[gentoo-commits] linux-patches r1797 - genpatches-2.6/trunk/2.6.35

[Mike Pagano (mpagano)]

Author: mpagano
Date: 2010-09-27 14:39:39 +0000 (Mon, 27 Sep 2010)
New Revision: 1797

Added:
   genpatches-2.6/trunk/2.6.35/1005_linux-2.6.35.6.patch
Removed:
   genpatches-2.6/trunk/2.6.35/2600_support-eject-dell-studio-1555.patch
Modified:
   genpatches-2.6/trunk/2.6.35/0000_README
Log:
Linux patch 2.6.35.6. Remove redundant patch

Modified: genpatches-2.6/trunk/2.6.35/0000_README
===================================================================
--- genpatches-2.6/trunk/2.6.35/0000_README	2010-09-27 14:28:40 UTC (rev 1796)
+++ genpatches-2.6/trunk/2.6.35/0000_README	2010-09-27 14:39:39 UTC (rev 1797)
@@ -63,10 +63,6 @@
 From:   http://bugs.gentoo.org/show_bug.cgi?id=318365
 Desc:   create /sys/fs/cgroup to mount cgroupfs to support systemd
 
-Patch:  2600_support-eject-dell-studio-1555.patch
-From:   http://bugs.gentoo.org/show_bug.cgi?id=333379
-Desc:   Add support for eject key on Dell Studio 1555
-
 Patch:	2900_xconfig-with-qt4.patch
 From:	http://bugs.gentoo.org/show_bug.cgi?id=320761
 Desc:	xconfig patch for qt4 - thanks to Sam Iam

Added: genpatches-2.6/trunk/2.6.35/1005_linux-2.6.35.6.patch
===================================================================
--- genpatches-2.6/trunk/2.6.35/1005_linux-2.6.35.6.patch	                        (rev 0)
+++ genpatches-2.6/trunk/2.6.35/1005_linux-2.6.35.6.patch	2010-09-27 14:39:39 UTC (rev 1797)
@@ -0,0 +1,4005 @@
+diff --git a/arch/alpha/kernel/err_marvel.c b/arch/alpha/kernel/err_marvel.c
+index 52a79df..5c905aa 100644
+--- a/arch/alpha/kernel/err_marvel.c
++++ b/arch/alpha/kernel/err_marvel.c
+@@ -109,7 +109,7 @@ marvel_print_err_cyc(u64 err_cyc)
+ #define IO7__ERR_CYC__CYCLE__M	(0x7)
+ 
+ 	printk("%s        Packet In Error: %s\n"
+-	       "%s        Error in %s, cycle %ld%s%s\n",
++	       "%s        Error in %s, cycle %lld%s%s\n",
+ 	       err_print_prefix, 
+ 	       packet_desc[EXTRACT(err_cyc, IO7__ERR_CYC__PACKET)],
+ 	       err_print_prefix,
+@@ -313,7 +313,7 @@ marvel_print_po7_ugbge_sym(u64 ugbge_sym)
+ 	}
+ 
+ 	printk("%s      Up Hose Garbage Symptom:\n"
+-	       "%s        Source Port: %ld - Dest PID: %ld - OpCode: %s\n", 
++	       "%s        Source Port: %lld - Dest PID: %lld - OpCode: %s\n",
+ 	       err_print_prefix,
+ 	       err_print_prefix, 
+ 	       EXTRACT(ugbge_sym, IO7__PO7_UGBGE_SYM__UPH_SRC_PORT),
+@@ -552,7 +552,7 @@ marvel_print_pox_spl_cmplt(u64 spl_cmplt)
+ #define IO7__POX_SPLCMPLT__REM_BYTE_COUNT__M	(0xfff)
+ 
+ 	printk("%s      Split Completion Error:\n"	
+-	       "%s         Source (Bus:Dev:Func): %ld:%ld:%ld\n",
++	       "%s         Source (Bus:Dev:Func): %lld:%lld:%lld\n",
+ 	       err_print_prefix,
+ 	       err_print_prefix,
+ 	       EXTRACT(spl_cmplt, IO7__POX_SPLCMPLT__SOURCE_BUS),
+diff --git a/arch/alpha/kernel/proto.h b/arch/alpha/kernel/proto.h
+index 3d2627e..d3e52d3 100644
+--- a/arch/alpha/kernel/proto.h
++++ b/arch/alpha/kernel/proto.h
+@@ -156,9 +156,6 @@ extern void SMC669_Init(int);
+ /* es1888.c */
+ extern void es1888_init(void);
+ 
+-/* ns87312.c */
+-extern void ns87312_enable_ide(long ide_base);
+-
+ /* ../lib/fpreg.c */
+ extern void alpha_write_fp_reg (unsigned long reg, unsigned long val);
+ extern unsigned long alpha_read_fp_reg (unsigned long reg);
+diff --git a/arch/alpha/kernel/sys_cabriolet.c b/arch/alpha/kernel/sys_cabriolet.c
+index affd0f3..14c8898 100644
+--- a/arch/alpha/kernel/sys_cabriolet.c
++++ b/arch/alpha/kernel/sys_cabriolet.c
+@@ -33,7 +33,7 @@
+ #include "irq_impl.h"
+ #include "pci_impl.h"
+ #include "machvec_impl.h"
+-
++#include "pc873xx.h"
+ 
+ /* Note mask bit is true for DISABLED irqs.  */
+ static unsigned long cached_irq_mask = ~0UL;
+@@ -236,17 +236,30 @@ cabriolet_map_irq(struct pci_dev *dev, u8 slot, u8 pin)
+ }
+ 
+ static inline void __init
++cabriolet_enable_ide(void)
++{
++	if (pc873xx_probe() == -1) {
++		printk(KERN_ERR "Probing for PC873xx Super IO chip failed.\n");
++	 } else {
++		printk(KERN_INFO "Found %s Super IO chip at 0x%x\n",
++			pc873xx_get_model(), pc873xx_get_base());
++
++		pc873xx_enable_ide();
++	}
++}
++
++static inline void __init
+ cabriolet_init_pci(void)
+ {
+ 	common_init_pci();
+-	ns87312_enable_ide(0x398);
++	cabriolet_enable_ide();
+ }
+ 
+ static inline void __init
+ cia_cab_init_pci(void)
+ {
+ 	cia_init_pci();
+-	ns87312_enable_ide(0x398);
++	cabriolet_enable_ide();
+ }
+ 
+ /*
+diff --git a/arch/alpha/kernel/sys_takara.c b/arch/alpha/kernel/sys_takara.c
+index 2304648..4da596b 100644
+--- a/arch/alpha/kernel/sys_takara.c
++++ b/arch/alpha/kernel/sys_takara.c
+@@ -29,7 +29,7 @@
+ #include "irq_impl.h"
+ #include "pci_impl.h"
+ #include "machvec_impl.h"
+-
++#include "pc873xx.h"
+ 
+ /* Note mask bit is true for DISABLED irqs.  */
+ static unsigned long cached_irq_mask[2] = { -1, -1 };
+@@ -264,7 +264,14 @@ takara_init_pci(void)
+ 		alpha_mv.pci_map_irq = takara_map_irq_srm;
+ 
+ 	cia_init_pci();
+-	ns87312_enable_ide(0x26e);
++
++	if (pc873xx_probe() == -1) {
++		printk(KERN_ERR "Probing for PC873xx Super IO chip failed.\n");
++	} else {
++		printk(KERN_INFO "Found %s Super IO chip at 0x%x\n",
++			pc873xx_get_model(), pc873xx_get_base());
++		pc873xx_enable_ide();
++	}
+ }
+ 
+ 
+diff --git a/arch/arm/mach-at91/at91sam9g45_devices.c b/arch/arm/mach-at91/at91sam9g45_devices.c
+index 809114d..501ac6f 100644
+--- a/arch/arm/mach-at91/at91sam9g45_devices.c
++++ b/arch/arm/mach-at91/at91sam9g45_devices.c
+@@ -46,7 +46,7 @@ static struct resource hdmac_resources[] = {
+ 		.end	= AT91_BASE_SYS + AT91_DMA + SZ_512 - 1,
+ 		.flags	= IORESOURCE_MEM,
+ 	},
+-	[2] = {
++	[1] = {
+ 		.start	= AT91SAM9G45_ID_DMA,
+ 		.end	= AT91SAM9G45_ID_DMA,
+ 		.flags	= IORESOURCE_IRQ,
+diff --git a/arch/ia64/kernel/fsys.S b/arch/ia64/kernel/fsys.S
+index 3567d54..331d42b 100644
+--- a/arch/ia64/kernel/fsys.S
++++ b/arch/ia64/kernel/fsys.S
+@@ -420,22 +420,31 @@ EX(.fail_efault, ld8 r14=[r33])			// r14 <- *set
+ 	;;
+ 
+ 	RSM_PSR_I(p0, r18, r19)			// mask interrupt delivery
+-	mov ar.ccv=0
+ 	andcm r14=r14,r17			// filter out SIGKILL & SIGSTOP
++	mov r8=EINVAL			// default to EINVAL
+ 
+ #ifdef CONFIG_SMP
+-	mov r17=1
++	// __ticket_spin_trylock(r31)
++	ld4 r17=[r31]
+ 	;;
+-	cmpxchg4.acq r18=[r31],r17,ar.ccv	// try to acquire the lock
+-	mov r8=EINVAL			// default to EINVAL
++	mov.m ar.ccv=r17
++	extr.u r9=r17,17,15
++	adds r19=1,r17
++	extr.u r18=r17,0,15
++	;;
++	cmp.eq p6,p7=r9,r18
+ 	;;
++(p6)	cmpxchg4.acq r9=[r31],r19,ar.ccv
++(p6)	dep.z r20=r19,1,15		// next serving ticket for unlock
++(p7)	br.cond.spnt.many .lock_contention
++	;;
++	cmp4.eq p0,p7=r9,r17
++	adds r31=2,r31
++(p7)	br.cond.spnt.many .lock_contention
+ 	ld8 r3=[r2]			// re-read current->blocked now that we hold the lock
+-	cmp4.ne p6,p0=r18,r0
+-(p6)	br.cond.spnt.many .lock_contention
+ 	;;
+ #else
+ 	ld8 r3=[r2]			// re-read current->blocked now that we hold the lock
+-	mov r8=EINVAL			// default to EINVAL
+ #endif
+ 	add r18=IA64_TASK_PENDING_OFFSET+IA64_SIGPENDING_SIGNAL_OFFSET,r16
+ 	add r19=IA64_TASK_SIGNAL_OFFSET,r16
+@@ -490,7 +499,9 @@ EX(.fail_efault, ld8 r14=[r33])			// r14 <- *set
+ (p6)	br.cond.spnt.few 1b			// yes -> retry
+ 
+ #ifdef CONFIG_SMP
+-	st4.rel [r31]=r0			// release the lock
++	// __ticket_spin_unlock(r31)
++	st2.rel [r31]=r20
++	mov r20=0					// i must not leak kernel bits...
+ #endif
+ 	SSM_PSR_I(p0, p9, r31)
+ 	;;
+@@ -512,7 +523,8 @@ EX(.fail_efault, (p15) st8 [r34]=r3)
+ 
+ .sig_pending:
+ #ifdef CONFIG_SMP
+-	st4.rel [r31]=r0			// release the lock
++	// __ticket_spin_unlock(r31)
++	st2.rel [r31]=r20			// release the lock
+ #endif
+ 	SSM_PSR_I(p0, p9, r17)
+ 	;;
+diff --git a/arch/sparc/include/asm/oplib_64.h b/arch/sparc/include/asm/oplib_64.h
+index a5db031..3e0b2d6 100644
+--- a/arch/sparc/include/asm/oplib_64.h
++++ b/arch/sparc/include/asm/oplib_64.h
+@@ -185,9 +185,8 @@ extern int prom_getunumber(int syndrome_code,
+ 			   char *buf, int buflen);
+ 
+ /* Retain physical memory to the caller across soft resets. */
+-extern unsigned long prom_retain(const char *name,
+-				 unsigned long pa_low, unsigned long pa_high,
+-				 long size, long align);
++extern int prom_retain(const char *name, unsigned long size,
++		       unsigned long align, unsigned long *paddr);
+ 
+ /* Load explicit I/D TLB entries into the calling processor. */
+ extern long prom_itlb_load(unsigned long index,
+@@ -287,26 +286,6 @@ extern void prom_sun4v_guest_soft_state(void);
+ extern int prom_ihandle2path(int handle, char *buffer, int bufsize);
+ 
+ /* Client interface level routines. */
+-extern long p1275_cmd(const char *, long, ...);
+-
+-#if 0
+-#define P1275_SIZE(x) ((((long)((x) / 32)) << 32) | (x))
+-#else
+-#define P1275_SIZE(x) x
+-#endif
+-
+-/* We support at most 16 input and 1 output argument */
+-#define P1275_ARG_NUMBER		0
+-#define P1275_ARG_IN_STRING		1
+-#define P1275_ARG_OUT_BUF		2
+-#define P1275_ARG_OUT_32B		3
+-#define P1275_ARG_IN_FUNCTION		4
+-#define P1275_ARG_IN_BUF		5
+-#define P1275_ARG_IN_64B		6
+-
+-#define P1275_IN(x) ((x) & 0xf)
+-#define P1275_OUT(x) (((x) << 4) & 0xf0)
+-#define P1275_INOUT(i,o) (P1275_IN(i)|P1275_OUT(o))
+-#define P1275_ARG(n,x) ((x) << ((n)*3 + 8))
++extern void p1275_cmd_direct(unsigned long *);
+ 
+ #endif /* !(__SPARC64_OPLIB_H) */
+diff --git a/arch/sparc/prom/cif.S b/arch/sparc/prom/cif.S
+index 5f27ad7..9c86b4b 100644
+--- a/arch/sparc/prom/cif.S
++++ b/arch/sparc/prom/cif.S
+@@ -9,18 +9,18 @@
+ #include <asm/thread_info.h>
+ 
+ 	.text
+-	.globl	prom_cif_interface
+-prom_cif_interface:
+-	sethi	%hi(p1275buf), %o0
+-	or	%o0, %lo(p1275buf), %o0
+-	ldx	[%o0 + 0x010], %o1	! prom_cif_stack
+-	save	%o1, -192, %sp
+-	ldx	[%i0 + 0x008], %l2	! prom_cif_handler
++	.globl	prom_cif_direct
++prom_cif_direct:
++	sethi	%hi(p1275buf), %o1
++	or	%o1, %lo(p1275buf), %o1
++	ldx	[%o1 + 0x0010], %o2	! prom_cif_stack
++	save	%o2, -192, %sp
++	ldx	[%i1 + 0x0008], %l2	! prom_cif_handler
+ 	mov	%g4, %l0
+ 	mov	%g5, %l1
+ 	mov	%g6, %l3
+ 	call	%l2
+-	 add	%i0, 0x018, %o0		! prom_args
++	 mov	%i0, %o0		! prom_args
+ 	mov	%l0, %g4
+ 	mov	%l1, %g5
+ 	mov	%l3, %g6
+diff --git a/arch/sparc/prom/console_64.c b/arch/sparc/prom/console_64.c
+index f55d58a..10322dc 100644
+--- a/arch/sparc/prom/console_64.c
++++ b/arch/sparc/prom/console_64.c
+@@ -21,14 +21,22 @@ extern int prom_stdin, prom_stdout;
+ inline int
+ prom_nbgetchar(void)
+ {
++	unsigned long args[7];
+ 	char inc;
+ 
+-	if (p1275_cmd("read", P1275_ARG(1,P1275_ARG_OUT_BUF)|
+-			      P1275_INOUT(3,1),
+-			      prom_stdin, &inc, P1275_SIZE(1)) == 1)
++	args[0] = (unsigned long) "read";
++	args[1] = 3;
++	args[2] = 1;
++	args[3] = (unsigned int) prom_stdin;
++	args[4] = (unsigned long) &inc;
++	args[5] = 1;
++	args[6] = (unsigned long) -1;
++
++	p1275_cmd_direct(args);
++
++	if (args[6] == 1)
+ 		return inc;
+-	else
+-		return -1;
++	return -1;
+ }
+ 
+ /* Non blocking put character to console device, returns -1 if
+@@ -37,12 +45,22 @@ prom_nbgetchar(void)
+ inline int
+ prom_nbputchar(char c)
+ {
++	unsigned long args[7];
+ 	char outc;
+ 	
+ 	outc = c;
+-	if (p1275_cmd("write", P1275_ARG(1,P1275_ARG_IN_BUF)|
+-			       P1275_INOUT(3,1),
+-			       prom_stdout, &outc, P1275_SIZE(1)) == 1)
++
++	args[0] = (unsigned long) "write";
++	args[1] = 3;
++	args[2] = 1;
++	args[3] = (unsigned int) prom_stdout;
++	args[4] = (unsigned long) &outc;
++	args[5] = 1;
++	args[6] = (unsigned long) -1;
++
++	p1275_cmd_direct(args);
++
++	if (args[6] == 1)
+ 		return 0;
+ 	else
+ 		return -1;
+@@ -67,7 +85,15 @@ prom_putchar(char c)
+ void
+ prom_puts(const char *s, int len)
+ {
+-	p1275_cmd("write", P1275_ARG(1,P1275_ARG_IN_BUF)|
+-			   P1275_INOUT(3,1),
+-			   prom_stdout, s, P1275_SIZE(len));
++	unsigned long args[7];
++
++	args[0] = (unsigned long) "write";
++	args[1] = 3;
++	args[2] = 1;
++	args[3] = (unsigned int) prom_stdout;
++	args[4] = (unsigned long) s;
++	args[5] = len;
++	args[6] = (unsigned long) -1;
++
++	p1275_cmd_direct(args);
+ }
+diff --git a/arch/sparc/prom/devops_64.c b/arch/sparc/prom/devops_64.c
+index 9dbd803..a017119 100644
+--- a/arch/sparc/prom/devops_64.c
++++ b/arch/sparc/prom/devops_64.c
+@@ -18,16 +18,32 @@
+ int
+ prom_devopen(const char *dstr)
+ {
+-	return p1275_cmd ("open", P1275_ARG(0,P1275_ARG_IN_STRING)|
+-				  P1275_INOUT(1,1),
+-				  dstr);
++	unsigned long args[5];
++
++	args[0] = (unsigned long) "open";
++	args[1] = 1;
++	args[2] = 1;
++	args[3] = (unsigned long) dstr;
++	args[4] = (unsigned long) -1;
++
++	p1275_cmd_direct(args);
++
++	return (int) args[4];
+ }
+ 
+ /* Close the device described by device handle 'dhandle'. */
+ int
+ prom_devclose(int dhandle)
+ {
+-	p1275_cmd ("close", P1275_INOUT(1,0), dhandle);
++	unsigned long args[4];
++
++	args[0] = (unsigned long) "close";
++	args[1] = 1;
++	args[2] = 0;
++	args[3] = (unsigned int) dhandle;
++
++	p1275_cmd_direct(args);
++
+ 	return 0;
+ }
+ 
+@@ -37,5 +53,15 @@ prom_devclose(int dhandle)
+ void
+ prom_seek(int dhandle, unsigned int seekhi, unsigned int seeklo)
+ {
+-	p1275_cmd ("seek", P1275_INOUT(3,1), dhandle, seekhi, seeklo);
++	unsigned long args[7];
++
++	args[0] = (unsigned long) "seek";
++	args[1] = 3;
++	args[2] = 1;
++	args[3] = (unsigned int) dhandle;
++	args[4] = seekhi;
++	args[5] = seeklo;
++	args[6] = (unsigned long) -1;
++
++	p1275_cmd_direct(args);
+ }
+diff --git a/arch/sparc/prom/misc_64.c b/arch/sparc/prom/misc_64.c
+index 39fc6af..6cb1581 100644
+--- a/arch/sparc/prom/misc_64.c
++++ b/arch/sparc/prom/misc_64.c
+@@ -20,10 +20,17 @@
+ 
+ int prom_service_exists(const char *service_name)
+ {
+-	int err = p1275_cmd("test", P1275_ARG(0, P1275_ARG_IN_STRING) |
+-			    P1275_INOUT(1, 1), service_name);
++	unsigned long args[5];
+ 
+-	if (err)
++	args[0] = (unsigned long) "test";
++	args[1] = 1;
++	args[2] = 1;
++	args[3] = (unsigned long) service_name;
++	args[4] = (unsigned long) -1;
++
++	p1275_cmd_direct(args);
++
++	if (args[4])
+ 		return 0;
+ 	return 1;
+ }
+@@ -31,30 +38,47 @@ int prom_service_exists(const char *service_name)
+ void prom_sun4v_guest_soft_state(void)
+ {
+ 	const char *svc = "SUNW,soft-state-supported";
++	unsigned long args[3];
+ 
+ 	if (!prom_service_exists(svc))
+ 		return;
+-	p1275_cmd(svc, P1275_INOUT(0, 0));
++	args[0] = (unsigned long) svc;
++	args[1] = 0;
++	args[2] = 0;
++	p1275_cmd_direct(args);
+ }
+ 
+ /* Reset and reboot the machine with the command 'bcommand'. */
+ void prom_reboot(const char *bcommand)
+ {
++	unsigned long args[4];
++
+ #ifdef CONFIG_SUN_LDOMS
+ 	if (ldom_domaining_enabled)
+ 		ldom_reboot(bcommand);
+ #endif
+-	p1275_cmd("boot", P1275_ARG(0, P1275_ARG_IN_STRING) |
+-		  P1275_INOUT(1, 0), bcommand);
++	args[0] = (unsigned long) "boot";
++	args[1] = 1;
++	args[2] = 0;
++	args[3] = (unsigned long) bcommand;
++
++	p1275_cmd_direct(args);
+ }
+ 
+ /* Forth evaluate the expression contained in 'fstring'. */
+ void prom_feval(const char *fstring)
+ {
++	unsigned long args[5];
++
+ 	if (!fstring || fstring[0] == 0)
