transport = list_entry(pos, struct sctp_transport, transports);
--		list_del_init(pos);
--		sctp_transport_free(transport);
-+		if (transport->state != SCTP_ACTIVE)
-+			sctp_assoc_rm_peer(asoc, transport);
- 	}
- 
--	asoc->peer.transport_count = 0;
--
- nomem:
- 	return 0;
- }
-@@ -2455,6 +2455,9 @@ static int sctp_process_param(struct sctp_association *asoc,
- 		break;
- 
- 	case SCTP_PARAM_SET_PRIMARY:
-+		if (!sctp_addip_enable)
-+			goto fall_through;
-+
- 		addr_param = param.v + sizeof(sctp_addip_param_t);
- 
- 		af = sctp_get_af_specific(param_type2af(param.p->type));
-diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
-index 3f964db..5360c86 100644
---- a/net/xfrm/xfrm_output.c
-+++ b/net/xfrm/xfrm_output.c
-@@ -27,10 +27,14 @@ static int xfrm_state_check_space(struct xfrm_state *x, struct sk_buff *skb)
- 		- skb_headroom(skb);
- 	int ntail = dst->dev->needed_tailroom - skb_tailroom(skb);
- 
--	if (nhead > 0 || ntail > 0)
--		return pskb_expand_head(skb, nhead, ntail, GFP_ATOMIC);
--
--	return 0;
-+	if (nhead <= 0) {
-+		if (ntail <= 0)
-+			return 0;
-+		nhead = 0;
-+	} else if (ntail < 0)
-+		ntail = 0;
-+
-+	return pskb_expand_head(skb, nhead, ntail, GFP_ATOMIC);
- }
- 
- static int xfrm_output_one(struct sk_buff *skb, int err)
-diff --git a/sound/core/pcm.c b/sound/core/pcm.c
-index 9dd9bc7..ece25c7 100644
---- a/sound/core/pcm.c
-+++ b/sound/core/pcm.c
-@@ -781,7 +781,7 @@ int snd_pcm_attach_substream(struct snd_pcm *pcm, int stream,
- 		return -ENODEV;
- 
- 	card = pcm->card;
--	down_read(&card->controls_rwsem);
-+	read_lock(&card->ctl_files_rwlock);
- 	list_for_each_entry(kctl, &card->ctl_files, list) {
- 		if (kctl->pid == current->pid) {
- 			prefer_subdevice = kctl->prefer_pcm_subdevice;
-@@ -789,7 +789,7 @@ int snd_pcm_attach_substream(struct snd_pcm *pcm, int stream,
- 				break;
- 		}
- 	}
--	up_read(&card->controls_rwsem);
-+	read_unlock(&card->ctl_files_rwlock);
- 
- 	switch (stream) {
- 	case SNDRV_PCM_STREAM_PLAYBACK:
-diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
-index 61f5d42..225112b 100644
---- a/sound/core/pcm_native.c
-+++ b/sound/core/pcm_native.c
-@@ -1545,16 +1545,10 @@ static int snd_pcm_drop(struct snd_pcm_substream *substream)
- 	card = substream->pcm->card;
- 
- 	if (runtime->status->state == SNDRV_PCM_STATE_OPEN ||
--	    runtime->status->state == SNDRV_PCM_STATE_DISCONNECTED)
-+	    runtime->status->state == SNDRV_PCM_STATE_DISCONNECTED ||
-+	    runtime->status->state == SNDRV_PCM_STATE_SUSPENDED)
- 		return -EBADFD;
- 
--	snd_power_lock(card);
--	if (runtime->status->state == SNDRV_PCM_STATE_SUSPENDED) {
--		result = snd_power_wait(card, SNDRV_CTL_POWER_D0);
--		if (result < 0)
--			goto _unlock;
--	}
--
- 	snd_pcm_stream_lock_irq(substream);
- 	/* resume pause */
