[gentoo-commits] linux-patches r1296 - genpatches-2.6/trunk/2.6.24

[Daniel Drake (dsd)]

Author: dsd
Date: 2008-04-19 09:58:26 +0000 (Sat, 19 Apr 2008)
New Revision: 1296

Added:
   genpatches-2.6/trunk/2.6.24/1003_linux-2.6.24.4.patch
   genpatches-2.6/trunk/2.6.24/1004_linux-2.6.24.5.patch
Removed:
   genpatches-2.6/trunk/2.6.24/1003-linux-2.6.24.4.patch
   genpatches-2.6/trunk/2.6.24/1400_prevent-gcc43-optimization-udivdi3.patch
   genpatches-2.6/trunk/2.6.24/1700-futex_cmpxchg_inatomic_impl_check.patch
   genpatches-2.6/trunk/2.6.24/2103_ata-assume-no-device-attached.patch
   genpatches-2.6/trunk/2.6.24/2200_ppc32-apm-export-fix.patch
   genpatches-2.6/trunk/2.6.24/2305_bluetooth-suspend-oops.patch
   genpatches-2.6/trunk/2.6.24/2405_sis190-eeprom-mac.patch
   genpatches-2.6/trunk/2.6.24/2505_usb-storage-motorola-rokr.patch
Modified:
   genpatches-2.6/trunk/2.6.24/0000_README
Log:
Linux 2.6.24.5

Modified: genpatches-2.6/trunk/2.6.24/0000_README
===================================================================
--- genpatches-2.6/trunk/2.6.24/0000_README	2008-04-18 19:34:38 UTC (rev 1295)
+++ genpatches-2.6/trunk/2.6.24/0000_README	2008-04-19 09:58:26 UTC (rev 1296)
@@ -55,14 +55,10 @@
 From:	http://www.kernel.org
 Desc:	Linux 2.6.24.4
 
-Patch:	1400_prevent-gcc43-optimization-udivdi3.patch
-From:	http://bugs.gentoo.org/show_bug.cgi?id=214654
-Desc:	Prevent gcc udivdi3 optimizations due to some unsupported archs.
+Patch:	1004_linux-2.6.24.5.patch
+From:	http://www.kernel.org
+Desc:	Linux 2.6.24.5
 
-Patch:	1700_futex-cmpxchg-inatomic-impl-check.patch
-From:	http://bugs.gentoo.org/show_bug.cgi?id=217030
-Desc:	Detect whether futex_atomic_cmpxchg_inatomic was implemented at run time
-
 Patch:	2100_sd-sr-medium-detection.patch
 From:	http://bugs.gentoo.org/196879
 Desc:	Add early medium-not-present detection in sr/sd drivers
@@ -75,30 +71,10 @@
 From:	http://bugs.gentoo.org/196879
 Desc:	Fix TEST_UNIT_READY for medium detection
 
-Patch:	2103_ata-assume-no-device-attached.patch
-From:	http://bugs.gentoo.org/211369
-Desc:	Fix for device attached to pata_sis as secondary master
-
-Patch:	2200_ppc32-apm-export-fix.patch
-From:	http://bugs.gentoo.org/217629
-Desc:	Fix build of modular drivers/macintosh/apm_emu.c
-
-Patch:	2305_bluetooth-suspend-oops.patch
-From:	http://bugs.gentoo.org/211179
-Desc:	Fix bluetooth rfcomm crash on suspend
-
 Patch:	2400_ipw2200-radiotap-addr.patch
 From:	http://bugs.gentoo.org/215714
 Desc:	Fix IPW2200 radiotap interface
 
-Patch:	2405_sis190-eeprom-mac.patch
-From:	http://bugs.gentoo.org/207706
-Desc:	Fix reading of MAC address in sis190 driver
-
-Patch:	2505_usb-storage-motorola-rokr.patch
-From:	http://bugs.gentoo.org/212729
-Desc:	Fix usb-storage access to Motorola ROKR phone
-
 Patch:	2510_ricoh-handle-susp-resum-disab.patch
 From:	http://bugs.gentoo.org/185581
 Desc:	Handle suspend/resume in Ricoh MMC disabler

Deleted: genpatches-2.6/trunk/2.6.24/1003-linux-2.6.24.4.patch
===================================================================
--- genpatches-2.6/trunk/2.6.24/1003-linux-2.6.24.4.patch	2008-04-18 19:34:38 UTC (rev 1295)
+++ genpatches-2.6/trunk/2.6.24/1003-linux-2.6.24.4.patch	2008-04-19 09:58:26 UTC (rev 1296)
@@ -1,3643 +0,0 @@
-diff --git a/arch/arm/mach-pxa/clock.c b/arch/arm/mach-pxa/clock.c
-index 83ef5ec..df5ae27 100644
---- a/arch/arm/mach-pxa/clock.c
-+++ b/arch/arm/mach-pxa/clock.c
-@@ -23,18 +23,27 @@ static LIST_HEAD(clocks);
- static DEFINE_MUTEX(clocks_mutex);
- static DEFINE_SPINLOCK(clocks_lock);
- 
-+static struct clk *clk_lookup(struct device *dev, const char *id)
-+{
-+	struct clk *p;
-+
-+	list_for_each_entry(p, &clocks, node)
-+		if (strcmp(id, p->name) == 0 && p->dev == dev)
-+			return p;
-+
-+	return NULL;
-+}
-+
- struct clk *clk_get(struct device *dev, const char *id)
- {
- 	struct clk *p, *clk = ERR_PTR(-ENOENT);
- 
- 	mutex_lock(&clocks_mutex);
--	list_for_each_entry(p, &clocks, node) {
--		if (strcmp(id, p->name) == 0 &&
--		    (p->dev == NULL || p->dev == dev)) {
--			clk = p;
--			break;
--		}
--	}
-+	p = clk_lookup(dev, id);
-+	if (!p)
-+		p = clk_lookup(NULL, id);
-+	if (p)
-+		clk = p;
- 	mutex_unlock(&clocks_mutex);
- 
- 	return clk;
-diff --git a/arch/mips/kernel/i8259.c b/arch/mips/kernel/i8259.c
-index 4710135..9158dd8 100644
---- a/arch/mips/kernel/i8259.c
-+++ b/arch/mips/kernel/i8259.c
-@@ -338,8 +338,10 @@ void __init init_i8259_irqs(void)
- 
- 	init_8259A(0);
- 
--	for (i = I8259A_IRQ_BASE; i < I8259A_IRQ_BASE + 16; i++)
-+	for (i = I8259A_IRQ_BASE; i < I8259A_IRQ_BASE + 16; i++) {
- 		set_irq_chip_and_handler(i, &i8259A_chip, handle_level_irq);
-+		set_irq_probe(i);
-+	}
- 
- 	setup_irq(I8259A_IRQ_BASE + PIC_CASCADE_IR, &irq2);
- }
-diff --git a/arch/mips/kernel/irq.c b/arch/mips/kernel/irq.c
-index d06e9c9..e3309ff 100644
---- a/arch/mips/kernel/irq.c
-+++ b/arch/mips/kernel/irq.c
-@@ -145,6 +145,11 @@ __setup("nokgdb", nokgdb);
- 
- void __init init_IRQ(void)
- {
-+	int i;
-+
-+	for (i = 0; i < NR_IRQS; i++)
-+		set_irq_noprobe(i);
-+
- 	arch_init_irq();
- 
- #ifdef CONFIG_KGDB
-diff --git a/arch/s390/lib/uaccess_pt.c b/arch/s390/lib/uaccess_pt.c
-index 7e8efaa..5efdfe9 100644
---- a/arch/s390/lib/uaccess_pt.c
-+++ b/arch/s390/lib/uaccess_pt.c
-@@ -406,6 +406,8 @@ int futex_atomic_cmpxchg_pt(int __user *uaddr, int oldval, int newval)
- {
- 	int ret;
- 
-+	if (!current->mm)
-+		return -EFAULT;
- 	spin_lock(&current->mm->page_table_lock);
- 	uaddr = (int __user *) __dat_user_addr((unsigned long) uaddr);
- 	if (!uaddr) {
-diff --git a/arch/sparc/kernel/Makefile b/arch/sparc/kernel/Makefile
-index e795f28..bf1b15d 100644
---- a/arch/sparc/kernel/Makefile
-+++ b/arch/sparc/kernel/Makefile
-@@ -1,4 +1,4 @@
--# $Id: Makefile,v 1.62 2000/12/15 00:41:17 davem Exp $
-+#
- # Makefile for the linux kernel.
- #
- 
-@@ -12,7 +12,8 @@ obj-y    := entry.o wof.o wuf.o etrap.o rtrap.o traps.o $(IRQ_OBJS) \
- 	    sys_sparc.o sunos_asm.o systbls.o \
- 	    time.o windows.o cpu.o devices.o sclow.o \
- 	    tadpole.o tick14.o ptrace.o sys_solaris.o \
--	    unaligned.o muldiv.o semaphore.o prom.o of_device.o devres.o
-+	    unaligned.o una_asm.o muldiv.o semaphore.o \
-+	    prom.o of_device.o devres.o
- 
- devres-y = ../../../kernel/irq/devres.o
- 
-diff --git a/arch/sparc/kernel/una_asm.S b/arch/sparc/kernel/una_asm.S
-new file mode 100644
-index 0000000..8cc0345
---- /dev/null
-+++ b/arch/sparc/kernel/una_asm.S
-@@ -0,0 +1,153 @@
-+/* una_asm.S: Kernel unaligned trap assembler helpers.
-+ *
-+ * Copyright (C) 1996,2005,2008 David S. Miller (davem@×××××××××.net)
-+ * Copyright (C) 1996,1997 Jakub Jelinek (jj@××××××××××××××××.cz)
-+ */
-+
-+#include <linux/errno.h>
-+
-+	.text
-+
-+retl_efault:
-+	retl
-+	 mov	-EFAULT, %o0
-+
-+	/* int __do_int_store(unsigned long *dst_addr, int size,
-+	 *                    unsigned long *src_val)
-+	 *
-+	 * %o0 = dest_addr
-+	 * %o1 = size
-+	 * %o2 = src_val
-+	 *
-+	 * Return '0' on success, -EFAULT on failure.
-+	 */
-+	.globl	__do_int_store
-+__do_int_store:
-+	ld	[%o2], %g1
-+	cmp	%1, 2
-+	be	2f
-+	 cmp	%1, 4
-+	be	1f
-+	 srl	%g1, 24, %g2
-+	srl	%g1, 16, %g7
-+4:	stb	%g2, [%o0]
-+	srl	%g1, 8, %g2
-+5:	stb	%g7, [%o0 + 1]
-+	ld	[%o2 + 4], %g7
-+6:	stb	%g2, [%o0 + 2]
-+	srl	%g7, 24, %g2
-+7:	stb	%g1, [%o0 + 3]
-+	srl	%g7, 16, %g1
-+8:	stb	%g2, [%o0 + 4]
-+	srl	%g7, 8, %g2
-+9:	stb	%g1, [%o0 + 5]
-+10:	stb	%g2, [%o0 + 6]
-+	b	0f
-+11:	 stb	%g7, [%o0 + 7]
-+1:	srl	%g1, 16, %g7
-+12:	stb	%g2, [%o0]
-+	srl	%g1, 8, %g2
-+13:	stb	%g7, [%o0 + 1]
-+14:	stb	%g2, [%o0 + 2]
-+	b	0f
-+15:	 stb	%g1, [%o0 + 3]
-+2:	srl	%g1, 8, %g2
-+16:	stb	%g2, [%o0]
-+17:	stb	%g1, [%o0 + 1]
-+0:	retl
-+	 mov	0, %o0
-+
-+	.section __ex_table,#alloc
-+	.word	4b, retl_efault
-+	.word	5b, retl_efault
-+	.word	6b, retl_efault
-+	.word	7b, retl_efault
-+	.word	8b, retl_efault
-+	.word	9b, retl_efault
-+	.word	10b, retl_efault
-+	.word	11b, retl_efault
-+	.word	12b, retl_efault
-+	.word	13b, retl_efault
-+	.word	14b, retl_efault
-+	.word	15b, retl_efault
-+	.word	16b, retl_efault
-+	.word	17b, retl_efault
-+	.previous
-+
-+	/* int do_int_load(unsigned long *dest_reg, int size,
-+	 *                 unsigned long *saddr, int is_signed)
-+	 *
-+	 * %o0 = dest_reg
-+	 * %o1 = size
-+	 * %o2 = saddr
-+	 * %o3 = is_signed
-+	 *
-+	 * Return '0' on success, -EFAULT on failure.
-+	 */
-+	.globl	do_int_load
-+do_int_load:
-+	cmp	%o1, 8
-+	be	9f
-+	 cmp	%o1, 4
-+	be	6f
-+4:	 ldub	[%o2], %g1
-+5:	ldub	[%o2 + 1], %g2
-+	sll	%g1, 8, %g1
-+	tst	%o3
-+	be	3f
-+	 or	%g1, %g2, %g1
-+	sll	%g1, 16, %g1
-+	sra	%g1, 16, %g1
-+3:	b	0f
-+	 st	%g1, [%o0]
-+6:	ldub	[%o2 + 1], %g2
-+	sll	%g1, 24, %g1
-+7:	ldub	[%o2 + 2], %g7
-+	sll	%g2, 16, %g2
-+8:	ldub	[%o2 + 3], %g3
-+	sll	%g7, 8, %g7
-+	or	%g3, %g2, %g3
-+	or	%g7, %g3, %g7
-+	or	%g1, %g7, %g1
-+	b	0f
-+	 st	%g1, [%o0]
-+9:	ldub	[%o2], %g1
-+10:	ldub	[%o2 + 1], %g2
-+	sll	%g1, 24, %g1
-+11:	ldub	[%o2 + 2], %g7
-+	sll	%g2, 16, %g2
-+12:	ldub	[%o2 + 3], %g3
-+	sll	%g7, 8, %g7
-+	or	%g1, %g2, %g1
-+	or	%g7, %g3, %g7
-+	or	%g1, %g7, %g7
-+13:	ldub	[%o2 + 4], %g1
-+	st	%g7, [%o0]
-+14:	ldub	[%o2 + 5], %g2
-+	sll	%g1, 24, %g1
-+15:	ldub	[%o2 + 6], %g7
-+	sll	%g2, 16, %g2
-+16:	ldub	[%o2 + 7], %g3
-+	sll	%g7, 8, %g7
-+	or	%g1, %g2, %g1
-+	or	%g7, %g3, %g7
-+	or	%g1, %g7, %g7
-+	st	%g7, [%o0 + 4]
-+0:	retl
-+	 mov	0, %o0
-+
-+	.section __ex_table,#alloc
-+	.word	4b, retl_efault
-+	.word	5b, retl_efault
-+	.word	6b, retl_efault
-+	.word	7b, retl_efault
-+	.word	8b, retl_efault
-+	.word	9b, retl_efault
-+	.word	10b, retl_efault
-+	.word	11b, retl_efault
-+	.word	12b, retl_efault
-+	.word	13b, retl_efault
-+	.word	14b, retl_efault
-+	.word	15b, retl_efault
-+	.word	16b, retl_efault
-+	.previous
-diff --git a/arch/sparc/kernel/unaligned.c b/arch/sparc/kernel/unaligned.c
-index a6330fb..33857be 100644
---- a/arch/sparc/kernel/unaligned.c
-+++ b/arch/sparc/kernel/unaligned.c
-@@ -175,157 +175,31 @@ static void unaligned_panic(char *str)
- 	panic(str);
- }
- 
--#define do_integer_load(dest_reg, size, saddr, is_signed, errh) ({		\
--__asm__ __volatile__ (								\
--	"cmp	%1, 8\n\t"							\
--	"be	9f\n\t"								\
--	" cmp	%1, 4\n\t"							\
--	"be	6f\n"								\
--"4:\t"	" ldub	[%2], %%l1\n"							\
--"5:\t"	"ldub	[%2 + 1], %%l2\n\t"						\
--	"sll	%%l1, 8, %%l1\n\t"						\
--	"tst	%3\n\t"								\
--	"be	3f\n\t"								\
--	" add	%%l1, %%l2, %%l1\n\t"						\
--	"sll	%%l1, 16, %%l1\n\t"						\
--	"sra	%%l1, 16, %%l1\n"						\
--"3:\t"	"b	0f\n\t"								\
--	" st	%%l1, [%0]\n"							\
--"6:\t"	"ldub	[%2 + 1], %%l2\n\t"						\
--	"sll	%%l1, 24, %%l1\n"						\
--"7:\t"	"ldub	[%2 + 2], %%g7\n\t"						\
--	"sll	%%l2, 16, %%l2\n"						\
--"8:\t"	"ldub	[%2 + 3], %%g1\n\t"						\
--	"sll	%%g7, 8, %%g7\n\t"						\
--	"or	%%l1, %%l2, %%l1\n\t"						\
--	"or	%%g7, %%g1, %%g7\n\t"						\
--	"or	%%l1, %%g7, %%l1\n\t"						\
--	"b	0f\n\t"								\
--	" st	%%l1, [%0]\n"							\
--"9:\t"	"ldub	[%2], %%l1\n"							\
--"10:\t"	"ldub	[%2 + 1], %%l2\n\t"						\
--	"sll	%%l1, 24, %%l1\n"						\
--"11:\t"	"ldub	[%2 + 2], %%g7\n\t"						\
--	"sll	%%l2, 16, %%l2\n"						\
--"12:\t"	"ldub	[%2 + 3], %%g1\n\t"						\
--	"sll	%%g7, 8, %%g7\n\t"						\
--	"or	%%l1, %%l2, %%l1\n\t"						\
--	"or	%%g7, %%g1, %%g7\n\t"						\
--	"or	%%l1, %%g7, %%g7\n"						\
--"13:\t"	"ldub	[%2 + 4], %%l1\n\t"						\
--	"st	%%g7, [%0]\n"							\
--"14:\t"	"ldub	[%2 + 5], %%l2\n\t"						\
--	"sll	%%l1, 24, %%l1\n"						\
--"15:\t"	"ldub	[%2 + 6], %%g7\n\t"						\
--	"sll	%%l2, 16, %%l2\n"						\
--"16:\t"	"ldub	[%2 + 7], %%g1\n\t"						\
--	"sll	%%g7, 8, %%g7\n\t"						\
--	"or	%%l1, %%l2, %%l1\n\t"						\
--	"or	%%g7, %%g1, %%g7\n\t"						\
--	"or	%%l1, %%g7, %%g7\n\t"						\
--	"st	%%g7, [%0 + 4]\n"						\
--"0:\n\n\t"									\
--	".section __ex_table,#alloc\n\t"					\
--	".word	4b, " #errh "\n\t"						\
--	".word	5b, " #errh "\n\t"						\
--	".word	6b, " #errh "\n\t"						\
--	".word	7b, " #errh "\n\t"						\
--	".word	8b, " #errh "\n\t"						\
--	".word	9b, " #errh "\n\t"						\
--	".word	10b, " #errh "\n\t"						\
--	".word	11b, " #errh "\n\t"						\
--	".word	12b, " #errh "\n\t"						\
--	".word	13b, " #errh "\n\t"						\
--	".word	14b, " #errh "\n\t"						\
--	".word	15b, " #errh "\n\t"						\
--	".word	16b, " #errh "\n\n\t"						\
--	".previous\n\t"								\
--	: : "r" (dest_reg), "r" (size), "r" (saddr), "r" (is_signed)		\
--	: "l1", "l2", "g7", "g1", "cc");					\
--})
--	
--#define store_common(dst_addr, size, src_val, errh) ({				\
--__asm__ __volatile__ (								\
--	"ld	[%2], %%l1\n"							\
--	"cmp	%1, 2\n\t"							\
--	"be	2f\n\t"								\
--	" cmp	%1, 4\n\t"							\
--	"be	1f\n\t"								\
--	" srl	%%l1, 24, %%l2\n\t"						\
--	"srl	%%l1, 16, %%g7\n"						\
--"4:\t"	"stb	%%l2, [%0]\n\t"							\
--	"srl	%%l1, 8, %%l2\n"						\
--"5:\t"	"stb	%%g7, [%0 + 1]\n\t"						\
--	"ld	[%2 + 4], %%g7\n"						\
--"6:\t"	"stb	%%l2, [%0 + 2]\n\t"						\
--	"srl	%%g7, 24, %%l2\n"						\
--"7:\t"	"stb	%%l1, [%0 + 3]\n\t"						\
--	"srl	%%g7, 16, %%l1\n"						\
--"8:\t"	"stb	%%l2, [%0 + 4]\n\t"						\
--	"srl	%%g7, 8, %%l2\n"						\
--"9:\t"	"stb	%%l1, [%0 + 5]\n"						\
--"10:\t"	"stb	%%l2, [%0 + 6]\n\t"						\
--	"b	0f\n"								\
--"11:\t"	" stb	%%g7, [%0 + 7]\n"						\
--"1:\t"	"srl	%%l1, 16, %%g7\n"						\
--"12:\t"	"stb	%%l2, [%0]\n\t"							\
--	"srl	%%l1, 8, %%l2\n"						\
--"13:\t"	"stb	%%g7, [%0 + 1]\n"						\
--"14:\t"	"stb	%%l2, [%0 + 2]\n\t"						\
--	"b	0f\n"								\
--"15:\t"	" stb	%%l1, [%0 + 3]\n"						\
--"2:\t"	"srl	%%l1, 8, %%l2\n"						\
--"16:\t"	"stb	%%l2, [%0]\n"							\
--"17:\t"	"stb	%%l1, [%0 + 1]\n"						\
--"0:\n\n\t"									\
--	".section __ex_table,#alloc\n\t"					\
--	".word	4b, " #errh "\n\t"						\
--	".word	5b, " #errh "\n\t"						\
--	".word	6b, " #errh "\n\t"						\
--	".word	7b, " #errh "\n\t"						\
--	".word	8b, " #errh "\n\t"						\
--	".word	9b, " #errh "\n\t"						\
--	".word	10b, " #errh "\n\t"						\
--	".word	11b, " #errh "\n\t"						\
--	".word	12b, " #errh "\n\t"						\
--	".word	13b, " #errh "\n\t"						\
--	".word	14b, " #errh "\n\t"						\
--	".word	15b, " #errh "\n\t"						\
--	".word	16b, " #errh "\n\t"						\
--	".word	17b, " #errh "\n\n\t"						\
--	".previous\n\t"								\