+ 		return;
+-	p1275_cmd("interpret", P1275_ARG(0, P1275_ARG_IN_STRING) |
+-		  P1275_INOUT(1, 1), fstring);
++	args[0] = (unsigned long) "interpret";
++	args[1] = 1;
++	args[2] = 1;
++	args[3] = (unsigned long) fstring;
++	args[4] = (unsigned long) -1;
++
++	p1275_cmd_direct(args);
+ }
+ EXPORT_SYMBOL(prom_feval);
+ 
+@@ -68,6 +92,7 @@ extern void smp_release(void);
+  */
+ void prom_cmdline(void)
+ {
++	unsigned long args[3];
+ 	unsigned long flags;
+ 
+ 	local_irq_save(flags);
+@@ -76,7 +101,11 @@ void prom_cmdline(void)
+ 	smp_capture();
+ #endif
+ 
+-	p1275_cmd("enter", P1275_INOUT(0, 0));
++	args[0] = (unsigned long) "enter";
++	args[1] = 0;
++	args[2] = 0;
++
++	p1275_cmd_direct(args);
+ 
+ #ifdef CONFIG_SMP
+ 	smp_release();
+@@ -90,22 +119,32 @@ void prom_cmdline(void)
+  */
+ void notrace prom_halt(void)
+ {
++	unsigned long args[3];
++
+ #ifdef CONFIG_SUN_LDOMS
+ 	if (ldom_domaining_enabled)
+ 		ldom_power_off();
+ #endif
+ again:
+-	p1275_cmd("exit", P1275_INOUT(0, 0));
++	args[0] = (unsigned long) "exit";
++	args[1] = 0;
++	args[2] = 0;
++	p1275_cmd_direct(args);
+ 	goto again; /* PROM is out to get me -DaveM */
+ }
+ 
+ void prom_halt_power_off(void)
+ {
++	unsigned long args[3];
++
+ #ifdef CONFIG_SUN_LDOMS
+ 	if (ldom_domaining_enabled)
+ 		ldom_power_off();
+ #endif
+-	p1275_cmd("SUNW,power-off", P1275_INOUT(0, 0));
++	args[0] = (unsigned long) "SUNW,power-off";
++	args[1] = 0;
++	args[2] = 0;
++	p1275_cmd_direct(args);
+ 
+ 	/* if nothing else helps, we just halt */
+ 	prom_halt();
+@@ -114,10 +153,15 @@ void prom_halt_power_off(void)
+ /* Set prom sync handler to call function 'funcp'. */
+ void prom_setcallback(callback_func_t funcp)
+ {
++	unsigned long args[5];
+ 	if (!funcp)
+ 		return;
+-	p1275_cmd("set-callback", P1275_ARG(0, P1275_ARG_IN_FUNCTION) |
+-		  P1275_INOUT(1, 1), funcp);
++	args[0] = (unsigned long) "set-callback";
++	args[1] = 1;
++	args[2] = 1;
++	args[3] = (unsigned long) funcp;
++	args[4] = (unsigned long) -1;
++	p1275_cmd_direct(args);
+ }
+ 
+ /* Get the idprom and stuff it into buffer 'idbuf'.  Returns the
+@@ -173,57 +217,61 @@ static int prom_get_memory_ihandle(void)
+ }
+ 
+ /* Load explicit I/D TLB entries. */
++static long tlb_load(const char *type, unsigned long index,
++		     unsigned long tte_data, unsigned long vaddr)
++{
++	unsigned long args[9];
++
++	args[0] = (unsigned long) prom_callmethod_name;
++	args[1] = 5;
++	args[2] = 1;
++	args[3] = (unsigned long) type;
++	args[4] = (unsigned int) prom_get_mmu_ihandle();
++	args[5] = vaddr;
++	args[6] = tte_data;
++	args[7] = index;
++	args[8] = (unsigned long) -1;
++
++	p1275_cmd_direct(args);
++
++	return (long) args[8];
++}
++
+ long prom_itlb_load(unsigned long index,
+ 		    unsigned long tte_data,
+ 		    unsigned long vaddr)
+ {
+-	return p1275_cmd(prom_callmethod_name,
+-			 (P1275_ARG(0, P1275_ARG_IN_STRING) |
+-			  P1275_ARG(2, P1275_ARG_IN_64B) |
+-			  P1275_ARG(3, P1275_ARG_IN_64B) |
+-			  P1275_INOUT(5, 1)),
+-			 "SUNW,itlb-load",
+-			 prom_get_mmu_ihandle(),
+-			 /* And then our actual args are pushed backwards. */
+-			 vaddr,
+-			 tte_data,
+-			 index);
++	return tlb_load("SUNW,itlb-load", index, tte_data, vaddr);
+ }
+ 
+ long prom_dtlb_load(unsigned long index,
+ 		    unsigned long tte_data,
+ 		    unsigned long vaddr)
+ {
+-	return p1275_cmd(prom_callmethod_name,
+-			 (P1275_ARG(0, P1275_ARG_IN_STRING) |
+-			  P1275_ARG(2, P1275_ARG_IN_64B) |
+-			  P1275_ARG(3, P1275_ARG_IN_64B) |
+-			  P1275_INOUT(5, 1)),
+-			 "SUNW,dtlb-load",
+-			 prom_get_mmu_ihandle(),
+-			 /* And then our actual args are pushed backwards. */
+-			 vaddr,
+-			 tte_data,
+-			 index);
++	return tlb_load("SUNW,dtlb-load", index, tte_data, vaddr);
+ }
+ 
+ int prom_map(int mode, unsigned long size,
+ 	     unsigned long vaddr, unsigned long paddr)
+ {
+-	int ret = p1275_cmd(prom_callmethod_name,
+-			    (P1275_ARG(0, P1275_ARG_IN_STRING) |
+-			     P1275_ARG(3, P1275_ARG_IN_64B) |
+-			     P1275_ARG(4, P1275_ARG_IN_64B) |
+-			     P1275_ARG(6, P1275_ARG_IN_64B) |
+-			     P1275_INOUT(7, 1)),
+-			    prom_map_name,
+-			    prom_get_mmu_ihandle(),
+-			    mode,
+-			    size,
+-			    vaddr,
+-			    0,
+-			    paddr);
+-
++	unsigned long args[11];
++	int ret;
++
++	args[0] = (unsigned long) prom_callmethod_name;
++	args[1] = 7;
++	args[2] = 1;
++	args[3] = (unsigned long) prom_map_name;
++	args[4] = (unsigned int) prom_get_mmu_ihandle();
++	args[5] = (unsigned int) mode;
++	args[6] = size;
++	args[7] = vaddr;
++	args[8] = 0;
++	args[9] = paddr;
++	args[10] = (unsigned long) -1;
++
++	p1275_cmd_direct(args);
++
++	ret = (int) args[10];
+ 	if (ret == 0)
+ 		ret = -1;
+ 	return ret;
+@@ -231,40 +279,51 @@ int prom_map(int mode, unsigned long size,
+ 
+ void prom_unmap(unsigned long size, unsigned long vaddr)
+ {
+-	p1275_cmd(prom_callmethod_name,
+-		  (P1275_ARG(0, P1275_ARG_IN_STRING) |
+-		   P1275_ARG(2, P1275_ARG_IN_64B) |
+-		   P1275_ARG(3, P1275_ARG_IN_64B) |
+-		   P1275_INOUT(4, 0)),
+-		  prom_unmap_name,
+-		  prom_get_mmu_ihandle(),
+-		  size,
+-		  vaddr);
++	unsigned long args[7];
++
++	args[0] = (unsigned long) prom_callmethod_name;
++	args[1] = 4;
++	args[2] = 0;
++	args[3] = (unsigned long) prom_unmap_name;
++	args[4] = (unsigned int) prom_get_mmu_ihandle();
++	args[5] = size;
++	args[6] = vaddr;
++
++	p1275_cmd_direct(args);
+ }
+ 
+ /* Set aside physical memory which is not touched or modified
+  * across soft resets.
+  */
+-unsigned long prom_retain(const char *name,
+-			  unsigned long pa_low, unsigned long pa_high,
+-			  long size, long align)
++int prom_retain(const char *name, unsigned long size,
++		unsigned long align, unsigned long *paddr)
+ {
+-	/* XXX I don't think we return multiple values correctly.
+-	 * XXX OBP supposedly returns pa_low/pa_high here, how does
+-	 * XXX it work?
++	unsigned long args[11];
++
++	args[0] = (unsigned long) prom_callmethod_name;
++	args[1] = 5;
++	args[2] = 3;
++	args[3] = (unsigned long) "SUNW,retain";
++	args[4] = (unsigned int) prom_get_memory_ihandle();
++	args[5] = align;
++	args[6] = size;
++	args[7] = (unsigned long) name;
++	args[8] = (unsigned long) -1;
++	args[9] = (unsigned long) -1;
++	args[10] = (unsigned long) -1;
++
++	p1275_cmd_direct(args);
++
++	if (args[8])
++		return (int) args[8];
++
++	/* Next we get "phys_high" then "phys_low".  On 64-bit
++	 * the phys_high cell is don't care since the phys_low
++	 * cell has the full value.
+ 	 */
++	*paddr = args[10];
+ 
+-	/* If align is zero, the pa_low/pa_high args are passed,
+-	 * else they are not.
+-	 */
+-	if (align == 0)
+-		return p1275_cmd("SUNW,retain",
+-				 (P1275_ARG(0, P1275_ARG_IN_BUF) | P1275_INOUT(5, 2)),
+-				 name, pa_low, pa_high, size, align);
+-	else
+-		return p1275_cmd("SUNW,retain",
+-				 (P1275_ARG(0, P1275_ARG_IN_BUF) | P1275_INOUT(3, 2)),
+-				 name, size, align);
++	return 0;
+ }
+ 
+ /* Get "Unumber" string for the SIMM at the given
+@@ -277,62 +336,129 @@ int prom_getunumber(int syndrome_code,
+ 		    unsigned long phys_addr,
+ 		    char *buf, int buflen)
+ {
+-	return p1275_cmd(prom_callmethod_name,
+-			 (P1275_ARG(0, P1275_ARG_IN_STRING)	|
+-			  P1275_ARG(3, P1275_ARG_OUT_BUF)	|
+-			  P1275_ARG(6, P1275_ARG_IN_64B)	|
+-			  P1275_INOUT(8, 2)),
+-			 "SUNW,get-unumber", prom_get_memory_ihandle(),
+-			 buflen, buf, P1275_SIZE(buflen),
+-			 0, phys_addr, syndrome_code);
++	unsigned long args[12];
++
++	args[0] = (unsigned long) prom_callmethod_name;
++	args[1] = 7;
++	args[2] = 2;
++	args[3] = (unsigned long) "SUNW,get-unumber";
++	args[4] = (unsigned int) prom_get_memory_ihandle();
++	args[5] = buflen;
++	args[6] = (unsigned long) buf;
++	args[7] = 0;
++	args[8] = phys_addr;
++	args[9] = (unsigned int) syndrome_code;
++	args[10] = (unsigned long) -1;
++	args[11] = (unsigned long) -1;
++
++	p1275_cmd_direct(args);
++
++	return (int) args[10];
+ }
+ 
+ /* Power management extensions. */
+ void prom_sleepself(void)
+ {
+-	p1275_cmd("SUNW,sleep-self", P1275_INOUT(0, 0));
++	unsigned long args[3];
++
++	args[0] = (unsigned long) "SUNW,sleep-self";
++	args[1] = 0;
++	args[2] = 0;
++	p1275_cmd_direct(args);
+ }
+ 
+ int prom_sleepsystem(void)
+ {
+-	return p1275_cmd("SUNW,sleep-system", P1275_INOUT(0, 1));
++	unsigned long args[4];
++
++	args[0] = (unsigned long) "SUNW,sleep-system";
++	args[1] = 0;
++	args[2] = 1;
++	args[3] = (unsigned long) -1;
++	p1275_cmd_direct(args);
++
++	return (int) args[3];
+ }
+ 
+ int prom_wakeupsystem(void)
+ {
+-	return p1275_cmd("SUNW,wakeup-system", P1275_INOUT(0, 1));
++	unsigned long args[4];
++
++	args[0] = (unsigned long) "SUNW,wakeup-system";
++	args[1] = 0;
++	args[2] = 1;
++	args[3] = (unsigned long) -1;
++	p1275_cmd_direct(args);
++
++	return (int) args[3];
+ }
+ 
+ #ifdef CONFIG_SMP
+ void prom_startcpu(int cpunode, unsigned long pc, unsigned long arg)
+ {
+-	p1275_cmd("SUNW,start-cpu", P1275_INOUT(3, 0), cpunode, pc, arg);
++	unsigned long args[6];
++
++	args[0] = (unsigned long) "SUNW,start-cpu";
++	args[1] = 3;
++	args[2] = 0;
++	args[3] = (unsigned int) cpunode;
++	args[4] = pc;
++	args[5] = arg;
++	p1275_cmd_direct(args);
+ }
+ 
+ void prom_startcpu_cpuid(int cpuid, unsigned long pc, unsigned long arg)
+ {
+-	p1275_cmd("SUNW,start-cpu-by-cpuid", P1275_INOUT(3, 0),
+-		  cpuid, pc, arg);
++	unsigned long args[6];
++
++	args[0] = (unsigned long) "SUNW,start-cpu-by-cpuid";
++	args[1] = 3;
++	args[2] = 0;
++	args[3] = (unsigned int) cpuid;
++	args[4] = pc;
++	args[5] = arg;
++	p1275_cmd_direct(args);
+ }
+ 
+ void prom_stopcpu_cpuid(int cpuid)
+ {
+-	p1275_cmd("SUNW,stop-cpu-by-cpuid", P1275_INOUT(1, 0),
+-		  cpuid);
++	unsigned long args[4];
++
++	args[0] = (unsigned long) "SUNW,stop-cpu-by-cpuid";
++	args[1] = 1;
++	args[2] = 0;
++	args[3] = (unsigned int) cpuid;
++	p1275_cmd_direct(args);
+ }
+ 
+ void prom_stopself(void)
+ {
+-	p1275_cmd("SUNW,stop-self", P1275_INOUT(0, 0));
++	unsigned long args[3];
++
++	args[0] = (unsigned long) "SUNW,stop-self";
++	args[1] = 0;
++	args[2] = 0;
++	p1275_cmd_direct(args);
+ }
+ 
+ void prom_idleself(void)
+ {
+-	p1275_cmd("SUNW,idle-self", P1275_INOUT(0, 0));
++	unsigned long args[3];
++
++	args[0] = (unsigned long) "SUNW,idle-self";
++	args[1] = 0;
++	args[2] = 0;
++	p1275_cmd_direct(args);
+ }
+ 
+ void prom_resumecpu(int cpunode)
+ {
+-	p1275_cmd("SUNW,resume-cpu", P1275_INOUT(1, 0), cpunode);
++	unsigned long args[4];
++
++	args[0] = (unsigned long) "SUNW,resume-cpu";
++	args[1] = 1;
++	args[2] = 0;
++	args[3] = (unsigned int) cpunode;
++	p1275_cmd_direct(args);
+ }
+ #endif
+diff --git a/arch/sparc/prom/p1275.c b/arch/sparc/prom/p1275.c
+index 2d8b70d..fa6e4e2 100644
+--- a/arch/sparc/prom/p1275.c
++++ b/arch/sparc/prom/p1275.c
+@@ -22,13 +22,11 @@ struct {
+ 	long prom_callback;			/* 0x00 */
+ 	void (*prom_cif_handler)(long *);	/* 0x08 */
+ 	unsigned long prom_cif_stack;		/* 0x10 */
+-	unsigned long prom_args [23];		/* 0x18 */
+-	char prom_buffer [3000];
+ } p1275buf;
+ 
+ extern void prom_world(int);
+ 
+-extern void prom_cif_interface(void);
++extern void prom_cif_direct(unsigned long *args);
+ extern void prom_cif_callback(void);
+ 
+ /*
+@@ -36,114 +34,20 @@ extern void prom_cif_callback(void);
+  */
+ DEFINE_RAW_SPINLOCK(prom_entry_lock);
+ 
+-long p1275_cmd(const char *service, long fmt, ...)
++void p1275_cmd_direct(unsigned long *args)
+ {
+-	char *p, *q;
+ 	unsigned long flags;
+-	int nargs, nrets, i;
+-	va_list list;
+-	long attrs, x;
+-	
+-	p = p1275buf.prom_buffer;
+ 
+ 	raw_local_save_flags(flags);
+ 	raw_local_irq_restore(PIL_NMI);
+ 	raw_spin_lock(&prom_entry_lock);
+ 
+-	p1275buf.prom_args[0] = (unsigned long)p;		/* service */
+-	strcpy (p, service);
+-	p = (char *)(((long)(strchr (p, 0) + 8)) & ~7);
+-	p1275buf.prom_args[1] = nargs = (fmt & 0x0f);		/* nargs */
+-	p1275buf.prom_args[2] = nrets = ((fmt & 0xf0) >> 4); 	/* nrets */
+-	attrs = fmt >> 8;
+-	va_start(list, fmt);
+-	for (i = 0; i < nargs; i++, attrs >>= 3) {
+-		switch (attrs & 0x7) {
+-		case P1275_ARG_NUMBER:
+-			p1275buf.prom_args[i + 3] =
+-						(unsigned)va_arg(list, long);
+-			break;
+-		case P1275_ARG_IN_64B:
+-			p1275buf.prom_args[i + 3] =
+-				va_arg(list, unsigned long);
+-			break;
+-		case P1275_ARG_IN_STRING:
+-			strcpy (p, va_arg(list, char *));
+-			p1275buf.prom_args[i + 3] = (unsigned long)p;
+-			p = (char *)(((long)(strchr (p, 0) + 8)) & ~7);
+-			break;
+-		case P1275_ARG_OUT_BUF:
+-			(void) va_arg(list, char *);
+-			p1275buf.prom_args[i + 3] = (unsigned long)p;
+-			x = va_arg(list, long);
+-			i++; attrs >>= 3;
+-			p = (char *)(((long)(p + (int)x + 7)) & ~7);
+-			p1275buf.prom_args[i + 3] = x;
+-			break;
+-		case P1275_ARG_IN_BUF:
+-			q = va_arg(list, char *);
+-			p1275buf.prom_args[i + 3] = (unsigned long)p;
+-			x = va_arg(list, long);
+-			i++; attrs >>= 3;
+-			memcpy (p, q, (int)x);
+-			p = (char *)(((long)(p + (int)x + 7)) & ~7);
+-			p1275buf.prom_args[i + 3] = x;
+-			break;
+-		case P1275_ARG_OUT_32B:
+-			(void) va_arg(list, char *);
+-			p1275buf.prom_args[i + 3] = (unsigned long)p;
+-			p += 32;
+-			break;
+-		case P1275_ARG_IN_FUNCTION:
+-			p1275buf.prom_args[i + 3] =
+-					(unsigned long)prom_cif_callback;
+-			p1275buf.prom_callback = va_arg(list, long);
+-			break;
+-		}
+-	}
+-	va_end(list);
+-
+ 	prom_world(1);
+-	prom_cif_interface();
++	prom_cif_direct(args);
+ 	prom_world(0);
+ 
+-	attrs = fmt >> 8;
+-	va_start(list, fmt);
+-	for (i = 0; i < nargs; i++, attrs >>= 3) {
+-		switch (attrs & 0x7) {
+-		case P1275_ARG_NUMBER:
+-			(void) va_arg(list, long);
+-			break;
+-		case P1275_ARG_IN_STRING:
+-			(void) va_arg(list, char *);
+-			break;
+-		case P1275_ARG_IN_FUNCTION:
+-			(void) va_arg(list, long);
+-			break;
+-		case P1275_ARG_IN_BUF:
+-			(void) va_arg(list, char *);
+-			(void) va_arg(list, long);
+-			i++; attrs >>= 3;
+-			break;
+-		case P1275_ARG_OUT_BUF:
+-			p = va_arg(list, char *);
+-			x = va_arg(list, long);
+-			memcpy (p, (char *)(p1275buf.prom_args[i + 3]), (int)x);
+-			i++; attrs >>= 3;
+-			break;
+-		case P1275_ARG_OUT_32B:
+-			p = va_arg(list, char *);
+-			memcpy (p, (char *)(p1275buf.prom_args[i + 3]), 32);
+-			break;
+-		}
+-	}
+-	va_end(list);
+-	x = p1275buf.prom_args [nargs + 3];
+-
+ 	raw_spin_unlock(&prom_entry_lock);
+ 	raw_local_irq_restore(flags);
+-
+-	return x;
+ }
+ 
+ void prom_cif_init(void *cif_handler, void *cif_stack)
+diff --git a/arch/sparc/prom/tree_64.c b/arch/sparc/prom/tree_64.c
+index 3c0d2dd..9d3f913 100644
+--- a/arch/sparc/prom/tree_64.c
++++ b/arch/sparc/prom/tree_64.c
+@@ -16,22 +16,39 @@
+ #include <asm/oplib.h>
+ #include <asm/ldc.h>
+ 
++static int prom_node_to_node(const char *type, int node)
++{
++	unsigned long args[5];
++
++	args[0] = (unsigned long) type;
++	args[1] = 1;
++	args[2] = 1;
++	args[3] = (unsigned int) node;
++	args[4] = (unsigned long) -1;
++
++	p1275_cmd_direct(args);
++
++	return (int) args[4];
++}
++
+ /* Return the child of node 'node' or zero if no this node has no
+  * direct descendent.