- 	if (runtime->status->state == SNDRV_PCM_STATE_PAUSED)
-@@ -1563,8 +1557,7 @@ static int snd_pcm_drop(struct snd_pcm_substream *substream)
- 	snd_pcm_stop(substream, SNDRV_PCM_STATE_SETUP);
- 	/* runtime->control->appl_ptr = runtime->status->hw_ptr; */
- 	snd_pcm_stream_unlock_irq(substream);
-- _unlock:
--	snd_power_unlock(card);
-+
- 	return result;
- }
- 
-diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
-index f7ea728..b917a9f 100644
---- a/sound/core/rawmidi.c
-+++ b/sound/core/rawmidi.c
-@@ -418,7 +418,7 @@ static int snd_rawmidi_open(struct inode *inode, struct file *file)
- 	mutex_lock(&rmidi->open_mutex);
- 	while (1) {
- 		subdevice = -1;
--		down_read(&card->controls_rwsem);
-+		read_lock(&card->ctl_files_rwlock);
- 		list_for_each_entry(kctl, &card->ctl_files, list) {
- 			if (kctl->pid == current->pid) {
- 				subdevice = kctl->prefer_rawmidi_subdevice;
-@@ -426,7 +426,7 @@ static int snd_rawmidi_open(struct inode *inode, struct file *file)
- 					break;
- 			}
- 		}
--		up_read(&card->controls_rwsem);
-+		read_unlock(&card->ctl_files_rwlock);
- 		err = snd_rawmidi_kernel_open(rmidi->card, rmidi->device,
- 					      subdevice, fflags, rawmidi_file);
- 		if (err >= 0)
-diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
-index a4f44a0..7207759 100644
---- a/sound/pci/hda/patch_sigmatel.c
-+++ b/sound/pci/hda/patch_sigmatel.c
-@@ -1667,8 +1667,8 @@ static struct snd_pci_quirk stac927x_cfg_tbl[] = {
- 	/* Dell 3 stack systems with verb table in BIOS */
- 	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x01f3, "Dell Inspiron 1420", STAC_DELL_BIOS),
- 	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x0227, "Dell Vostro 1400  ", STAC_DELL_BIOS),
--	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x022f, "Dell     ", STAC_DELL_BIOS),
- 	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x022e, "Dell     ", STAC_DELL_BIOS),
-+	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x022f, "Dell Inspiron 1525", STAC_DELL_3ST),
- 	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x0242, "Dell     ", STAC_DELL_BIOS),
- 	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x0243, "Dell     ", STAC_DELL_BIOS),
- 	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x02ff, "Dell     ", STAC_DELL_BIOS),
-diff --git a/sound/pci/oxygen/hifier.c b/sound/pci/oxygen/hifier.c
-index 090dd43..841e45d 100644
---- a/sound/pci/oxygen/hifier.c
-+++ b/sound/pci/oxygen/hifier.c
-@@ -17,6 +17,7 @@
-  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
-  */
- 
-+#include <linux/delay.h>
- #include <linux/pci.h>
- #include <sound/control.h>
- #include <sound/core.h>
-@@ -95,6 +96,9 @@ static void set_ak4396_params(struct oxygen *chip,
- 	else
- 		value |= AK4396_DFS_QUAD;
- 	data->ak4396_ctl2 = value;
-+