--	: : "r" (dst_addr), "r" (size), "r" (src_val)				\
--	: "l1", "l2", "g7", "g1", "cc");					\
--})
--
--#define do_integer_store(reg_num, size, dst_addr, regs, errh) ({		\
--	unsigned long *src_val;							\
--	static unsigned long zero[2] = { 0, };					\
--										\
--	if (reg_num) src_val = fetch_reg_addr(reg_num, regs);			\
--	else {									\
--		src_val = &zero[0];						\
--		if (size == 8)							\
--			zero[1] = fetch_reg(1, regs);				\
--	}									\
--	store_common(dst_addr, size, src_val, errh);				\
--})
-+/* una_asm.S */
-+extern int do_int_load(unsigned long *dest_reg, int size,
-+		       unsigned long *saddr, int is_signed);
-+extern int __do_int_store(unsigned long *dst_addr, int size,
-+			  unsigned long *src_val);
-+
-+static int do_int_store(int reg_num, int size, unsigned long *dst_addr,
-+			struct pt_regs *regs)
-+{
-+	unsigned long zero[2] = { 0, 0 };
-+	unsigned long *src_val;
-+
-+	if (reg_num)
-+		src_val = fetch_reg_addr(reg_num, regs);
-+	else {
-+		src_val = &zero[0];
-+		if (size == 8)
-+			zero[1] = fetch_reg(1, regs);
-+	}
-+	return __do_int_store(dst_addr, size, src_val);
-+}
- 
- extern void smp_capture(void);
- extern void smp_release(void);
- 
--#define do_atomic(srcdest_reg, mem, errh) ({					\
--	unsigned long flags, tmp;						\
--										\
--	smp_capture();								\
--	local_irq_save(flags);							\
--	tmp = *srcdest_reg;							\
--	do_integer_load(srcdest_reg, 4, mem, 0, errh);				\
--	store_common(mem, 4, &tmp, errh);					\
--	local_irq_restore(flags);						\
--	smp_release();								\
--})
--
- static inline void advance(struct pt_regs *regs)
- {
- 	regs->pc   = regs->npc;
-@@ -342,9 +216,7 @@ static inline int ok_for_kernel(unsigned int insn)
- 	return !floating_point_load_or_store_p(insn);
- }
- 
--void kernel_mna_trap_fault(struct pt_regs *regs, unsigned int insn) __asm__ ("kernel_mna_trap_fault");
--
--void kernel_mna_trap_fault(struct pt_regs *regs, unsigned int insn)
-+static void kernel_mna_trap_fault(struct pt_regs *regs, unsigned int insn)
- {
- 	unsigned long g2 = regs->u_regs [UREG_G2];
- 	unsigned long fixup = search_extables_range(regs->pc, &g2);
-@@ -379,48 +251,34 @@ asmlinkage void kernel_unaligned_trap(struct pt_regs *regs, unsigned int insn)
- 		printk("Unsupported unaligned load/store trap for kernel at <%08lx>.\n",
- 		       regs->pc);
- 		unaligned_panic("Wheee. Kernel does fpu/atomic unaligned load/store.");
--
--		__asm__ __volatile__ ("\n"
--"kernel_unaligned_trap_fault:\n\t"
--		"mov	%0, %%o0\n\t"
--		"call	kernel_mna_trap_fault\n\t"
--		" mov	%1, %%o1\n\t"
--		:
--		: "r" (regs), "r" (insn)
--		: "o0", "o1", "o2", "o3", "o4", "o5", "o7",
--		  "g1", "g2", "g3", "g4", "g5", "g7", "cc");
- 	} else {
- 		unsigned long addr = compute_effective_address(regs, insn);
-+		int err;
- 
- #ifdef DEBUG_MNA
- 		printk("KMNA: pc=%08lx [dir=%s addr=%08lx size=%d] retpc[%08lx]\n",
- 		       regs->pc, dirstrings[dir], addr, size, regs->u_regs[UREG_RETPC]);
- #endif
--		switch(dir) {
-+		switch (dir) {
- 		case load:
--			do_integer_load(fetch_reg_addr(((insn>>25)&0x1f), regs),
--					size, (unsigned long *) addr,
--					decode_signedness(insn),
--					kernel_unaligned_trap_fault);
-+			err = do_int_load(fetch_reg_addr(((insn>>25)&0x1f),
-+							 regs),
-+					  size, (unsigned long *) addr,
-+					  decode_signedness(insn));
- 			break;
- 
- 		case store:
--			do_integer_store(((insn>>25)&0x1f), size,
--					 (unsigned long *) addr, regs,
--					 kernel_unaligned_trap_fault);
-+			err = do_int_store(((insn>>25)&0x1f), size,
-+					   (unsigned long *) addr, regs);
- 			break;
--#if 0 /* unsupported */
--		case both:
--			do_atomic(fetch_reg_addr(((insn>>25)&0x1f), regs),
--				  (unsigned long *) addr,
--				  kernel_unaligned_trap_fault);
--			break;
--#endif
- 		default:
- 			panic("Impossible kernel unaligned trap.");
- 			/* Not reached... */
- 		}
--		advance(regs);
-+		if (err)
-+			kernel_mna_trap_fault(regs, insn);
-+		else
-+			advance(regs);
- 	}
- }
- 
-@@ -459,9 +317,7 @@ static inline int ok_for_user(struct pt_regs *regs, unsigned int insn,
- 	return 0;
- }
- 
--void user_mna_trap_fault(struct pt_regs *regs, unsigned int insn) __asm__ ("user_mna_trap_fault");
--
--void user_mna_trap_fault(struct pt_regs *regs, unsigned int insn)
-+static void user_mna_trap_fault(struct pt_regs *regs, unsigned int insn)
- {
- 	siginfo_t info;
- 
-@@ -485,7 +341,7 @@ asmlinkage void user_unaligned_trap(struct pt_regs *regs, unsigned int insn)
- 	if(!ok_for_user(regs, insn, dir)) {
- 		goto kill_user;
- 	} else {
--		int size = decode_access_size(insn);
-+		int err, size = decode_access_size(insn);
- 		unsigned long addr;
- 
- 		if(floating_point_load_or_store_p(insn)) {
-@@ -496,48 +352,34 @@ asmlinkage void user_unaligned_trap(struct pt_regs *regs, unsigned int insn)
- 		addr = compute_effective_address(regs, insn);
- 		switch(dir) {
- 		case load:
--			do_integer_load(fetch_reg_addr(((insn>>25)&0x1f), regs),
--					size, (unsigned long *) addr,
--					decode_signedness(insn),
--					user_unaligned_trap_fault);
-+			err = do_int_load(fetch_reg_addr(((insn>>25)&0x1f),
-+							 regs),
-+					  size, (unsigned long *) addr,
-+					  decode_signedness(insn));
- 			break;
- 
- 		case store:
--			do_integer_store(((insn>>25)&0x1f), size,
--					 (unsigned long *) addr, regs,
--					 user_unaligned_trap_fault);
-+			err = do_int_store(((insn>>25)&0x1f), size,
-+					   (unsigned long *) addr, regs);
- 			break;
- 
- 		case both:
--#if 0 /* unsupported */
--			do_atomic(fetch_reg_addr(((insn>>25)&0x1f), regs),
--				  (unsigned long *) addr,
--				  user_unaligned_trap_fault);
--#else
- 			/*
- 			 * This was supported in 2.4. However, we question
- 			 * the value of SWAP instruction across word boundaries.
- 			 */
- 			printk("Unaligned SWAP unsupported.\n");
--			goto kill_user;
--#endif
-+			err = -EFAULT;
- 			break;
- 
- 		default:
- 			unaligned_panic("Impossible user unaligned trap.");
--
--			__asm__ __volatile__ ("\n"
--"user_unaligned_trap_fault:\n\t"
--			"mov	%0, %%o0\n\t"
--			"call	user_mna_trap_fault\n\t"
--			" mov	%1, %%o1\n\t"
--			:
--			: "r" (regs), "r" (insn)
--			: "o0", "o1", "o2", "o3", "o4", "o5", "o7",
--			  "g1", "g2", "g3", "g4", "g5", "g7", "cc");
- 			goto out;
- 		}
--		advance(regs);
-+		if (err)
-+			goto kill_user;
-+		else
-+			advance(regs);
- 		goto out;
- 	}
- 
-diff --git a/arch/sparc64/mm/fault.c b/arch/sparc64/mm/fault.c
-index e2027f2..2650d0d 100644
---- a/arch/sparc64/mm/fault.c
-+++ b/arch/sparc64/mm/fault.c
-@@ -244,16 +244,8 @@ static void do_kernel_fault(struct pt_regs *regs, int si_code, int fault_code,
- 	if (regs->tstate & TSTATE_PRIV) {
- 		const struct exception_table_entry *entry;
- 
--		if (asi == ASI_P && (insn & 0xc0800000) == 0xc0800000) {
--			if (insn & 0x2000)
--				asi = (regs->tstate >> 24);
--			else
--				asi = (insn >> 5);
--		}
--	
--		/* Look in asi.h: All _S asis have LS bit set */
--		if ((asi & 0x1) &&
--		    (entry = search_exception_tables(regs->tpc))) {
-+		entry = search_exception_tables(regs->tpc);
-+		if (entry) {
- 			regs->tpc = entry->fixup;
- 			regs->tnpc = regs->tpc + 4;
- 			return;
-@@ -294,7 +286,7 @@ asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
- 		unsigned long tpc = regs->tpc;
- 
- 		/* Sanity check the PC. */
--		if ((tpc >= KERNBASE && tpc < (unsigned long) _etext) ||
-+		if ((tpc >= KERNBASE && tpc < (unsigned long) __init_end) ||
- 		    (tpc >= MODULES_VADDR && tpc < MODULES_END)) {
- 			/* Valid, no problems... */
- 		} else {
-diff --git a/arch/x86/ia32/ia32_signal.c b/arch/x86/ia32/ia32_signal.c
-index 6ea19c2..4eaaf78 100644
---- a/arch/x86/ia32/ia32_signal.c
-+++ b/arch/x86/ia32/ia32_signal.c
-@@ -494,7 +494,7 @@ int ia32_setup_frame(int sig, struct k_sigaction *ka,
- 	regs->ss = __USER32_DS; 
- 
- 	set_fs(USER_DS);
--	regs->eflags &= ~TF_MASK;
-+	regs->eflags &= ~(TF_MASK | X86_EFLAGS_DF);
- 	if (test_thread_flag(TIF_SINGLESTEP))
- 		ptrace_notify(SIGTRAP);
- 
-@@ -600,7 +600,7 @@ int ia32_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
- 	regs->ss = __USER32_DS; 
- 
- 	set_fs(USER_DS);
--	regs->eflags &= ~TF_MASK;
-+	regs->eflags &= ~(TF_MASK | X86_EFLAGS_DF);
- 	if (test_thread_flag(TIF_SINGLESTEP))
- 		ptrace_notify(SIGTRAP);
- 
-diff --git a/arch/x86/kernel/apic_32.c b/arch/x86/kernel/apic_32.c
-index edb5108..c48fbb1 100644
---- a/arch/x86/kernel/apic_32.c
-+++ b/arch/x86/kernel/apic_32.c
-@@ -154,7 +154,7 @@ unsigned long safe_apic_wait_icr_idle(void)
- /**
-  * enable_NMI_through_LVT0 - enable NMI through local vector table 0
-  */
--void enable_NMI_through_LVT0 (void * dummy)
-+void __cpuinit enable_NMI_through_LVT0(void)
- {
- 	unsigned int v = APIC_DM_NMI;
- 
-diff --git a/arch/x86/kernel/apic_64.c b/arch/x86/kernel/apic_64.c
-index f28ccb5..0173007 100644
---- a/arch/x86/kernel/apic_64.c
-+++ b/arch/x86/kernel/apic_64.c
-@@ -151,7 +151,7 @@ unsigned int safe_apic_wait_icr_idle(void)
- 	return send_status;
- }
- 
--void enable_NMI_through_LVT0 (void * dummy)
-+void enable_NMI_through_LVT0(void)
- {
- 	unsigned int v;
- 
-diff --git a/arch/x86/kernel/io_apic_32.c b/arch/x86/kernel/io_apic_32.c
-index a6b1490..232fdeb 100644
---- a/arch/x86/kernel/io_apic_32.c
-+++ b/arch/x86/kernel/io_apic_32.c
-@@ -2080,7 +2080,7 @@ static struct irq_chip lapic_chip __read_mostly = {
- 	.eoi		= ack_apic,
- };
- 
--static void setup_nmi (void)
-+static void __init setup_nmi(void)
- {
- 	/*
-  	 * Dirty trick to enable the NMI watchdog ...
-@@ -2093,7 +2093,7 @@ static void setup_nmi (void)
- 	 */ 
- 	apic_printk(APIC_VERBOSE, KERN_INFO "activating NMI Watchdog ...");
- 
--	on_each_cpu(enable_NMI_through_LVT0, NULL, 1, 1);
-+	enable_NMI_through_LVT0();
- 
- 	apic_printk(APIC_VERBOSE, " done.\n");
- }
-diff --git a/arch/x86/kernel/io_apic_64.c b/arch/x86/kernel/io_apic_64.c
-index cbac167..7119cb7 100644
---- a/arch/x86/kernel/io_apic_64.c
-+++ b/arch/x86/kernel/io_apic_64.c
-@@ -1565,7 +1565,7 @@ static struct hw_interrupt_type lapic_irq_type __read_mostly = {
- 	.end = end_lapic_irq,
- };
- 
--static void setup_nmi (void)
-+static void __init setup_nmi(void)
- {
- 	/*
-  	 * Dirty trick to enable the NMI watchdog ...
-@@ -1578,7 +1578,7 @@ static void setup_nmi (void)
- 	 */ 
- 	printk(KERN_INFO "activating NMI Watchdog ...");
- 
--	enable_NMI_through_LVT0(NULL);
-+	enable_NMI_through_LVT0();
- 
- 	printk(" done.\n");
- }
-@@ -1654,7 +1654,7 @@ static inline void unlock_ExtINT_logic(void)
-  *
-  * FIXME: really need to revamp this for modern platforms only.
-  */
--static inline void check_timer(void)
-+static inline void __init check_timer(void)
- {
- 	struct irq_cfg *cfg = irq_cfg + 0;
- 	int apic1, pin1, apic2, pin2;
-diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
-index ab79e1d..d7f7132 100644
---- a/arch/x86/kernel/process_64.c
-+++ b/arch/x86/kernel/process_64.c
-@@ -212,14 +212,13 @@ void cpu_idle (void)
- 	current_thread_info()->status |= TS_POLLING;
- 	/* endless idle loop with no priority at all */
- 	while (1) {
-+		tick_nohz_stop_sched_tick();
- 		while (!need_resched()) {
- 			void (*idle)(void);
- 
- 			if (__get_cpu_var(cpu_idle_state))
- 				__get_cpu_var(cpu_idle_state) = 0;
- 
--			tick_nohz_stop_sched_tick();
--
- 			rmb();
- 			idle = pm_idle;
- 			if (!idle)
-diff --git a/arch/x86/kernel/signal_32.c b/arch/x86/kernel/signal_32.c
-index 9bdd830..20056db 100644
---- a/arch/x86/kernel/signal_32.c
-+++ b/arch/x86/kernel/signal_32.c
-@@ -396,7 +396,7 @@ static int setup_frame(int sig, struct k_sigaction *ka,
- 	 * The tracer may want to single-step inside the
- 	 * handler too.
- 	 */
--	regs->eflags &= ~TF_MASK;
-+	regs->eflags &= ~(TF_MASK | X86_EFLAGS_DF);
- 	if (test_thread_flag(TIF_SINGLESTEP))
- 		ptrace_notify(SIGTRAP);
- 
-@@ -489,7 +489,7 @@ static int setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
- 	 * The tracer may want to single-step inside the
- 	 * handler too.
- 	 */
--	regs->eflags &= ~TF_MASK;
-+	regs->eflags &= ~(TF_MASK | X86_EFLAGS_DF);
- 	if (test_thread_flag(TIF_SINGLESTEP))
- 		ptrace_notify(SIGTRAP);
- 
-diff --git a/arch/x86/kernel/signal_64.c b/arch/x86/kernel/signal_64.c
-index ab086b0..62964c5 100644
---- a/arch/x86/kernel/signal_64.c
-+++ b/arch/x86/kernel/signal_64.c
-@@ -295,7 +295,7 @@ static int setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
- 	   see include/asm-x86_64/uaccess.h for details. */
- 	set_fs(USER_DS);
- 
--	regs->eflags &= ~TF_MASK;
-+	regs->eflags &= ~(TF_MASK | X86_EFLAGS_DF);
- 	if (test_thread_flag(TIF_SINGLESTEP))
- 		ptrace_notify(SIGTRAP);
- #ifdef DEBUG_SIG
-diff --git a/arch/x86/kernel/smpboot_32.c b/arch/x86/kernel/smpboot_32.c
-index 4ea80cb..fe200cf 100644
---- a/arch/x86/kernel/smpboot_32.c
-+++ b/arch/x86/kernel/smpboot_32.c
-@@ -405,7 +405,7 @@ static void __cpuinit start_secondary(void *unused)
- 	setup_secondary_clock();
- 	if (nmi_watchdog == NMI_IO_APIC) {
- 		disable_8259A_irq(0);
--		enable_NMI_through_LVT0(NULL);
-+		enable_NMI_through_LVT0();
- 		enable_8259A_irq(0);
- 	}
- 	/*
-diff --git a/arch/x86/kernel/smpboot_64.c b/arch/x86/kernel/smpboot_64.c
-index aaf4e12..eca8026 100644
---- a/arch/x86/kernel/smpboot_64.c
-+++ b/arch/x86/kernel/smpboot_64.c
-@@ -338,7 +338,7 @@ void __cpuinit start_secondary(void)
- 
- 	if (nmi_watchdog == NMI_IO_APIC) {
- 		disable_8259A_irq(0);
--		enable_NMI_through_LVT0(NULL);
-+		enable_NMI_through_LVT0();
- 		enable_8259A_irq(0);
- 	}
- 
-diff --git a/arch/x86/pci/mmconfig-shared.c b/arch/x86/pci/mmconfig-shared.c
-index 4df637e..6b521d3 100644
---- a/arch/x86/pci/mmconfig-shared.c
-+++ b/arch/x86/pci/mmconfig-shared.c
-@@ -22,42 +22,9 @@
- #define MMCONFIG_APER_MIN	(2 * 1024*1024)
- #define MMCONFIG_APER_MAX	(256 * 1024*1024)
- 
--DECLARE_BITMAP(pci_mmcfg_fallback_slots, 32*PCI_MMCFG_MAX_CHECK_BUS);
--
- /* Indicate if the mmcfg resources have been placed into the resource table. */
- static int __initdata pci_mmcfg_resources_inserted;
- 
--/* K8 systems have some devices (typically in the builtin northbridge)
--   that are only accessible using type1
--   Normally this can be expressed in the MCFG by not listing them
--   and assigning suitable _SEGs, but this isn't implemented in some BIOS.