+  */
+ inline int __prom_getchild(int node)
+ {
+-	return p1275_cmd ("child", P1275_INOUT(1, 1), node);
++	return prom_node_to_node("child", node);
+ }
+ 
+ inline int prom_getchild(int node)
+ {
+ 	int cnode;
+ 
+-	if(node == -1) return 0;
++	if (node == -1)
++		return 0;
+ 	cnode = __prom_getchild(node);
+-	if(cnode == -1) return 0;
+-	return (int)cnode;
++	if (cnode == -1)
++		return 0;
++	return cnode;
+ }
+ EXPORT_SYMBOL(prom_getchild);
+ 
+@@ -39,10 +56,12 @@ inline int prom_getparent(int node)
+ {
+ 	int cnode;
+ 
+-	if(node == -1) return 0;
+-	cnode = p1275_cmd ("parent", P1275_INOUT(1, 1), node);
+-	if(cnode == -1) return 0;
+-	return (int)cnode;
++	if (node == -1)
++		return 0;
++	cnode = prom_node_to_node("parent", node);
++	if (cnode == -1)
++		return 0;
++	return cnode;
+ }
+ 
+ /* Return the next sibling of node 'node' or zero if no more siblings
+@@ -50,7 +69,7 @@ inline int prom_getparent(int node)
+  */
+ inline int __prom_getsibling(int node)
+ {
+-	return p1275_cmd(prom_peer_name, P1275_INOUT(1, 1), node);
++	return prom_node_to_node(prom_peer_name, node);
+ }
+ 
+ inline int prom_getsibling(int node)
+@@ -72,11 +91,21 @@ EXPORT_SYMBOL(prom_getsibling);
+  */
+ inline int prom_getproplen(int node, const char *prop)
+ {
+-	if((!node) || (!prop)) return -1;
+-	return p1275_cmd ("getproplen", 
+-			  P1275_ARG(1,P1275_ARG_IN_STRING)|
+-			  P1275_INOUT(2, 1), 
+-			  node, prop);
++	unsigned long args[6];
++
++	if (!node || !prop)
++		return -1;
++
++	args[0] = (unsigned long) "getproplen";
++	args[1] = 2;
++	args[2] = 1;
++	args[3] = (unsigned int) node;
++	args[4] = (unsigned long) prop;
++	args[5] = (unsigned long) -1;
++
++	p1275_cmd_direct(args);
++
++	return (int) args[5];
+ }
+ EXPORT_SYMBOL(prom_getproplen);
+ 
+@@ -87,19 +116,25 @@ EXPORT_SYMBOL(prom_getproplen);
+ inline int prom_getproperty(int node, const char *prop,
+ 			    char *buffer, int bufsize)
+ {
++	unsigned long args[8];
+ 	int plen;
+ 
+ 	plen = prom_getproplen(node, prop);
+-	if ((plen > bufsize) || (plen == 0) || (plen == -1)) {
++	if ((plen > bufsize) || (plen == 0) || (plen == -1))
+ 		return -1;
+-	} else {
+-		/* Ok, things seem all right. */
+-		return p1275_cmd(prom_getprop_name, 
+-				 P1275_ARG(1,P1275_ARG_IN_STRING)|
+-				 P1275_ARG(2,P1275_ARG_OUT_BUF)|
+-				 P1275_INOUT(4, 1), 
+-				 node, prop, buffer, P1275_SIZE(plen));
+-	}
++
++	args[0] = (unsigned long) prom_getprop_name;
++	args[1] = 4;
++	args[2] = 1;
++	args[3] = (unsigned int) node;
++	args[4] = (unsigned long) prop;
++	args[5] = (unsigned long) buffer;
++	args[6] = bufsize;
++	args[7] = (unsigned long) -1;
++
++	p1275_cmd_direct(args);
++
++	return (int) args[7];
+ }
+ EXPORT_SYMBOL(prom_getproperty);
+ 
+@@ -110,7 +145,7 @@ inline int prom_getint(int node, const char *prop)
+ {
+ 	int intprop;
+ 
+-	if(prom_getproperty(node, prop, (char *) &intprop, sizeof(int)) != -1)
++	if (prom_getproperty(node, prop, (char *) &intprop, sizeof(int)) != -1)
+ 		return intprop;
+ 
+ 	return -1;
+@@ -126,7 +161,8 @@ int prom_getintdefault(int node, const char *property, int deflt)
+ 	int retval;
+ 
+ 	retval = prom_getint(node, property);
+-	if(retval == -1) return deflt;
++	if (retval == -1)
++		return deflt;
+ 
+ 	return retval;
+ }
+@@ -138,7 +174,8 @@ int prom_getbool(int node, const char *prop)
+ 	int retval;
+ 
+ 	retval = prom_getproplen(node, prop);
+-	if(retval == -1) return 0;
++	if (retval == -1)
++		return 0;
+ 	return 1;
+ }
+ EXPORT_SYMBOL(prom_getbool);
+@@ -152,7 +189,8 @@ void prom_getstring(int node, const char *prop, char *user_buf, int ubuf_size)
+ 	int len;
+ 
+ 	len = prom_getproperty(node, prop, user_buf, ubuf_size);
+-	if(len != -1) return;
++	if (len != -1)
++		return;
+ 	user_buf[0] = 0;
+ }
+ EXPORT_SYMBOL(prom_getstring);
+@@ -164,7 +202,8 @@ int prom_nodematch(int node, const char *name)
+ {
+ 	char namebuf[128];
+ 	prom_getproperty(node, "name", namebuf, sizeof(namebuf));
+-	if(strcmp(namebuf, name) == 0) return 1;
++	if (strcmp(namebuf, name) == 0)
++		return 1;
+ 	return 0;
+ }
+ 
+@@ -190,16 +229,29 @@ int prom_searchsiblings(int node_start, const char *nodename)
+ }
+ EXPORT_SYMBOL(prom_searchsiblings);
+ 
++static const char *prom_nextprop_name = "nextprop";
++
+ /* Return the first property type for node 'node'.
+  * buffer should be at least 32B in length
+  */
+ inline char *prom_firstprop(int node, char *buffer)
+ {
++	unsigned long args[7];
++
+ 	*buffer = 0;
+-	if(node == -1) return buffer;
+-	p1275_cmd ("nextprop", P1275_ARG(2,P1275_ARG_OUT_32B)|
+-			       P1275_INOUT(3, 0), 
+-			       node, (char *) 0x0, buffer);
++	if (node == -1)
++		return buffer;
++
++	args[0] = (unsigned long) prom_nextprop_name;
++	args[1] = 3;
++	args[2] = 1;
++	args[3] = (unsigned int) node;
++	args[4] = 0;
++	args[5] = (unsigned long) buffer;
++	args[6] = (unsigned long) -1;
++
++	p1275_cmd_direct(args);
++
+ 	return buffer;
+ }
+ EXPORT_SYMBOL(prom_firstprop);
+@@ -210,9 +262,10 @@ EXPORT_SYMBOL(prom_firstprop);
+  */
+ inline char *prom_nextprop(int node, const char *oprop, char *buffer)
+ {
++	unsigned long args[7];
+ 	char buf[32];
+ 
+-	if(node == -1) {
++	if (node == -1) {
+ 		*buffer = 0;
+ 		return buffer;
+ 	}
+@@ -220,10 +273,17 @@ inline char *prom_nextprop(int node, const char *oprop, char *buffer)
+ 		strcpy (buf, oprop);
+ 		oprop = buf;
+ 	}
+-	p1275_cmd ("nextprop", P1275_ARG(1,P1275_ARG_IN_STRING)|
+-				    P1275_ARG(2,P1275_ARG_OUT_32B)|
+-				    P1275_INOUT(3, 0), 
+-				    node, oprop, buffer); 
++
++	args[0] = (unsigned long) prom_nextprop_name;
++	args[1] = 3;
++	args[2] = 1;
++	args[3] = (unsigned int) node;
++	args[4] = (unsigned long) oprop;
++	args[5] = (unsigned long) buffer;
++	args[6] = (unsigned long) -1;
++
++	p1275_cmd_direct(args);
++
+ 	return buffer;
+ }
+ EXPORT_SYMBOL(prom_nextprop);
+@@ -231,12 +291,19 @@ EXPORT_SYMBOL(prom_nextprop);
+ int
+ prom_finddevice(const char *name)
+ {
++	unsigned long args[5];
++
+ 	if (!name)
+ 		return 0;
+-	return p1275_cmd(prom_finddev_name,
+-			 P1275_ARG(0,P1275_ARG_IN_STRING)|
+-			 P1275_INOUT(1, 1), 
+-			 name);
++	args[0] = (unsigned long) "finddevice";
++	args[1] = 1;
++	args[2] = 1;
++	args[3] = (unsigned long) name;
++	args[4] = (unsigned long) -1;
++
++	p1275_cmd_direct(args);
++
++	return (int) args[4];
+ }
+ EXPORT_SYMBOL(prom_finddevice);
+ 
+@@ -247,7 +314,7 @@ int prom_node_has_property(int node, const char *prop)
+ 	*buf = 0;
+ 	do {
+ 		prom_nextprop(node, buf, buf);
+-		if(!strcmp(buf, prop))
++		if (!strcmp(buf, prop))
+ 			return 1;
+ 	} while (*buf);
+ 	return 0;
+@@ -260,6 +327,8 @@ EXPORT_SYMBOL(prom_node_has_property);
+ int
+ prom_setprop(int node, const char *pname, char *value, int size)
+ {
++	unsigned long args[8];
++
+ 	if (size == 0)
+ 		return 0;
+ 	if ((pname == 0) || (value == 0))
+@@ -271,19 +340,37 @@ prom_setprop(int node, const char *pname, char *value, int size)
+ 		return 0;
+ 	}
+ #endif
+-	return p1275_cmd ("setprop", P1275_ARG(1,P1275_ARG_IN_STRING)|
+-					  P1275_ARG(2,P1275_ARG_IN_BUF)|
+-					  P1275_INOUT(4, 1), 
+-					  node, pname, value, P1275_SIZE(size));
++	args[0] = (unsigned long) "setprop";
++	args[1] = 4;
++	args[2] = 1;
++	args[3] = (unsigned int) node;
++	args[4] = (unsigned long) pname;
++	args[5] = (unsigned long) value;
++	args[6] = size;
++	args[7] = (unsigned long) -1;
++
++	p1275_cmd_direct(args);
++
++	return (int) args[7];
+ }
+ EXPORT_SYMBOL(prom_setprop);
+ 
+ inline int prom_inst2pkg(int inst)
+ {
++	unsigned long args[5];
+ 	int node;
+ 	
+-	node = p1275_cmd ("instance-to-package", P1275_INOUT(1, 1), inst);
+-	if (node == -1) return 0;
++	args[0] = (unsigned long) "instance-to-package";
++	args[1] = 1;
++	args[2] = 1;
++	args[3] = (unsigned int) inst;
++	args[4] = (unsigned long) -1;
++
++	p1275_cmd_direct(args);
++
++	node = (int) args[4];
++	if (node == -1)
++		return 0;
+ 	return node;
+ }
+ 
+@@ -296,17 +383,28 @@ prom_pathtoinode(const char *path)
+ 	int node, inst;
+ 
+ 	inst = prom_devopen (path);
+-	if (inst == 0) return 0;
+-	node = prom_inst2pkg (inst);
+-	prom_devclose (inst);
+-	if (node == -1) return 0;
++	if (inst == 0)
++		return 0;
++	node = prom_inst2pkg(inst);
++	prom_devclose(inst);
++	if (node == -1)
++		return 0;
+ 	return node;
+ }
+ 
+ int prom_ihandle2path(int handle, char *buffer, int bufsize)
+ {
+-	return p1275_cmd("instance-to-path",
+-			 P1275_ARG(1,P1275_ARG_OUT_BUF)|
+-			 P1275_INOUT(3, 1),
+-			 handle, buffer, P1275_SIZE(bufsize));
++	unsigned long args[7];
++
++	args[0] = (unsigned long) "instance-to-path";
++	args[1] = 3;
++	args[2] = 1;
++	args[3] = (unsigned int) handle;
++	args[4] = (unsigned long) buffer;
++	args[5] = bufsize;
++	args[6] = (unsigned long) -1;
++
++	p1275_cmd_direct(args);
++
++	return (int) args[6];
+ }
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index 5ac0bb4..715a7fa 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -345,10 +345,10 @@ static u32 group_table[] = {
+ 	DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM,
+ 	0, 0, 0, 0,
+ 	[Group4*8] =
+-	ByteOp | DstMem | SrcNone | ModRM, ByteOp | DstMem | SrcNone | ModRM,
++	ByteOp | DstMem | SrcNone | ModRM | Lock, ByteOp | DstMem | SrcNone | ModRM | Lock,
+ 	0, 0, 0, 0, 0, 0,
+ 	[Group5*8] =
+-	DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM,
++	DstMem | SrcNone | ModRM | Lock, DstMem | SrcNone | ModRM | Lock,
+ 	SrcMem | ModRM | Stack, 0,
+ 	SrcMem | ModRM | Stack, SrcMem | ModRM | Src2Mem16 | ImplicitOps,
+ 	SrcMem | ModRM | Stack, 0,
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index b1ed0a1..92b6ca4 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -799,8 +799,12 @@ static int kvm_handle_hva(struct kvm *kvm, unsigned long hva,
+ 			ret = handler(kvm, &memslot->rmap[gfn_offset], data);
+ 
+ 			for (j = 0; j < KVM_NR_PAGE_SIZES - 1; ++j) {
+-				int idx = gfn_offset;
+-				idx /= KVM_PAGES_PER_HPAGE(PT_DIRECTORY_LEVEL + j);
++				unsigned long idx;
++				int nr;
++
++				nr = KVM_PAGES_PER_HPAGE(PT_DIRECTORY_LEVEL+j);
++				idx = (memslot->base_gfn+gfn_offset) / nr -
++					memslot->base_gfn / nr;
+ 				ret |= handler(kvm,
+ 					&memslot->lpage_info[j][idx].rmap_pde,
+ 					data);
+diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
+index 2331bdc..e34452b 100644
+--- a/arch/x86/kvm/paging_tmpl.h
++++ b/arch/x86/kvm/paging_tmpl.h
+@@ -324,8 +324,32 @@ static u64 *FNAME(fetch)(struct kvm_vcpu *vcpu, gva_t addr,
+ 			break;
+ 		}
+ 
+-		if (is_shadow_present_pte(*sptep) && !is_large_pte(*sptep))
+-			continue;
++		if (is_shadow_present_pte(*sptep) && !is_large_pte(*sptep)) {
++			struct kvm_mmu_page *child;
++			unsigned direct_access;
++
++			if (level != gw->level)
++				continue;
++
++			/*
++			 * For the direct sp, if the guest pte's dirty bit
++			 * changed form clean to dirty, it will corrupt the
++			 * sp's access: allow writable in the read-only sp,
++			 * so we should update the spte at this point to get
++			 * a new sp with the correct access.
++			 */
++			direct_access = gw->pt_access & gw->pte_access;
++			if (!is_dirty_gpte(gw->ptes[gw->level - 1]))
++				direct_access &= ~ACC_WRITE_MASK;
++
++			child = page_header(*sptep & PT64_BASE_ADDR_MASK);
++			if (child->role.access == direct_access)
++				continue;
++
++			mmu_page_remove_parent_pte(child, sptep);
++			__set_spte(sptep, shadow_trap_nonpresent_pte);
++			kvm_flush_remote_tlbs(vcpu->kvm);
++		}
+ 
+ 		if (is_large_pte(*sptep)) {
+ 			rmap_remove(vcpu->kvm, sptep);
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index ee03679..7d04388 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -177,6 +177,7 @@ static u64 construct_eptp(unsigned long root_hpa);
+ static DEFINE_PER_CPU(struct vmcs *, vmxarea);
+ static DEFINE_PER_CPU(struct vmcs *, current_vmcs);
+ static DEFINE_PER_CPU(struct list_head, vcpus_on_cpu);
++static DEFINE_PER_CPU(struct desc_ptr, host_gdt);
+ 
+ static unsigned long *vmx_io_bitmap_a;
+ static unsigned long *vmx_io_bitmap_b;
+@@ -812,6 +813,7 @@ static void __vmx_load_host_state(struct vcpu_vmx *vmx)
+ 		wrmsrl(MSR_KERNEL_GS_BASE, vmx->msr_host_kernel_gs_base);
+ 	}
+ #endif
++	load_gdt(&__get_cpu_var(host_gdt));
+ }
+ 
+ static void vmx_load_host_state(struct vcpu_vmx *vmx)
+@@ -1314,6 +1316,8 @@ static int hardware_enable(void *garbage)
+ 
+ 	ept_sync_global();
+ 
++	store_gdt(&__get_cpu_var(host_gdt));
++
+ 	return 0;
+ }
+ 
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 7fa89c3..fd22688 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -5438,6 +5438,11 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm,
+ 				int user_alloc)
+ {
+ 	int npages = memslot->npages;
++	int map_flags = MAP_PRIVATE | MAP_ANONYMOUS;
++
++	/* Prevent internal slot pages from being moved by fork()/COW. */
++	if (memslot->id >= KVM_MEMORY_SLOTS)
++		map_flags = MAP_SHARED | MAP_ANONYMOUS;
+ 
+ 	/*To keep backward compatibility with older userspace,
+ 	 *x86 needs to hanlde !user_alloc case.