-+	msleep(1); /* wait for the new MCLK to become stable */
-+
- 	ak4396_write(chip, AK4396_CONTROL_1, AK4396_DIF_24_MSB);
- 	ak4396_write(chip, AK4396_CONTROL_2, value);
- 	ak4396_write(chip, AK4396_CONTROL_1, AK4396_DIF_24_MSB | AK4396_RSTN);
-diff --git a/sound/pci/oxygen/oxygen.c b/sound/pci/oxygen/oxygen.c
-index 63f185c..6a59041 100644
---- a/sound/pci/oxygen/oxygen.c
-+++ b/sound/pci/oxygen/oxygen.c
-@@ -28,6 +28,7 @@
-  * GPIO 1 -> DFS1 of AK5385
-  */
- 
-+#include <linux/delay.h>
- #include <linux/mutex.h>
- #include <linux/pci.h>
- #include <sound/ac97_codec.h>
-@@ -173,6 +174,9 @@ static void set_ak4396_params(struct oxygen *chip,
- 	else
- 		value |= AK4396_DFS_QUAD;
- 	data->ak4396_ctl2 = value;
-+
-+	msleep(1); /* wait for the new MCLK to become stable */
-+
- 	for (i = 0; i < 4; ++i) {
- 		ak4396_write(chip, i,
- 			     AK4396_CONTROL_1, AK4396_DIF_24_MSB);
-diff --git a/sound/ppc/awacs.c b/sound/ppc/awacs.c
-index 566a6d0..106c482 100644
---- a/sound/ppc/awacs.c
-+++ b/sound/ppc/awacs.c
-@@ -621,6 +621,13 @@ static struct snd_kcontrol_new snd_pmac_screamer_mixers_imac[] __initdata = {
- 	AWACS_SWITCH("CD Capture Switch", 0, SHIFT_MUX_CD, 0),
- };
- 
-+static struct snd_kcontrol_new snd_pmac_screamer_mixers_g4agp[] __initdata = {
-+	AWACS_VOLUME("Line out Playback Volume", 2, 6, 1),
-+	AWACS_VOLUME("Master Playback Volume", 5, 6, 1),
-+	AWACS_SWITCH("CD Capture Switch", 0, SHIFT_MUX_CD, 0),
-+	AWACS_SWITCH("Line Capture Switch", 0, SHIFT_MUX_MIC, 0),
-+};
-+
- static struct snd_kcontrol_new snd_pmac_awacs_mixers_pmac7500[] __initdata = {
- 	AWACS_VOLUME("Line out Playback Volume", 2, 6, 1),
- 	AWACS_SWITCH("CD Capture Switch", 0, SHIFT_MUX_CD, 0),
-@@ -688,7 +695,10 @@ static struct snd_kcontrol_new snd_pmac_awacs_speaker_vol[] __initdata = {
- static struct snd_kcontrol_new snd_pmac_awacs_speaker_sw __initdata =
- AWACS_SWITCH("PC Speaker Playback Switch", 1, SHIFT_SPKMUTE, 1);
- 
--static struct snd_kcontrol_new snd_pmac_awacs_speaker_sw_imac __initdata =
-+static struct snd_kcontrol_new snd_pmac_awacs_speaker_sw_imac1 __initdata =
-+AWACS_SWITCH("PC Speaker Playback Switch", 1, SHIFT_PAROUT1, 1);
-+
-+static struct snd_kcontrol_new snd_pmac_awacs_speaker_sw_imac2 __initdata =
- AWACS_SWITCH("PC Speaker Playback Switch", 1, SHIFT_PAROUT1, 0);
- 
- 
-@@ -765,11 +775,12 @@ static void snd_pmac_awacs_resume(struct snd_pmac *chip)
- 
- #define IS_PM7500 (machine_is_compatible("AAPL,7500"))
- #define IS_BEIGE (machine_is_compatible("AAPL,Gossamer"))
--#define IS_IMAC (machine_is_compatible("PowerMac2,1") \
--		|| machine_is_compatible("PowerMac2,2") \
-+#define IS_IMAC1 (machine_is_compatible("PowerMac2,1"))
-+#define IS_IMAC2 (machine_is_compatible("PowerMac2,2") \
- 		|| machine_is_compatible("PowerMac4,1"))