--   Instead try to discover all devices on bus 0 that are unreachable using MM
--   and fallback for them. */
--static void __init unreachable_devices(void)
--{
--	int i, bus;
--	/* Use the max bus number from ACPI here? */
--	for (bus = 0; bus < PCI_MMCFG_MAX_CHECK_BUS; bus++) {
--		for (i = 0; i < 32; i++) {
--			unsigned int devfn = PCI_DEVFN(i, 0);
--			u32 val1, val2;
--
--			pci_conf1_read(0, bus, devfn, 0, 4, &val1);
--			if (val1 == 0xffffffff)
--				continue;
--
--			if (pci_mmcfg_arch_reachable(0, bus, devfn)) {
--				raw_pci_ops->read(0, bus, devfn, 0, 4, &val2);
--				if (val1 == val2)
--					continue;
--			}
--			set_bit(i + 32 * bus, pci_mmcfg_fallback_slots);
--			printk(KERN_NOTICE "PCI: No mmconfig possible on device"
--			       " %02x:%02x\n", bus, i);
--		}
--	}
--}
--
- static const char __init *pci_mmcfg_e7520(void)
- {
- 	u32 win;
-@@ -270,8 +237,6 @@ void __init pci_mmcfg_init(int type)
- 		return;
- 
- 	if (pci_mmcfg_arch_init()) {
--		if (type == 1)
--			unreachable_devices();
- 		if (known_bridge)
- 			pci_mmcfg_insert_resources(IORESOURCE_BUSY);
- 		pci_probe = (pci_probe & ~PCI_PROBE_MASK) | PCI_PROBE_MMCONF;
-diff --git a/arch/x86/pci/mmconfig_32.c b/arch/x86/pci/mmconfig_32.c
-index 1bf5816..7b75e65 100644
---- a/arch/x86/pci/mmconfig_32.c
-+++ b/arch/x86/pci/mmconfig_32.c
-@@ -30,10 +30,6 @@ static u32 get_base_addr(unsigned int seg, int bus, unsigned devfn)
- 	struct acpi_mcfg_allocation *cfg;
- 	int cfg_num;
- 
--	if (seg == 0 && bus < PCI_MMCFG_MAX_CHECK_BUS &&
--	    test_bit(PCI_SLOT(devfn) + 32*bus, pci_mmcfg_fallback_slots))
--		return 0;
--
- 	for (cfg_num = 0; cfg_num < pci_mmcfg_config_num; cfg_num++) {
- 		cfg = &pci_mmcfg_config[cfg_num];
- 		if (cfg->pci_segment == seg &&
-@@ -68,13 +64,16 @@ static int pci_mmcfg_read(unsigned int seg, unsigned int bus,
- 	u32 base;
- 
- 	if ((bus > 255) || (devfn > 255) || (reg > 4095)) {
--		*value = -1;
-+err:		*value = -1;
- 		return -EINVAL;
- 	}
- 
-+	if (reg < 256)
-+		return pci_conf1_read(seg,bus,devfn,reg,len,value);
-+
- 	base = get_base_addr(seg, bus, devfn);
- 	if (!base)
--		return pci_conf1_read(seg,bus,devfn,reg,len,value);
-+		goto err;
- 
- 	spin_lock_irqsave(&pci_config_lock, flags);
- 
-@@ -105,9 +104,12 @@ static int pci_mmcfg_write(unsigned int seg, unsigned int bus,
- 	if ((bus > 255) || (devfn > 255) || (reg > 4095))
- 		return -EINVAL;
- 
-+	if (reg < 256)
-+		return pci_conf1_write(seg,bus,devfn,reg,len,value);
-+
- 	base = get_base_addr(seg, bus, devfn);
- 	if (!base)
--		return pci_conf1_write(seg,bus,devfn,reg,len,value);
-+		return -EINVAL;
- 
- 	spin_lock_irqsave(&pci_config_lock, flags);
- 
-@@ -134,12 +136,6 @@ static struct pci_raw_ops pci_mmcfg = {
- 	.write =	pci_mmcfg_write,
- };
- 
--int __init pci_mmcfg_arch_reachable(unsigned int seg, unsigned int bus,
--				    unsigned int devfn)
--{
--	return get_base_addr(seg, bus, devfn) != 0;
--}
--
- int __init pci_mmcfg_arch_init(void)
- {
- 	printk(KERN_INFO "PCI: Using MMCONFIG\n");
-diff --git a/arch/x86/pci/mmconfig_64.c b/arch/x86/pci/mmconfig_64.c
-index 4095e4d..c4cf318 100644
---- a/arch/x86/pci/mmconfig_64.c
-+++ b/arch/x86/pci/mmconfig_64.c
-@@ -40,9 +40,7 @@ static char __iomem *get_virt(unsigned int seg, unsigned bus)
- static char __iomem *pci_dev_base(unsigned int seg, unsigned int bus, unsigned int devfn)
- {
- 	char __iomem *addr;
--	if (seg == 0 && bus < PCI_MMCFG_MAX_CHECK_BUS &&
--		test_bit(32*bus + PCI_SLOT(devfn), pci_mmcfg_fallback_slots))
--		return NULL;
-+
- 	addr = get_virt(seg, bus);
- 	if (!addr)
- 		return NULL;
-@@ -56,13 +54,16 @@ static int pci_mmcfg_read(unsigned int seg, unsigned int bus,
- 
- 	/* Why do we have this when nobody checks it. How about a BUG()!? -AK */
- 	if (unlikely((bus > 255) || (devfn > 255) || (reg > 4095))) {
--		*value = -1;
-+err:		*value = -1;
- 		return -EINVAL;
- 	}
- 
-+	if (reg < 256)
-+		return pci_conf1_read(seg,bus,devfn,reg,len,value);
-+
- 	addr = pci_dev_base(seg, bus, devfn);
- 	if (!addr)
--		return pci_conf1_read(seg,bus,devfn,reg,len,value);
-+		goto err;
- 
- 	switch (len) {
- 	case 1:
-@@ -88,9 +89,12 @@ static int pci_mmcfg_write(unsigned int seg, unsigned int bus,
- 	if (unlikely((bus > 255) || (devfn > 255) || (reg > 4095)))
- 		return -EINVAL;
- 
-+	if (reg < 256)
-+		return pci_conf1_write(seg,bus,devfn,reg,len,value);
-+
- 	addr = pci_dev_base(seg, bus, devfn);
- 	if (!addr)
--		return pci_conf1_write(seg,bus,devfn,reg,len,value);
-+		return -EINVAL;
- 
- 	switch (len) {
- 	case 1:
-@@ -126,12 +130,6 @@ static void __iomem * __init mcfg_ioremap(struct acpi_mcfg_allocation *cfg)
- 	return addr;
- }
- 
--int __init pci_mmcfg_arch_reachable(unsigned int seg, unsigned int bus,
--				    unsigned int devfn)
--{
--	return pci_dev_base(seg, bus, devfn) != NULL;
--}
--
- int __init pci_mmcfg_arch_init(void)
- {
- 	int i;
-diff --git a/arch/x86/pci/pci.h b/arch/x86/pci/pci.h
-index ac56d39..36cb44c 100644
---- a/arch/x86/pci/pci.h
-+++ b/arch/x86/pci/pci.h
-@@ -98,13 +98,6 @@ extern void pcibios_sort(void);
- 
- /* pci-mmconfig.c */
- 
--/* Verify the first 16 busses. We assume that systems with more busses
--   get MCFG right. */
--#define PCI_MMCFG_MAX_CHECK_BUS 16
--extern DECLARE_BITMAP(pci_mmcfg_fallback_slots, 32*PCI_MMCFG_MAX_CHECK_BUS);
--
--extern int __init pci_mmcfg_arch_reachable(unsigned int seg, unsigned int bus,
--					   unsigned int devfn);
- extern int __init pci_mmcfg_arch_init(void);
- 
- /*
-diff --git a/crypto/async_tx/async_xor.c b/crypto/async_tx/async_xor.c
-index 2575f67..5c579d2 100644
---- a/crypto/async_tx/async_xor.c
-+++ b/crypto/async_tx/async_xor.c
-@@ -264,7 +264,7 @@ async_xor_zero_sum(struct page *dest, struct page **src_list,
- 
- 	BUG_ON(src_cnt <= 1);
- 
--	if (tx) {
-+	if (tx && src_cnt <= device->max_xor) {
- 		dma_addr_t dma_addr;
- 		enum dma_data_direction dir;
- 
-diff --git a/crypto/xcbc.c b/crypto/xcbc.c
-index ac68f3b..a957373 100644
---- a/crypto/xcbc.c
-+++ b/crypto/xcbc.c
-@@ -124,6 +124,11 @@ static int crypto_xcbc_digest_update2(struct hash_desc *pdesc,
- 		unsigned int offset = sg[i].offset;
- 		unsigned int slen = sg[i].length;
- 
-+		if (unlikely(slen > nbytes))
-+			slen = nbytes;
-+
-+		nbytes -= slen;
-+
- 		while (slen > 0) {
- 			unsigned int len = min(slen, ((unsigned int)(PAGE_SIZE)) - offset);
- 			char *p = crypto_kmap(pg, 0) + offset;
-@@ -177,7 +182,6 @@ static int crypto_xcbc_digest_update2(struct hash_desc *pdesc,
- 			offset = 0;
- 			pg++;
- 		}
--		nbytes-=sg[i].length;
- 		i++;
- 	} while (nbytes>0);
- 
-diff --git a/crypto/xts.c b/crypto/xts.c
-index 8eb08bf..d87b0f3 100644
---- a/crypto/xts.c
-+++ b/crypto/xts.c
-@@ -77,16 +77,16 @@ static int setkey(struct crypto_tfm *parent, const u8 *key,
- }
- 
- struct sinfo {
--	be128 t;
-+	be128 *t;
- 	struct crypto_tfm *tfm;
- 	void (*fn)(struct crypto_tfm *, u8 *, const u8 *);
- };
- 
- static inline void xts_round(struct sinfo *s, void *dst, const void *src)
- {
--	be128_xor(dst, &s->t, src);		/* PP <- T xor P */
-+	be128_xor(dst, s->t, src);		/* PP <- T xor P */
- 	s->fn(s->tfm, dst, dst);		/* CC <- E(Key1,PP) */
--	be128_xor(dst, dst, &s->t);		/* C <- T xor CC */
-+	be128_xor(dst, dst, s->t);		/* C <- T xor CC */
- }
- 
- static int crypt(struct blkcipher_desc *d,
-@@ -101,7 +101,6 @@ static int crypt(struct blkcipher_desc *d,
- 		.tfm = crypto_cipher_tfm(ctx->child),
- 		.fn = fn
- 	};
--	be128 *iv;
- 	u8 *wsrc;
- 	u8 *wdst;
- 
-@@ -109,20 +108,20 @@ static int crypt(struct blkcipher_desc *d,
- 	if (!w->nbytes)
- 		return err;
- 
-+	s.t = (be128 *)w->iv;
- 	avail = w->nbytes;
- 
- 	wsrc = w->src.virt.addr;
- 	wdst = w->dst.virt.addr;
- 
- 	/* calculate first value of T */
--	iv = (be128 *)w->iv;
--	tw(crypto_cipher_tfm(ctx->tweak), (void *)&s.t, w->iv);
-+	tw(crypto_cipher_tfm(ctx->tweak), w->iv, w->iv);
- 
- 	goto first;
- 
- 	for (;;) {
- 		do {
--			gf128mul_x_ble(&s.t, &s.t);
-+			gf128mul_x_ble(s.t, s.t);
- 
- first:
- 			xts_round(&s, wdst, wsrc);
-diff --git a/drivers/acorn/char/defkeymap-l7200.c b/drivers/acorn/char/defkeymap-l7200.c
-index 28a5fbc..93d80a1 100644
---- a/drivers/acorn/char/defkeymap-l7200.c
-+++ b/drivers/acorn/char/defkeymap-l7200.c
-@@ -347,40 +347,40 @@ char *func_table[MAX_NR_FUNC] = {
- };
- 
- struct kbdiacruc accent_table[MAX_DIACR] = {
--	{'`', 'A', '\300'},	{'`', 'a', '\340'},
--	{'\'', 'A', '\301'},	{'\'', 'a', '\341'},
--	{'^', 'A', '\302'},	{'^', 'a', '\342'},
--	{'~', 'A', '\303'},	{'~', 'a', '\343'},
--	{'"', 'A', '\304'},	{'"', 'a', '\344'},
--	{'O', 'A', '\305'},	{'o', 'a', '\345'},
--	{'0', 'A', '\305'},	{'0', 'a', '\345'},
--	{'A', 'A', '\305'},	{'a', 'a', '\345'},
--	{'A', 'E', '\306'},	{'a', 'e', '\346'},
--	{',', 'C', '\307'},	{',', 'c', '\347'},
--	{'`', 'E', '\310'},	{'`', 'e', '\350'},
--	{'\'', 'E', '\311'},	{'\'', 'e', '\351'},
--	{'^', 'E', '\312'},	{'^', 'e', '\352'},
--	{'"', 'E', '\313'},	{'"', 'e', '\353'},
--	{'`', 'I', '\314'},	{'`', 'i', '\354'},
--	{'\'', 'I', '\315'},	{'\'', 'i', '\355'},
--	{'^', 'I', '\316'},	{'^', 'i', '\356'},
--	{'"', 'I', '\317'},	{'"', 'i', '\357'},
--	{'-', 'D', '\320'},	{'-', 'd', '\360'},
--	{'~', 'N', '\321'},	{'~', 'n', '\361'},
--	{'`', 'O', '\322'},	{'`', 'o', '\362'},
--	{'\'', 'O', '\323'},	{'\'', 'o', '\363'},
--	{'^', 'O', '\324'},	{'^', 'o', '\364'},
--	{'~', 'O', '\325'},	{'~', 'o', '\365'},
--	{'"', 'O', '\326'},	{'"', 'o', '\366'},
--	{'/', 'O', '\330'},	{'/', 'o', '\370'},
--	{'`', 'U', '\331'},	{'`', 'u', '\371'},
--	{'\'', 'U', '\332'},	{'\'', 'u', '\372'},
--	{'^', 'U', '\333'},	{'^', 'u', '\373'},
--	{'"', 'U', '\334'},	{'"', 'u', '\374'},
--	{'\'', 'Y', '\335'},	{'\'', 'y', '\375'},
--	{'T', 'H', '\336'},	{'t', 'h', '\376'},
--	{'s', 's', '\337'},	{'"', 'y', '\377'},
--	{'s', 'z', '\337'},	{'i', 'j', '\377'},
-+	{'`', 'A', 0300},	{'`', 'a', 0340},
-+	{'\'', 'A', 0301},	{'\'', 'a', 0341},
-+	{'^', 'A', 0302},	{'^', 'a', 0342},
-+	{'~', 'A', 0303},	{'~', 'a', 0343},
-+	{'"', 'A', 0304},	{'"', 'a', 0344},
-+	{'O', 'A', 0305},	{'o', 'a', 0345},
-+	{'0', 'A', 0305},	{'0', 'a', 0345},
-+	{'A', 'A', 0305},	{'a', 'a', 0345},
-+	{'A', 'E', 0306},	{'a', 'e', 0346},
-+	{',', 'C', 0307},	{',', 'c', 0347},
-+	{'`', 'E', 0310},	{'`', 'e', 0350},
-+	{'\'', 'E', 0311},	{'\'', 'e', 0351},
-+	{'^', 'E', 0312},	{'^', 'e', 0352},
-+	{'"', 'E', 0313},	{'"', 'e', 0353},
-+	{'`', 'I', 0314},	{'`', 'i', 0354},
-+	{'\'', 'I', 0315},	{'\'', 'i', 0355},
-+	{'^', 'I', 0316},	{'^', 'i', 0356},
-+	{'"', 'I', 0317},	{'"', 'i', 0357},
-+	{'-', 'D', 0320},	{'-', 'd', 0360},
-+	{'~', 'N', 0321},	{'~', 'n', 0361},
-+	{'`', 'O', 0322},	{'`', 'o', 0362},
-+	{'\'', 'O', 0323},	{'\'', 'o', 0363},
-+	{'^', 'O', 0324},	{'^', 'o', 0364},
-+	{'~', 'O', 0325},	{'~', 'o', 0365},
-+	{'"', 'O', 0326},	{'"', 'o', 0366},
-+	{'/', 'O', 0330},	{'/', 'o', 0370},
-+	{'`', 'U', 0331},	{'`', 'u', 0371},
-+	{'\'', 'U', 0332},	{'\'', 'u', 0372},
-+	{'^', 'U', 0333},	{'^', 'u', 0373},
-+	{'"', 'U', 0334},	{'"', 'u', 0374},
-+	{'\'', 'Y', 0335},	{'\'', 'y', 0375},
-+	{'T', 'H', 0336},	{'t', 'h', 0376},
-+	{'s', 's', 0337},	{'"', 'y', 0377},
-+	{'s', 'z', 0337},	{'i', 'j', 0377},
- };
- 
- unsigned int accent_table_size = 68;
-diff --git a/drivers/ata/pata_hpt366.c b/drivers/ata/pata_hpt366.c
-index 0713872..a742efa 100644
---- a/drivers/ata/pata_hpt366.c
-+++ b/drivers/ata/pata_hpt366.c
-@@ -27,7 +27,7 @@
- #include <linux/libata.h>
- 
- #define DRV_NAME	"pata_hpt366"
--#define DRV_VERSION	"0.6.1"
-+#define DRV_VERSION	"0.6.2"
- 
- struct hpt_clock {
- 	u8	xfer_speed;
-@@ -180,9 +180,9 @@ static unsigned long hpt366_filter(struct ata_device *adev, unsigned long mask)
- 		if (hpt_dma_blacklisted(adev, "UDMA",  bad_ata33))
- 			mask &= ~ATA_MASK_UDMA;
- 		if (hpt_dma_blacklisted(adev, "UDMA3", bad_ata66_3))
--			mask &= ~(0x07 << ATA_SHIFT_UDMA);
-+			mask &= ~(0xF8 << ATA_SHIFT_UDMA);
- 		if (hpt_dma_blacklisted(adev, "UDMA4", bad_ata66_4))
--			mask &= ~(0x0F << ATA_SHIFT_UDMA);
-+			mask &= ~(0xF0 << ATA_SHIFT_UDMA);
- 	}
- 	return ata_pci_default_filter(adev, mask);
- }
-diff --git a/drivers/ata/pata_hpt37x.c b/drivers/ata/pata_hpt37x.c
-index c79f066..eac6a2b 100644
---- a/drivers/ata/pata_hpt37x.c
-+++ b/drivers/ata/pata_hpt37x.c
-@@ -24,7 +24,7 @@
- #include <linux/libata.h>
- 
- #define DRV_NAME	"pata_hpt37x"
--#define DRV_VERSION	"0.6.9"
-+#define DRV_VERSION	"0.6.11"
- 
- struct hpt_clock {
- 	u8	xfer_speed;
-@@ -281,7 +281,7 @@ static unsigned long hpt370_filter(struct ata_device *adev, unsigned long mask)
- 		if (hpt_dma_blacklisted(adev, "UDMA", bad_ata33))
- 			mask &= ~ATA_MASK_UDMA;
- 		if (hpt_dma_blacklisted(adev, "UDMA100", bad_ata100_5))
--			mask &= ~(0x1F << ATA_SHIFT_UDMA);
-+			mask &= ~(0xE0 << ATA_SHIFT_UDMA);
- 	}
- 	return ata_pci_default_filter(adev, mask);
- }
-@@ -297,7 +297,7 @@ static unsigned long hpt370a_filter(struct ata_device *adev, unsigned long mask)
- {
- 	if (adev->class == ATA_DEV_ATA) {
- 		if (hpt_dma_blacklisted(adev, "UDMA100", bad_ata100_5))
--			mask &= ~ (0x1F << ATA_SHIFT_UDMA);
-+			mask &= ~(0xE0 << ATA_SHIFT_UDMA);
- 	}
- 	return ata_pci_default_filter(adev, mask);
- }
-diff --git a/drivers/ata/pata_serverworks.c b/drivers/ata/pata_serverworks.c
-index 8bed888..004cac7 100644
---- a/drivers/ata/pata_serverworks.c
-+++ b/drivers/ata/pata_serverworks.c
-@@ -226,7 +226,7 @@ static unsigned long serverworks_csb_filter(struct ata_device *adev, unsigned lo
- 
- 	for (i = 0; (p = csb_bad_ata100[i]) != NULL; i++) {
- 		if (!strcmp(p, model_num))
--			mask &= ~(0x1F << ATA_SHIFT_UDMA);
-+			mask &= ~(0xE0 << ATA_SHIFT_UDMA);
- 	}
- 	return ata_pci_default_filter(adev, mask);
- }
-diff --git a/drivers/base/platform.c b/drivers/base/platform.c
-index fb56092..39d8b7b 100644
---- a/drivers/base/platform.c
-+++ b/drivers/base/platform.c
-@@ -647,7 +647,7 @@ u64 dma_get_required_mask(struct device *dev)
- 		high_totalram += high_totalram - 1;
- 		mask = (((u64)high_totalram) << 32) + 0xffffffff;
- 	}
--	return mask & *dev->dma_mask;
-+	return mask;
- }
- EXPORT_SYMBOL_GPL(dma_get_required_mask);
- #endif
-diff --git a/drivers/block/ub.c b/drivers/block/ub.c
-index 08e909d..7aca466 100644
---- a/drivers/block/ub.c
-+++ b/drivers/block/ub.c
-@@ -657,7 +657,6 @@ static int ub_request_fn_1(struct ub_lun *lun, struct request *rq)
- 	if ((cmd = ub_get_cmd(lun)) == NULL)
- 		return -1;
- 	memset(cmd, 0, sizeof(struct ub_scsi_cmd));
--	sg_init_table(cmd->sgv, UB_MAX_REQ_SG);
- 
- 	blkdev_dequeue_request(rq);
- 
-@@ -668,6 +667,7 @@ static int ub_request_fn_1(struct ub_lun *lun, struct request *rq)
- 	/*
- 	 * get scatterlist from block layer
- 	 */
-+	sg_init_table(&urq->sgv[0], UB_MAX_REQ_SG);
- 	n_elem = blk_rq_map_sg(lun->disk->queue, rq, &urq->sgv[0]);
- 	if (n_elem < 0) {