+@@ -5450,7 +5455,7 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm,
+ 			userspace_addr = do_mmap(NULL, 0,
+ 						 npages * PAGE_SIZE,
+ 						 PROT_READ | PROT_WRITE,
+-						 MAP_PRIVATE | MAP_ANONYMOUS,
++						 map_flags,
+ 						 0);
+ 			up_write(&current->mm->mmap_sem);
+ 
+diff --git a/arch/x86/lib/atomic64_386_32.S b/arch/x86/lib/atomic64_386_32.S
+index 78ee8e0..2cda60a 100644
+--- a/arch/x86/lib/atomic64_386_32.S
++++ b/arch/x86/lib/atomic64_386_32.S
+@@ -26,35 +26,37 @@
+ .endm
+ 
+ #define BEGIN(op) \
+-.macro END; \
++.macro endp; \
+ 	CFI_ENDPROC; \
+ ENDPROC(atomic64_##op##_386); \
+-.purgem END; \
++.purgem endp; \
+ .endm; \
+ ENTRY(atomic64_##op##_386); \
+ 	CFI_STARTPROC; \
+ 	LOCK v;
+ 
++#define ENDP endp
++
+ #define RET \
+ 	UNLOCK v; \
+ 	ret
+ 
+-#define RET_END \
++#define RET_ENDP \
+ 	RET; \
+-	END
++	ENDP
+ 
+ #define v %ecx
+ BEGIN(read)
+ 	movl  (v), %eax
+ 	movl 4(v), %edx
+-RET_END
++RET_ENDP
+ #undef v
+ 
+ #define v %esi
+ BEGIN(set)
+ 	movl %ebx,  (v)
+ 	movl %ecx, 4(v)
+-RET_END
++RET_ENDP
+ #undef v
+ 
+ #define v  %esi
+@@ -63,14 +65,14 @@ BEGIN(xchg)
+ 	movl 4(v), %edx
+ 	movl %ebx,  (v)
+ 	movl %ecx, 4(v)
+-RET_END
++RET_ENDP
+ #undef v
+ 
+ #define v %ecx
+ BEGIN(add)
+ 	addl %eax,  (v)
+ 	adcl %edx, 4(v)
+-RET_END
++RET_ENDP
+ #undef v
+ 
+ #define v %ecx
+@@ -79,14 +81,14 @@ BEGIN(add_return)
+ 	adcl 4(v), %edx
+ 	movl %eax,  (v)
+ 	movl %edx, 4(v)
+-RET_END
++RET_ENDP
+ #undef v
+ 
+ #define v %ecx
+ BEGIN(sub)
+ 	subl %eax,  (v)
+ 	sbbl %edx, 4(v)
+-RET_END
++RET_ENDP
+ #undef v
+ 
+ #define v %ecx
+@@ -98,14 +100,14 @@ BEGIN(sub_return)
+ 	adcl 4(v), %edx
+ 	movl %eax,  (v)
+ 	movl %edx, 4(v)
+-RET_END
++RET_ENDP
+ #undef v
+ 
+ #define v %esi
+ BEGIN(inc)
+ 	addl $1,  (v)
+ 	adcl $0, 4(v)
+-RET_END
++RET_ENDP
+ #undef v
+ 
+ #define v %esi
+@@ -116,14 +118,14 @@ BEGIN(inc_return)
+ 	adcl $0, %edx
+ 	movl %eax,  (v)
+ 	movl %edx, 4(v)
+-RET_END
++RET_ENDP
+ #undef v
+ 
+ #define v %esi
+ BEGIN(dec)
+ 	subl $1,  (v)
+ 	sbbl $0, 4(v)
+-RET_END
++RET_ENDP
+ #undef v
+ 
+ #define v %esi
+@@ -134,7 +136,7 @@ BEGIN(dec_return)
+ 	sbbl $0, %edx
+ 	movl %eax,  (v)
+ 	movl %edx, 4(v)
+-RET_END
++RET_ENDP
+ #undef v
+ 
+ #define v %ecx
+@@ -156,7 +158,7 @@ BEGIN(add_unless)
+ 	jne 1b
+ 	xorl %eax, %eax
+ 	jmp 2b
+-END
++ENDP
+ #undef v
+ 
+ #define v %esi
+@@ -177,7 +179,7 @@ BEGIN(inc_not_zero)
+ 	testl %edx, %edx
+ 	jne 1b
+ 	jmp 2b
+-END
++ENDP
+ #undef v
+ 
+ #define v %esi
+@@ -190,5 +192,5 @@ BEGIN(dec_if_positive)
+ 	movl %eax,  (v)
+ 	movl %edx, 4(v)
+ 1:
+-RET_END
++RET_ENDP
+ #undef v
+diff --git a/arch/x86/oprofile/nmi_int.c b/arch/x86/oprofile/nmi_int.c
+index cfe4faa..009b819 100644
+--- a/arch/x86/oprofile/nmi_int.c
++++ b/arch/x86/oprofile/nmi_int.c
+@@ -671,7 +671,9 @@ static int __init ppro_init(char **cpu_type)
+ 	case 14:
+ 		*cpu_type = "i386/core";
+ 		break;
+-	case 15: case 23:
++	case 0x0f:
++	case 0x16:
++	case 0x17:
+ 		*cpu_type = "i386/core_2";
+ 		break;
+ 	case 0x1a:
+diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
+index 941fcb8..cb1cedc 100644
+--- a/drivers/base/power/main.c
++++ b/drivers/base/power/main.c
+@@ -59,6 +59,7 @@ void device_pm_init(struct device *dev)
+ {
+ 	dev->power.status = DPM_ON;
+ 	init_completion(&dev->power.completion);
++	complete_all(&dev->power.completion);
+ 	pm_runtime_init(dev);
+ }
+ 
+diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
+index d836a71..adc0f89 100644
+--- a/drivers/char/agp/intel-agp.c
++++ b/drivers/char/agp/intel-agp.c
+@@ -805,6 +805,8 @@ static const struct intel_driver_description {
+ 	    "G45/G43", NULL, &intel_i965_driver },
+ 	{ PCI_DEVICE_ID_INTEL_B43_HB, PCI_DEVICE_ID_INTEL_B43_IG,
+ 	    "B43", NULL, &intel_i965_driver },
++	{ PCI_DEVICE_ID_INTEL_B43_1_HB, PCI_DEVICE_ID_INTEL_B43_1_IG,
++	    "B43", NULL, &intel_i965_driver },
+ 	{ PCI_DEVICE_ID_INTEL_G41_HB, PCI_DEVICE_ID_INTEL_G41_IG,
+ 	    "G41", NULL, &intel_i965_driver },
+ 	{ PCI_DEVICE_ID_INTEL_IRONLAKE_D_HB, PCI_DEVICE_ID_INTEL_IRONLAKE_D_IG,
+@@ -815,17 +817,27 @@ static const struct intel_driver_description {
+ 	    "HD Graphics", NULL, &intel_i965_driver },
+ 	{ PCI_DEVICE_ID_INTEL_IRONLAKE_MC2_HB, PCI_DEVICE_ID_INTEL_IRONLAKE_M_IG,
+ 	    "HD Graphics", NULL, &intel_i965_driver },
+-	{ PCI_DEVICE_ID_INTEL_SANDYBRIDGE_HB, PCI_DEVICE_ID_INTEL_SANDYBRIDGE_IG,
+-	    "Sandybridge", NULL, &intel_i965_driver },
+-	{ PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB, PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_IG,
+-	    "Sandybridge", NULL, &intel_i965_driver },
++	{ PCI_DEVICE_ID_INTEL_SANDYBRIDGE_HB, PCI_DEVICE_ID_INTEL_SANDYBRIDGE_GT1_IG,
++	    "Sandybridge", NULL, &intel_gen6_driver },
++	{ PCI_DEVICE_ID_INTEL_SANDYBRIDGE_HB, PCI_DEVICE_ID_INTEL_SANDYBRIDGE_GT2_IG,
++	    "Sandybridge", NULL, &intel_gen6_driver },
++	{ PCI_DEVICE_ID_INTEL_SANDYBRIDGE_HB, PCI_DEVICE_ID_INTEL_SANDYBRIDGE_GT2_PLUS_IG,
++	    "Sandybridge", NULL, &intel_gen6_driver },
++	{ PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB, PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_GT1_IG,
++	    "Sandybridge", NULL, &intel_gen6_driver },
++	{ PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB, PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_GT2_IG,
++	    "Sandybridge", NULL, &intel_gen6_driver },
++	{ PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB, PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_GT2_PLUS_IG,
++	    "Sandybridge", NULL, &intel_gen6_driver },
++	{ PCI_DEVICE_ID_INTEL_SANDYBRIDGE_S_HB, PCI_DEVICE_ID_INTEL_SANDYBRIDGE_S_IG,
++	    "Sandybridge", NULL, &intel_gen6_driver },
+ 	{ 0, 0, NULL, NULL, NULL }
+ };
+ 
+ static int __devinit intel_gmch_probe(struct pci_dev *pdev,
+ 				      struct agp_bridge_data *bridge)
+ {
+-	int i;
++	int i, mask;
+ 	bridge->driver = NULL;
+ 
+ 	for (i = 0; intel_agp_chipsets[i].name != NULL; i++) {
+@@ -845,14 +857,19 @@ static int __devinit intel_gmch_probe(struct pci_dev *pdev,
+ 
+ 	dev_info(&pdev->dev, "Intel %s Chipset\n", intel_agp_chipsets[i].name);
+ 
+-	if (bridge->driver->mask_memory == intel_i965_mask_memory) {
+-		if (pci_set_dma_mask(intel_private.pcidev, DMA_BIT_MASK(36)))
+-			dev_err(&intel_private.pcidev->dev,
+-				"set gfx device dma mask 36bit failed!\n");
+-		else
+-			pci_set_consistent_dma_mask(intel_private.pcidev,
+-						    DMA_BIT_MASK(36));
+-	}
++	if (bridge->driver->mask_memory == intel_gen6_mask_memory)
++		mask = 40;
++	else if (bridge->driver->mask_memory == intel_i965_mask_memory)
++		mask = 36;
++	else
++		mask = 32;
++
++	if (pci_set_dma_mask(intel_private.pcidev, DMA_BIT_MASK(mask)))
++		dev_err(&intel_private.pcidev->dev,
++			"set gfx device dma mask %d-bit failed!\n", mask);
++	else
++		pci_set_consistent_dma_mask(intel_private.pcidev,
++					    DMA_BIT_MASK(mask));
+ 
+ 	return 1;
+ }
+@@ -1036,6 +1053,7 @@ static struct pci_device_id agp_intel_pci_table[] = {
+ 	ID(PCI_DEVICE_ID_INTEL_IRONLAKE_MC2_HB),
+ 	ID(PCI_DEVICE_ID_INTEL_SANDYBRIDGE_HB),
+ 	ID(PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB),
++	ID(PCI_DEVICE_ID_INTEL_SANDYBRIDGE_S_HB),
+ 	{ }
+ };
+ 
+diff --git a/drivers/char/agp/intel-agp.h b/drivers/char/agp/intel-agp.h
+index 2547465..bc9a4ad 100644
+--- a/drivers/char/agp/intel-agp.h
++++ b/drivers/char/agp/intel-agp.h
+@@ -178,6 +178,8 @@
+ #define PCI_DEVICE_ID_INTEL_Q33_IG          0x29D2
+ #define PCI_DEVICE_ID_INTEL_B43_HB          0x2E40
+ #define PCI_DEVICE_ID_INTEL_B43_IG          0x2E42
++#define PCI_DEVICE_ID_INTEL_B43_1_HB        0x2E90
++#define PCI_DEVICE_ID_INTEL_B43_1_IG        0x2E92
+ #define PCI_DEVICE_ID_INTEL_GM45_HB         0x2A40
+ #define PCI_DEVICE_ID_INTEL_GM45_IG         0x2A42
+ #define PCI_DEVICE_ID_INTEL_EAGLELAKE_HB        0x2E00
+@@ -194,10 +196,16 @@
+ #define PCI_DEVICE_ID_INTEL_IRONLAKE_MA_HB	    0x0062
+ #define PCI_DEVICE_ID_INTEL_IRONLAKE_MC2_HB    0x006a
+ #define PCI_DEVICE_ID_INTEL_IRONLAKE_M_IG	    0x0046
+-#define PCI_DEVICE_ID_INTEL_SANDYBRIDGE_HB  0x0100
+-#define PCI_DEVICE_ID_INTEL_SANDYBRIDGE_IG  0x0102
+-#define PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB  0x0104
+-#define PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_IG  0x0106
++#define PCI_DEVICE_ID_INTEL_SANDYBRIDGE_HB		0x0100  /* Desktop */
++#define PCI_DEVICE_ID_INTEL_SANDYBRIDGE_GT1_IG		0x0102
++#define PCI_DEVICE_ID_INTEL_SANDYBRIDGE_GT2_IG		0x0112
++#define PCI_DEVICE_ID_INTEL_SANDYBRIDGE_GT2_PLUS_IG	0x0122
++#define PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB		0x0104  /* Mobile */
++#define PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_GT1_IG	0x0106
++#define PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_GT2_IG	0x0116
++#define PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_GT2_PLUS_IG	0x0126
++#define PCI_DEVICE_ID_INTEL_SANDYBRIDGE_S_HB		0x0108  /* Server */
++#define PCI_DEVICE_ID_INTEL_SANDYBRIDGE_S_IG		0x010A
+ 
+ /* cover 915 and 945 variants */
+ #define IS_I915 (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_E7221_HB || \
+@@ -224,7 +232,8 @@
+ 		agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_PINEVIEW_HB)
+ 
+ #define IS_SNB (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_SANDYBRIDGE_HB || \
+-		agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB)
++		agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB || \
++		agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_SANDYBRIDGE_S_HB)
+ 
+ #define IS_G4X (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_EAGLELAKE_HB || \
+ 		agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_Q45_HB || \
+diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c
+index ea6997e..ed11c77 100644
+--- a/drivers/char/agp/intel-gtt.c
++++ b/drivers/char/agp/intel-gtt.c
+@@ -585,8 +585,7 @@ static void intel_i830_init_gtt_entries(void)
+ 			gtt_entries = 0;
+ 			break;
+ 		}
+-	} else if (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_SANDYBRIDGE_HB ||
+-		   agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB) {
++	} else if (IS_SNB) {
+ 		/*
+ 		 * SandyBridge has new memory control reg at 0x50.w
+ 		 */
+@@ -1318,6 +1317,16 @@ static unsigned long intel_i965_mask_memory(struct agp_bridge_data *bridge,
+ 	return addr | bridge->driver->masks[type].mask;
+ }
+ 
++static unsigned long intel_gen6_mask_memory(struct agp_bridge_data *bridge,
++					    dma_addr_t addr, int type)
++{
++	/* gen6 has bit11-4 for physical addr bit39-32 */
++	addr |= (addr >> 28) & 0xff0;
++
++	/* Type checking must be done elsewhere */
++	return addr | bridge->driver->masks[type].mask;
++}
++
+ static void intel_i965_get_gtt_range(int *gtt_offset, int *gtt_size)
+ {
+ 	u16 snb_gmch_ctl;
+@@ -1337,6 +1346,7 @@ static void intel_i965_get_gtt_range(int *gtt_offset, int *gtt_size)
+ 		break;
+ 	case PCI_DEVICE_ID_INTEL_SANDYBRIDGE_HB:
+ 	case PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB:
++	case PCI_DEVICE_ID_INTEL_SANDYBRIDGE_S_HB:
+ 		*gtt_offset = MB(2);
+ 
+ 		pci_read_config_word(intel_private.pcidev, SNB_GMCH_CTRL, &snb_gmch_ctl);
+@@ -1526,6 +1536,39 @@ static const struct agp_bridge_driver intel_i965_driver = {
+ #endif
+ };
+ 
++static const struct agp_bridge_driver intel_gen6_driver = {
++	.owner			= THIS_MODULE,
++	.aperture_sizes		= intel_i830_sizes,
++	.size_type		= FIXED_APER_SIZE,
++	.num_aperture_sizes	= 4,
++	.needs_scratch_page	= true,
++	.configure		= intel_i9xx_configure,
++	.fetch_size		= intel_i9xx_fetch_size,
++	.cleanup		= intel_i915_cleanup,
++	.mask_memory		= intel_gen6_mask_memory,
++	.masks			= intel_i810_masks,
++	.agp_enable		= intel_i810_agp_enable,
++	.cache_flush		= global_cache_flush,
++	.create_gatt_table	= intel_i965_create_gatt_table,
++	.free_gatt_table	= intel_i830_free_gatt_table,
++	.insert_memory		= intel_i915_insert_entries,
++	.remove_memory		= intel_i915_remove_entries,
++	.alloc_by_type		= intel_i830_alloc_by_type,
++	.free_by_type		= intel_i810_free_by_type,
++	.agp_alloc_page		= agp_generic_alloc_page,
++	.agp_alloc_pages        = agp_generic_alloc_pages,
++	.agp_destroy_page	= agp_generic_destroy_page,
++	.agp_destroy_pages      = agp_generic_destroy_pages,
++	.agp_type_to_mask_type	= intel_i830_type_to_mask_type,
++	.chipset_flush		= intel_i915_chipset_flush,
++#ifdef USE_PCI_DMA_API
++	.agp_map_page		= intel_agp_map_page,
++	.agp_unmap_page		= intel_agp_unmap_page,
++	.agp_map_memory		= intel_agp_map_memory,
++	.agp_unmap_memory	= intel_agp_unmap_memory,
++#endif
++};
++
+ static const struct agp_bridge_driver intel_g33_driver = {
+ 	.owner			= THIS_MODULE,
+ 	.aperture_sizes		= intel_i830_sizes,
+diff --git a/drivers/char/mem.c b/drivers/char/mem.c
+index a398ecd..1f528fa 100644
+--- a/drivers/char/mem.c
++++ b/drivers/char/mem.c
+@@ -788,10 +788,11 @@ static const struct file_operations zero_fops = {
+ /*
+  * capabilities for /dev/zero
+  * - permits private mappings, "copies" are taken of the source of zeros
++ * - no writeback happens
+  */
+ static struct backing_dev_info zero_bdi = {
+ 	.name		= "char/mem",
+-	.capabilities	= BDI_CAP_MAP_COPY,
++	.capabilities	= BDI_CAP_MAP_COPY | BDI_CAP_NO_ACCT_AND_WRITEBACK,
+ };
+ 
+ static const struct file_operations full_fops = {
+diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
+index 942a982..c810481 100644
+--- a/drivers/char/virtio_console.c
++++ b/drivers/char/virtio_console.c
+@@ -596,6 +596,10 @@ static ssize_t port_fops_write(struct file *filp, const char __user *ubuf,
+ 	ssize_t ret;
+ 	bool nonblock;
+ 
++	/* Userspace could be out to fool us */
++	if (!count)
++		return 0;
++
+ 	port = filp->private_data;
+ 
+ 	nonblock = filp->f_flags & O_NONBLOCK;
+@@ -642,7 +646,7 @@ static unsigned int port_fops_poll(struct file *filp, poll_table *wait)
+ 	poll_wait(filp, &port->waitqueue, wait);
+ 
+ 	ret = 0;
+-	if (port->inbuf)
++	if (!will_read_block(port))
+ 		ret |= POLLIN | POLLRDNORM;
+ 	if (!will_write_block(port))
+ 		ret |= POLLOUT;
+diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
+index 423dc90..194e0c4 100644
+--- a/drivers/gpu/drm/i915/i915_drv.c
++++ b/drivers/gpu/drm/i915/i915_drv.c
+@@ -175,12 +175,18 @@ static const struct pci_device_id pciidlist[] = {
+ 	INTEL_VGA_DEVICE(0x2e22, &intel_g45_info),
+ 	INTEL_VGA_DEVICE(0x2e32, &intel_g45_info),
+ 	INTEL_VGA_DEVICE(0x2e42, &intel_g45_info),
++	INTEL_VGA_DEVICE(0x2e92, &intel_g45_info),		/* B43_G.1 */
+ 	INTEL_VGA_DEVICE(0xa001, &intel_pineview_info),
+ 	INTEL_VGA_DEVICE(0xa011, &intel_pineview_info),
+ 	INTEL_VGA_DEVICE(0x0042, &intel_ironlake_d_info),
+ 	INTEL_VGA_DEVICE(0x0046, &intel_ironlake_m_info),
+ 	INTEL_VGA_DEVICE(0x0102, &intel_sandybridge_d_info),
++	INTEL_VGA_DEVICE(0x0112, &intel_sandybridge_d_info),
++	INTEL_VGA_DEVICE(0x0122, &intel_sandybridge_d_info),
+ 	INTEL_VGA_DEVICE(0x0106, &intel_sandybridge_m_info),
++	INTEL_VGA_DEVICE(0x0116, &intel_sandybridge_m_info),
++	INTEL_VGA_DEVICE(0x0126, &intel_sandybridge_m_info),
++	INTEL_VGA_DEVICE(0x010A, &intel_sandybridge_d_info),
+ 	{0, 0, 0}
+ };
+ 
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index ac38e46..d1c1243 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -2376,11 +2376,19 @@ static bool intel_crtc_mode_fixup(struct drm_crtc *crtc,
+ 				  struct drm_display_mode *adjusted_mode)
+ {
+ 	struct drm_device *dev = crtc->dev;
++
+ 	if (HAS_PCH_SPLIT(dev)) {
+ 		/* FDI link clock is fixed at 2.7G */
+ 		if (mode->clock * 3 > 27000 * 4)
+ 			return MODE_CLOCK_HIGH;
+ 	}
++
++	/* XXX some encoders set the crtcinfo, others don't.
++	 * Obviously we need some form of conflict resolution here...