-+#define IS_G4AGP (machine_is_compatible("PowerMac3,1"))
- 
--static int imac;
-+static int imac1, imac2;
- 
- #ifdef PMAC_SUPPORT_AUTOMUTE
- /*
-@@ -815,13 +826,18 @@ static void snd_pmac_awacs_update_automute(struct snd_pmac *chip, int do_notify)
- 		{
- 			int reg = chip->awacs_reg[1]
- 				| (MASK_HDMUTE | MASK_SPKMUTE);
--			if (imac) {
-+			if (imac1) {
-+				reg &= ~MASK_SPKMUTE;
-+				reg |= MASK_PAROUT1;
-+			} else if (imac2) {
- 				reg &= ~MASK_SPKMUTE;
- 				reg &= ~MASK_PAROUT1;
- 			}
- 			if (snd_pmac_awacs_detect_headphone(chip))
- 				reg &= ~MASK_HDMUTE;
--			else if (imac)
-+			else if (imac1)
-+				reg &= ~MASK_PAROUT1;
-+			else if (imac2)
- 				reg |= MASK_PAROUT1;
- 			else
- 				reg &= ~MASK_SPKMUTE;
-@@ -850,9 +866,13 @@ snd_pmac_awacs_init(struct snd_pmac *chip)
- {
- 	int pm7500 = IS_PM7500;
- 	int beige = IS_BEIGE;
-+	int g4agp = IS_G4AGP;
-+	int imac;
- 	int err, vol;
- 
--	imac = IS_IMAC;
-+	imac1 = IS_IMAC1;
-+	imac2 = IS_IMAC2;
-+	imac = imac1 || imac2;
- 	/* looks like MASK_GAINLINE triggers something, so we set here
- 	 * as start-up
- 	 */
-@@ -939,7 +959,7 @@ snd_pmac_awacs_init(struct snd_pmac *chip)
- 				snd_pmac_awacs_mixers);
- 	if (err < 0)
- 		return err;
--	if (beige)
-+	if (beige || g4agp)
- 		;
- 	else if (chip->model == PMAC_SCREAMER)
- 		err = build_mixers(chip, ARRAY_SIZE(snd_pmac_screamer_mixers2),
-@@ -961,13 +981,17 @@ snd_pmac_awacs_init(struct snd_pmac *chip)
- 		err = build_mixers(chip,
- 				   ARRAY_SIZE(snd_pmac_screamer_mixers_imac),
- 				   snd_pmac_screamer_mixers_imac);
-+	else if (g4agp)
-+		err = build_mixers(chip,
-+				   ARRAY_SIZE(snd_pmac_screamer_mixers_g4agp),
-+				   snd_pmac_screamer_mixers_g4agp);
- 	else
- 		err = build_mixers(chip,
- 				   ARRAY_SIZE(snd_pmac_awacs_mixers_pmac),
- 				   snd_pmac_awacs_mixers_pmac);
- 	if (err < 0)
- 		return err;
--	chip->master_sw_ctl = snd_ctl_new1((pm7500 || imac)
-+	chip->master_sw_ctl = snd_ctl_new1((pm7500 || imac || g4agp)
- 			? &snd_pmac_awacs_master_sw_imac
- 			: &snd_pmac_awacs_master_sw, chip);
- 	err = snd_ctl_add(chip->card, chip->master_sw_ctl);
-@@ -1004,15 +1028,17 @@ snd_pmac_awacs_init(struct snd_pmac *chip)
- 					snd_pmac_awacs_speaker_vol);
- 		if (err < 0)
- 			return err;
--		chip->speaker_sw_ctl = snd_ctl_new1(imac
--				? &snd_pmac_awacs_speaker_sw_imac
-+		chip->speaker_sw_ctl = snd_ctl_new1(imac1
-+				? &snd_pmac_awacs_speaker_sw_imac1
-+				: imac2
-+				? &snd_pmac_awacs_speaker_sw_imac2
- 				: &snd_pmac_awacs_speaker_sw, chip);
- 		err = snd_ctl_add(chip->card, chip->speaker_sw_ctl);
- 		if (err < 0)
- 			return err;
- 	}
- 
--	if (beige)
-+	if (beige || g4agp)
- 		err = build_mixers(chip,
- 				ARRAY_SIZE(snd_pmac_screamer_mic_boost_beige),
- 				snd_pmac_screamer_mic_boost_beige);