- 		/* Impossible, because blk_rq_map_sg should not hit ENOMEM. */
-diff --git a/drivers/char/defkeymap.c_shipped b/drivers/char/defkeymap.c_shipped
-index 0aa419a..d2208df 100644
---- a/drivers/char/defkeymap.c_shipped
-+++ b/drivers/char/defkeymap.c_shipped
-@@ -223,40 +223,40 @@ char *func_table[MAX_NR_FUNC] = {
- };
- 
- struct kbdiacruc accent_table[MAX_DIACR] = {
--	{'`', 'A', '\300'},	{'`', 'a', '\340'},
--	{'\'', 'A', '\301'},	{'\'', 'a', '\341'},
--	{'^', 'A', '\302'},	{'^', 'a', '\342'},
--	{'~', 'A', '\303'},	{'~', 'a', '\343'},
--	{'"', 'A', '\304'},	{'"', 'a', '\344'},
--	{'O', 'A', '\305'},	{'o', 'a', '\345'},
--	{'0', 'A', '\305'},	{'0', 'a', '\345'},
--	{'A', 'A', '\305'},	{'a', 'a', '\345'},
--	{'A', 'E', '\306'},	{'a', 'e', '\346'},
--	{',', 'C', '\307'},	{',', 'c', '\347'},
--	{'`', 'E', '\310'},	{'`', 'e', '\350'},
--	{'\'', 'E', '\311'},	{'\'', 'e', '\351'},
--	{'^', 'E', '\312'},	{'^', 'e', '\352'},
--	{'"', 'E', '\313'},	{'"', 'e', '\353'},
--	{'`', 'I', '\314'},	{'`', 'i', '\354'},
--	{'\'', 'I', '\315'},	{'\'', 'i', '\355'},
--	{'^', 'I', '\316'},	{'^', 'i', '\356'},
--	{'"', 'I', '\317'},	{'"', 'i', '\357'},
--	{'-', 'D', '\320'},	{'-', 'd', '\360'},
--	{'~', 'N', '\321'},	{'~', 'n', '\361'},
--	{'`', 'O', '\322'},	{'`', 'o', '\362'},
--	{'\'', 'O', '\323'},	{'\'', 'o', '\363'},
--	{'^', 'O', '\324'},	{'^', 'o', '\364'},
--	{'~', 'O', '\325'},	{'~', 'o', '\365'},
--	{'"', 'O', '\326'},	{'"', 'o', '\366'},
--	{'/', 'O', '\330'},	{'/', 'o', '\370'},
--	{'`', 'U', '\331'},	{'`', 'u', '\371'},
--	{'\'', 'U', '\332'},	{'\'', 'u', '\372'},
--	{'^', 'U', '\333'},	{'^', 'u', '\373'},
--	{'"', 'U', '\334'},	{'"', 'u', '\374'},
--	{'\'', 'Y', '\335'},	{'\'', 'y', '\375'},
--	{'T', 'H', '\336'},	{'t', 'h', '\376'},
--	{'s', 's', '\337'},	{'"', 'y', '\377'},
--	{'s', 'z', '\337'},	{'i', 'j', '\377'},
-+	{'`', 'A', 0300},	{'`', 'a', 0340},
-+	{'\'', 'A', 0301},	{'\'', 'a', 0341},
-+	{'^', 'A', 0302},	{'^', 'a', 0342},
-+	{'~', 'A', 0303},	{'~', 'a', 0343},
-+	{'"', 'A', 0304},	{'"', 'a', 0344},
-+	{'O', 'A', 0305},	{'o', 'a', 0345},
-+	{'0', 'A', 0305},	{'0', 'a', 0345},
-+	{'A', 'A', 0305},	{'a', 'a', 0345},
-+	{'A', 'E', 0306},	{'a', 'e', 0346},
-+	{',', 'C', 0307},	{',', 'c', 0347},
-+	{'`', 'E', 0310},	{'`', 'e', 0350},
-+	{'\'', 'E', 0311},	{'\'', 'e', 0351},
-+	{'^', 'E', 0312},	{'^', 'e', 0352},
-+	{'"', 'E', 0313},	{'"', 'e', 0353},
-+	{'`', 'I', 0314},	{'`', 'i', 0354},
-+	{'\'', 'I', 0315},	{'\'', 'i', 0355},
-+	{'^', 'I', 0316},	{'^', 'i', 0356},
-+	{'"', 'I', 0317},	{'"', 'i', 0357},
-+	{'-', 'D', 0320},	{'-', 'd', 0360},
-+	{'~', 'N', 0321},	{'~', 'n', 0361},
-+	{'`', 'O', 0322},	{'`', 'o', 0362},
-+	{'\'', 'O', 0323},	{'\'', 'o', 0363},
-+	{'^', 'O', 0324},	{'^', 'o', 0364},
-+	{'~', 'O', 0325},	{'~', 'o', 0365},
-+	{'"', 'O', 0326},	{'"', 'o', 0366},
-+	{'/', 'O', 0330},	{'/', 'o', 0370},
-+	{'`', 'U', 0331},	{'`', 'u', 0371},
-+	{'\'', 'U', 0332},	{'\'', 'u', 0372},
-+	{'^', 'U', 0333},	{'^', 'u', 0373},
-+	{'"', 'U', 0334},	{'"', 'u', 0374},
-+	{'\'', 'Y', 0335},	{'\'', 'y', 0375},
-+	{'T', 'H', 0336},	{'t', 'h', 0376},
-+	{'s', 's', 0337},	{'"', 'y', 0377},
-+	{'s', 'z', 0337},	{'i', 'j', 0377},
- };
- 
- unsigned int accent_table_size = 68;
-diff --git a/drivers/char/vt.c b/drivers/char/vt.c
-index 7a5badf..93cfe4a 100644
---- a/drivers/char/vt.c
-+++ b/drivers/char/vt.c
-@@ -702,6 +702,7 @@ void redraw_screen(struct vc_data *vc, int is_switch)
- 	if (is_switch) {
- 		set_leds();
- 		compute_shiftstate();
-+		notify_update(vc);
- 	}
- }
- 
-diff --git a/drivers/dma/ioat_dma.c b/drivers/dma/ioat_dma.c
-index 45e7b46..8cf542b 100644
---- a/drivers/dma/ioat_dma.c
-+++ b/drivers/dma/ioat_dma.c
-@@ -726,6 +726,7 @@ static struct dma_async_tx_descriptor *ioat1_dma_prep_memcpy(
- 
- 	if (new) {
- 		new->len = len;
-+		new->async_tx.ack = 0;
- 		return &new->async_tx;
- 	} else
- 		return NULL;
-@@ -749,6 +750,7 @@ static struct dma_async_tx_descriptor *ioat2_dma_prep_memcpy(
- 
- 	if (new) {
- 		new->len = len;
-+		new->async_tx.ack = 0;
- 		return &new->async_tx;
- 	} else
- 		return NULL;
-diff --git a/drivers/message/fusion/mptsas.c b/drivers/message/fusion/mptsas.c
-index e4c94f9..c8d3ffb 100644
---- a/drivers/message/fusion/mptsas.c
-+++ b/drivers/message/fusion/mptsas.c
-@@ -1699,6 +1699,11 @@ mptsas_sas_expander_pg0(MPT_ADAPTER *ioc, struct mptsas_portinfo *port_info,
- 	if (error)
- 		goto out_free_consistent;
- 
-+	if (!buffer->NumPhys) {
-+		error = -ENODEV;
-+		goto out_free_consistent;
-+	}
-+
- 	/* save config data */
- 	port_info->num_phys = buffer->NumPhys;
- 	port_info->phy_info = kcalloc(port_info->num_phys,
-diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
-index 9cc5a6b..55584ee 100644
---- a/drivers/net/e1000e/netdev.c
-+++ b/drivers/net/e1000e/netdev.c
-@@ -1686,6 +1686,9 @@ static void e1000_setup_rctl(struct e1000_adapter *adapter)
- 	else
- 		rctl |= E1000_RCTL_LPE;
- 
-+	/* Enable hardware CRC frame stripping */
-+	rctl |= E1000_RCTL_SECRC;
-+
- 	/* Setup buffer sizes */
- 	rctl &= ~E1000_RCTL_SZ_4096;
- 	rctl |= E1000_RCTL_BSEX;
-@@ -1751,9 +1754,6 @@ static void e1000_setup_rctl(struct e1000_adapter *adapter)
- 
- 		/* Enable Packet split descriptors */
- 		rctl |= E1000_RCTL_DTYP_PS;
--		
--		/* Enable hardware CRC frame stripping */
--		rctl |= E1000_RCTL_SECRC;
- 
- 		psrctl |= adapter->rx_ps_bsize0 >>
- 			E1000_PSRCTL_BSIZE0_SHIFT;
-diff --git a/drivers/net/macb.c b/drivers/net/macb.c
-index e10528e..c796948 100644
---- a/drivers/net/macb.c
-+++ b/drivers/net/macb.c
-@@ -148,7 +148,7 @@ static void macb_handle_link_change(struct net_device *dev)
- 
- 			if (phydev->duplex)
- 				reg |= MACB_BIT(FD);
--			if (phydev->speed)
-+			if (phydev->speed == SPEED_100)
- 				reg |= MACB_BIT(SPD);
- 
- 			macb_writel(bp, NCFGR, reg);
-diff --git a/drivers/net/niu.c b/drivers/net/niu.c
-index 5f6beab..226dc54 100644
---- a/drivers/net/niu.c
-+++ b/drivers/net/niu.c
-@@ -33,8 +33,8 @@
- 
- #define DRV_MODULE_NAME		"niu"
- #define PFX DRV_MODULE_NAME	": "
--#define DRV_MODULE_VERSION	"0.6"
--#define DRV_MODULE_RELDATE	"January 5, 2008"
-+#define DRV_MODULE_VERSION	"0.7"
-+#define DRV_MODULE_RELDATE	"February 18, 2008"
- 
- static char version[] __devinitdata =
- 	DRV_MODULE_NAME ".c:v" DRV_MODULE_VERSION " (" DRV_MODULE_RELDATE ")\n";
-@@ -1616,12 +1616,13 @@ static int niu_enable_alt_mac(struct niu *np, int index, int on)
- 	if (index >= niu_num_alt_addr(np))
- 		return -EINVAL;
- 
--	if (np->flags & NIU_FLAGS_XMAC)
-+	if (np->flags & NIU_FLAGS_XMAC) {
- 		reg = XMAC_ADDR_CMPEN;
--	else
-+		mask = 1 << index;
-+	} else {
- 		reg = BMAC_ADDR_CMPEN;
--
--	mask = 1 << index;
-+		mask = 1 << (index + 1);
-+	}
- 
- 	val = nr64_mac(reg);
- 	if (on)
-@@ -5147,7 +5148,12 @@ static void niu_set_rx_mode(struct net_device *dev)
- 			index++;
- 		}
- 	} else {
--		for (i = 0; i < niu_num_alt_addr(np); i++) {
-+		int alt_start;
-+		if (np->flags & NIU_FLAGS_XMAC)
-+			alt_start = 0;
-+		else
-+			alt_start = 1;
-+		for (i = alt_start; i < niu_num_alt_addr(np); i++) {
- 			err = niu_enable_alt_mac(np, i, 0);
- 			if (err)
- 				printk(KERN_WARNING PFX "%s: Error %d "
-diff --git a/drivers/net/niu.h b/drivers/net/niu.h
-index 0e8626a..59dc05f 100644
---- a/drivers/net/niu.h
-+++ b/drivers/net/niu.h
-@@ -499,7 +499,7 @@
- #define BMAC_ADDR2			0x00110UL
- #define  BMAC_ADDR2_ADDR2		0x000000000000ffffULL
- 
--#define BMAC_NUM_ALT_ADDR		7
-+#define BMAC_NUM_ALT_ADDR		6
- 
- #define BMAC_ALT_ADDR0(NUM)		(0x00118UL + (NUM)*0x18UL)
- #define  BMAC_ALT_ADDR0_ADDR0		0x000000000000ffffULL
-diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
-index 559a9a9..ddcc0c4 100644
---- a/drivers/net/wireless/b43/dma.c
-+++ b/drivers/net/wireless/b43/dma.c
-@@ -165,7 +165,7 @@ static void op64_fill_descriptor(struct b43_dmaring *ring,
- 	addrhi = (((u64) dmaaddr >> 32) & ~SSB_DMA_TRANSLATION_MASK);
- 	addrext = (((u64) dmaaddr >> 32) & SSB_DMA_TRANSLATION_MASK)
- 	    >> SSB_DMA_TRANSLATION_SHIFT;
--	addrhi |= ssb_dma_translation(ring->dev->dev);
-+	addrhi |= (ssb_dma_translation(ring->dev->dev) << 1);
- 	if (slot == ring->nr_slots - 1)
- 		ctl0 |= B43_DMA64_DCTL0_DTABLEEND;
- 	if (start)
-@@ -426,9 +426,21 @@ static inline
- static int alloc_ringmemory(struct b43_dmaring *ring)
- {
- 	struct device *dev = ring->dev->dev->dev;
--
-+	gfp_t flags = GFP_KERNEL;
-+
-+	/* The specs call for 4K buffers for 30- and 32-bit DMA with 4K
-+	 * alignment and 8K buffers for 64-bit DMA with 8K alignment. Testing
-+	 * has shown that 4K is sufficient for the latter as long as the buffer
-+	 * does not cross an 8K boundary.
-+	 *
-+	 * For unknown reasons - possibly a hardware error - the BCM4311 rev
-+	 * 02, which uses 64-bit DMA, needs the ring buffer in very low memory,
-+	 * which accounts for the GFP_DMA flag below.
-+	 */
-+	if (ring->dma64)
-+		flags |= GFP_DMA;
- 	ring->descbase = dma_alloc_coherent(dev, B43_DMA_RINGMEMSIZE,
--					    &(ring->dmabase), GFP_KERNEL);
-+					    &(ring->dmabase), flags);
- 	if (!ring->descbase) {
- 		b43err(ring->dev->wl, "DMA ringmemory allocation failed\n");
- 		return -ENOMEM;
-@@ -483,7 +495,7 @@ int b43_dmacontroller_rx_reset(struct b43_wldev *dev, u16 mmio_base, int dma64)
- 	return 0;
- }
- 
--/* Reset the RX DMA channel */
-+/* Reset the TX DMA channel */
- int b43_dmacontroller_tx_reset(struct b43_wldev *dev, u16 mmio_base, int dma64)
- {
- 	int i;
-@@ -647,7 +659,7 @@ static int dmacontroller_setup(struct b43_dmaring *ring)
- 			b43_dma_write(ring, B43_DMA64_TXRINGHI,
- 				      ((ringbase >> 32) &
- 				       ~SSB_DMA_TRANSLATION_MASK)
--				      | trans);
-+				      | (trans << 1));
- 		} else {
- 			u32 ringbase = (u32) (ring->dmabase);
- 
-@@ -680,8 +692,9 @@ static int dmacontroller_setup(struct b43_dmaring *ring)
- 			b43_dma_write(ring, B43_DMA64_RXRINGHI,
- 				      ((ringbase >> 32) &
- 				       ~SSB_DMA_TRANSLATION_MASK)
--				      | trans);
--			b43_dma_write(ring, B43_DMA64_RXINDEX, 200);
-+				      | (trans << 1));
-+			b43_dma_write(ring, B43_DMA64_RXINDEX, ring->nr_slots *
-+				      sizeof(struct b43_dmadesc64));
- 		} else {
- 			u32 ringbase = (u32) (ring->dmabase);
- 
-@@ -695,11 +708,12 @@ static int dmacontroller_setup(struct b43_dmaring *ring)
- 			b43_dma_write(ring, B43_DMA32_RXRING,
- 				      (ringbase & ~SSB_DMA_TRANSLATION_MASK)
- 				      | trans);
--			b43_dma_write(ring, B43_DMA32_RXINDEX, 200);
-+			b43_dma_write(ring, B43_DMA32_RXINDEX, ring->nr_slots *
-+				      sizeof(struct b43_dmadesc32));
- 		}
- 	}
- 
--      out:
-+out:
- 	return err;
- }
- 
-diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
-index 69795fd..36a1de2 100644
---- a/drivers/net/wireless/b43/main.c
-+++ b/drivers/net/wireless/b43/main.c
-@@ -101,6 +101,7 @@ static const struct ssb_device_id b43_ssb_tbl[] = {
- 	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
- 	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
- 	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
-+	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
- 	SSB_DEVTABLE_END
- };
- 
-@@ -3079,7 +3080,7 @@ static int b43_phy_versioning(struct b43_wldev *dev)
- 			unsupported = 1;
- 		break;
- 	case B43_PHYTYPE_G:
--		if (phy_rev > 8)
-+		if (phy_rev > 9)
- 			unsupported = 1;
- 		break;
- 	default:
-diff --git a/drivers/s390/char/defkeymap.c b/drivers/s390/char/defkeymap.c
-index 389346c..07c7f31 100644
---- a/drivers/s390/char/defkeymap.c
-+++ b/drivers/s390/char/defkeymap.c
-@@ -151,8 +151,8 @@ char *func_table[MAX_NR_FUNC] = {
- };
- 
- struct kbdiacruc accent_table[MAX_DIACR] = {
--	{'^', 'c', '\003'},	{'^', 'd', '\004'},
--	{'^', 'z', '\032'},	{'^', '\012', '\000'},
-+	{'^', 'c', 0003},	{'^', 'd', 0004},
-+	{'^', 'z', 0032},	{'^', 0012, 0000},
- };
- 
- unsigned int accent_table_size = 4;
-diff --git a/drivers/scsi/advansys.c b/drivers/scsi/advansys.c
-index 38a1ee2..f40417b 100644
---- a/drivers/scsi/advansys.c
-+++ b/drivers/scsi/advansys.c
-@@ -566,7 +566,7 @@ typedef struct asc_dvc_var {
- 	ASC_SCSI_BIT_ID_TYPE unit_not_ready;
- 	ASC_SCSI_BIT_ID_TYPE queue_full_or_busy;
- 	ASC_SCSI_BIT_ID_TYPE start_motor;
--	uchar overrun_buf[ASC_OVERRUN_BSIZE] __aligned(8);
-+	uchar *overrun_buf;
- 	dma_addr_t overrun_dma;
- 	uchar scsi_reset_wait;
- 	uchar chip_no;
-@@ -6439,7 +6439,7 @@ static int AdvLoadMicrocode(AdvPortAddr iop_base, unsigned char *buf, int size,
- 			i += 2;
- 			len += 2;
- 		} else {
--			unsigned char off = buf[i] * 2;
-+			unsigned int off = buf[i] * 2;
- 			unsigned short word = (buf[off + 1] << 8) | buf[off];
- 			AdvWriteWordAutoIncLram(iop_base, word);
- 			len += 2;
-@@ -13833,6 +13833,12 @@ static int __devinit advansys_board_found(struct Scsi_Host *shost,
- 	 */
- 	if (ASC_NARROW_BOARD(boardp)) {
- 		ASC_DBG(2, "AscInitAsc1000Driver()\n");
-+
-+		asc_dvc_varp->overrun_buf = kzalloc(ASC_OVERRUN_BSIZE, GFP_KERNEL);
-+		if (!asc_dvc_varp->overrun_buf) {
-+			ret = -ENOMEM;
-+			goto err_free_wide_mem;
-+		}
- 		warn_code = AscInitAsc1000Driver(asc_dvc_varp);
- 
- 		if (warn_code || asc_dvc_varp->err_code) {
-@@ -13840,8 +13846,10 @@ static int __devinit advansys_board_found(struct Scsi_Host *shost,
- 					"warn 0x%x, error 0x%x\n",
- 					asc_dvc_varp->init_state, warn_code,
- 					asc_dvc_varp->err_code);
--			if (asc_dvc_varp->err_code)
-+			if (asc_dvc_varp->err_code) {
- 				ret = -ENODEV;
-+				kfree(asc_dvc_varp->overrun_buf);
-+			}
- 		}
- 	} else {
- 		if (advansys_wide_init_chip(shost))
-@@ -13894,6 +13902,7 @@ static int advansys_release(struct Scsi_Host *shost)
- 		dma_unmap_single(board->dev,
- 					board->dvc_var.asc_dvc_var.overrun_dma,
- 					ASC_OVERRUN_BSIZE, DMA_FROM_DEVICE);
-+		kfree(board->dvc_var.asc_dvc_var.overrun_buf);
- 	} else {
- 		iounmap(board->ioremap_addr);
- 		advansys_wide_free_mem(board);
-diff --git a/drivers/scsi/aic94xx/aic94xx_scb.c b/drivers/scsi/aic94xx/aic94xx_scb.c
-index db6ab1a..eae2d97 100644
---- a/drivers/scsi/aic94xx/aic94xx_scb.c
-+++ b/drivers/scsi/aic94xx/aic94xx_scb.c
-@@ -458,13 +458,19 @@ static void escb_tasklet_complete(struct asd_ascb *ascb,
- 		tc_abort = le16_to_cpu(tc_abort);
- 
- 		list_for_each_entry_safe(a, b, &asd_ha->seq.pend_q, list) {
--			struct sas_task *task = ascb->uldd_task;
-+			struct sas_task *task = a->uldd_task;
-+
-+			if (a->tc_index != tc_abort)
-+				continue;
- 
--			if (task && a->tc_index == tc_abort) {
-+			if (task) {
- 				failed_dev = task->dev;
- 				sas_task_abort(task);
--				break;
-+			} else {
-+				ASD_DPRINTK("R_T_A for non TASK scb 0x%x\n",
-+					    a->scb->header.opcode);
- 			}
-+			break;
- 		}
- 
- 		if (!failed_dev) {
-@@ -478,7 +484,7 @@ static void escb_tasklet_complete(struct asd_ascb *ascb,
- 		 * that the EH will wake up and do something.