++	 */
++	if (adjusted_mode->crtc_htotal == 0)
++		drm_mode_set_crtcinfo(adjusted_mode, 0);
++
+ 	return true;
+ }
+ 
+diff --git a/drivers/gpu/drm/nouveau/nv50_instmem.c b/drivers/gpu/drm/nouveau/nv50_instmem.c
+index 5f21df3..3fcae54 100644
+--- a/drivers/gpu/drm/nouveau/nv50_instmem.c
++++ b/drivers/gpu/drm/nouveau/nv50_instmem.c
+@@ -141,6 +141,8 @@ nv50_instmem_init(struct drm_device *dev)
+ 	chan->file_priv = (struct drm_file *)-2;
+ 	dev_priv->fifos[0] = dev_priv->fifos[127] = chan;
+ 
++	INIT_LIST_HEAD(&chan->ramht_refs);
++
+ 	/* Channel's PRAMIN object + heap */
+ 	ret = nouveau_gpuobj_new_fake(dev, 0, c_offset, c_size, 0,
+ 							NULL, &chan->ramin);
+diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c
+index 5c53624..407cb84 100644
+--- a/drivers/message/fusion/mptscsih.c
++++ b/drivers/message/fusion/mptscsih.c
+@@ -2459,6 +2459,8 @@ mptscsih_slave_configure(struct scsi_device *sdev)
+ 		ioc->name,sdev->tagged_supported, sdev->simple_tags,
+ 		sdev->ordered_tags));
+ 
++	blk_queue_dma_alignment (sdev->request_queue, 512 - 1);
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
+index 822f586..0ddf4c6 100644
+--- a/drivers/net/bonding/bond_3ad.c
++++ b/drivers/net/bonding/bond_3ad.c
+@@ -2466,6 +2466,9 @@ int bond_3ad_lacpdu_recv(struct sk_buff *skb, struct net_device *dev, struct pac
+ 	if (!(dev->flags & IFF_MASTER))
+ 		goto out;
+ 
++	if (!pskb_may_pull(skb, sizeof(struct lacpdu)))
++		goto out;
++
+ 	read_lock(&bond->lock);
+ 	slave = bond_get_slave_by_dev((struct bonding *)netdev_priv(dev),
+ 					orig_dev);
+diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
+index 8d7dfd2..0cb1ded 100644
+--- a/drivers/net/bonding/bond_alb.c
++++ b/drivers/net/bonding/bond_alb.c
+@@ -369,6 +369,9 @@ static int rlb_arp_recv(struct sk_buff *skb, struct net_device *bond_dev, struct
+ 		goto out;
+ 	}
+ 
++	if (!pskb_may_pull(skb, arp_hdr_len(bond_dev)))
++		goto out;
++
+ 	if (skb->len < sizeof(struct arp_pkt)) {
+ 		pr_debug("Packet is too small to be an ARP\n");
+ 		goto out;
+diff --git a/drivers/net/cxgb3/cxgb3_main.c b/drivers/net/cxgb3/cxgb3_main.c
+index e3f1b85..3e0f19f 100644
+--- a/drivers/net/cxgb3/cxgb3_main.c
++++ b/drivers/net/cxgb3/cxgb3_main.c
+@@ -2296,6 +2296,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr)
+ 	case CHELSIO_GET_QSET_NUM:{
+ 		struct ch_reg edata;
+ 
++		memset(&edata, 0, sizeof(struct ch_reg));
++
+ 		edata.cmd = CHELSIO_GET_QSET_NUM;
+ 		edata.val = pi->nqsets;
+ 		if (copy_to_user(useraddr, &edata, sizeof(edata)))
+diff --git a/drivers/net/eql.c b/drivers/net/eql.c
+index dda2c79..0cb1cf9 100644
+--- a/drivers/net/eql.c
++++ b/drivers/net/eql.c
+@@ -555,6 +555,8 @@ static int eql_g_master_cfg(struct net_device *dev, master_config_t __user *mcp)
+ 	equalizer_t *eql;
+ 	master_config_t mc;
+ 
++	memset(&mc, 0, sizeof(master_config_t));
++
+ 	if (eql_is_master(dev)) {
+ 		eql = netdev_priv(dev);
+ 		mc.max_slaves = eql->max_slaves;
+diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
+index 4dd2351..e254274 100644
+--- a/drivers/net/usb/hso.c
++++ b/drivers/net/usb/hso.c
+@@ -1653,6 +1653,8 @@ static int hso_get_count(struct hso_serial *serial,
+ 	struct uart_icount cnow;
+ 	struct hso_tiocmget  *tiocmget = serial->tiocmget;
+ 
++	memset(&icount, 0, sizeof(struct serial_icounter_struct));
++
+ 	if (!tiocmget)
+ 		 return -ENOENT;
+ 	spin_lock_irq(&serial->serial_lock);
+diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
+index 435fbbc..8e499e8 100644
+--- a/drivers/pci/intel-iommu.c
++++ b/drivers/pci/intel-iommu.c
+@@ -71,6 +71,49 @@
+ #define DMA_32BIT_PFN		IOVA_PFN(DMA_BIT_MASK(32))
+ #define DMA_64BIT_PFN		IOVA_PFN(DMA_BIT_MASK(64))
+ 
++/* page table handling */
++#define LEVEL_STRIDE		(9)
++#define LEVEL_MASK		(((u64)1 << LEVEL_STRIDE) - 1)
++
++static inline int agaw_to_level(int agaw)
++{
++	return agaw + 2;
++}
++
++static inline int agaw_to_width(int agaw)
++{
++	return 30 + agaw * LEVEL_STRIDE;
++}
++
++static inline int width_to_agaw(int width)
++{
++	return (width - 30) / LEVEL_STRIDE;
++}
++
++static inline unsigned int level_to_offset_bits(int level)
++{
++	return (level - 1) * LEVEL_STRIDE;
++}
++
++static inline int pfn_level_offset(unsigned long pfn, int level)
++{
++	return (pfn >> level_to_offset_bits(level)) & LEVEL_MASK;
++}
++
++static inline unsigned long level_mask(int level)
++{
++	return -1UL << level_to_offset_bits(level);
++}
++
++static inline unsigned long level_size(int level)
++{
++	return 1UL << level_to_offset_bits(level);
++}
++
++static inline unsigned long align_to_level(unsigned long pfn, int level)
++{
++	return (pfn + level_size(level) - 1) & level_mask(level);
++}
+ 
+ /* VT-d pages must always be _smaller_ than MM pages. Otherwise things
+    are never going to work. */
+@@ -434,8 +477,6 @@ void free_iova_mem(struct iova *iova)
+ }
+ 
+ 
+-static inline int width_to_agaw(int width);
+-
+ static int __iommu_calculate_agaw(struct intel_iommu *iommu, int max_gaw)
+ {
+ 	unsigned long sagaw;
+@@ -646,51 +687,6 @@ out:
+ 	spin_unlock_irqrestore(&iommu->lock, flags);
+ }
+ 
+-/* page table handling */
+-#define LEVEL_STRIDE		(9)
+-#define LEVEL_MASK		(((u64)1 << LEVEL_STRIDE) - 1)
+-
+-static inline int agaw_to_level(int agaw)
+-{
+-	return agaw + 2;
+-}
+-
+-static inline int agaw_to_width(int agaw)
+-{
+-	return 30 + agaw * LEVEL_STRIDE;
+-
+-}
+-
+-static inline int width_to_agaw(int width)
+-{
+-	return (width - 30) / LEVEL_STRIDE;
+-}
+-
+-static inline unsigned int level_to_offset_bits(int level)
+-{
+-	return (level - 1) * LEVEL_STRIDE;
+-}
+-
+-static inline int pfn_level_offset(unsigned long pfn, int level)
+-{
+-	return (pfn >> level_to_offset_bits(level)) & LEVEL_MASK;
+-}
+-
+-static inline unsigned long level_mask(int level)
+-{
+-	return -1UL << level_to_offset_bits(level);
+-}
+-
+-static inline unsigned long level_size(int level)
+-{
+-	return 1UL << level_to_offset_bits(level);
+-}
+-
+-static inline unsigned long align_to_level(unsigned long pfn, int level)
+-{
+-	return (pfn + level_size(level) - 1) & level_mask(level);
+-}
+-
+ static struct dma_pte *pfn_to_dma_pte(struct dmar_domain *domain,
+ 				      unsigned long pfn)
+ {
+diff --git a/drivers/platform/x86/dell-wmi.c b/drivers/platform/x86/dell-wmi.c
+index 66f53c3..12a8e6f 100644
+--- a/drivers/platform/x86/dell-wmi.c
++++ b/drivers/platform/x86/dell-wmi.c
+@@ -221,7 +221,7 @@ static void dell_wmi_notify(u32 value, void *context)
+ 			return;
+ 		}
+ 
+-		if (dell_new_hk_type)
++		if (dell_new_hk_type || buffer_entry[1] == 0x0)
+ 			reported_key = (int)buffer_entry[2];
+ 		else
+ 			reported_key = (int)buffer_entry[1] & 0xffff;
+diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
+index 51c07a0..f1c1862 100644
+--- a/drivers/platform/x86/hp-wmi.c
++++ b/drivers/platform/x86/hp-wmi.c
+@@ -58,6 +58,12 @@ enum hp_wmi_radio {
+ 	HPWMI_WWAN = 2,
+ };
+ 
++enum hp_wmi_event_ids {
++	HPWMI_DOCK_EVENT = 1,
++	HPWMI_BEZEL_BUTTON = 4,
++	HPWMI_WIRELESS = 5,
++};
++
+ static int __devinit hp_wmi_bios_setup(struct platform_device *device);
+ static int __exit hp_wmi_bios_remove(struct platform_device *device);
+ static int hp_wmi_resume_handler(struct device *device);
+@@ -338,7 +344,7 @@ static void hp_wmi_notify(u32 value, void *context)
+ 	struct acpi_buffer response = { ACPI_ALLOCATE_BUFFER, NULL };
+ 	static struct key_entry *key;
+ 	union acpi_object *obj;
+-	int eventcode;
++	int eventcode, key_code;
+ 	acpi_status status;
+ 
+ 	status = wmi_get_event_data(value, &response);
+@@ -357,28 +363,32 @@ static void hp_wmi_notify(u32 value, void *context)
+ 
+ 	eventcode = *((u8 *) obj->buffer.pointer);
+ 	kfree(obj);
+-	if (eventcode == 0x4)
+-		eventcode = hp_wmi_perform_query(HPWMI_HOTKEY_QUERY, 0,
+-						0);
+-	key = hp_wmi_get_entry_by_scancode(eventcode);
+-	if (key) {
+-		switch (key->type) {
+-		case KE_KEY:
+-			input_report_key(hp_wmi_input_dev,
+-					 key->keycode, 1);
+-			input_sync(hp_wmi_input_dev);
+-			input_report_key(hp_wmi_input_dev,
+-					 key->keycode, 0);
+-			input_sync(hp_wmi_input_dev);
+-			break;
+-		}
+-	} else if (eventcode == 0x1) {
++	switch (eventcode) {
++	case HPWMI_DOCK_EVENT:
+ 		input_report_switch(hp_wmi_input_dev, SW_DOCK,
+ 				    hp_wmi_dock_state());
+ 		input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE,
+ 				    hp_wmi_tablet_state());
+ 		input_sync(hp_wmi_input_dev);
+-	} else if (eventcode == 0x5) {
++		break;
++	case HPWMI_BEZEL_BUTTON:
++		key_code = hp_wmi_perform_query(HPWMI_HOTKEY_QUERY, 0,
++						 0);
++		key = hp_wmi_get_entry_by_scancode(key_code);
++		if (key) {
++			switch (key->type) {
++			case KE_KEY:
++				input_report_key(hp_wmi_input_dev,
++						 key->keycode, 1);
++				input_sync(hp_wmi_input_dev);
++				input_report_key(hp_wmi_input_dev,
++						 key->keycode, 0);
++				input_sync(hp_wmi_input_dev);
++				break;
++			}
++		}
++		break;
++	case HPWMI_WIRELESS:
+ 		if (wifi_rfkill)
+ 			rfkill_set_states(wifi_rfkill,
+ 					  hp_wmi_get_sw_state(HPWMI_WIFI),
+@@ -391,9 +401,12 @@ static void hp_wmi_notify(u32 value, void *context)
+ 			rfkill_set_states(wwan_rfkill,
+ 					  hp_wmi_get_sw_state(HPWMI_WWAN),
+ 					  hp_wmi_get_hw_state(HPWMI_WWAN));
+-	} else
++		break;
++	default:
+ 		printk(KERN_INFO "HP WMI: Unknown key pressed - %x\n",
+ 			eventcode);
++		break;
++	}
+ }
+ 
+ static int __init hp_wmi_input_setup(void)
+diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
+index 70b68d3..2a305ef 100644
+--- a/drivers/rtc/rtc-s3c.c
++++ b/drivers/rtc/rtc-s3c.c
+@@ -298,11 +298,6 @@ static int s3c_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
+ 
+ 	s3c_rtc_setaie(alrm->enabled);
+ 
+-	if (alrm->enabled)
+-		enable_irq_wake(s3c_rtc_alarmno);
+-	else
+-		disable_irq_wake(s3c_rtc_alarmno);
+-
+ 	return 0;
+ }
+ 
+@@ -547,6 +542,10 @@ static int s3c_rtc_suspend(struct platform_device *pdev, pm_message_t state)
+ 		ticnt_en_save &= S3C64XX_RTCCON_TICEN;
+ 	}
+ 	s3c_rtc_enable(pdev, 0);
++
++	if (device_may_wakeup(&pdev->dev))
++		enable_irq_wake(s3c_rtc_alarmno);
++
+ 	return 0;
+ }
+ 
+@@ -560,6 +559,10 @@ static int s3c_rtc_resume(struct platform_device *pdev)
+ 		tmp = readb(s3c_rtc_base + S3C2410_RTCCON);
+ 		writeb(tmp | ticnt_en_save, s3c_rtc_base + S3C2410_RTCCON);
+ 	}
++
++	if (device_may_wakeup(&pdev->dev))
++		disable_irq_wake(s3c_rtc_alarmno);
++
+ 	return 0;
+ }
+ #else
+diff --git a/drivers/staging/vt6655/wpactl.c b/drivers/staging/vt6655/wpactl.c
+index 22c2fab..f79808e 100644
+--- a/drivers/staging/vt6655/wpactl.c
++++ b/drivers/staging/vt6655/wpactl.c
+@@ -766,9 +766,14 @@ static int wpa_set_associate(PSDevice pDevice,
+     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "wpa_ie_len = %d\n", param->u.wpa_associate.wpa_ie_len);
+ 
+ 
+-	if (param->u.wpa_associate.wpa_ie &&
+-	    copy_from_user(&abyWPAIE[0], param->u.wpa_associate.wpa_ie, param->u.wpa_associate.wpa_ie_len))
+-	    return -EINVAL;
++	if (param->u.wpa_associate.wpa_ie_len) {
++		if (!param->u.wpa_associate.wpa_ie)
++			return -EINVAL;
++		if (param->u.wpa_associate.wpa_ie_len > sizeof(abyWPAIE))
++			return -EINVAL;
++		if (copy_from_user(&abyWPAIE[0], param->u.wpa_associate.wpa_ie, param->u.wpa_associate.wpa_ie_len))
++			return -EFAULT;
++	}
+ 
+ 	if (param->u.wpa_associate.mode == 1)
+ 	    pMgmt->eConfigMode = WMAC_CONFIG_IBSS_STA;
+diff --git a/drivers/usb/musb/musb_debugfs.c b/drivers/usb/musb/musb_debugfs.c
+index c79a5e3..9e8639d 100644
+--- a/drivers/usb/musb/musb_debugfs.c
++++ b/drivers/usb/musb/musb_debugfs.c
+@@ -195,15 +195,14 @@ static const struct file_operations musb_regdump_fops = {
+ 
+ static int musb_test_mode_open(struct inode *inode, struct file *file)
+ {
+-	file->private_data = inode->i_private;
+-
+ 	return single_open(file, musb_test_mode_show, inode->i_private);
+ }
+ 
+ static ssize_t musb_test_mode_write(struct file *file,
+ 		const char __user *ubuf, size_t count, loff_t *ppos)
+ {
+-	struct musb		*musb = file->private_data;
++	struct seq_file		*s = file->private_data;
++	struct musb		*musb = s->private;
+ 	u8			test = 0;
+ 	char			buf[18];
+ 
+diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
+index 30922a7..aa66581 100644
+--- a/drivers/usb/serial/mos7720.c
++++ b/drivers/usb/serial/mos7720.c
+@@ -2024,6 +2024,9 @@ static int mos7720_ioctl(struct tty_struct *tty, struct file *file,
+ 
+ 	case TIOCGICOUNT:
+ 		cnow = mos7720_port->icount;
++
++		memset(&icount, 0, sizeof(struct serial_icounter_struct));
++
+ 		icount.cts = cnow.cts;
+ 		icount.dsr = cnow.dsr;
+ 		icount.rng = cnow.rng;
+diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
+index 1c9b6e9..1a42bc2 100644
+--- a/drivers/usb/serial/mos7840.c
++++ b/drivers/usb/serial/mos7840.c
+@@ -2285,6 +2285,9 @@ static int mos7840_ioctl(struct tty_struct *tty, struct file *file,
+ 	case TIOCGICOUNT:
+ 		cnow = mos7840_port->icount;
+ 		smp_rmb();
++
++		memset(&icount, 0, sizeof(struct serial_icounter_struct));
++
+ 		icount.cts = cnow.cts;
+ 		icount.dsr = cnow.dsr;
+ 		icount.rng = cnow.rng;
+diff --git a/drivers/video/sis/sis_main.c b/drivers/video/sis/sis_main.c
+index 559bf17..b52f8e4 100644
+--- a/drivers/video/sis/sis_main.c
++++ b/drivers/video/sis/sis_main.c
+@@ -1701,6 +1701,9 @@ static int	sisfb_ioctl(struct fb_info *info, unsigned int cmd,
+ 		break;
+ 
+ 	   case FBIOGET_VBLANK:
++
++		memset(&sisvbblank, 0, sizeof(struct fb_vblank));
++
+ 		sisvbblank.count = 0;
+ 		sisvbblank.flags = sisfb_setupvbblankflags(ivideo, &sisvbblank.vcount, &sisvbblank.hcount);
+ 
+diff --git a/drivers/video/via/ioctl.c b/drivers/video/via/ioctl.c
+index da03c07..4d553d0 100644
+--- a/drivers/video/via/ioctl.c
++++ b/drivers/video/via/ioctl.c
+@@ -25,6 +25,8 @@ int viafb_ioctl_get_viafb_info(u_long arg)
+ {
+ 	struct viafb_ioctl_info viainfo;
+ 
++	memset(&viainfo, 0, sizeof(struct viafb_ioctl_info));
++
+ 	viainfo.viafb_id = VIAID;
+ 	viainfo.vendor_id = PCI_VIA_VENDOR_ID;
+ 
+diff --git a/fs/aio.c b/fs/aio.c
+index 1ccf25c..5fb0fd7 100644
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -712,8 +712,16 @@ static ssize_t aio_run_iocb(struct kiocb *iocb)
+ 	 */
+ 	ret = retry(iocb);
+ 
+-	if (ret != -EIOCBRETRY && ret != -EIOCBQUEUED)
++	if (ret != -EIOCBRETRY && ret != -EIOCBQUEUED) {
++		/*
++		 * There's no easy way to restart the syscall since other AIO's
++		 * may be already running. Just fail this IO with EINTR.
++		 */
++		if (unlikely(ret == -ERESTARTSYS || ret == -ERESTARTNOINTR ||
++			     ret == -ERESTARTNOHAND || ret == -ERESTART_RESTARTBLOCK))
++			ret = -EINTR;
+ 		aio_complete(iocb, ret, 0);
++	}
+ out:
+ 	spin_lock_irq(&ctx->ctx_lock);
+ 
+@@ -1659,6 +1667,9 @@ long do_io_submit(aio_context_t ctx_id, long nr,
+ 	if (unlikely(nr < 0))
+ 		return -EINVAL;
+ 
++	if (unlikely(nr > LONG_MAX/sizeof(*iocbpp)))
++		nr = LONG_MAX/sizeof(*iocbpp);
++
+ 	if (unlikely(!access_ok(VERIFY_READ, iocbpp, (nr*sizeof(*iocbpp)))))
+ 		return -EFAULT;
+ 
+diff --git a/fs/char_dev.c b/fs/char_dev.c
+index f80a4f2..143d393 100644
+--- a/fs/char_dev.c
++++ b/fs/char_dev.c
+@@ -40,7 +40,9 @@ struct backing_dev_info directly_mappable_cdev_bdi = {
+ #endif
+ 		/* permit direct mmap, for read, write or exec */
+ 		BDI_CAP_MAP_DIRECT |
+-		BDI_CAP_READ_MAP | BDI_CAP_WRITE_MAP | BDI_CAP_EXEC_MAP),
++		BDI_CAP_READ_MAP | BDI_CAP_WRITE_MAP | BDI_CAP_EXEC_MAP |
++		/* no writeback happens */
++		BDI_CAP_NO_ACCT_AND_WRITEBACK),
+ };
+ 
+ static struct kobj_map *cdev_map;
+diff --git a/fs/compat.c b/fs/compat.c
+index 6490d21..af7c230 100644
+--- a/fs/compat.c
++++ b/fs/compat.c
+@@ -1150,7 +1150,7 @@ static ssize_t compat_do_readv_writev(int type, struct file *file,
+ {
+ 	compat_ssize_t tot_len;
+ 	struct iovec iovstack[UIO_FASTIOV];
+-	struct iovec *iov;
++	struct iovec *iov = iovstack;
+ 	ssize_t ret;
+ 	io_fn_t fn;
+ 	iov_fn_t fnv;
+diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
+index 6a857e2..83917b5 100644
+--- a/fs/gfs2/log.c
++++ b/fs/gfs2/log.c
+@@ -932,7 +932,7 @@ int gfs2_logd(void *data)
+ 
+ 		do {
+ 			prepare_to_wait(&sdp->sd_logd_waitq, &wait,
+-					TASK_UNINTERRUPTIBLE);
++					TASK_INTERRUPTIBLE);
+ 			if (!gfs2_ail_flush_reqd(sdp) &&
+ 			    !gfs2_jrnl_flush_reqd(sdp) &&
+ 			    !kthread_should_stop())
+diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
+index e46ca68..0c6bbc0 100644
+--- a/fs/notify/inotify/inotify_user.c
++++ b/fs/notify/inotify/inotify_user.c
+@@ -96,8 +96,11 @@ static inline __u32 inotify_arg_to_mask(u32 arg)
+ {
+ 	__u32 mask;
+ 
+-	/* everything should accept their own ignored and cares about children */
+-	mask = (FS_IN_IGNORED | FS_EVENT_ON_CHILD);
++	/*
++	 * everything should accept their own ignored, cares about children,
++	 * and should receive events when the inode is unmounted
++	 */
++	mask = (FS_IN_IGNORED | FS_EVENT_ON_CHILD | FS_UNMOUNT);
+ 
+ 	/* mask off the flags used to open the fd */
+ 	mask |= (arg & (IN_ALL_EVENTS | IN_ONESHOT));
+diff --git a/fs/proc/vmcore.c b/fs/proc/vmcore.c
+index 91c817f..2367fb3 100644
+--- a/fs/proc/vmcore.c
++++ b/fs/proc/vmcore.c
+@@ -163,7 +163,7 @@ static ssize_t read_vmcore(struct file *file, char __user *buffer,
+ 
+ static const struct file_operations proc_vmcore_operations = {
+ 	.read		= read_vmcore,
+-	.llseek		= generic_file_llseek,
++	.llseek		= default_llseek,
+ };
+ 
+ static struct vmcore* __init get_new_element(void)
+diff --git a/fs/xfs/linux-2.6/xfs_ioctl.c b/fs/xfs/linux-2.6/xfs_ioctl.c
+index e59a810..82a74f6 100644
+--- a/fs/xfs/linux-2.6/xfs_ioctl.c
++++ b/fs/xfs/linux-2.6/xfs_ioctl.c
+@@ -794,6 +794,8 @@ xfs_ioc_fsgetxattr(
+ {
+ 	struct fsxattr		fa;
+ 
++	memset(&fa, 0, sizeof(struct fsxattr));
++
+ 	xfs_ilock(ip, XFS_ILOCK_SHARED);
+ 	fa.fsx_xflags = xfs_ip2xflags(ip);
+ 	fa.fsx_extsize = ip->i_d.di_extsize << ip->i_mount->m_sb.sb_blocklog;
+diff --git a/include/linux/ksm.h b/include/linux/ksm.h
+index 43bdab7..e809eb1 100644
+--- a/include/linux/ksm.h
++++ b/include/linux/ksm.h
+@@ -16,6 +16,9 @@
+ struct stable_node;
+ struct mem_cgroup;
+ 
++struct page *ksm_does_need_to_copy(struct page *page,
++			struct vm_area_struct *vma, unsigned long address);
++
+ #ifdef CONFIG_KSM
+ int ksm_madvise(struct vm_area_struct *vma, unsigned long start,
+ 		unsigned long end, int advice, unsigned long *vm_flags);
+@@ -70,19 +73,14 @@ static inline void set_page_stable_node(struct page *page,
+  * We'd like to make this conditional on vma->vm_flags & VM_MERGEABLE,
+  * but what if the vma was unmerged while the page was swapped out?
+  */
+-struct page *ksm_does_need_to_copy(struct page *page,
+-			struct vm_area_struct *vma, unsigned long address);
+-static inline struct page *ksm_might_need_to_copy(struct page *page,
++static inline int ksm_might_need_to_copy(struct page *page,
+ 			struct vm_area_struct *vma, unsigned long address)
+ {
+ 	struct anon_vma *anon_vma = page_anon_vma(page);
+ 
+-	if (!anon_vma ||
+-	    (anon_vma == vma->anon_vma &&
+-	     page->index == linear_page_index(vma, address)))
+-		return page;
+-
+-	return ksm_does_need_to_copy(page, vma, address);
++	return anon_vma &&
++		(anon_vma != vma->anon_vma ||
++		 page->index != linear_page_index(vma, address));
+ }
+ 
+ int page_referenced_ksm(struct page *page,
+@@ -115,10 +113,10 @@ static inline int ksm_madvise(struct vm_area_struct *vma, unsigned long start,
+ 	return 0;
+ }
+ 
+-static inline struct page *ksm_might_need_to_copy(struct page *page,
++static inline int ksm_might_need_to_copy(struct page *page,
+ 			struct vm_area_struct *vma, unsigned long address)
+ {
+-	return page;
++	return 0;
+ }
+ 
+ static inline int page_referenced_ksm(struct page *page,
+diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
+index 7cb116a..f24d8fc 100644
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -123,6 +123,7 @@ struct kvm_memory_slot {
+ 	} *lpage_info[KVM_NR_PAGE_SIZES - 1];
+ 	unsigned long userspace_addr;
+ 	int user_alloc;
++	int id;
+ };
+ 
+ static inline unsigned long kvm_dirty_bitmap_bytes(struct kvm_memory_slot *memslot)
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index a2b4804..c1f54d2 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -78,7 +78,11 @@ extern unsigned int kobjsize(const void *objp);
+ #define VM_MAYSHARE	0x00000080
+ 
+ #define VM_GROWSDOWN	0x00000100	/* general info on the segment */
++#if defined(CONFIG_STACK_GROWSUP) || defined(CONFIG_IA64)
+ #define VM_GROWSUP	0x00000200
++#else
++#define VM_GROWSUP	0x00000000
++#endif
+ #define VM_PFNMAP	0x00000400	/* Page-ranges managed without "struct page", just pure PFN */
+ #define VM_DENYWRITE	0x00000800	/* ETXTBSY on write attempts.. */
+ 
+@@ -1329,8 +1333,10 @@ unsigned long ra_submit(struct file_ra_state *ra,
+ 
+ /* Do stack extension */
+ extern int expand_stack(struct vm_area_struct *vma, unsigned long address);
+-#ifdef CONFIG_IA64
++#if VM_GROWSUP
+ extern int expand_upwards(struct vm_area_struct *vma, unsigned long address);
++#else
++  #define expand_upwards(vma, address) do { } while (0)
+ #endif
+ extern int expand_stack_downwards(struct vm_area_struct *vma,
+ 				  unsigned long address);
+diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
+index b4d109e..8b2db3d 100644
+--- a/include/linux/mmzone.h
++++ b/include/linux/mmzone.h
+@@ -284,6 +284,13 @@ struct zone {
+ 	unsigned long watermark[NR_WMARK];
+ 
+ 	/*
++	 * When free pages are below this point, additional steps are taken
++	 * when reading the number of free pages to avoid per-cpu counter
++	 * drift allowing watermarks to be breached
++	 */
++	unsigned long percpu_drift_mark;
++
++	/*
+ 	 * We don't know if the memory that we're going to allocate will be freeable
+ 	 * or/and it will be released eventually, so to avoid totally wasting several
+ 	 * GB of ram we must reserve some of the lower zone memory (otherwise we risk
+@@ -456,6 +463,12 @@ static inline int zone_is_oom_locked(const struct zone *zone)
+ 	return test_bit(ZONE_OOM_LOCKED, &zone->flags);
+ }
+ 
++#ifdef CONFIG_SMP
++unsigned long zone_nr_free_pages(struct zone *zone);
++#else
++#define zone_nr_free_pages(zone) zone_page_state(zone, NR_FREE_PAGES)
++#endif /* CONFIG_SMP */
++
+ /*
+  * The "priority" of VM scanning is how much of the queues we will scan in one
+  * go. A value of 12 for DEF_PRIORITY implies that we will scan 1/4096th of the
+diff --git a/include/linux/vmstat.h b/include/linux/vmstat.h
+index 7f43ccd..eaaea37 100644
+--- a/include/linux/vmstat.h
++++ b/include/linux/vmstat.h
+@@ -170,6 +170,28 @@ static inline unsigned long zone_page_state(struct zone *zone,
+ 	return x;
+ }
+ 
++/*
++ * More accurate version that also considers the currently pending
++ * deltas. For that we need to loop over all cpus to find the current
++ * deltas. There is no synchronization so the result cannot be
++ * exactly accurate either.
++ */
++static inline unsigned long zone_page_state_snapshot(struct zone *zone,
++					enum zone_stat_item item)
++{
++	long x = atomic_long_read(&zone->vm_stat[item]);
++
++#ifdef CONFIG_SMP
++	int cpu;
++	for_each_online_cpu(cpu)
++		x += per_cpu_ptr(zone->pageset, cpu)->vm_stat_diff[item];
++
++	if (x < 0)
++		x = 0;
++#endif
++	return x;
++}
++
+ extern unsigned long global_reclaimable_pages(void);
+ extern unsigned long zone_reclaimable_pages(struct zone *zone);
+ 
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 0a691ea..e2a9f59 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -749,6 +749,7 @@ struct proto {
+ 	/* Keeping track of sk's, looking them up, and port selection methods. */
+ 	void			(*hash)(struct sock *sk);
+ 	void			(*unhash)(struct sock *sk);
++	void			(*rehash)(struct sock *sk);
+ 	int			(*get_port)(struct sock *sk, unsigned short snum);
+ 
+ 	/* Keeping track of sockets in use */
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index a144914..e824cf0 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -268,11 +268,21 @@ static inline int between(__u32 seq1, __u32 seq2, __u32 seq3)
+ 	return seq3 - seq2 >= seq1 - seq2;
+ }
+ 
+-static inline int tcp_too_many_orphans(struct sock *sk, int num)
++static inline bool tcp_too_many_orphans(struct sock *sk, int shift)
+ {
+-	return (num > sysctl_tcp_max_orphans) ||
+-		(sk->sk_wmem_queued > SOCK_MIN_SNDBUF &&
+-		 atomic_read(&tcp_memory_allocated) > sysctl_tcp_mem[2]);
++	struct percpu_counter *ocp = sk->sk_prot->orphan_count;
++	int orphans = percpu_counter_read_positive(ocp);
++
++	if (orphans << shift > sysctl_tcp_max_orphans) {
++		orphans = percpu_counter_sum_positive(ocp);
++		if (orphans << shift > sysctl_tcp_max_orphans)
++			return true;
++	}
++
++	if (sk->sk_wmem_queued > SOCK_MIN_SNDBUF &&
++	    atomic_read(&tcp_memory_allocated) > sysctl_tcp_mem[2])
++		return true;
++	return false;
+ }
+ 
+ /* syncookies: remember time of last synqueue overflow */
+@@ -509,8 +519,22 @@ extern unsigned int tcp_current_mss(struct sock *sk);
+ /* Bound MSS / TSO packet size with the half of the window */
+ static inline int tcp_bound_to_half_wnd(struct tcp_sock *tp, int pktsize)
+ {
+-	if (tp->max_window && pktsize > (tp->max_window >> 1))
+-		return max(tp->max_window >> 1, 68U - tp->tcp_header_len);
++	int cutoff;
++
++	/* When peer uses tiny windows, there is no use in packetizing
++	 * to sub-MSS pieces for the sake of SWS or making sure there
++	 * are enough packets in the pipe for fast recovery.
++	 *
++	 * On the other hand, for extremely large MSS devices, handling
++	 * smaller than MSS windows in this way does make sense.
++	 */
++	if (tp->max_window >= 512)
++		cutoff = (tp->max_window >> 1);
++	else
++		cutoff = tp->max_window;
++
++	if (cutoff && pktsize > cutoff)
++		return max_t(int, cutoff, 68U - tp->tcp_header_len);
+ 	else
+ 		return pktsize;
+ }
+diff --git a/include/net/udp.h b/include/net/udp.h
+index 5348d80..4201dc8 100644
+--- a/include/net/udp.h
++++ b/include/net/udp.h
+@@ -151,6 +151,7 @@ static inline void udp_lib_hash(struct sock *sk)
+ }
+ 
+ extern void udp_lib_unhash(struct sock *sk);
++extern void udp_lib_rehash(struct sock *sk, u16 new_hash);
+ 
+ static inline void udp_lib_close(struct sock *sk, long timeout)
+ {
+diff --git a/kernel/exit.c b/kernel/exit.c
+index ceffc67..ac90425 100644
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -1383,8 +1383,7 @@ static int wait_task_stopped(struct wait_opts *wo,
+ 	if (!unlikely(wo->wo_flags & WNOWAIT))
+ 		*p_code = 0;
+ 
+-	/* don't need the RCU readlock here as we're holding a spinlock */
+-	uid = __task_cred(p)->uid;
++	uid = task_uid(p);
+ unlock_sig:
+ 	spin_unlock_irq(&p->sighand->siglock);
+ 	if (!exit_code)
+@@ -1457,7 +1456,7 @@ static int wait_task_continued(struct wait_opts *wo, struct task_struct *p)
+ 	}
+ 	if (!unlikely(wo->wo_flags & WNOWAIT))
+ 		p->signal->flags &= ~SIGNAL_STOP_CONTINUED;
+-	uid = __task_cred(p)->uid;
++	uid = task_uid(p);
+ 	spin_unlock_irq(&p->sighand->siglock);
+ 
+ 	pid = task_pid_vnr(p);
+diff --git a/kernel/hw_breakpoint.c b/kernel/hw_breakpoint.c
+index 7a56b22..6eb6422 100644
+--- a/kernel/hw_breakpoint.c
++++ b/kernel/hw_breakpoint.c
+@@ -417,7 +417,8 @@ register_user_hw_breakpoint(struct perf_event_attr *attr,
+ 			    perf_overflow_handler_t triggered,
+ 			    struct task_struct *tsk)
+ {
+-	return perf_event_create_kernel_counter(attr, -1, tsk->pid, triggered);
++	return perf_event_create_kernel_counter(attr, -1, task_pid_vnr(tsk),
++						triggered);
+ }
+ EXPORT_SYMBOL_GPL(register_user_hw_breakpoint);
+ 
+diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
+index 25ce010..7fa52b5 100644
+--- a/kernel/power/snapshot.c
++++ b/kernel/power/snapshot.c
+@@ -1121,9 +1121,19 @@ static unsigned long preallocate_image_pages(unsigned long nr_pages, gfp_t mask)
+ 	return nr_alloc;
+ }
+ 
+-static unsigned long preallocate_image_memory(unsigned long nr_pages)
++static unsigned long preallocate_image_memory(unsigned long nr_pages,
++					      unsigned long avail_normal)
+ {
+-	return preallocate_image_pages(nr_pages, GFP_IMAGE);
++	unsigned long alloc;
++
++	if (avail_normal <= alloc_normal)
++		return 0;
++
++	alloc = avail_normal - alloc_normal;
++	if (nr_pages < alloc)
++		alloc = nr_pages;
++
++	return preallocate_image_pages(alloc, GFP_IMAGE);
+ }
+ 
+ #ifdef CONFIG_HIGHMEM
+@@ -1169,15 +1179,22 @@ static inline unsigned long preallocate_highmem_fraction(unsigned long nr_pages,
+  */
+ static void free_unnecessary_pages(void)
+ {
+-	unsigned long save_highmem, to_free_normal, to_free_highmem;
++	unsigned long save, to_free_normal, to_free_highmem;
+ 
+-	to_free_normal = alloc_normal - count_data_pages();
+-	save_highmem = count_highmem_pages();
+-	if (alloc_highmem > save_highmem) {
+-		to_free_highmem = alloc_highmem - save_highmem;
++	save = count_data_pages();
++	if (alloc_normal >= save) {
++		to_free_normal = alloc_normal - save;
++		save = 0;
++	} else {
++		to_free_normal = 0;
++		save -= alloc_normal;
++	}
++	save += count_highmem_pages();
++	if (alloc_highmem >= save) {
++		to_free_highmem = alloc_highmem - save;
+ 	} else {
+ 		to_free_highmem = 0;
+-		to_free_normal -= save_highmem - alloc_highmem;
++		to_free_normal -= save - alloc_highmem;
+ 	}
+ 
+ 	memory_bm_position_reset(&copy_bm);
+@@ -1258,7 +1275,7 @@ int hibernate_preallocate_memory(void)
+ {
+ 	struct zone *zone;
+ 	unsigned long saveable, size, max_size, count, highmem, pages = 0;
+-	unsigned long alloc, save_highmem, pages_highmem;
++	unsigned long alloc, save_highmem, pages_highmem, avail_normal;
+ 	struct timeval start, stop;
+ 	int error;
+ 
+@@ -1295,6 +1312,7 @@ int hibernate_preallocate_memory(void)
+ 		else
+ 			count += zone_page_state(zone, NR_FREE_PAGES);
+ 	}
++	avail_normal = count;
+ 	count += highmem;
+ 	count -= totalreserve_pages;
+ 
+@@ -1309,12 +1327,21 @@ int hibernate_preallocate_memory(void)
+ 	 */
+ 	if (size >= saveable) {
+ 		pages = preallocate_image_highmem(save_highmem);
+-		pages += preallocate_image_memory(saveable - pages);
++		pages += preallocate_image_memory(saveable - pages, avail_normal);
+ 		goto out;
+ 	}
+ 
+ 	/* Estimate the minimum size of the image. */
+ 	pages = minimum_image_size(saveable);
++	/*
++	 * To avoid excessive pressure on the normal zone, leave room in it to
++	 * accommodate an image of the minimum size (unless it's already too
++	 * small, in which case don't preallocate pages from it at all).
++	 */
++	if (avail_normal > pages)
++		avail_normal -= pages;
++	else
++		avail_normal = 0;
+ 	if (size < pages)
+ 		size = min_t(unsigned long, pages, max_size);
+ 
+@@ -1335,16 +1362,34 @@ int hibernate_preallocate_memory(void)
+ 	 */
+ 	pages_highmem = preallocate_image_highmem(highmem / 2);
+ 	alloc = (count - max_size) - pages_highmem;
+-	pages = preallocate_image_memory(alloc);
+-	if (pages < alloc)
+-		goto err_out;
+-	size = max_size - size;
+-	alloc = size;
+-	size = preallocate_highmem_fraction(size, highmem, count);
+-	pages_highmem += size;
+-	alloc -= size;
+-	pages += preallocate_image_memory(alloc);
+-	pages += pages_highmem;
++	pages = preallocate_image_memory(alloc, avail_normal);
++	if (pages < alloc) {
++		/* We have exhausted non-highmem pages, try highmem. */
++		alloc -= pages;
++		pages += pages_highmem;
++		pages_highmem = preallocate_image_highmem(alloc);
++		if (pages_highmem < alloc)
++			goto err_out;
++		pages += pages_highmem;
++		/*
++		 * size is the desired number of saveable pages to leave in
++		 * memory, so try to preallocate (all memory - size) pages.
++		 */
++		alloc = (count - pages) - size;
++		pages += preallocate_image_highmem(alloc);
++	} else {
++		/*
++		 * There are approximately max_size saveable pages at this point
++		 * and we want to reduce this number down to size.
++		 */
++		alloc = max_size - size;
++		size = preallocate_highmem_fraction(alloc, highmem, count);
++		pages_highmem += size;
++		alloc -= size;
++		size = preallocate_image_memory(alloc, avail_normal);
++		pages_highmem += preallocate_image_highmem(alloc - size);
++		pages += pages_highmem + size;
++	}
+ 
+ 	/*
+ 	 * We only need as many page frames for the image as there are saveable
+diff --git a/kernel/sched.c b/kernel/sched.c
+index 6d0dbeb..4fa520b 100644
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -3349,9 +3349,9 @@ void task_times(struct task_struct *p, cputime_t *ut, cputime_t *st)
+ 	rtime = nsecs_to_cputime(p->se.sum_exec_runtime);
+ 
+ 	if (total) {
+-		u64 temp;
++		u64 temp = rtime;
+ 
+-		temp = (u64)(rtime * utime);
++		temp *= utime;
+ 		do_div(temp, total);
+ 		utime = (cputime_t)temp;
+ 	} else
+@@ -3382,9 +3382,9 @@ void thread_group_times(struct task_struct *p, cputime_t *ut, cputime_t *st)
+ 	rtime = nsecs_to_cputime(cputime.sum_exec_runtime);
+ 
+ 	if (total) {
+-		u64 temp;
++		u64 temp = rtime;
+ 
+-		temp = (u64)(rtime * cputime.utime);
++		temp *= cputime.utime;
+ 		do_div(temp, total);
+ 		utime = (cputime_t)temp;
+ 	} else
+diff --git a/kernel/sys.c b/kernel/sys.c
+index e83ddbb..f4fcc6e 100644
+--- a/kernel/sys.c
++++ b/kernel/sys.c
+@@ -931,6 +931,7 @@ SYSCALL_DEFINE2(setpgid, pid_t, pid, pid_t, pgid)
+ 		pgid = pid;
+ 	if (pgid < 0)
+ 		return -EINVAL;
++	rcu_read_lock();
+ 
+ 	/* From this point forward we keep holding onto the tasklist lock
+ 	 * so that our parent does not change from under us. -DaveM
+@@ -984,6 +985,7 @@ SYSCALL_DEFINE2(setpgid, pid_t, pid, pid_t, pgid)
+ out:
+ 	/* All paths lead to here, thus we are safe. -DaveM */
+ 	write_unlock_irq(&tasklist_lock);
++	rcu_read_unlock();
+ 	return err;
+ }
+ 
+diff --git a/mm/backing-dev.c b/mm/backing-dev.c
+index 123bcef..c0f7157 100644
+--- a/mm/backing-dev.c
++++ b/mm/backing-dev.c
+@@ -29,6 +29,7 @@ EXPORT_SYMBOL_GPL(default_backing_dev_info);
+ 
+ struct backing_dev_info noop_backing_dev_info = {
+ 	.name		= "noop",
++	.capabilities	= BDI_CAP_NO_ACCT_AND_WRITEBACK,
+ };
+ EXPORT_SYMBOL_GPL(noop_backing_dev_info);
+ 
+@@ -254,6 +255,7 @@ static int __init default_bdi_init(void)
+ 	err = bdi_init(&default_backing_dev_info);
+ 	if (!err)
+ 		bdi_register(&default_backing_dev_info, NULL, "default");
++	err = bdi_init(&noop_backing_dev_info);
+ 
+ 	return err;
+ }
+diff --git a/mm/ksm.c b/mm/ksm.c
+index 6c3e99b..17ee9df 100644
+--- a/mm/ksm.c
++++ b/mm/ksm.c
+@@ -1523,8 +1523,6 @@ struct page *ksm_does_need_to_copy(struct page *page,
+ {
+ 	struct page *new_page;
+ 
+-	unlock_page(page);	/* any racers will COW it, not modify it */
+-
+ 	new_page = alloc_page_vma(GFP_HIGHUSER_MOVABLE, vma, address);
+ 	if (new_page) {
+ 		copy_user_highpage(new_page, page, address, vma);
+@@ -1540,7 +1538,6 @@ struct page *ksm_does_need_to_copy(struct page *page,
+ 			add_page_to_unevictable_list(new_page);
+ 	}
+ 
+-	page_cache_release(page);
+ 	return new_page;
+ }
+ 
+diff --git a/mm/memory.c b/mm/memory.c
+index 53cf85d..7550758 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -2626,7 +2626,7 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
+ 		unsigned int flags, pte_t orig_pte)
+ {
+ 	spinlock_t *ptl;
+-	struct page *page;
++	struct page *page, *swapcache = NULL;
+ 	swp_entry_t entry;
+ 	pte_t pte;
+ 	struct mem_cgroup *ptr = NULL;
+@@ -2681,10 +2681,25 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
+ 	lock_page(page);
+ 	delayacct_clear_flag(DELAYACCT_PF_SWAPIN);
+ 
+-	page = ksm_might_need_to_copy(page, vma, address);
+-	if (!page) {
+-		ret = VM_FAULT_OOM;
+-		goto out;
++	/*
++	 * Make sure try_to_free_swap or reuse_swap_page or swapoff did not
++	 * release the swapcache from under us.  The page pin, and pte_same
++	 * test below, are not enough to exclude that.  Even if it is still
++	 * swapcache, we need to check that the page's swap has not changed.