- 		 */
- 		list_for_each_entry_safe(a, b, &asd_ha->seq.pend_q, list) {
--			struct sas_task *task = ascb->uldd_task;
-+			struct sas_task *task = a->uldd_task;
- 
- 			if (task &&
- 			    task->dev == failed_dev &&
-diff --git a/drivers/scsi/arcmsr/arcmsr_hba.c b/drivers/scsi/arcmsr/arcmsr_hba.c
-index d466a2d..dcd6c9a 100644
---- a/drivers/scsi/arcmsr/arcmsr_hba.c
-+++ b/drivers/scsi/arcmsr/arcmsr_hba.c
-@@ -1380,17 +1380,16 @@ static int arcmsr_iop_message_xfer(struct AdapterControlBlock *acb, \
- 	switch(controlcode) {
- 
- 	case ARCMSR_MESSAGE_READ_RQBUFFER: {
--		unsigned long *ver_addr;
--		dma_addr_t buf_handle;
-+		unsigned char *ver_addr;
- 		uint8_t *pQbuffer, *ptmpQbuffer;
- 		int32_t allxfer_len = 0;
- 
--		ver_addr = pci_alloc_consistent(acb->pdev, 1032, &buf_handle);
-+		ver_addr = kmalloc(1032, GFP_ATOMIC);
- 		if (!ver_addr) {
- 			retvalue = ARCMSR_MESSAGE_FAIL;
- 			goto message_out;
- 		}
--		ptmpQbuffer = (uint8_t *) ver_addr;
-+		ptmpQbuffer = ver_addr;
- 		while ((acb->rqbuf_firstindex != acb->rqbuf_lastindex)
- 			&& (allxfer_len < 1031)) {
- 			pQbuffer = &acb->rqbuffer[acb->rqbuf_firstindex];
-@@ -1419,25 +1418,24 @@ static int arcmsr_iop_message_xfer(struct AdapterControlBlock *acb, \
- 			}
- 			arcmsr_iop_message_read(acb);
- 		}
--		memcpy(pcmdmessagefld->messagedatabuffer, (uint8_t *)ver_addr, allxfer_len);
-+		memcpy(pcmdmessagefld->messagedatabuffer, ver_addr, allxfer_len);
- 		pcmdmessagefld->cmdmessage.Length = allxfer_len;
- 		pcmdmessagefld->cmdmessage.ReturnCode = ARCMSR_MESSAGE_RETURNCODE_OK;
--		pci_free_consistent(acb->pdev, 1032, ver_addr, buf_handle);
-+		kfree(ver_addr);
- 		}
- 		break;
- 
- 	case ARCMSR_MESSAGE_WRITE_WQBUFFER: {
--		unsigned long *ver_addr;
--		dma_addr_t buf_handle;
-+		unsigned char *ver_addr;
- 		int32_t my_empty_len, user_len, wqbuf_firstindex, wqbuf_lastindex;
- 		uint8_t *pQbuffer, *ptmpuserbuffer;
- 
--		ver_addr = pci_alloc_consistent(acb->pdev, 1032, &buf_handle);
-+		ver_addr = kmalloc(1032, GFP_ATOMIC);
- 		if (!ver_addr) {
- 			retvalue = ARCMSR_MESSAGE_FAIL;
- 			goto message_out;
- 		}
--		ptmpuserbuffer = (uint8_t *)ver_addr;
-+		ptmpuserbuffer = ver_addr;
- 		user_len = pcmdmessagefld->cmdmessage.Length;
- 		memcpy(ptmpuserbuffer, pcmdmessagefld->messagedatabuffer, user_len);
- 		wqbuf_lastindex = acb->wqbuf_lastindex;
-@@ -1483,7 +1481,7 @@ static int arcmsr_iop_message_xfer(struct AdapterControlBlock *acb, \
- 				retvalue = ARCMSR_MESSAGE_FAIL;
- 			}
- 			}
--			pci_free_consistent(acb->pdev, 1032, ver_addr, buf_handle);
-+			kfree(ver_addr);
- 		}
- 		break;
- 
-diff --git a/drivers/scsi/gdth.c b/drivers/scsi/gdth.c
-index 8eb78be..b8b67f6 100644
---- a/drivers/scsi/gdth.c
-+++ b/drivers/scsi/gdth.c
-@@ -160,7 +160,7 @@ static void gdth_readapp_event(gdth_ha_str *ha, unchar application,
- static void gdth_clear_events(void);
- 
- static void gdth_copy_internal_data(gdth_ha_str *ha, Scsi_Cmnd *scp,
--                                    char *buffer, ushort count, int to_buffer);
-+                                    char *buffer, ushort count);
- static int gdth_internal_cache_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp);
- static int gdth_fill_cache_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp, ushort hdrive);
- 
-@@ -183,7 +183,6 @@ static int gdth_ioctl(struct inode *inode, struct file *filep,
-                       unsigned int cmd, unsigned long arg);
- 
- static void gdth_flush(gdth_ha_str *ha);
--static int gdth_halt(struct notifier_block *nb, ulong event, void *buf);
- static int gdth_queuecommand(Scsi_Cmnd *scp,void (*done)(Scsi_Cmnd *));
- static int __gdth_queuecommand(gdth_ha_str *ha, struct scsi_cmnd *scp,
- 				struct gdth_cmndinfo *cmndinfo);
-@@ -418,12 +417,6 @@ static inline void gdth_set_sglist(struct scsi_cmnd *cmd,
- #include "gdth_proc.h"
- #include "gdth_proc.c"
- 
--/* notifier block to get a notify on system shutdown/halt/reboot */
--static struct notifier_block gdth_notifier = {
--    gdth_halt, NULL, 0
--};
--static int notifier_disabled = 0;
--
- static gdth_ha_str *gdth_find_ha(int hanum)
- {
- 	gdth_ha_str *ha;
-@@ -446,8 +439,8 @@ static struct gdth_cmndinfo *gdth_get_cmndinfo(gdth_ha_str *ha)
- 	for (i=0; i<GDTH_MAXCMDS; ++i) {
- 		if (ha->cmndinfo[i].index == 0) {
- 			priv = &ha->cmndinfo[i];
--			priv->index = i+1;
- 			memset(priv, 0, sizeof(*priv));
-+			priv->index = i+1;
- 			break;
- 		}
- 	}
-@@ -494,7 +487,6 @@ int __gdth_execute(struct scsi_device *sdev, gdth_cmd_str *gdtcmd, char *cmnd,
-     gdth_ha_str *ha = shost_priv(sdev->host);
-     Scsi_Cmnd *scp;
-     struct gdth_cmndinfo cmndinfo;
--    struct scatterlist one_sg;
-     DECLARE_COMPLETION_ONSTACK(wait);
-     int rval;
- 
-@@ -508,13 +500,10 @@ int __gdth_execute(struct scsi_device *sdev, gdth_cmd_str *gdtcmd, char *cmnd,
-     /* use request field to save the ptr. to completion struct. */
-     scp->request = (struct request *)&wait;
-     scp->timeout_per_command = timeout*HZ;
--    sg_init_one(&one_sg, gdtcmd, sizeof(*gdtcmd));
--    gdth_set_sglist(scp, &one_sg);
--    gdth_set_sg_count(scp, 1);
--    gdth_set_bufflen(scp, sizeof(*gdtcmd));
-     scp->cmd_len = 12;
-     memcpy(scp->cmnd, cmnd, 12);
-     cmndinfo.priority = IOCTL_PRI;
-+    cmndinfo.internal_cmd_str = gdtcmd;
-     cmndinfo.internal_command = 1;
- 
-     TRACE(("__gdth_execute() cmd 0x%x\n", scp->cmnd[0]));
-@@ -2355,7 +2344,7 @@ static void gdth_next(gdth_ha_str *ha)
-  * buffers, kmap_atomic() as needed.
-  */
- static void gdth_copy_internal_data(gdth_ha_str *ha, Scsi_Cmnd *scp,
--                                    char *buffer, ushort count, int to_buffer)
-+                                    char *buffer, ushort count)
- {
-     ushort cpcount,i, max_sg = gdth_sg_count(scp);
-     ushort cpsum,cpnow;
-@@ -2381,10 +2370,7 @@ static void gdth_copy_internal_data(gdth_ha_str *ha, Scsi_Cmnd *scp,
-             }
-             local_irq_save(flags);
-             address = kmap_atomic(sg_page(sl), KM_BIO_SRC_IRQ) + sl->offset;
--            if (to_buffer)
--                memcpy(buffer, address, cpnow);
--            else
--                memcpy(address, buffer, cpnow);
-+            memcpy(address, buffer, cpnow);
-             flush_dcache_page(sg_page(sl));
-             kunmap_atomic(address, KM_BIO_SRC_IRQ);
-             local_irq_restore(flags);
-@@ -2438,7 +2424,7 @@ static int gdth_internal_cache_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp)
-         strcpy(inq.vendor,ha->oem_name);
-         sprintf(inq.product,"Host Drive  #%02d",t);
-         strcpy(inq.revision,"   ");
--        gdth_copy_internal_data(ha, scp, (char*)&inq, sizeof(gdth_inq_data), 0);
-+        gdth_copy_internal_data(ha, scp, (char*)&inq, sizeof(gdth_inq_data));
-         break;
- 
-       case REQUEST_SENSE:
-@@ -2448,7 +2434,7 @@ static int gdth_internal_cache_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp)
-         sd.key       = NO_SENSE;
-         sd.info      = 0;
-         sd.add_length= 0;
--        gdth_copy_internal_data(ha, scp, (char*)&sd, sizeof(gdth_sense_data), 0);
-+        gdth_copy_internal_data(ha, scp, (char*)&sd, sizeof(gdth_sense_data));
-         break;
- 
-       case MODE_SENSE:
-@@ -2460,7 +2446,7 @@ static int gdth_internal_cache_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp)
-         mpd.bd.block_length[0] = (SECTOR_SIZE & 0x00ff0000) >> 16;
-         mpd.bd.block_length[1] = (SECTOR_SIZE & 0x0000ff00) >> 8;
-         mpd.bd.block_length[2] = (SECTOR_SIZE & 0x000000ff);
--        gdth_copy_internal_data(ha, scp, (char*)&mpd, sizeof(gdth_modep_data), 0);
-+        gdth_copy_internal_data(ha, scp, (char*)&mpd, sizeof(gdth_modep_data));
-         break;
- 
-       case READ_CAPACITY:
-@@ -2470,7 +2456,7 @@ static int gdth_internal_cache_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp)
-         else
-             rdc.last_block_no = cpu_to_be32(ha->hdr[t].size-1);
-         rdc.block_length  = cpu_to_be32(SECTOR_SIZE);
--        gdth_copy_internal_data(ha, scp, (char*)&rdc, sizeof(gdth_rdcap_data), 0);
-+        gdth_copy_internal_data(ha, scp, (char*)&rdc, sizeof(gdth_rdcap_data));
-         break;
- 
-       case SERVICE_ACTION_IN:
-@@ -2482,7 +2468,7 @@ static int gdth_internal_cache_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp)
-             rdc16.last_block_no = cpu_to_be64(ha->hdr[t].size-1);
-             rdc16.block_length  = cpu_to_be32(SECTOR_SIZE);
-             gdth_copy_internal_data(ha, scp, (char*)&rdc16,
--                                                 sizeof(gdth_rdcap16_data), 0);
-+                                                 sizeof(gdth_rdcap16_data));
-         } else { 
-             scp->result = DID_ABORT << 16;
-         }
-@@ -2852,6 +2838,7 @@ static int gdth_fill_raw_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp, unchar b)
- static int gdth_special_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp)
- {
-     register gdth_cmd_str *cmdp;
-+    struct gdth_cmndinfo *cmndinfo = gdth_cmnd_priv(scp);
-     int cmd_index;
- 
-     cmdp= ha->pccb;
-@@ -2860,7 +2847,7 @@ static int gdth_special_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp)
-     if (ha->type==GDT_EISA && ha->cmd_cnt>0) 
-         return 0;
- 
--    gdth_copy_internal_data(ha, scp, (char *)cmdp, sizeof(gdth_cmd_str), 1);
-+    *cmdp = *cmndinfo->internal_cmd_str;
-     cmdp->RequestBuffer = scp;
- 
-     /* search free command index */
-@@ -3793,6 +3780,8 @@ static void gdth_timeout(ulong data)
-     gdth_ha_str *ha;
-     ulong flags;
- 
-+    BUG_ON(list_empty(&gdth_instances));
-+
-     ha = list_first_entry(&gdth_instances, gdth_ha_str, list);
-     spin_lock_irqsave(&ha->smp_lock, flags);
- 
-@@ -4668,45 +4657,6 @@ static void gdth_flush(gdth_ha_str *ha)
-     }
- }
- 
--/* shutdown routine */
--static int gdth_halt(struct notifier_block *nb, ulong event, void *buf)
--{
--    gdth_ha_str *ha;
--#ifndef __alpha__
--    gdth_cmd_str    gdtcmd;
--    char            cmnd[MAX_COMMAND_SIZE];   
--#endif
--
--    if (notifier_disabled)
--        return NOTIFY_OK;
--
--    TRACE2(("gdth_halt() event %d\n",(int)event));
--    if (event != SYS_RESTART && event != SYS_HALT && event != SYS_POWER_OFF)
--        return NOTIFY_DONE;
--
--    notifier_disabled = 1;
--    printk("GDT-HA: Flushing all host drives .. ");
--    list_for_each_entry(ha, &gdth_instances, list) {
--        gdth_flush(ha);
--
--#ifndef __alpha__
--        /* controller reset */
--        memset(cmnd, 0xff, MAX_COMMAND_SIZE);
--        gdtcmd.BoardNode = LOCALBOARD;
--        gdtcmd.Service = CACHESERVICE;
--        gdtcmd.OpCode = GDT_RESET;
--        TRACE2(("gdth_halt(): reset controller %d\n", ha->hanum));
--        gdth_execute(ha->shost, &gdtcmd, cmnd, 10, NULL);
--#endif
--    }
--    printk("Done.\n");
--
--#ifdef GDTH_STATISTICS
--    del_timer(&gdth_timer);
--#endif
--    return NOTIFY_OK;
--}
--
- /* configure lun */
- static int gdth_slave_configure(struct scsi_device *sdev)
- {
-@@ -5141,13 +5091,13 @@ static void gdth_remove_one(gdth_ha_str *ha)
- 
- 	scsi_remove_host(shp);
- 
-+	gdth_flush(ha);
-+
- 	if (ha->sdev) {
- 		scsi_free_host_dev(ha->sdev);
- 		ha->sdev = NULL;
- 	}
- 
--	gdth_flush(ha);
--
- 	if (shp->irq)
- 		free_irq(shp->irq,ha);
- 
-@@ -5173,6 +5123,24 @@ static void gdth_remove_one(gdth_ha_str *ha)
- 	scsi_host_put(shp);
- }
- 
-+static int gdth_halt(struct notifier_block *nb, ulong event, void *buf)
-+{
-+	gdth_ha_str *ha;
-+
-+	TRACE2(("gdth_halt() event %d\n", (int)event));
-+	if (event != SYS_RESTART && event != SYS_HALT && event != SYS_POWER_OFF)
-+		return NOTIFY_DONE;
-+
-+	list_for_each_entry(ha, &gdth_instances, list)
-+		gdth_flush(ha);
-+
-+	return NOTIFY_OK;
-+}
-+
-+static struct notifier_block gdth_notifier = {
-+    gdth_halt, NULL, 0
-+};
-+
- static int __init gdth_init(void)
- {
- 	if (disable) {
-@@ -5235,7 +5203,6 @@ static int __init gdth_init(void)
- 	add_timer(&gdth_timer);
- #endif
- 	major = register_chrdev(0,"gdth", &gdth_fops);
--	notifier_disabled = 0;
- 	register_reboot_notifier(&gdth_notifier);
- 	gdth_polling = FALSE;
- 	return 0;
-@@ -5245,14 +5212,15 @@ static void __exit gdth_exit(void)
- {
- 	gdth_ha_str *ha;
- 
--	list_for_each_entry(ha, &gdth_instances, list)
--		gdth_remove_one(ha);
-+	unregister_chrdev(major, "gdth");
-+	unregister_reboot_notifier(&gdth_notifier);
- 
- #ifdef GDTH_STATISTICS
--	del_timer(&gdth_timer);
-+	del_timer_sync(&gdth_timer);
- #endif
--	unregister_chrdev(major,"gdth");
--	unregister_reboot_notifier(&gdth_notifier);
-+
-+	list_for_each_entry(ha, &gdth_instances, list)
-+		gdth_remove_one(ha);
- }
- 
- module_init(gdth_init);
-diff --git a/drivers/scsi/gdth.h b/drivers/scsi/gdth.h
-index 1434c6b..26e4e92 100644
---- a/drivers/scsi/gdth.h
-+++ b/drivers/scsi/gdth.h
-@@ -915,6 +915,7 @@ typedef struct {
-     struct gdth_cmndinfo {                      /* per-command private info */
-         int index;
-         int internal_command;                   /* don't call scsi_done */
-+        gdth_cmd_str *internal_cmd_str;         /* crier for internal messages*/
-         dma_addr_t sense_paddr;                 /* sense dma-addr */
-         unchar priority;
-         int timeout;
-diff --git a/drivers/scsi/gdth_proc.c b/drivers/scsi/gdth_proc.c
-index de57734..ce0228e 100644
---- a/drivers/scsi/gdth_proc.c
-+++ b/drivers/scsi/gdth_proc.c
-@@ -694,15 +694,13 @@ static void gdth_ioctl_free(gdth_ha_str *ha, int size, char *buf, ulong64 paddr)
- {
-     ulong flags;
- 
--    spin_lock_irqsave(&ha->smp_lock, flags);
--
-     if (buf == ha->pscratch) {
-+	spin_lock_irqsave(&ha->smp_lock, flags);
-         ha->scratch_busy = FALSE;
-+	spin_unlock_irqrestore(&ha->smp_lock, flags);
-     } else {
-         pci_free_consistent(ha->pdev, size, buf, paddr);
-     }
--
--    spin_unlock_irqrestore(&ha->smp_lock, flags);
- }
- 
- #ifdef GDTH_IOCTL_PROC
-diff --git a/drivers/scsi/ips.c b/drivers/scsi/ips.c
-index 5c5a9b2..f4e9c8d 100644
---- a/drivers/scsi/ips.c
-+++ b/drivers/scsi/ips.c
-@@ -1580,7 +1580,7 @@ ips_make_passthru(ips_ha_t *ha, struct scsi_cmnd *SC, ips_scb_t *scb, int intr)
- 	METHOD_TRACE("ips_make_passthru", 1);
- 
-         scsi_for_each_sg(SC, sg, scsi_sg_count(SC), i)
--                length += sg[i].length;
-+		length += sg->length;
- 
- 	if (length < sizeof (ips_passthru_t)) {