++	 */
++	if (unlikely(!PageSwapCache(page) || page_private(page) != entry.val))
++		goto out_page;
++
++	if (ksm_might_need_to_copy(page, vma, address)) {
++		swapcache = page;
++		page = ksm_does_need_to_copy(page, vma, address);
++
++		if (unlikely(!page)) {
++			ret = VM_FAULT_OOM;
++			page = swapcache;
++			swapcache = NULL;
++			goto out_page;
++		}
+ 	}
+ 
+ 	if (mem_cgroup_try_charge_swapin(mm, page, GFP_KERNEL, &ptr)) {
+@@ -2735,6 +2750,18 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
+ 	if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
+ 		try_to_free_swap(page);
+ 	unlock_page(page);
++	if (swapcache) {
++		/*
++		 * Hold the lock to avoid the swap entry to be reused
++		 * until we take the PT lock for the pte_same() check
++		 * (to avoid false positives from pte_same). For
++		 * further safety release the lock after the swap_free
++		 * so that the swap count won't change under a
++		 * parallel locked swapcache.
++		 */
++		unlock_page(swapcache);
++		page_cache_release(swapcache);
++	}
+ 
+ 	if (flags & FAULT_FLAG_WRITE) {
+ 		ret |= do_wp_page(mm, vma, address, page_table, pmd, ptl, pte);
+@@ -2756,15 +2783,17 @@ out_page:
+ 	unlock_page(page);
+ out_release:
+ 	page_cache_release(page);
++	if (swapcache) {
++		unlock_page(swapcache);
++		page_cache_release(swapcache);
++	}
+ 	return ret;
+ }
+ 
+ /*
+- * This is like a special single-page "expand_downwards()",
+- * except we must first make sure that 'address-PAGE_SIZE'
++ * This is like a special single-page "expand_{down|up}wards()",
++ * except we must first make sure that 'address{-|+}PAGE_SIZE'
+  * doesn't hit another vma.
+- *
+- * The "find_vma()" will do the right thing even if we wrap
+  */
+ static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address)
+ {
+@@ -2783,6 +2812,15 @@ static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned lo
+ 
+ 		expand_stack(vma, address - PAGE_SIZE);
+ 	}
++	if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
++		struct vm_area_struct *next = vma->vm_next;
++
++		/* As VM_GROWSDOWN but s/below/above/ */
++		if (next && next->vm_start == address + PAGE_SIZE)
++			return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
++
++		expand_upwards(vma, address + PAGE_SIZE);
++	}
+ 	return 0;
+ }
+ 
+diff --git a/mm/mmap.c b/mm/mmap.c
+index 3867cfc..3a94362 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -1704,9 +1704,6 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+  * PA-RISC uses this for its stack; IA64 for its Register Backing Store.
+  * vma is the last one with address > vma->vm_end.  Have to extend vma.
+  */
+-#ifndef CONFIG_IA64
+-static
+-#endif
+ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
+ {
+ 	int error;
+@@ -1997,6 +1994,7 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+ 			removed_exe_file_vma(mm);
+ 		fput(new->vm_file);
+ 	}
++	unlink_anon_vmas(new);
+  out_free_mpol:
+ 	mpol_put(pol);
+  out_free_vma:
+diff --git a/mm/mmzone.c b/mm/mmzone.c
+index f5b7d17..e35bfb8 100644
+--- a/mm/mmzone.c
++++ b/mm/mmzone.c
+@@ -87,3 +87,24 @@ int memmap_valid_within(unsigned long pfn,
+ 	return 1;
+ }
+ #endif /* CONFIG_ARCH_HAS_HOLES_MEMORYMODEL */
++
++#ifdef CONFIG_SMP
++/* Called when a more accurate view of NR_FREE_PAGES is needed */
++unsigned long zone_nr_free_pages(struct zone *zone)
++{
++	unsigned long nr_free_pages = zone_page_state(zone, NR_FREE_PAGES);
++
++	/*
++	 * While kswapd is awake, it is considered the zone is under some
++	 * memory pressure. Under pressure, there is a risk that
++	 * per-cpu-counter-drift will allow the min watermark to be breached
++	 * potentially causing a live-lock. While kswapd is awake and
++	 * free pages are low, get a better estimate for free pages
++	 */
++	if (nr_free_pages < zone->percpu_drift_mark &&
++			!waitqueue_active(&zone->zone_pgdat->kswapd_wait))
++		return zone_page_state_snapshot(zone, NR_FREE_PAGES);
++
++	return nr_free_pages;
++}
++#endif /* CONFIG_SMP */
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 9bd339e..f7cc624 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -588,13 +588,13 @@ static void free_pcppages_bulk(struct zone *zone, int count,
+ {
+ 	int migratetype = 0;
+ 	int batch_free = 0;
++	int to_free = count;
+ 
+ 	spin_lock(&zone->lock);
+ 	zone->all_unreclaimable = 0;
+ 	zone->pages_scanned = 0;
+ 
+-	__mod_zone_page_state(zone, NR_FREE_PAGES, count);
+-	while (count) {
++	while (to_free) {
+ 		struct page *page;
+ 		struct list_head *list;
+ 
+@@ -619,8 +619,9 @@ static void free_pcppages_bulk(struct zone *zone, int count,
+ 			/* MIGRATE_MOVABLE list may include MIGRATE_RESERVEs */
+ 			__free_one_page(page, zone, 0, page_private(page));
+ 			trace_mm_page_pcpu_drain(page, 0, page_private(page));
+-		} while (--count && --batch_free && !list_empty(list));
++		} while (--to_free && --batch_free && !list_empty(list));
+ 	}
++	__mod_zone_page_state(zone, NR_FREE_PAGES, count);
+ 	spin_unlock(&zone->lock);
+ }
+ 
+@@ -631,8 +632,8 @@ static void free_one_page(struct zone *zone, struct page *page, int order,
+ 	zone->all_unreclaimable = 0;
+ 	zone->pages_scanned = 0;
+ 
+-	__mod_zone_page_state(zone, NR_FREE_PAGES, 1 << order);
+ 	__free_one_page(page, zone, order, migratetype);
++	__mod_zone_page_state(zone, NR_FREE_PAGES, 1 << order);
+ 	spin_unlock(&zone->lock);
+ }
+ 
+@@ -1461,7 +1462,7 @@ int zone_watermark_ok(struct zone *z, int order, unsigned long mark,
+ {
+ 	/* free_pages my go negative - that's OK */
+ 	long min = mark;
+-	long free_pages = zone_page_state(z, NR_FREE_PAGES) - (1 << order) + 1;
++	long free_pages = zone_nr_free_pages(z) - (1 << order) + 1;
+ 	int o;
+ 
+ 	if (alloc_flags & ALLOC_HIGH)
+@@ -1843,6 +1844,7 @@ __alloc_pages_direct_reclaim(gfp_t gfp_mask, unsigned int order,
+ 	struct page *page = NULL;
+ 	struct reclaim_state reclaim_state;
+ 	struct task_struct *p = current;
++	bool drained = false;
+ 
+ 	cond_resched();
+ 
+@@ -1861,14 +1863,25 @@ __alloc_pages_direct_reclaim(gfp_t gfp_mask, unsigned int order,
+ 
+ 	cond_resched();
+ 
+-	if (order != 0)
+-		drain_all_pages();
++	if (unlikely(!(*did_some_progress)))
++		return NULL;
+ 
+-	if (likely(*did_some_progress))
+-		page = get_page_from_freelist(gfp_mask, nodemask, order,
++retry:
++	page = get_page_from_freelist(gfp_mask, nodemask, order,
+ 					zonelist, high_zoneidx,
+ 					alloc_flags, preferred_zone,
+ 					migratetype);
++
++	/*
++	 * If an allocation failed after direct reclaim, it could be because
++	 * pages are pinned on the per-cpu lists. Drain them and try again
++	 */
++	if (!page && !drained) {
++		drain_all_pages();
++		drained = true;
++		goto retry;
++	}
++
+ 	return page;
+ }
+ 
+@@ -2412,7 +2425,7 @@ void show_free_areas(void)
+ 			" all_unreclaimable? %s"
+ 			"\n",
+ 			zone->name,
+-			K(zone_page_state(zone, NR_FREE_PAGES)),
++			K(zone_nr_free_pages(zone)),
+ 			K(min_wmark_pages(zone)),
+ 			K(low_wmark_pages(zone)),
+ 			K(high_wmark_pages(zone)),
+diff --git a/mm/percpu.c b/mm/percpu.c
+index 6470e77..0a09fff 100644
+--- a/mm/percpu.c
++++ b/mm/percpu.c
+@@ -1413,9 +1413,9 @@ int __init pcpu_setup_first_chunk(const struct pcpu_alloc_info *ai,
+ 
+ 			if (pcpu_first_unit_cpu == NR_CPUS)
+ 				pcpu_first_unit_cpu = cpu;
++			pcpu_last_unit_cpu = cpu;
+ 		}
+ 	}
+-	pcpu_last_unit_cpu = cpu;
+ 	pcpu_nr_units = unit;
+ 
+ 	for_each_possible_cpu(cpu)
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index b94fe1b..9753626 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -1726,13 +1726,12 @@ static void shrink_zone(int priority, struct zone *zone,
+  * If a zone is deemed to be full of pinned pages then just give it a light
+  * scan then give up on it.
+  */
+-static bool shrink_zones(int priority, struct zonelist *zonelist,
++static void shrink_zones(int priority, struct zonelist *zonelist,
+ 					struct scan_control *sc)
+ {
+ 	enum zone_type high_zoneidx = gfp_zone(sc->gfp_mask);
+ 	struct zoneref *z;
+ 	struct zone *zone;
+-	bool all_unreclaimable = true;
+ 
+ 	for_each_zone_zonelist_nodemask(zone, z, zonelist, high_zoneidx,
+ 					sc->nodemask) {
+@@ -1759,8 +1758,38 @@ static bool shrink_zones(int priority, struct zonelist *zonelist,
+ 		}
+ 
+ 		shrink_zone(priority, zone, sc);
+-		all_unreclaimable = false;
+ 	}
++}
++
++static bool zone_reclaimable(struct zone *zone)
++{
++	return zone->pages_scanned < zone_reclaimable_pages(zone) * 6;
++}
++
++/*
++ * As hibernation is going on, kswapd is freezed so that it can't mark
++ * the zone into all_unreclaimable. It can't handle OOM during hibernation.
++ * So let's check zone's unreclaimable in direct reclaim as well as kswapd.
++ */
++static bool all_unreclaimable(struct zonelist *zonelist,
++		struct scan_control *sc)
++{
++	struct zoneref *z;
++	struct zone *zone;
++	bool all_unreclaimable = true;
++
++	for_each_zone_zonelist_nodemask(zone, z, zonelist,
++			gfp_zone(sc->gfp_mask), sc->nodemask) {
++		if (!populated_zone(zone))
++			continue;
++		if (!cpuset_zone_allowed_hardwall(zone, GFP_KERNEL))
++			continue;
++		if (zone_reclaimable(zone)) {
++			all_unreclaimable = false;
++			break;
++		}
++	}
++
+ 	return all_unreclaimable;
+ }
+ 
+@@ -1784,7 +1813,6 @@ static unsigned long do_try_to_free_pages(struct zonelist *zonelist,
+ 					struct scan_control *sc)
+ {
+ 	int priority;
+-	bool all_unreclaimable;
+ 	unsigned long total_scanned = 0;
+ 	struct reclaim_state *reclaim_state = current->reclaim_state;
+ 	unsigned long lru_pages = 0;
+@@ -1815,7 +1843,7 @@ static unsigned long do_try_to_free_pages(struct zonelist *zonelist,
+ 		sc->nr_scanned = 0;
+ 		if (!priority)
+ 			disable_swap_token();
+-		all_unreclaimable = shrink_zones(priority, zonelist, sc);
++		shrink_zones(priority, zonelist, sc);
+ 		/*
+ 		 * Don't shrink slabs when reclaiming memory from
+ 		 * over limit cgroups
+@@ -1879,7 +1907,7 @@ out:
+ 		return sc->nr_reclaimed;
+ 
+ 	/* top priority shrink_zones still had more to do? don't OOM, then */
+-	if (scanning_global_lru(sc) && !all_unreclaimable)
++	if (scanning_global_lru(sc) && !all_unreclaimable(zonelist, sc))
+ 		return 1;
+ 
+ 	return 0;
+@@ -2137,8 +2165,7 @@ loop_again:
+ 			total_scanned += sc.nr_scanned;
+ 			if (zone->all_unreclaimable)
+ 				continue;
+-			if (nr_slab == 0 &&
+-			    zone->pages_scanned >= (zone_reclaimable_pages(zone) * 6))
++			if (nr_slab == 0 && !zone_reclaimable(zone))
+ 				zone->all_unreclaimable = 1;
+ 			/*
+ 			 * If we've done a decent amount of scanning and
+diff --git a/mm/vmstat.c b/mm/vmstat.c
+index 7759941..26d5716 100644
+--- a/mm/vmstat.c
++++ b/mm/vmstat.c
+@@ -138,11 +138,24 @@ static void refresh_zone_stat_thresholds(void)
+ 	int threshold;
+ 
+ 	for_each_populated_zone(zone) {
++		unsigned long max_drift, tolerate_drift;
++
+ 		threshold = calculate_threshold(zone);
+ 
+ 		for_each_online_cpu(cpu)
+ 			per_cpu_ptr(zone->pageset, cpu)->stat_threshold
+ 							= threshold;
++
++		/*
++		 * Only set percpu_drift_mark if there is a danger that
++		 * NR_FREE_PAGES reports the low watermark is ok when in fact
++		 * the min watermark could be breached by an allocation
++		 */
++		tolerate_drift = low_wmark_pages(zone) - min_wmark_pages(zone);
++		max_drift = num_online_cpus() * threshold;
++		if (max_drift > tolerate_drift)
++			zone->percpu_drift_mark = high_wmark_pages(zone) +
++					max_drift;
+ 	}
+ }
+ 
+@@ -813,7 +826,7 @@ static void zoneinfo_show_print(struct seq_file *m, pg_data_t *pgdat,
+ 		   "\n        scanned  %lu"
+ 		   "\n        spanned  %lu"
+ 		   "\n        present  %lu",
+-		   zone_page_state(zone, NR_FREE_PAGES),
++		   zone_nr_free_pages(zone),
+ 		   min_wmark_pages(zone),
+ 		   low_wmark_pages(zone),
+ 		   high_wmark_pages(zone),
+diff --git a/net/Kconfig b/net/Kconfig
+index 0d68b40..a44092e 100644
+--- a/net/Kconfig
++++ b/net/Kconfig
+@@ -206,7 +206,7 @@ source "net/dcb/Kconfig"
+ 
+ config RPS
+ 	boolean
+-	depends on SMP && SYSFS
++	depends on SMP && SYSFS && USE_GENERIC_SMP_HELPERS
+ 	default y
+ 
+ menu "Network testing"
+diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
+index 8fb75f8..e759b89 100644
+--- a/net/bridge/br_netfilter.c
++++ b/net/bridge/br_netfilter.c
+@@ -749,9 +749,11 @@ static int br_nf_dev_queue_xmit(struct sk_buff *skb)
+ {
+ 	if (skb->nfct != NULL && skb->protocol == htons(ETH_P_IP) &&
+ 	    skb->len + nf_bridge_mtu_reduction(skb) > skb->dev->mtu &&
+-	    !skb_is_gso(skb))
++	    !skb_is_gso(skb)) {
++		/* BUG: Should really parse the IP options here. */
++		memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
+ 		return ip_fragment(skb, br_dev_queue_push_xmit);
+-	else
++	} else
+ 		return br_dev_queue_push_xmit(skb);
+ }
+ #else
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index ce88293..a586e89 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -2574,6 +2574,10 @@ struct sk_buff *skb_segment(struct sk_buff *skb, int features)
+ 		__copy_skb_header(nskb, skb);
+ 		nskb->mac_len = skb->mac_len;
+ 
++		/* nskb and skb might have different headroom */
++		if (nskb->ip_summed == CHECKSUM_PARTIAL)
++			nskb->csum_start += skb_headroom(nskb) - headroom;
++
+ 		skb_reset_mac_header(nskb);
+ 		skb_set_network_header(nskb, skb->mac_len);
+ 		nskb->transport_header = (nskb->network_header +
+@@ -2704,7 +2708,7 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
+ 		return -E2BIG;
+ 
+ 	headroom = skb_headroom(p);
+-	nskb = netdev_alloc_skb(p->dev, headroom + skb_gro_offset(p));
++	nskb = alloc_skb(headroom + skb_gro_offset(p), GFP_ATOMIC);
+ 	if (unlikely(!nskb))
+ 		return -ENOMEM;
+ 
+diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c
+index fb24658..31cafd4 100644
+--- a/net/ipv4/datagram.c
++++ b/net/ipv4/datagram.c
+@@ -62,8 +62,11 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+ 	}
+ 	if (!inet->inet_saddr)
+ 		inet->inet_saddr = rt->rt_src;	/* Update source address */
+-	if (!inet->inet_rcv_saddr)
++	if (!inet->inet_rcv_saddr) {
+ 		inet->inet_rcv_saddr = rt->rt_src;
++		if (sk->sk_prot->rehash)
++			sk->sk_prot->rehash(sk);
++	}
+ 	inet->inet_daddr = rt->rt_dst;
+ 	inet->inet_dport = usin->sin_port;
+ 	sk->sk_state = TCP_ESTABLISHED;
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 560acc6..0189deb 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -2741,6 +2741,11 @@ slow_output:
+ 
+ EXPORT_SYMBOL_GPL(__ip_route_output_key);
+ 
++static struct dst_entry *ipv4_blackhole_dst_check(struct dst_entry *dst, u32 cookie)
++{
++	return NULL;
++}
++
+ static void ipv4_rt_blackhole_update_pmtu(struct dst_entry *dst, u32 mtu)
+ {
+ }
+@@ -2749,7 +2754,7 @@ static struct dst_ops ipv4_dst_blackhole_ops = {
+ 	.family			=	AF_INET,
+ 	.protocol		=	cpu_to_be16(ETH_P_IP),
+ 	.destroy		=	ipv4_dst_destroy,
+-	.check			=	ipv4_dst_check,
++	.check			=	ipv4_blackhole_dst_check,
+ 	.update_pmtu		=	ipv4_rt_blackhole_update_pmtu,
+ 	.entries		=	ATOMIC_INIT(0),
+ };
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index c259714..c88ca26 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -453,7 +453,8 @@ unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
+ 				if (sk_stream_wspace(sk) >= sk_stream_min_wspace(sk))
+ 					mask |= POLLOUT | POLLWRNORM;
+ 			}
+-		}
++		} else
++			mask |= POLLOUT | POLLWRNORM;
+ 
+ 		if (tp->urg_data & TCP_URG_VALID)
+ 			mask |= POLLPRI;
+@@ -2002,11 +2003,8 @@ adjudge_to_death:
+ 		}
+ 	}
+ 	if (sk->sk_state != TCP_CLOSE) {
+-		int orphan_count = percpu_counter_read_positive(
+-						sk->sk_prot->orphan_count);
+-
+ 		sk_mem_reclaim(sk);
+-		if (tcp_too_many_orphans(sk, orphan_count)) {
++		if (tcp_too_many_orphans(sk, 0)) {
+ 			if (net_ratelimit())
+ 				printk(KERN_INFO "TCP: too many of orphaned "
+ 				       "sockets\n");
+@@ -3196,7 +3194,7 @@ void __init tcp_init(void)
+ {
+ 	struct sk_buff *skb = NULL;
+ 	unsigned long nr_pages, limit;
+-	int order, i, max_share;
++	int i, max_share, cnt;
+ 	unsigned long jiffy = jiffies;
+ 
+ 	BUILD_BUG_ON(sizeof(struct tcp_skb_cb) > sizeof(skb->cb));
+@@ -3245,22 +3243,12 @@ void __init tcp_init(void)
+ 		INIT_HLIST_HEAD(&tcp_hashinfo.bhash[i].chain);
+ 	}
+ 
+-	/* Try to be a bit smarter and adjust defaults depending
+-	 * on available memory.