- 		/* wrong size */
-@@ -6842,13 +6842,10 @@ ips_register_scsi(int index)
- 	if (request_irq(ha->irq, do_ipsintr, IRQF_SHARED, ips_name, ha)) {
- 		IPS_PRINTK(KERN_WARNING, ha->pcidev,
- 			   "Unable to install interrupt handler\n");
--		scsi_host_put(sh);
--		return -1;
-+		goto err_out_sh;
- 	}
- 
- 	kfree(oldha);
--	ips_sh[index] = sh;
--	ips_ha[index] = ha;
- 
- 	/* Store away needed values for later use */
- 	sh->io_port = ha->io_addr;
-@@ -6867,10 +6864,21 @@ ips_register_scsi(int index)
- 	sh->max_channel = ha->nbus - 1;
- 	sh->can_queue = ha->max_cmds - 1;
- 
--	scsi_add_host(sh, NULL);
-+	if (scsi_add_host(sh, &ha->pcidev->dev))
-+		goto err_out;
-+
-+	ips_sh[index] = sh;
-+	ips_ha[index] = ha;
-+
- 	scsi_scan_host(sh);
- 
- 	return 0;
-+
-+err_out:
-+	free_irq(ha->pcidev->irq, ha);
-+err_out_sh:
-+	scsi_host_put(sh);
-+	return -1;
- }
- 
- /*---------------------------------------------------------------------------*/
-diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
-index a9ac5b1..273728e 100644
---- a/drivers/scsi/scsi_lib.c
-+++ b/drivers/scsi/scsi_lib.c
-@@ -298,7 +298,6 @@ static int scsi_req_map_sg(struct request *rq, struct scatterlist *sgl,
- 		page = sg_page(sg);
- 		off = sg->offset;
- 		len = sg->length;
-- 		data_len += len;
- 
- 		while (len > 0 && data_len > 0) {
- 			/*
-diff --git a/drivers/spi/atmel_spi.c b/drivers/spi/atmel_spi.c
-index ff10808..e9d7959 100644
---- a/drivers/spi/atmel_spi.c
-+++ b/drivers/spi/atmel_spi.c
-@@ -85,6 +85,16 @@ static void cs_activate(struct atmel_spi *as, struct spi_device *spi)
- 	unsigned gpio = (unsigned) spi->controller_data;
- 	unsigned active = spi->mode & SPI_CS_HIGH;
- 	u32 mr;
-+	int i;
-+	u32 csr;
-+	u32 cpol = (spi->mode & SPI_CPOL) ? SPI_BIT(CPOL) : 0;
-+
-+	/* Make sure clock polarity is correct */
-+	for (i = 0; i < spi->master->num_chipselect; i++) {
-+		csr = spi_readl(as, CSR0 + 4 * i);
-+		if ((csr ^ cpol) & SPI_BIT(CPOL))
-+			spi_writel(as, CSR0 + 4 * i, csr ^ SPI_BIT(CPOL));
-+	}
- 
- 	mr = spi_readl(as, MR);
- 	mr = SPI_BFINS(PCS, ~(1 << spi->chip_select), mr);
-diff --git a/drivers/spi/pxa2xx_spi.c b/drivers/spi/pxa2xx_spi.c
-index 1c2ab54..840e682 100644
---- a/drivers/spi/pxa2xx_spi.c
-+++ b/drivers/spi/pxa2xx_spi.c
-@@ -48,13 +48,19 @@ MODULE_LICENSE("GPL");
- #define RESET_DMA_CHANNEL (DCSR_NODESC | DMA_INT_MASK)
- #define IS_DMA_ALIGNED(x) (((u32)(x)&0x07)==0)
- 
--/* for testing SSCR1 changes that require SSP restart, basically
-- * everything except the service and interrupt enables */
--#define SSCR1_CHANGE_MASK (SSCR1_TTELP | SSCR1_TTE | SSCR1_EBCEI | SSCR1_SCFR \
-+/*
-+ * for testing SSCR1 changes that require SSP restart, basically
-+ * everything except the service and interrupt enables, the pxa270 developer
-+ * manual says only SSCR1_SCFR, SSCR1_SPH, SSCR1_SPO need to be in this
-+ * list, but the PXA255 dev man says all bits without really meaning the
-+ * service and interrupt enables
-+ */
-+#define SSCR1_CHANGE_MASK (SSCR1_TTELP | SSCR1_TTE | SSCR1_SCFR \
- 				| SSCR1_ECRA | SSCR1_ECRB | SSCR1_SCLKDIR \
--				| SSCR1_RWOT | SSCR1_TRAIL | SSCR1_PINTE \
--				| SSCR1_STRF | SSCR1_EFWR |SSCR1_RFT \
--				| SSCR1_TFT | SSCR1_SPH | SSCR1_SPO | SSCR1_LBM)
-+				| SSCR1_SFRMDIR | SSCR1_RWOT | SSCR1_TRAIL \
-+				| SSCR1_IFS | SSCR1_STRF | SSCR1_EFWR \
-+				| SSCR1_RFT | SSCR1_TFT | SSCR1_MWDS \
-+				| SSCR1_SPH | SSCR1_SPO | SSCR1_LBM)
- 
- #define DEFINE_SSP_REG(reg, off) \
- static inline u32 read_##reg(void *p) { return __raw_readl(p + (off)); } \
-@@ -961,9 +967,6 @@ static void pump_transfers(unsigned long data)
- 		if (drv_data->ssp_type == PXA25x_SSP)
- 			DCMD(drv_data->tx_channel) |= DCMD_ENDIRQEN;
- 
--		/* Fix me, need to handle cs polarity */
--		drv_data->cs_control(PXA2XX_CS_ASSERT);
--
- 		/* Clear status and start DMA engine */
- 		cr1 = chip->cr1 | dma_thresh | drv_data->dma_cr1;
- 		write_SSSR(drv_data->clear_sr, reg);
-@@ -973,9 +976,6 @@ static void pump_transfers(unsigned long data)
- 		/* Ensure we have the correct interrupt handler	*/
- 		drv_data->transfer_handler = interrupt_transfer;
- 
--		/* Fix me, need to handle cs polarity */
--		drv_data->cs_control(PXA2XX_CS_ASSERT);
--
- 		/* Clear status  */
- 		cr1 = chip->cr1 | chip->threshold | drv_data->int_cr1;
- 		write_SSSR(drv_data->clear_sr, reg);
-@@ -986,16 +986,29 @@ static void pump_transfers(unsigned long data)
- 		|| (read_SSCR1(reg) & SSCR1_CHANGE_MASK) !=
- 			(cr1 & SSCR1_CHANGE_MASK)) {
- 
-+		/* stop the SSP, and update the other bits */
- 		write_SSCR0(cr0 & ~SSCR0_SSE, reg);
- 		if (drv_data->ssp_type != PXA25x_SSP)
- 			write_SSTO(chip->timeout, reg);
--		write_SSCR1(cr1, reg);
-+		/* first set CR1 without interrupt and service enables */
-+		write_SSCR1(cr1 & SSCR1_CHANGE_MASK, reg);
-+		/* restart the SSP */
- 		write_SSCR0(cr0, reg);
-+
- 	} else {
- 		if (drv_data->ssp_type != PXA25x_SSP)
- 			write_SSTO(chip->timeout, reg);
--		write_SSCR1(cr1, reg);
- 	}
-+
-+	/* FIXME, need to handle cs polarity,
-+	 * this driver uses struct pxa2xx_spi_chip.cs_control to
-+	 * specify a CS handling function, and it ignores most
-+	 * struct spi_device.mode[s], including SPI_CS_HIGH */
-+	drv_data->cs_control(PXA2XX_CS_ASSERT);
-+
-+	/* after chip select, release the data by enabling service
-+	 * requests and interrupts, without changing any mode bits */
-+	write_SSCR1(cr1, reg);
- }
- 
- static void pump_messages(struct work_struct *work)
-diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
-index b10f39c..d1df9e9 100644
---- a/drivers/usb/host/ehci-q.c
-+++ b/drivers/usb/host/ehci-q.c
-@@ -315,10 +315,10 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh)
- 			if (likely (last->urb != urb)) {
- 				ehci_urb_done(ehci, last->urb, last_status);
- 				count++;
-+				last_status = -EINPROGRESS;
- 			}
- 			ehci_qtd_free (ehci, last);
- 			last = NULL;
--			last_status = -EINPROGRESS;
- 		}
- 
- 		/* ignore urbs submitted during completions we reported */
-diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
-index 1382af9..c04beac 100644
---- a/drivers/usb/serial/ftdi_sio.c
-+++ b/drivers/usb/serial/ftdi_sio.c
-@@ -310,6 +310,7 @@ struct ftdi_sio_quirk {
- };
- 
- static int   ftdi_olimex_probe		(struct usb_serial *serial);
-+static int   ftdi_mtxorb_hack_setup	(struct usb_serial *serial);
- static void  ftdi_USB_UIRT_setup	(struct ftdi_private *priv);
- static void  ftdi_HE_TIRA1_setup	(struct ftdi_private *priv);
- 
-@@ -317,6 +318,10 @@ static struct ftdi_sio_quirk ftdi_olimex_quirk = {
- 	.probe	= ftdi_olimex_probe,
- };
- 
-+static struct ftdi_sio_quirk ftdi_mtxorb_hack_quirk = {
-+	.probe  = ftdi_mtxorb_hack_setup,
-+};
-+
- static struct ftdi_sio_quirk ftdi_USB_UIRT_quirk = {
- 	.port_probe = ftdi_USB_UIRT_setup,
- };
-@@ -379,6 +384,8 @@ static struct usb_device_id id_table_combined [] = {
- 	{ USB_DEVICE(FTDI_VID, FTDI_MTXORB_4_PID) },
- 	{ USB_DEVICE(FTDI_VID, FTDI_MTXORB_5_PID) },
- 	{ USB_DEVICE(FTDI_VID, FTDI_MTXORB_6_PID) },
-+	{ USB_DEVICE(MTXORB_VK_VID, MTXORB_VK_PID),
-+		.driver_info = (kernel_ulong_t)&ftdi_mtxorb_hack_quirk },
- 	{ USB_DEVICE(FTDI_VID, FTDI_PERLE_ULTRAPORT_PID) },
- 	{ USB_DEVICE(FTDI_VID, FTDI_PIEGROUP_PID) },
- 	{ USB_DEVICE(FTDI_VID, FTDI_TNC_X_PID) },
-@@ -492,6 +499,7 @@ static struct usb_device_id id_table_combined [] = {
- 	{ USB_DEVICE(FTDI_VID, FTDI_ELV_FS20SIG_PID) },
- 	{ USB_DEVICE(FTDI_VID, FTDI_ELV_WS300PC_PID) },
- 	{ USB_DEVICE(FTDI_VID, FTDI_ELV_FHZ1300PC_PID) },
-+	{ USB_DEVICE(FTDI_VID, FTDI_ELV_EM1010PC_PID) },
- 	{ USB_DEVICE(FTDI_VID, FTDI_ELV_WS500_PID) },
- 	{ USB_DEVICE(FTDI_VID, LINX_SDMUSBQSS_PID) },
- 	{ USB_DEVICE(FTDI_VID, LINX_MASTERDEVEL2_PID) },
-@@ -1301,6 +1309,23 @@ static int ftdi_olimex_probe(struct usb_serial *serial)
- 	return 0;
- }
- 
-+/*
-+ * The Matrix Orbital VK204-25-USB has an invalid IN endpoint.
-+ * We have to correct it if we want to read from it.
-+ */
-+static int ftdi_mtxorb_hack_setup(struct usb_serial *serial)
-+{
-+	struct usb_host_endpoint *ep = serial->dev->ep_in[1];
-+	struct usb_endpoint_descriptor *ep_desc = &ep->desc;
-+
-+	if (ep->enabled && ep_desc->wMaxPacketSize == 0) {
-+		ep_desc->wMaxPacketSize = 0x40;
-+		info("Fixing invalid wMaxPacketSize on read pipe");
-+	}
-+
-+	return 0;
-+}
-+
- /* ftdi_shutdown is called from usbserial:usb_serial_disconnect
-  *   it is called when the usb device is disconnected
-  *
-diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
-index f6053da..893b429 100644
---- a/drivers/usb/serial/ftdi_sio.h
-+++ b/drivers/usb/serial/ftdi_sio.h
-@@ -98,6 +98,13 @@
- #define FTDI_MTXORB_5_PID      0xFA05  /* Matrix Orbital Product Id */
- #define FTDI_MTXORB_6_PID      0xFA06  /* Matrix Orbital Product Id */
- 
-+/*
-+ * The following are the values for the Matrix Orbital VK204-25-USB
-+ * display, which use the FT232RL.
-+ */
-+#define MTXORB_VK_VID		0x1b3d
-+#define MTXORB_VK_PID		0x0158
-+
- /* Interbiometrics USB I/O Board */
- /* Developed for Interbiometrics by Rudolf Gugler */
- #define INTERBIOMETRICS_VID              0x1209
-diff --git a/drivers/usb/storage/protocol.c b/drivers/usb/storage/protocol.c
-index 889622b..45262f3 100644
---- a/drivers/usb/storage/protocol.c
-+++ b/drivers/usb/storage/protocol.c
-@@ -194,7 +194,7 @@ unsigned int usb_stor_access_xfer_buf(unsigned char *buffer,
- 		 * and the starting offset within the page, and update
- 		 * the *offset and *index values for the next loop. */
- 		cnt = 0;
--		while (cnt < buflen) {
-+		while (cnt < buflen && sg) {
- 			struct page *page = sg_page(sg) +
- 					((sg->offset + *offset) >> PAGE_SHIFT);
- 			unsigned int poff =
-@@ -249,7 +249,8 @@ void usb_stor_set_xfer_buf(unsigned char *buffer,
- 	unsigned int offset = 0;
- 	struct scatterlist *sg = NULL;
- 
--	usb_stor_access_xfer_buf(buffer, buflen, srb, &sg, &offset,
-+	buflen = min(buflen, srb->request_bufflen);
-+	buflen = usb_stor_access_xfer_buf(buffer, buflen, srb, &sg, &offset,
- 			TO_XFER_BUF);
- 	if (buflen < srb->request_bufflen)
- 		srb->resid = srb->request_bufflen - buflen;
-diff --git a/fs/aio.c b/fs/aio.c
-index 9dec7d2..758f911 100644
---- a/fs/aio.c
-+++ b/fs/aio.c
-@@ -997,6 +997,14 @@ put_rq:
- 	/* everything turned out well, dispose of the aiocb. */
- 	ret = __aio_put_req(ctx, iocb);
- 
-+	/*
-+	 * We have to order our ring_info tail store above and test
-+	 * of the wait list below outside the wait lock.  This is
-+	 * like in wake_up_bit() where clearing a bit has to be
-+	 * ordered with the unlocked test.
-+	 */
-+	smp_mb();
-+
- 	if (waitqueue_active(&ctx->wait))
- 		wake_up(&ctx->wait);
- 
-diff --git a/fs/ecryptfs/mmap.c b/fs/ecryptfs/mmap.c
-index 32c5711..a985a8f 100644
---- a/fs/ecryptfs/mmap.c
-+++ b/fs/ecryptfs/mmap.c
-@@ -263,52 +263,102 @@ out:
- 	return 0;
- }
- 
--/* This function must zero any hole we create */
-+/**
-+ * ecryptfs_prepare_write
-+ * @file: The eCryptfs file
-+ * @page: The eCryptfs page
-+ * @from: The start byte from which we will write
-+ * @to: The end byte to which we will write
-+ *
-+ * This function must zero any hole we create
-+ *
-+ * Returns zero on success; non-zero otherwise
-+ */
- static int ecryptfs_prepare_write(struct file *file, struct page *page,
- 				  unsigned from, unsigned to)
- {
--	int rc = 0;
- 	loff_t prev_page_end_size;
-+	int rc = 0;
- 
- 	if (!PageUptodate(page)) {
--		rc = ecryptfs_read_lower_page_segment(page, page->index, 0,
--						      PAGE_CACHE_SIZE,
--						      page->mapping->host);
--		if (rc) {
--			printk(KERN_ERR "%s: Error attemping to read lower "
--			       "page segment; rc = [%d]\n", __FUNCTION__, rc);
--			ClearPageUptodate(page);
--			goto out;
--		} else
-+		struct ecryptfs_crypt_stat *crypt_stat =
-+			&ecryptfs_inode_to_private(
-+				file->f_path.dentry->d_inode)->crypt_stat;
-+
-+		if (!(crypt_stat->flags & ECRYPTFS_ENCRYPTED)
-+		    || (crypt_stat->flags & ECRYPTFS_NEW_FILE)) {
-+			rc = ecryptfs_read_lower_page_segment(
-+				page, page->index, 0, PAGE_CACHE_SIZE,
-+				page->mapping->host);
-+			if (rc) {
-+				printk(KERN_ERR "%s: Error attemping to read "
-+				       "lower page segment; rc = [%d]\n",
-+				       __FUNCTION__, rc);
-+				ClearPageUptodate(page);
-+				goto out;
-+			} else
-+				SetPageUptodate(page);
-+		} else if (crypt_stat->flags & ECRYPTFS_VIEW_AS_ENCRYPTED) {
-+			if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR) {
-+				rc = ecryptfs_copy_up_encrypted_with_header(
-+					page, crypt_stat);
-+				if (rc) {
-+					printk(KERN_ERR "%s: Error attempting "
-+					       "to copy the encrypted content "
-+					       "from the lower file whilst "
-+					       "inserting the metadata from "
-+					       "the xattr into the header; rc "
-+					       "= [%d]\n", __FUNCTION__, rc);
-+					ClearPageUptodate(page);
-+					goto out;
-+				}
-+				SetPageUptodate(page);
-+			} else {
-+				rc = ecryptfs_read_lower_page_segment(
-+					page, page->index, 0, PAGE_CACHE_SIZE,
-+					page->mapping->host);
-+				if (rc) {
-+					printk(KERN_ERR "%s: Error reading "
-+					       "page; rc = [%d]\n",
-+					       __FUNCTION__, rc);
-+					ClearPageUptodate(page);
-+					goto out;
-+				}
-+				SetPageUptodate(page);
-+			}
-+		} else {
-+			rc = ecryptfs_decrypt_page(page);
-+			if (rc) {
-+				printk(KERN_ERR "%s: Error decrypting page "
-+				       "at index [%ld]; rc = [%d]\n",
-+				       __FUNCTION__, page->index, rc);
-+				ClearPageUptodate(page);
-+				goto out;
-+			}
- 			SetPageUptodate(page);
-+		}
- 	}
--
- 	prev_page_end_size = ((loff_t)page->index << PAGE_CACHE_SHIFT);
--
--	/*
--	 * If creating a page or more of holes, zero them out via truncate.
--	 * Note, this will increase i_size.
--	 */
-+	/* If creating a page or more of holes, zero them out via truncate.
-+	 * Note, this will increase i_size. */
- 	if (page->index != 0) {
- 		if (prev_page_end_size > i_size_read(page->mapping->host)) {
- 			rc = ecryptfs_truncate(file->f_path.dentry,
- 					       prev_page_end_size);
- 			if (rc) {
--				printk(KERN_ERR "Error on attempt to "
-+				printk(KERN_ERR "%s: Error on attempt to "
- 				       "truncate to (higher) offset [%lld];"
--				       " rc = [%d]\n", prev_page_end_size, rc);
-+				       " rc = [%d]\n", __FUNCTION__,
-+				       prev_page_end_size, rc);
- 				goto out;
- 			}
- 		}
- 	}
--	/*
--	 * Writing to a new page, and creating a small hole from start of page?
--	 * Zero it out.
--	 */
--	if ((i_size_read(page->mapping->host) == prev_page_end_size) &&
--	    (from != 0)) {
-+	/* Writing to a new page, and creating a small hole from start
-+	 * of page?  Zero it out. */
-+	if ((i_size_read(page->mapping->host) == prev_page_end_size)
-+	    && (from != 0))
- 		zero_user_page(page, 0, PAGE_CACHE_SIZE, KM_USER0);
--	}
- out:
- 	return rc;
- }
-diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
-index 80d2f52..dcac591 100644
---- a/fs/fuse/dir.c
-+++ b/fs/fuse/dir.c
-@@ -905,7 +905,7 @@ static int fuse_permission(struct inode *inode, int mask, struct nameidata *nd)
- 	}
- 
- 	if (fc->flags & FUSE_DEFAULT_PERMISSIONS) {
--		int err = generic_permission(inode, mask, NULL);
-+		err = generic_permission(inode, mask, NULL);
- 
- 		/* If permission is denied, try to refresh file
- 		   attributes.  This is also needed, because the root
-diff --git a/fs/isofs/compress.c b/fs/isofs/compress.c
-index 37dbd64..defb932 100644
---- a/fs/isofs/compress.c
-+++ b/fs/isofs/compress.c
-@@ -72,6 +72,17 @@ static int zisofs_readpage(struct file *file, struct page *page)
- 	offset = index & ~zisofs_block_page_mask;
- 	blockindex = offset >> zisofs_block_page_shift;
- 	maxpage = (inode->i_size + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
-+
-+	/*
-+	 * If this page is wholly outside i_size we just return zero;
-+	 * do_generic_file_read() will handle this for us
-+	 */
-+	if (page->index >= maxpage) {
-+		SetPageUptodate(page);
-+		unlock_page(page);
-+		return 0;
-+	}
-+
- 	maxpage = min(zisofs_block_pages, maxpage-offset);
- 
- 	for ( i = 0 ; i < maxpage ; i++, offset++ ) {
-diff --git a/fs/jbd/recovery.c b/fs/jbd/recovery.c
-index c5d9694..9aaa4fa 100644
---- a/fs/jbd/recovery.c
-+++ b/fs/jbd/recovery.c
-@@ -478,7 +478,7 @@ static int do_one_pass(journal_t *journal,
- 					memcpy(nbh->b_data, obh->b_data,
- 							journal->j_blocksize);
- 					if (flags & JFS_FLAG_ESCAPE) {
--						*((__be32 *)bh->b_data) =
-+						*((__be32 *)nbh->b_data) =
- 						cpu_to_be32(JFS_MAGIC_NUMBER);
- 					}
- 
-diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c
-index d0ce627..fa0d4e9 100644
---- a/fs/jbd2/recovery.c
-+++ b/fs/jbd2/recovery.c
-@@ -488,7 +488,7 @@ static int do_one_pass(journal_t *journal,
- 					memcpy(nbh->b_data, obh->b_data,
- 							journal->j_blocksize);
- 					if (flags & JBD2_FLAG_ESCAPE) {
--						*((__be32 *)bh->b_data) =
-+						*((__be32 *)nbh->b_data) =
- 						cpu_to_be32(JBD2_MAGIC_NUMBER);
- 					}
- 
-diff --git a/fs/nfsd/nfsfh.c b/fs/nfsd/nfsfh.c
-index 468f17a..429cec2 100644
---- a/fs/nfsd/nfsfh.c
-+++ b/fs/nfsd/nfsfh.c
-@@ -231,6 +231,7 @@ fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, int access)
- 		fhp->fh_dentry = dentry;
- 		fhp->fh_export = exp;
- 		nfsd_nr_verified++;
-+		cache_get(&exp->h);
- 	} else {
- 		/*
- 		 * just rechecking permissions
-@@ -240,6 +241,7 @@ fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, int access)
- 		dprintk("nfsd: fh_verify - just checking\n");
- 		dentry = fhp->fh_dentry;
- 		exp = fhp->fh_export;
-+		cache_get(&exp->h);
- 		/*
- 		 * Set user creds for this exportpoint; necessary even
- 		 * in the "just checking" case because this may be a
-@@ -251,8 +253,6 @@ fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, int access)
- 		if (error)
- 			goto out;
- 	}
--	cache_get(&exp->h);
--
- 
- 	error = nfsd_mode_check(rqstp, dentry->d_inode->i_mode, type);
- 	if (error)
-diff --git a/fs/ufs/util.h b/fs/ufs/util.h
-index b26fc4d..23ceed8 100644
---- a/fs/ufs/util.h
-+++ b/fs/ufs/util.h
-@@ -58,7 +58,7 @@ ufs_set_fs_state(struct super_block *sb, struct ufs_super_block_first *usb1,
- {
- 	switch (UFS_SB(sb)->s_flags & UFS_ST_MASK) {
- 	case UFS_ST_SUNOS:
--		if (fs32_to_cpu(sb, usb3->fs_postblformat == UFS_42POSTBLFMT)) {
-+		if (fs32_to_cpu(sb, usb3->fs_postblformat) == UFS_42POSTBLFMT) {
- 			usb1->fs_u0.fs_sun.fs_state = cpu_to_fs32(sb, value);
- 			break;
- 		}
-diff --git a/include/asm-arm/arch-pxa/pxa-regs.h b/include/asm-arm/arch-pxa/pxa-regs.h
-index 1bd398d..c12c294 100644
---- a/include/asm-arm/arch-pxa/pxa-regs.h
-+++ b/include/asm-arm/arch-pxa/pxa-regs.h
-@@ -1669,6 +1669,7 @@
- #define SSCR1_RSRE		(1 << 20)	/* Receive Service Request Enable */
- #define SSCR1_TINTE		(1 << 19)	/* Receiver Time-out Interrupt enable */
- #define SSCR1_PINTE		(1 << 18)	/* Peripheral Trailing Byte Interupt Enable */
-+#define SSCR1_IFS		(1 << 16)	/* Invert Frame Signal */
- #define SSCR1_STRF		(1 << 15)	/* Select FIFO or EFWR */
- #define SSCR1_EFWR		(1 << 14)	/* Enable FIFO Write/Read */
- 
-diff --git a/include/asm-x86/apic_32.h b/include/asm-x86/apic_32.h
-index be158b2..04fbe7f 100644
---- a/include/asm-x86/apic_32.h
-+++ b/include/asm-x86/apic_32.h
-@@ -109,7 +109,7 @@ extern void setup_boot_APIC_clock (void);
- extern void setup_secondary_APIC_clock (void);
- extern int APIC_init_uniprocessor (void);
- 
--extern void enable_NMI_through_LVT0 (void * dummy);
-+extern void enable_NMI_through_LVT0(void);
- 
- #define ARCH_APICTIMER_STOPS_ON_C3	1
- 
-diff --git a/include/asm-x86/futex_32.h b/include/asm-x86/futex_32.h
-index 438ef0e..80964fd 100644
---- a/include/asm-x86/futex_32.h
-+++ b/include/asm-x86/futex_32.h
-@@ -28,7 +28,7 @@
- "1:	movl	%2, %0\n\
- 	movl	%0, %3\n"					\
- 	insn "\n"						\
--"2:	" LOCK_PREFIX "cmpxchgl %3, %2\n\
-+"2:	lock ; cmpxchgl %3, %2\n\
- 	jnz	1b\n\
- 3:	.section .fixup,\"ax\"\n\
- 4:	mov	%5, %1\n\
-@@ -68,7 +68,7 @@ futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
- #endif
- 		switch (op) {
- 		case FUTEX_OP_ADD:
--			__futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret,
-+			__futex_atomic_op1("lock ; xaddl %0, %2", ret,
- 					   oldval, uaddr, oparg);
- 			break;
- 		case FUTEX_OP_OR:
-@@ -111,7 +111,7 @@ futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval, int newval)
- 		return -EFAULT;
- 
- 	__asm__ __volatile__(
--		"1:	" LOCK_PREFIX "cmpxchgl %3, %1		\n"
-+		"1:	lock ; cmpxchgl %3, %1			\n"
- 
- 		"2:	.section .fixup, \"ax\"			\n"
- 		"3:	mov     %2, %0				\n"
-diff --git a/include/asm-x86/futex_64.h b/include/asm-x86/futex_64.h
-index 5cdfb08..423c051 100644
---- a/include/asm-x86/futex_64.h
-+++ b/include/asm-x86/futex_64.h
-@@ -27,7 +27,7 @@
- "1:	movl	%2, %0\n\
- 	movl	%0, %3\n"					\
- 	insn "\n"						\
--"2:	" LOCK_PREFIX "cmpxchgl %3, %2\n\
-+"2:	lock ; cmpxchgl %3, %2\n\
- 	jnz	1b\n\
- 3:	.section .fixup,\"ax\"\n\
- 4:	mov	%5, %1\n\
-@@ -62,7 +62,7 @@ futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
- 		__futex_atomic_op1("xchgl %0, %2", ret, oldval, uaddr, oparg);
- 		break;
- 	case FUTEX_OP_ADD:
--		__futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret, oldval,
-+		__futex_atomic_op1("lock ; xaddl %0, %2", ret, oldval,
- 				   uaddr, oparg);
- 		break;
- 	case FUTEX_OP_OR:
-@@ -101,7 +101,7 @@ futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval, int newval)
- 		return -EFAULT;
- 
- 	__asm__ __volatile__(
--		"1:	" LOCK_PREFIX "cmpxchgl %3, %1		\n"
-+		"1:	lock ; cmpxchgl %3, %1			\n"
- 
- 		"2:	.section .fixup, \"ax\"			\n"
- 		"3:	mov     %2, %0				\n"
-diff --git a/include/asm-x86/io_apic_64.h b/include/asm-x86/io_apic_64.h
-index e2c1367..1913ad0 100644
---- a/include/asm-x86/io_apic_64.h
-+++ b/include/asm-x86/io_apic_64.h
-@@ -129,7 +129,7 @@ extern int io_apic_set_pci_routing (int ioapic, int pin, int irq, int, int);
- 
- extern int sis_apic_bug; /* dummy */ 
- 
--void enable_NMI_through_LVT0 (void * dummy);
-+void enable_NMI_through_LVT0(void);
- 
- extern spinlock_t i8259A_lock;
- 
-diff --git a/include/asm-x86/processor_32.h b/include/asm-x86/processor_32.h
-index 13976b0..787ee2e 100644
---- a/include/asm-x86/processor_32.h
-+++ b/include/asm-x86/processor_32.h
-@@ -712,9 +712,10 @@ static inline unsigned int cpuid_edx(unsigned int op)
- #define ASM_NOP6 K7_NOP6
- #define ASM_NOP7 K7_NOP7
- #define ASM_NOP8 K7_NOP8
--#elif defined(CONFIG_M686) || defined(CONFIG_MPENTIUMII) || \
-+#elif (defined(CONFIG_M686) || defined(CONFIG_MPENTIUMII) || \
-       defined(CONFIG_MPENTIUMIII) || defined(CONFIG_MPENTIUMM) || \
--      defined(CONFIG_MCORE2) || defined(CONFIG_PENTIUM4)
-+      defined(CONFIG_MCORE2) || defined(CONFIG_PENTIUM4)) && \
-+      !defined(CONFIG_X86_GENERIC)
- #define ASM_NOP1 P6_NOP1
- #define ASM_NOP2 P6_NOP2
- #define ASM_NOP3 P6_NOP3
-diff --git a/include/linux/Kbuild b/include/linux/Kbuild
-index 4b32bb1..f30fa92 100644
---- a/include/linux/Kbuild
-+++ b/include/linux/Kbuild
-@@ -217,7 +217,6 @@ unifdef-y += i2o-dev.h
- unifdef-y += icmp.h
- unifdef-y += icmpv6.h
- unifdef-y += if_addr.h
--unifdef-y += if_addrlabel.h
- unifdef-y += if_arp.h
- unifdef-y += if_bridge.h
- unifdef-y += if_ec.h
-diff --git a/include/linux/futex.h b/include/linux/futex.h
-index 92d420f..e5f3b84 100644
---- a/include/linux/futex.h
-+++ b/include/linux/futex.h
-@@ -153,6 +153,7 @@ union futex_key {
- #ifdef CONFIG_FUTEX
- extern void exit_robust_list(struct task_struct *curr);
- extern void exit_pi_state_list(struct task_struct *curr);
-+extern int futex_cmpxchg_enabled;
- #else
- static inline void exit_robust_list(struct task_struct *curr)
- {
-diff --git a/include/linux/irq.h b/include/linux/irq.h
-index 4669be0..1fc1cb8 100644
---- a/include/linux/irq.h
-+++ b/include/linux/irq.h
-@@ -367,6 +367,9 @@ set_irq_chained_handler(unsigned int irq,
- 	__set_irq_handler(irq, handle, 1, NULL);
- }
- 
-+extern void set_irq_noprobe(unsigned int irq);
-+extern void set_irq_probe(unsigned int irq);
-+
- /* Handle dynamic irq creation and destruction */
- extern int create_irq(void);
- extern void destroy_irq(unsigned int irq);
-diff --git a/include/linux/moduleparam.h b/include/linux/moduleparam.h
-index 13410b2..c1d64c2 100644
---- a/include/linux/moduleparam.h
-+++ b/include/linux/moduleparam.h
-@@ -62,6 +62,16 @@ struct kparam_array
- 	void *elem;
- };
- 
-+/* On alpha, ia64 and ppc64 relocations to global data cannot go into
-+   read-only sections (which is part of respective UNIX ABI on these
-+   platforms). So 'const' makes no sense and even causes compile failures
-+   with some compilers. */
-+#if defined(CONFIG_ALPHA) || defined(CONFIG_IA64) || defined(CONFIG_PPC64)
-+#define __moduleparam_const
-+#else
-+#define __moduleparam_const const
-+#endif
-+
- /* This is the fundamental function for registering boot/module
-    parameters.  perm sets the visibility in sysfs: 000 means it's
-    not there, read bits mean it's readable, write bits mean it's
-@@ -71,7 +81,7 @@ struct kparam_array
- 	static int __param_perm_check_##name __attribute__((unused)) =	\
- 	BUILD_BUG_ON_ZERO((perm) < 0 || (perm) > 0777 || ((perm) & 2));	\
- 	static const char __param_str_##name[] = prefix #name;		\
--	static struct kernel_param const __param_##name			\
-+	static struct kernel_param __moduleparam_const __param_##name	\
- 	__attribute_used__						\
-     __attribute__ ((unused,__section__ ("__param"),aligned(sizeof(void *)))) \
- 	= { __param_str_##name, perm, set, get, { arg } }
-diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
-index 70013c5..89cd011 100644
---- a/include/net/inet_sock.h
-+++ b/include/net/inet_sock.h
-@@ -175,7 +175,8 @@ extern void build_ehash_secret(void);
- static inline unsigned int inet_ehashfn(const __be32 laddr, const __u16 lport,
- 					const __be32 faddr, const __be16 fport)
- {
--	return jhash_2words((__force __u32) laddr ^ (__force __u32) faddr,
-+	return jhash_3words((__force __u32) laddr,
-+			    (__force __u32) faddr,
- 			    ((__u32) lport) << 16 | (__force __u32)fport,
- 			    inet_ehash_secret);
- }
-diff --git a/kernel/futex.c b/kernel/futex.c
-index 55d78b5..d166080 100644
---- a/kernel/futex.c
-+++ b/kernel/futex.c
-@@ -60,6 +60,8 @@
- 
- #include "rtmutex_common.h"
- 
-+int __read_mostly futex_cmpxchg_enabled;
-+
- #define FUTEX_HASHBITS (CONFIG_BASE_SMALL ? 4 : 8)
- 
- /*
-@@ -466,6 +468,8 @@ void exit_pi_state_list(struct task_struct *curr)
- 	struct futex_hash_bucket *hb;
- 	union futex_key key;
- 
-+	if (!futex_cmpxchg_enabled)
-+		return;
- 	/*
- 	 * We are a ZOMBIE and nobody can enqueue itself on
- 	 * pi_state_list anymore, but we have to be careful
-@@ -1854,6 +1858,8 @@ asmlinkage long
- sys_set_robust_list(struct robust_list_head __user *head,
- 		    size_t len)
- {
-+	if (!futex_cmpxchg_enabled)
-+		return -ENOSYS;
- 	/*
- 	 * The kernel knows only one size for now:
- 	 */
-@@ -1878,6 +1884,9 @@ sys_get_robust_list(int pid, struct robust_list_head __user * __user *head_ptr,
- 	struct robust_list_head __user *head;
- 	unsigned long ret;
- 
-+	if (!futex_cmpxchg_enabled)
-+		return -ENOSYS;
-+
- 	if (!pid)
- 		head = current->robust_list;
- 	else {
-@@ -1980,6 +1989,9 @@ void exit_robust_list(struct task_struct *curr)
- 	unsigned long futex_offset;
- 	int rc;
- 
-+	if (!futex_cmpxchg_enabled)
-+		return;
-+
- 	/*
- 	 * Fetch the list head (which was registered earlier, via
- 	 * sys_set_robust_list()):
-@@ -2034,7 +2046,7 @@ void exit_robust_list(struct task_struct *curr)
- long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
- 		u32 __user *uaddr2, u32 val2, u32 val3)
- {
--	int ret;
-+	int ret = -ENOSYS;
- 	int cmd = op & FUTEX_CMD_MASK;
- 	struct rw_semaphore *fshared = NULL;
- 
-@@ -2062,13 +2074,16 @@ long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
- 		ret = futex_wake_op(uaddr, fshared, uaddr2, val, val2, val3);
- 		break;
- 	case FUTEX_LOCK_PI:
--		ret = futex_lock_pi(uaddr, fshared, val, timeout, 0);
-+		if (futex_cmpxchg_enabled)
-+			ret = futex_lock_pi(uaddr, fshared, val, timeout, 0);
- 		break;
- 	case FUTEX_UNLOCK_PI:
--		ret = futex_unlock_pi(uaddr, fshared);
-+		if (futex_cmpxchg_enabled)
-+			ret = futex_unlock_pi(uaddr, fshared);
- 		break;
- 	case FUTEX_TRYLOCK_PI:
--		ret = futex_lock_pi(uaddr, fshared, 0, timeout, 1);
-+		if (futex_cmpxchg_enabled)
-+			ret = futex_lock_pi(uaddr, fshared, 0, timeout, 1);
- 		break;
- 	default:
- 		ret = -ENOSYS;
-@@ -2123,8 +2138,29 @@ static struct file_system_type futex_fs_type = {
- 
- static int __init init(void)
- {
--	int i = register_filesystem(&futex_fs_type);
-+	u32 curval;
-+	int i;
-+
-+	/*
-+	 * This will fail and we want it. Some arch implementations do
-+	 * runtime detection of the futex_atomic_cmpxchg_inatomic()
-+	 * functionality. We want to know that before we call in any
-+	 * of the complex code paths. Also we want to prevent
-+	 * registration of robust lists in that case. NULL is
-+	 * guaranteed to fault and we get -EFAULT on functional
-+	 * implementation, the non functional ones will return
-+	 * -ENOSYS.
-+	 */
-+	curval = cmpxchg_futex_value_locked(NULL, 0, 0);
-+	if (curval == -EFAULT)
-+		futex_cmpxchg_enabled = 1;
- 
-+	for (i = 0; i < ARRAY_SIZE(futex_queues); i++) {
-+		plist_head_init(&futex_queues[i].chain, &futex_queues[i].lock);
-+		spin_lock_init(&futex_queues[i].lock);
-+	}
-+
-+	i = register_filesystem(&futex_fs_type);
- 	if (i)
- 		return i;
- 
-@@ -2134,10 +2170,6 @@ static int __init init(void)
- 		return PTR_ERR(futex_mnt);
- 	}
- 
--	for (i = 0; i < ARRAY_SIZE(futex_queues); i++) {
--		plist_head_init(&futex_queues[i].chain, &futex_queues[i].lock);
--		spin_lock_init(&futex_queues[i].lock);
--	}
- 	return 0;
- }
- __initcall(init);
-diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c
-index 8682c79..d95f79b 100644
---- a/kernel/futex_compat.c
-+++ b/kernel/futex_compat.c
-@@ -54,6 +54,9 @@ void compat_exit_robust_list(struct task_struct *curr)
- 	compat_long_t futex_offset;
- 	int rc;
- 
-+	if (!futex_cmpxchg_enabled)
-+		return;
-+
- 	/*
- 	 * Fetch the list head (which was registered earlier, via
- 	 * sys_set_robust_list()):
-@@ -115,6 +118,9 @@ asmlinkage long
- compat_sys_set_robust_list(struct compat_robust_list_head __user *head,
- 			   compat_size_t len)
- {
-+	if (!futex_cmpxchg_enabled)
-+		return -ENOSYS;
-+
- 	if (unlikely(len != sizeof(*head)))
- 		return -EINVAL;
- 
-@@ -130,6 +136,9 @@ compat_sys_get_robust_list(int pid, compat_uptr_t __user *head_ptr,
- 	struct compat_robust_list_head __user *head;
- 	unsigned long ret;
- 
-+	if (!futex_cmpxchg_enabled)
-+		return -ENOSYS;
-+
- 	if (!pid)
- 		head = current->compat_robust_list;
- 	else {
-diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
-index 465c69c..e4e1c99 100644
---- a/kernel/irq/chip.c
-+++ b/kernel/irq/chip.c
-@@ -607,3 +607,39 @@ set_irq_chip_and_handler_name(unsigned int irq, struct irq_chip *chip,
- 	set_irq_chip(irq, chip);
- 	__set_irq_handler(irq, handle, 0, name);
- }
-+
-+void __init set_irq_noprobe(unsigned int irq)
-+{
-+	struct irq_desc *desc;
-+	unsigned long flags;
-+
-+	if (irq >= NR_IRQS) {
-+		printk(KERN_ERR "Trying to mark IRQ%d non-probeable\n", irq);
-+
-+		return;
-+	}
-+
-+	desc = irq_desc + irq;
-+
-+	spin_lock_irqsave(&desc->lock, flags);
-+	desc->status |= IRQ_NOPROBE;
-+	spin_unlock_irqrestore(&desc->lock, flags);
-+}
-+
-+void __init set_irq_probe(unsigned int irq)
-+{
-+	struct irq_desc *desc;
-+	unsigned long flags;
-+
-+	if (irq >= NR_IRQS) {
-+		printk(KERN_ERR "Trying to mark IRQ%d probeable\n", irq);
-+
-+		return;
-+	}
-+
-+	desc = irq_desc + irq;
-+
-+	spin_lock_irqsave(&desc->lock, flags);
-+	desc->status &= ~IRQ_NOPROBE;
-+	spin_unlock_irqrestore(&desc->lock, flags);
-+}
-diff --git a/kernel/relay.c b/kernel/relay.c
-index 7c03733..889102a 100644
---- a/kernel/relay.c
-+++ b/kernel/relay.c
-@@ -1072,7 +1072,7 @@ static int subbuf_splice_actor(struct file *in,
- 			       unsigned int flags,
- 			       int *nonpad_ret)
- {
--	unsigned int pidx, poff, total_len, subbuf_pages, ret;
-+	unsigned int pidx, poff, total_len, subbuf_pages, nr_pages, ret;
- 	struct rchan_buf *rbuf = in->private_data;
- 	unsigned int subbuf_size = rbuf->chan->subbuf_size;
- 	uint64_t pos = (uint64_t) *ppos;
-@@ -1103,8 +1103,9 @@ static int subbuf_splice_actor(struct file *in,
- 	subbuf_pages = rbuf->chan->alloc_size >> PAGE_SHIFT;
- 	pidx = (read_start / PAGE_SIZE) % subbuf_pages;
- 	poff = read_start & ~PAGE_MASK;
-+	nr_pages = min_t(unsigned int, subbuf_pages, PIPE_BUFFERS);
- 
--	for (total_len = 0; spd.nr_pages < subbuf_pages; spd.nr_pages++) {
-+	for (total_len = 0; spd.nr_pages < nr_pages; spd.nr_pages++) {
- 		unsigned int this_len, this_end, private;
- 		unsigned int cur_pos = read_start + total_len;
- 
-diff --git a/kernel/sched.c b/kernel/sched.c
-index e76b11c..5ba5db9 100644
---- a/kernel/sched.c
-+++ b/kernel/sched.c
-@@ -4028,11 +4028,10 @@ void rt_mutex_setprio(struct task_struct *p, int prio)
- 	oldprio = p->prio;
- 	on_rq = p->se.on_rq;
- 	running = task_current(rq, p);
--	if (on_rq) {
-+	if (on_rq)
- 		dequeue_task(rq, p, 0);
--		if (running)
--			p->sched_class->put_prev_task(rq, p);
--	}
-+	if (running)
-+		p->sched_class->put_prev_task(rq, p);
- 
- 	if (rt_prio(prio))
- 		p->sched_class = &rt_sched_class;
-@@ -4041,9 +4040,9 @@ void rt_mutex_setprio(struct task_struct *p, int prio)
- 
- 	p->prio = prio;
- 
-+	if (running)
-+		p->sched_class->set_curr_task(rq);
- 	if (on_rq) {
--		if (running)
--			p->sched_class->set_curr_task(rq);
- 		enqueue_task(rq, p, 0);
- 		/*
- 		 * Reschedule if we are currently running on this runqueue and
-@@ -4339,18 +4338,17 @@ recheck:
- 	update_rq_clock(rq);
- 	on_rq = p->se.on_rq;
- 	running = task_current(rq, p);
--	if (on_rq) {
-+	if (on_rq)
- 		deactivate_task(rq, p, 0);
--		if (running)
--			p->sched_class->put_prev_task(rq, p);
--	}
-+	if (running)
-+		p->sched_class->put_prev_task(rq, p);
- 
- 	oldprio = p->prio;
- 	__setscheduler(rq, p, policy, param->sched_priority);
- 
-+	if (running)
-+		p->sched_class->set_curr_task(rq);
- 	if (on_rq) {
--		if (running)
--			p->sched_class->set_curr_task(rq);
- 		activate_task(rq, p, 0);
- 		/*
- 		 * Reschedule if we are currently running on this runqueue and
-@@ -7110,19 +7108,17 @@ void sched_move_task(struct task_struct *tsk)
- 	running = task_current(rq, tsk);
- 	on_rq = tsk->se.on_rq;
- 
--	if (on_rq) {
-+	if (on_rq)
- 		dequeue_task(rq, tsk, 0);
--		if (unlikely(running))
--			tsk->sched_class->put_prev_task(rq, tsk);
--	}
-+	if (unlikely(running))
-+		tsk->sched_class->put_prev_task(rq, tsk);
- 
- 	set_task_cfs_rq(tsk, task_cpu(tsk));
- 
--	if (on_rq) {
--		if (unlikely(running))
--			tsk->sched_class->set_curr_task(rq);
-+	if (unlikely(running))
-+		tsk->sched_class->set_curr_task(rq);
-+	if (on_rq)
- 		enqueue_task(rq, tsk, 0);
--	}
- 
- done:
- 	task_rq_unlock(rq, &flags);
-diff --git a/kernel/sysctl.c b/kernel/sysctl.c
-index e3e0ee3..397ff8c 100644
---- a/kernel/sysctl.c
-+++ b/kernel/sysctl.c
-@@ -306,7 +306,7 @@ static struct ctl_table kern_table[] = {
- 		.procname	= "sched_nr_migrate",
- 		.data		= &sysctl_sched_nr_migrate,
- 		.maxlen		= sizeof(unsigned int),
--		.mode		= 644,
-+		.mode		= 0644,
- 		.proc_handler	= &proc_dointvec,
- 	},
- #endif
-diff --git a/mm/filemap.c b/mm/filemap.c
-index 69430d2..76b036f 100644
---- a/mm/filemap.c
-+++ b/mm/filemap.c
-@@ -1725,21 +1725,27 @@ size_t iov_iter_copy_from_user(struct page *page,
- }
- EXPORT_SYMBOL(iov_iter_copy_from_user);
- 
--static void __iov_iter_advance_iov(struct iov_iter *i, size_t bytes)
-+void iov_iter_advance(struct iov_iter *i, size_t bytes)
- {
-+	BUG_ON(i->count < bytes);
-+
- 	if (likely(i->nr_segs == 1)) {
- 		i->iov_offset += bytes;
-+		i->count -= bytes;
- 	} else {
- 		const struct iovec *iov = i->iov;
- 		size_t base = i->iov_offset;
- 
- 		/*
- 		 * The !iov->iov_len check ensures we skip over unlikely
--		 * zero-length segments.