+-	 */
+-	for (order = 0; ((1 << order) << PAGE_SHIFT) <
+-			(tcp_hashinfo.bhash_size * sizeof(struct inet_bind_hashbucket));
+-			order++)
+-		;
+-	if (order >= 4) {
+-		tcp_death_row.sysctl_max_tw_buckets = 180000;
+-		sysctl_tcp_max_orphans = 4096 << (order - 4);
+-		sysctl_max_syn_backlog = 1024;
+-	} else if (order < 3) {
+-		tcp_death_row.sysctl_max_tw_buckets >>= (3 - order);
+-		sysctl_tcp_max_orphans >>= (3 - order);
+-		sysctl_max_syn_backlog = 128;
+-	}
++
++	cnt = tcp_hashinfo.ehash_mask + 1;
++
++	tcp_death_row.sysctl_max_tw_buckets = cnt / 2;
++	sysctl_tcp_max_orphans = cnt / 2;
++	sysctl_max_syn_backlog = max(128, cnt / 256);
+ 
+ 	/* Set the pressure threshold to be a fraction of global memory that
+ 	 * is up to 1/2 at 256 MB, decreasing toward zero with the amount of
+diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
+index 440a5c6..7abd922 100644
+--- a/net/ipv4/tcp_timer.c
++++ b/net/ipv4/tcp_timer.c
+@@ -67,18 +67,18 @@ static void tcp_write_err(struct sock *sk)
+ static int tcp_out_of_resources(struct sock *sk, int do_reset)
+ {
+ 	struct tcp_sock *tp = tcp_sk(sk);
+-	int orphans = percpu_counter_read_positive(&tcp_orphan_count);
++	int shift = 0;
+ 
+ 	/* If peer does not open window for long time, or did not transmit
+ 	 * anything for long time, penalize it. */
+ 	if ((s32)(tcp_time_stamp - tp->lsndtime) > 2*TCP_RTO_MAX || !do_reset)
+-		orphans <<= 1;
++		shift++;
+ 
+ 	/* If some dubious ICMP arrived, penalize even more. */
+ 	if (sk->sk_err_soft)
+-		orphans <<= 1;
++		shift++;
+ 
+-	if (tcp_too_many_orphans(sk, orphans)) {
++	if (tcp_too_many_orphans(sk, shift)) {
+ 		if (net_ratelimit())
+ 			printk(KERN_INFO "Out of socket memory\n");
+ 
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index eec4ff4..434dd67 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -1260,6 +1260,49 @@ void udp_lib_unhash(struct sock *sk)
+ }
+ EXPORT_SYMBOL(udp_lib_unhash);
+ 
++/*
++ * inet_rcv_saddr was changed, we must rehash secondary hash
++ */
++void udp_lib_rehash(struct sock *sk, u16 newhash)
++{
++	if (sk_hashed(sk)) {
++		struct udp_table *udptable = sk->sk_prot->h.udp_table;
++		struct udp_hslot *hslot, *hslot2, *nhslot2;
++
++		hslot2 = udp_hashslot2(udptable, udp_sk(sk)->udp_portaddr_hash);
++		nhslot2 = udp_hashslot2(udptable, newhash);
++		udp_sk(sk)->udp_portaddr_hash = newhash;
++		if (hslot2 != nhslot2) {
++			hslot = udp_hashslot(udptable, sock_net(sk),
++					     udp_sk(sk)->udp_port_hash);
++			/* we must lock primary chain too */
++			spin_lock_bh(&hslot->lock);
++
++			spin_lock(&hslot2->lock);
++			hlist_nulls_del_init_rcu(&udp_sk(sk)->udp_portaddr_node);
++			hslot2->count--;
++			spin_unlock(&hslot2->lock);
++
++			spin_lock(&nhslot2->lock);
++			hlist_nulls_add_head_rcu(&udp_sk(sk)->udp_portaddr_node,
++						 &nhslot2->head);
++			nhslot2->count++;
++			spin_unlock(&nhslot2->lock);
++
++			spin_unlock_bh(&hslot->lock);
++		}
++	}
++}
++EXPORT_SYMBOL(udp_lib_rehash);
++
++static void udp_v4_rehash(struct sock *sk)
++{
++	u16 new_hash = udp4_portaddr_hash(sock_net(sk),
++					  inet_sk(sk)->inet_rcv_saddr,
++					  inet_sk(sk)->inet_num);
++	udp_lib_rehash(sk, new_hash);
++}
++
+ static int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
+ {
+ 	int rc;
+@@ -1843,6 +1886,7 @@ struct proto udp_prot = {
+ 	.backlog_rcv	   = __udp_queue_rcv_skb,
+ 	.hash		   = udp_lib_hash,
+ 	.unhash		   = udp_lib_unhash,
++	.rehash		   = udp_v4_rehash,
+ 	.get_port	   = udp_v4_get_port,
+ 	.memory_allocated  = &udp_memory_allocated,
+ 	.sysctl_mem	   = sysctl_udp_mem,
+diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
+index 7126846..0e3754a1 100644
+--- a/net/ipv6/datagram.c
++++ b/net/ipv6/datagram.c
+@@ -104,9 +104,12 @@ ipv4_connected:
+ 		if (ipv6_addr_any(&np->saddr))
+ 			ipv6_addr_set_v4mapped(inet->inet_saddr, &np->saddr);
+ 
+-		if (ipv6_addr_any(&np->rcv_saddr))
++		if (ipv6_addr_any(&np->rcv_saddr)) {
+ 			ipv6_addr_set_v4mapped(inet->inet_rcv_saddr,
+ 					       &np->rcv_saddr);
++			if (sk->sk_prot->rehash)
++				sk->sk_prot->rehash(sk);
++		}
+ 
+ 		goto out;
+ 	}
+@@ -191,6 +194,8 @@ ipv4_connected:
+ 	if (ipv6_addr_any(&np->rcv_saddr)) {
+ 		ipv6_addr_copy(&np->rcv_saddr, &fl.fl6_src);
+ 		inet->inet_rcv_saddr = LOOPBACK4_IPV6;
++		if (sk->sk_prot->rehash)
++			sk->sk_prot->rehash(sk);
+ 	}
+ 
+ 	ip6_dst_store(sk, dst,
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index 87be586..97e1214 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -111,6 +111,15 @@ int udp_v6_get_port(struct sock *sk, unsigned short snum)
+ 	return udp_lib_get_port(sk, snum, ipv6_rcv_saddr_equal, hash2_nulladdr);
+ }
+ 
++static void udp_v6_rehash(struct sock *sk)
++{
++	u16 new_hash = udp6_portaddr_hash(sock_net(sk),
++					  &inet6_sk(sk)->rcv_saddr,
++					  inet_sk(sk)->inet_num);
++
++	udp_lib_rehash(sk, new_hash);
++}
++
+ static inline int compute_score(struct sock *sk, struct net *net,
+ 				unsigned short hnum,
+ 				struct in6_addr *saddr, __be16 sport,
+@@ -1452,6 +1461,7 @@ struct proto udpv6_prot = {
+ 	.backlog_rcv	   = udpv6_queue_rcv_skb,
+ 	.hash		   = udp_lib_hash,
+ 	.unhash		   = udp_lib_unhash,
++	.rehash		   = udp_v6_rehash,
+ 	.get_port	   = udp_v6_get_port,
+ 	.memory_allocated  = &udp_memory_allocated,
+ 	.sysctl_mem	   = sysctl_udp_mem,
+diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
+index 79986a6..fd55b51 100644
+--- a/net/irda/af_irda.c
++++ b/net/irda/af_irda.c
+@@ -824,8 +824,8 @@ static int irda_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ 
+ 	err = irda_open_tsap(self, addr->sir_lsap_sel, addr->sir_name);
+ 	if (err < 0) {
+-		kfree(self->ias_obj->name);
+-		kfree(self->ias_obj);
++		irias_delete_object(self->ias_obj);
++		self->ias_obj = NULL;
+ 		goto out;
+ 	}
+ 
+diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
+index 58c6c4c..1ae6976 100644
+--- a/net/l2tp/l2tp_eth.c
++++ b/net/l2tp/l2tp_eth.c
+@@ -132,7 +132,7 @@ static void l2tp_eth_dev_recv(struct l2tp_session *session, struct sk_buff *skb,
+ 		printk("\n");
+ 	}
+ 
+-	if (data_len < ETH_HLEN)
++	if (!pskb_may_pull(skb, sizeof(ETH_HLEN)))
+ 		goto error;
+ 
+ 	secpath_reset(skb);
+diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
+index 023ba82..5826129 100644
+--- a/net/llc/af_llc.c
++++ b/net/llc/af_llc.c
+@@ -1024,7 +1024,8 @@ static int llc_ui_setsockopt(struct socket *sock, int level, int optname,
+ {
+ 	struct sock *sk = sock->sk;
+ 	struct llc_sock *llc = llc_sk(sk);
+-	int rc = -EINVAL, opt;
++	unsigned int opt;
++	int rc = -EINVAL;
+ 
+ 	lock_sock(sk);
+ 	if (unlikely(level != SOL_LLC || optlen != sizeof(int)))
+diff --git a/net/rds/recv.c b/net/rds/recv.c
+index 795a00b..c93588c 100644
+--- a/net/rds/recv.c
++++ b/net/rds/recv.c
+@@ -297,7 +297,7 @@ static int rds_still_queued(struct rds_sock *rs, struct rds_incoming *inc,
+ int rds_notify_queue_get(struct rds_sock *rs, struct msghdr *msghdr)
+ {
+ 	struct rds_notifier *notifier;
+-	struct rds_rdma_notify cmsg;
++	struct rds_rdma_notify cmsg = { 0 }; /* fill holes with zero */
+ 	unsigned int count = 0, max_messages = ~0U;
+ 	unsigned long flags;
+ 	LIST_HEAD(copy);
+diff --git a/net/sctp/output.c b/net/sctp/output.c
+index a646681..bcc4590 100644
+--- a/net/sctp/output.c
++++ b/net/sctp/output.c
+@@ -92,7 +92,6 @@ struct sctp_packet *sctp_packet_config(struct sctp_packet *packet,
+ 	SCTP_DEBUG_PRINTK("%s: packet:%p vtag:0x%x\n", __func__,
+ 			  packet, vtag);
+ 
+-	sctp_packet_reset(packet);
+ 	packet->vtag = vtag;
+ 
+ 	if (ecn_capable && sctp_packet_empty(packet)) {
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index fef2cc5..617bea4 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -673,6 +673,7 @@ static int unix_autobind(struct socket *sock)
+ 	static u32 ordernum = 1;
+ 	struct unix_address *addr;
+ 	int err;
++	unsigned int retries = 0;
+ 
+ 	mutex_lock(&u->readlock);
+ 
+@@ -698,9 +699,17 @@ retry:
+ 	if (__unix_find_socket_byname(net, addr->name, addr->len, sock->type,
+ 				      addr->hash)) {
+ 		spin_unlock(&unix_table_lock);
+-		/* Sanity yield. It is unusual case, but yet... */
+-		if (!(ordernum&0xFF))
+-			yield();
++		/*
++		 * __unix_find_socket_byname() may take long time if many names
++		 * are already in use.
++		 */
++		cond_resched();
++		/* Give up if all names seems to be in use. */
++		if (retries++ == 0xFFFFF) {
++			err = -ENOSPC;
++			kfree(addr);
++			goto out;
++		}
+ 		goto retry;
+ 	}
+ 	addr->hash ^= sk->sk_type;
+diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
+index 6261745..e0d1e2b 100644
+--- a/security/keys/keyctl.c
++++ b/security/keys/keyctl.c
+@@ -1259,6 +1259,7 @@ long keyctl_session_to_parent(void)
+ 	keyring_r = NULL;
+ 
+ 	me = current;
++	rcu_read_lock();
+ 	write_lock_irq(&tasklist_lock);
+ 
+ 	parent = me->real_parent;
+@@ -1291,7 +1292,8 @@ long keyctl_session_to_parent(void)
+ 		goto not_permitted;
+ 
+ 	/* the keyrings must have the same UID */
+-	if (pcred->tgcred->session_keyring->uid != mycred->euid ||
++	if ((pcred->tgcred->session_keyring &&
++	     pcred->tgcred->session_keyring->uid != mycred->euid) ||
+ 	    mycred->tgcred->session_keyring->uid != mycred->euid)
+ 		goto not_permitted;
+ 
+@@ -1306,6 +1308,7 @@ long keyctl_session_to_parent(void)
+ 	set_ti_thread_flag(task_thread_info(parent), TIF_NOTIFY_RESUME);
+ 
+ 	write_unlock_irq(&tasklist_lock);
++	rcu_read_unlock();
+ 	if (oldcred)
+ 		put_cred(oldcred);
+ 	return 0;
+@@ -1314,6 +1317,7 @@ already_same:
+ 	ret = 0;
+ not_permitted:
+ 	write_unlock_irq(&tasklist_lock);
++	rcu_read_unlock();
+ 	put_cred(cred);
+ 	return ret;
+ 
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index f1e7bab..b8d730c 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -202,6 +202,7 @@ struct sigmatel_spec {
+ 	unsigned int spdif_mute: 1;
+ 	unsigned int check_volume_offset:1;
+ 	unsigned int auto_mic:1;
++	unsigned int linear_tone_beep:1;
+ 
+ 	/* gpio lines */
+ 	unsigned int eapd_mask;
+@@ -3802,7 +3803,7 @@ static int stac92xx_parse_auto_config(struct hda_codec *codec, hda_nid_t dig_out
+ 			return err;
+ 		if (codec->beep) {
+ 			/* IDT/STAC codecs have linear beep tone parameter */
+-			codec->beep->linear_tone = 1;
++			codec->beep->linear_tone = spec->linear_tone_beep;
+ 			/* if no beep switch is available, make its own one */
+ 			caps = query_amp_caps(codec, nid, HDA_OUTPUT);
+ 			if (!(caps & AC_AMPCAP_MUTE)) {
+@@ -5005,6 +5006,7 @@ static int patch_stac9200(struct hda_codec *codec)
+ 
+ 	codec->no_trigger_sense = 1;
+ 	codec->spec = spec;
++	spec->linear_tone_beep = 1;
+ 	spec->num_pins = ARRAY_SIZE(stac9200_pin_nids);
+ 	spec->pin_nids = stac9200_pin_nids;
+ 	spec->board_config = snd_hda_check_board_config(codec, STAC_9200_MODELS,
+@@ -5068,6 +5070,7 @@ static int patch_stac925x(struct hda_codec *codec)
+ 
+ 	codec->no_trigger_sense = 1;
+ 	codec->spec = spec;
++	spec->linear_tone_beep = 1;
+ 	spec->num_pins = ARRAY_SIZE(stac925x_pin_nids);
+ 	spec->pin_nids = stac925x_pin_nids;
+ 
+@@ -5153,6 +5156,7 @@ static int patch_stac92hd73xx(struct hda_codec *codec)
+ 
+ 	codec->no_trigger_sense = 1;
+ 	codec->spec = spec;
++	spec->linear_tone_beep = 0;
+ 	codec->slave_dig_outs = stac92hd73xx_slave_dig_outs;
+ 	spec->num_pins = ARRAY_SIZE(stac92hd73xx_pin_nids);
+ 	spec->pin_nids = stac92hd73xx_pin_nids;
+@@ -5300,6 +5304,7 @@ static int patch_stac92hd83xxx(struct hda_codec *codec)
+ 
+ 	codec->no_trigger_sense = 1;
+ 	codec->spec = spec;
++	spec->linear_tone_beep = 1;
+ 	codec->slave_dig_outs = stac92hd83xxx_slave_dig_outs;
+ 	spec->digbeep_nid = 0x21;
+ 	spec->mux_nids = stac92hd83xxx_mux_nids;
+@@ -5522,6 +5527,7 @@ static int patch_stac92hd71bxx(struct hda_codec *codec)
+ 
+ 	codec->no_trigger_sense = 1;
+ 	codec->spec = spec;
++	spec->linear_tone_beep = 0;
+ 	codec->patch_ops = stac92xx_patch_ops;
+ 	spec->num_pins = STAC92HD71BXX_NUM_PINS;
+ 	switch (codec->vendor_id) {
+@@ -5779,6 +5785,7 @@ static int patch_stac922x(struct hda_codec *codec)
+ 
+ 	codec->no_trigger_sense = 1;
+ 	codec->spec = spec;
++	spec->linear_tone_beep = 1;
+ 	spec->num_pins = ARRAY_SIZE(stac922x_pin_nids);
+ 	spec->pin_nids = stac922x_pin_nids;
+ 	spec->board_config = snd_hda_check_board_config(codec, STAC_922X_MODELS,
+@@ -5883,6 +5890,7 @@ static int patch_stac927x(struct hda_codec *codec)
+ 
+ 	codec->no_trigger_sense = 1;
+ 	codec->spec = spec;
++	spec->linear_tone_beep = 1;
+ 	codec->slave_dig_outs = stac927x_slave_dig_outs;
+ 	spec->num_pins = ARRAY_SIZE(stac927x_pin_nids);
+ 	spec->pin_nids = stac927x_pin_nids;
+@@ -6018,6 +6026,7 @@ static int patch_stac9205(struct hda_codec *codec)
+ 
+ 	codec->no_trigger_sense = 1;
+ 	codec->spec = spec;
++	spec->linear_tone_beep = 1;
+ 	spec->num_pins = ARRAY_SIZE(stac9205_pin_nids);
+ 	spec->pin_nids = stac9205_pin_nids;
+ 	spec->board_config = snd_hda_check_board_config(codec, STAC_9205_MODELS,
+@@ -6174,6 +6183,7 @@ static int patch_stac9872(struct hda_codec *codec)
+ 		return -ENOMEM;
+ 	codec->no_trigger_sense = 1;
+ 	codec->spec = spec;
++	spec->linear_tone_beep = 1;
+ 	spec->num_pins = ARRAY_SIZE(stac9872_pin_nids);
+ 	spec->pin_nids = stac9872_pin_nids;
+ 
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index f032806..2774528 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -566,6 +566,7 @@ int __kvm_set_memory_region(struct kvm *kvm,
+ 
+ 	new = old = *memslot;
+ 
++	new.id = mem->slot;
+ 	new.base_gfn = base_gfn;
+ 	new.npages = npages;
+ 	new.flags = mem->flags;

Deleted: genpatches-2.6/trunk/2.6.35/2600_support-eject-dell-studio-1555.patch
===================================================================
--- genpatches-2.6/trunk/2.6.35/2600_support-eject-dell-studio-1555.patch	2010-09-27 14:28:40 UTC (rev 1796)
+++ genpatches-2.6/trunk/2.6.35/2600_support-eject-dell-studio-1555.patch	2010-09-27 14:39:39 UTC (rev 1797)
@@ -1,30 +0,0 @@
-From: Islam Amer <pharon@×××××.com>
-Date: Thu, 24 Jun 2010 17:39:47 +0000 (-0400)
-Subject: dell-wmi: Add support for eject key on Dell Studio 1555
-X-Git-Tag: v2.6.36-rc1~579^2~64
-X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=d5164dbf1f651d1e955b158fb70a9c844cc91cd1
-
-dell-wmi: Add support for eject key on Dell Studio 1555
-
-Fixes pressing the eject key on Dell Studio 1555 does not work and produces
-message :
-
-dell-wmi: Unknown key 0 pressed
-
-Signed-off-by: Islam Amer <pharon@×××××.com>
----
-
-diff --git a/drivers/platform/x86/dell-wmi.c b/drivers/platform/x86/dell-wmi.c
-index 66f53c3..12a8e6f 100644
---- a/drivers/platform/x86/dell-wmi.c
-+++ b/drivers/platform/x86/dell-wmi.c
-@@ -221,7 +221,7 @@ static void dell_wmi_notify(u32 value, void *context)
- 			return;
- 		}
- 
--		if (dell_new_hk_type)
-+		if (dell_new_hk_type || buffer_entry[1] == 0x0)
- 			reported_key = (int)buffer_entry[2];
- 		else
- 			reported_key = (int)buffer_entry[1] & 0xffff;
-