-+		 * zero-length segments (without overruning the iovec).
- 		 */
--		while (bytes || !iov->iov_len) {
--			int copy = min(bytes, iov->iov_len - base);
-+		while (bytes || unlikely(!iov->iov_len && i->count)) {
-+			int copy;
- 
-+			copy = min(bytes, iov->iov_len - base);
-+			BUG_ON(!i->count || i->count < copy);
-+			i->count -= copy;
- 			bytes -= copy;
- 			base += copy;
- 			if (iov->iov_len == base) {
-@@ -1751,14 +1757,6 @@ static void __iov_iter_advance_iov(struct iov_iter *i, size_t bytes)
- 		i->iov_offset = base;
- 	}
- }
--
--void iov_iter_advance(struct iov_iter *i, size_t bytes)
--{
--	BUG_ON(i->count < bytes);
--
--	__iov_iter_advance_iov(i, bytes);
--	i->count -= bytes;
--}
- EXPORT_SYMBOL(iov_iter_advance);
- 
- /*
-diff --git a/mm/hugetlb.c b/mm/hugetlb.c
-index 9c746cb..d95ce35 100644
---- a/mm/hugetlb.c
-+++ b/mm/hugetlb.c
-@@ -119,6 +119,7 @@ static void free_huge_page(struct page *page)
- 	struct address_space *mapping;
- 
- 	mapping = (struct address_space *) page_private(page);
-+	set_page_private(page, 0);
- 	BUG_ON(page_count(page));
- 	INIT_LIST_HEAD(&page->lru);
- 
-@@ -133,7 +134,6 @@ static void free_huge_page(struct page *page)
- 	spin_unlock(&hugetlb_lock);
- 	if (mapping)
- 		hugetlb_put_quota(mapping, 1);
--	set_page_private(page, 0);
- }
- 
- /*
-diff --git a/mm/slab.c b/mm/slab.c
-index ff31261..79c3be0 100644
---- a/mm/slab.c
-+++ b/mm/slab.c
-@@ -2961,11 +2961,10 @@ static void *cache_alloc_refill(struct kmem_cache *cachep, gfp_t flags)
- 	struct array_cache *ac;
- 	int node;
- 
--	node = numa_node_id();
--
-+retry:
- 	check_irq_off();
-+	node = numa_node_id();
- 	ac = cpu_cache_get(cachep);
--retry:
- 	batchcount = ac->batchcount;
- 	if (!ac->touched && batchcount > BATCHREFILL_LIMIT) {
- 		/*
-diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
-index 2726adc..e13cf5e 100644
---- a/net/bluetooth/hci_sysfs.c
-+++ b/net/bluetooth/hci_sysfs.c
-@@ -282,6 +282,7 @@ static void add_conn(struct work_struct *work)
- 	int i;
- 
- 	flush_workqueue(btdelconn);
-+
- 	if (device_add(&conn->dev) < 0) {
- 		BT_ERR("Failed to register connection device");
- 		return;
-@@ -317,7 +318,6 @@ void hci_conn_add_sysfs(struct hci_conn *conn)
- 	INIT_WORK(&conn->work, add_conn);
- 
- 	queue_work(btaddconn, &conn->work);
--	schedule_work(&conn->work);
- }
- 
- static int __match_tty(struct device *dev, void *data)
-@@ -354,7 +354,6 @@ void hci_conn_del_sysfs(struct hci_conn *conn)
- 	INIT_WORK(&conn->work, del_conn);
- 
- 	queue_work(btdelconn, &conn->work);
--	schedule_work(&conn->work);
- }
- 
- int hci_register_sysfs(struct hci_dev *hdev)
-@@ -408,6 +407,7 @@ int __init bt_sysfs_init(void)
- 		err = -ENOMEM;
- 		goto out;
- 	}
-+
- 	btdelconn = create_singlethread_workqueue("btdelconn");
- 	if (!btdelconn) {
- 		err = -ENOMEM;
-@@ -447,8 +447,12 @@ out:
- void bt_sysfs_cleanup(void)
- {
- 	destroy_workqueue(btaddconn);
-+
- 	destroy_workqueue(btdelconn);
-+
- 	class_destroy(bt_class);
-+
- 	bus_unregister(&bt_bus);
-+
- 	platform_device_unregister(bt_platform);
- }
-diff --git a/net/bridge/netfilter/ebt_dnat.c b/net/bridge/netfilter/ebt_dnat.c
-index 74262e9..1024511 100644
---- a/net/bridge/netfilter/ebt_dnat.c
-+++ b/net/bridge/netfilter/ebt_dnat.c
-@@ -20,8 +20,8 @@ static int ebt_target_dnat(struct sk_buff *skb, unsigned int hooknr,
- {
- 	struct ebt_nat_info *info = (struct ebt_nat_info *)data;
- 
--	if (skb_make_writable(skb, 0))
--		return NF_DROP;
-+	if (!skb_make_writable(skb, 0))
-+		return EBT_DROP;
- 
- 	memcpy(eth_hdr(skb)->h_dest, info->mac, ETH_ALEN);
- 	return info->target;
-diff --git a/net/bridge/netfilter/ebt_redirect.c b/net/bridge/netfilter/ebt_redirect.c
-index 422cb83..88afc34 100644
---- a/net/bridge/netfilter/ebt_redirect.c
-+++ b/net/bridge/netfilter/ebt_redirect.c
-@@ -21,8 +21,8 @@ static int ebt_target_redirect(struct sk_buff *skb, unsigned int hooknr,
- {
- 	struct ebt_redirect_info *info = (struct ebt_redirect_info *)data;
- 
--	if (skb_make_writable(skb, 0))
--		return NF_DROP;
-+	if (!skb_make_writable(skb, 0))
-+		return EBT_DROP;
- 
- 	if (hooknr != NF_BR_BROUTING)
- 		memcpy(eth_hdr(skb)->h_dest,
-diff --git a/net/bridge/netfilter/ebt_snat.c b/net/bridge/netfilter/ebt_snat.c
-index 425ac92..4c5a5a9 100644
---- a/net/bridge/netfilter/ebt_snat.c
-+++ b/net/bridge/netfilter/ebt_snat.c
-@@ -22,8 +22,8 @@ static int ebt_target_snat(struct sk_buff *skb, unsigned int hooknr,
- {
- 	struct ebt_nat_info *info = (struct ebt_nat_info *) data;
- 
--	if (skb_make_writable(skb, 0))
--		return NF_DROP;
-+	if (!skb_make_writable(skb, 0))
-+		return EBT_DROP;
- 
- 	memcpy(eth_hdr(skb)->h_source, info->mac, ETH_ALEN);
- 	if (!(info->target & NAT_ARP_BIT) &&
-diff --git a/net/core/dev.c b/net/core/dev.c
-index 0879f52..4d44372 100644
---- a/net/core/dev.c
-+++ b/net/core/dev.c
-@@ -1068,8 +1068,6 @@ int dev_close(struct net_device *dev)
- 	 */
- 	call_netdevice_notifiers(NETDEV_GOING_DOWN, dev);
- 
--	dev_deactivate(dev);
--
- 	clear_bit(__LINK_STATE_START, &dev->state);
- 
- 	/* Synchronize to scheduled poll. We cannot touch poll list,
-@@ -1080,6 +1078,8 @@ int dev_close(struct net_device *dev)
- 	 */
- 	smp_mb__after_clear_bit(); /* Commit netif_running(). */
- 
-+	dev_deactivate(dev);
-+
- 	/*
- 	 *	Call the device specific close. This cannot fail.
- 	 *	Only if device is UP
-@@ -2906,7 +2906,7 @@ int __dev_addr_add(struct dev_addr_list **list, int *count,
- 		}
- 	}
- 
--	da = kmalloc(sizeof(*da), GFP_ATOMIC);
-+	da = kzalloc(sizeof(*da), GFP_ATOMIC);
- 	if (da == NULL)
- 		return -ENOMEM;
- 	memcpy(da->da_addr, addr, alen);
-diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
-index 82817e5..7794e17 100644
---- a/net/ipv4/ip_sockglue.c
-+++ b/net/ipv4/ip_sockglue.c
-@@ -514,11 +514,6 @@ static int do_ip_setsockopt(struct sock *sk, int level,
- 			val &= ~3;
- 			val |= inet->tos & 3;
- 		}
--		if (IPTOS_PREC(val) >= IPTOS_PREC_CRITIC_ECP &&
--		    !capable(CAP_NET_ADMIN)) {
--			err = -EPERM;
--			break;
--		}
- 		if (inet->tos != val) {
- 			inet->tos = val;
- 			sk->sk_priority = rt_tos2priority(val);
-diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
-index 80cab8c..b284b4e 100644
---- a/net/ipv4/ipcomp.c
-+++ b/net/ipv4/ipcomp.c
-@@ -108,8 +108,11 @@ static int ipcomp_compress(struct xfrm_state *x, struct sk_buff *skb)
- 	const int cpu = get_cpu();
- 	u8 *scratch = *per_cpu_ptr(ipcomp_scratches, cpu);
- 	struct crypto_comp *tfm = *per_cpu_ptr(ipcd->tfms, cpu);
--	int err = crypto_comp_compress(tfm, start, plen, scratch, &dlen);
-+	int err;
- 
-+	local_bh_disable();
-+	err = crypto_comp_compress(tfm, start, plen, scratch, &dlen);
-+	local_bh_enable();
- 	if (err)
- 		goto out;
- 
-diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
-index b8f7763..15dc11e 100644
---- a/net/ipv4/ipconfig.c
-+++ b/net/ipv4/ipconfig.c
-@@ -739,9 +739,9 @@ static void __init ic_bootp_send_if(struct ic_device *d, unsigned long jiffies_d
- 		printk("Unknown ARP type 0x%04x for device %s\n", dev->type, dev->name);
- 		b->htype = dev->type; /* can cause undefined behavior */
- 	}
-+
-+	/* server_ip and your_ip address are both already zero per RFC2131 */
- 	b->hlen = dev->addr_len;
--	b->your_ip = NONE;
--	b->server_ip = NONE;
- 	memcpy(b->hw_addr, dev->dev_addr, dev->addr_len);
- 	b->secs = htons(jiffies_diff / HZ);
- 	b->xid = d->xid;
-diff --git a/net/ipv4/netfilter/arpt_mangle.c b/net/ipv4/netfilter/arpt_mangle.c
-index 45fa4e2..3f4222b 100644
---- a/net/ipv4/netfilter/arpt_mangle.c
-+++ b/net/ipv4/netfilter/arpt_mangle.c
-@@ -19,7 +19,7 @@ target(struct sk_buff *skb,
- 	unsigned char *arpptr;
- 	int pln, hln;
- 
--	if (skb_make_writable(skb, skb->len))
-+	if (!skb_make_writable(skb, skb->len))
- 		return NF_DROP;
- 
- 	arp = arp_hdr(skb);
-diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
-index 14d64a3..16d0fb3 100644
---- a/net/ipv4/netfilter/ip_queue.c
-+++ b/net/ipv4/netfilter/ip_queue.c
-@@ -336,8 +336,8 @@ static int
- ipq_mangle_ipv4(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
- {
- 	int diff;
--	int err;
- 	struct iphdr *user_iph = (struct iphdr *)v->payload;
-+	struct sk_buff *nskb;
- 
- 	if (v->data_len < sizeof(*user_iph))
- 		return 0;
-@@ -349,14 +349,16 @@ ipq_mangle_ipv4(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
- 		if (v->data_len > 0xFFFF)
- 			return -EINVAL;
- 		if (diff > skb_tailroom(e->skb)) {
--			err = pskb_expand_head(e->skb, 0,
-+			nskb = skb_copy_expand(e->skb, 0,
- 					       diff - skb_tailroom(e->skb),
- 					       GFP_ATOMIC);
--			if (err) {
-+			if (!nskb) {
- 				printk(KERN_WARNING "ip_queue: error "
--				      "in mangle, dropping packet: %d\n", -err);
--				return err;
-+				      "in mangle, dropping packet\n");
-+				return -ENOMEM;
- 			}
-+			kfree_skb(e->skb);
-+			e->skb = nskb;
- 		}
- 		skb_put(e->skb, diff);
- 	}
-diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
-index 2f59baa..5b4095b 100644
---- a/net/ipv6/ip6_output.c
-+++ b/net/ipv6/ip6_output.c
-@@ -593,7 +593,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
- 	 * or if the skb it not generated by a local socket.  (This last
- 	 * check should be redundant, but it's free.)
- 	 */
--	if (!np || np->pmtudisc >= IPV6_PMTUDISC_DO) {
-+	if (!skb->local_df) {
- 		skb->dev = skb->dst->dev;
- 		icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
- 		IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_FRAGFAILS);
-@@ -1389,6 +1389,10 @@ int ip6_push_pending_frames(struct sock *sk)
- 		tmp_skb->sk = NULL;
- 	}
- 
-+	/* Allow local fragmentation. */
-+	if (np->pmtudisc < IPV6_PMTUDISC_DO)
-+		skb->local_df = 1;
-+
- 	ipv6_addr_copy(final_dst, &fl->fl6_dst);
- 	__skb_pull(skb, skb_network_header_len(skb));
- 	if (opt && opt->opt_flen)
-diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
-index 5383b33..81941a1 100644
---- a/net/ipv6/ip6_tunnel.c
-+++ b/net/ipv6/ip6_tunnel.c
-@@ -550,6 +550,7 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
- 			ip_rt_put(rt);
- 			goto out;
- 		}
-+		skb2->dst = (struct dst_entry *)rt;
- 	} else {
- 		ip_rt_put(rt);
- 		if (ip_route_input(skb2, eiph->daddr, eiph->saddr, eiph->tos,
-diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
-index 1c5b09f..f46c38f 100644
---- a/net/ipv6/ipcomp6.c
-+++ b/net/ipv6/ipcomp6.c
-@@ -146,7 +146,9 @@ static int ipcomp6_output(struct xfrm_state *x, struct sk_buff *skb)
- 	scratch = *per_cpu_ptr(ipcomp6_scratches, cpu);
- 	tfm = *per_cpu_ptr(ipcd->tfms, cpu);
- 
-+	local_bh_disable();
- 	err = crypto_comp_compress(tfm, start, plen, scratch, &dlen);
-+	local_bh_enable();
- 	if (err || (dlen + sizeof(*ipch)) >= plen) {
- 		put_cpu();
- 		goto out_ok;
-diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
-index e273605..710a04f 100644
---- a/net/ipv6/netfilter/ip6_queue.c
-+++ b/net/ipv6/netfilter/ip6_queue.c
-@@ -333,8 +333,8 @@ static int
- ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
- {
- 	int diff;
--	int err;
- 	struct ipv6hdr *user_iph = (struct ipv6hdr *)v->payload;
-+	struct sk_buff *nskb;
- 
- 	if (v->data_len < sizeof(*user_iph))
- 		return 0;
-@@ -346,14 +346,16 @@ ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
- 		if (v->data_len > 0xFFFF)
- 			return -EINVAL;
- 		if (diff > skb_tailroom(e->skb)) {
--			err = pskb_expand_head(e->skb, 0,
-+			nskb = skb_copy_expand(e->skb, 0,
- 					       diff - skb_tailroom(e->skb),
- 					       GFP_ATOMIC);
--			if (err) {
-+			if (!nskb) {
- 				printk(KERN_WARNING "ip6_queue: OOM "
- 				      "in mangle, dropping packet\n");
--				return err;
-+				return -ENOMEM;
- 			}
-+			kfree_skb(e->skb);
-+			e->skb = nskb;
- 		}
- 		skb_put(e->skb, diff);
- 	}
-diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
-index 6569767..dc22909 100644
---- a/net/ipv6/xfrm6_output.c
-+++ b/net/ipv6/xfrm6_output.c
-@@ -34,7 +34,7 @@ static int xfrm6_tunnel_check_size(struct sk_buff *skb)
- 	if (mtu < IPV6_MIN_MTU)
- 		mtu = IPV6_MIN_MTU;
- 
--	if (skb->len > mtu) {
-+	if (!skb->local_df && skb->len > mtu) {
- 		skb->dev = dst->dev;
- 		icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
- 		ret = -EMSGSIZE;
-diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
-index 2c7bd2e..dc43df1 100644
---- a/net/netfilter/nfnetlink_log.c
-+++ b/net/netfilter/nfnetlink_log.c
-@@ -594,7 +594,7 @@ nfulnl_log_packet(unsigned int pf,
- 	/* FIXME: do we want to make the size calculation conditional based on
- 	 * what is actually present?  way more branches and checks, but more
- 	 * memory efficient... */
--	size =    NLMSG_ALIGN(sizeof(struct nfgenmsg))
-+	size =    NLMSG_SPACE(sizeof(struct nfgenmsg))
- 		+ nla_total_size(sizeof(struct nfulnl_msg_packet_hdr))
- 		+ nla_total_size(sizeof(u_int32_t))	/* ifindex */
- 		+ nla_total_size(sizeof(u_int32_t))	/* ifindex */
-diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
-index 3ceeffc..7c3646c 100644
---- a/net/netfilter/nfnetlink_queue.c
-+++ b/net/netfilter/nfnetlink_queue.c
-@@ -353,7 +353,7 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
- 
- 	QDEBUG("entered\n");
- 
--	size =    NLMSG_ALIGN(sizeof(struct nfgenmsg))
-+	size =    NLMSG_SPACE(sizeof(struct nfgenmsg))
- 		+ nla_total_size(sizeof(struct nfqnl_msg_packet_hdr))
- 		+ nla_total_size(sizeof(u_int32_t))	/* ifindex */
- 		+ nla_total_size(sizeof(u_int32_t))	/* ifindex */
-@@ -616,8 +616,8 @@ err_out_put:
- static int
- nfqnl_mangle(void *data, int data_len, struct nfqnl_queue_entry *e)
- {
-+	struct sk_buff *nskb;
- 	int diff;
--	int err;
- 
- 	diff = data_len - e->skb->len;
- 	if (diff < 0) {
-@@ -627,14 +627,16 @@ nfqnl_mangle(void *data, int data_len, struct nfqnl_queue_entry *e)
- 		if (data_len > 0xFFFF)
- 			return -EINVAL;
- 		if (diff > skb_tailroom(e->skb)) {
--			err = pskb_expand_head(e->skb, 0,
-+			nskb = skb_copy_expand(e->skb, 0,
- 					       diff - skb_tailroom(e->skb),
- 					       GFP_ATOMIC);
--			if (err) {
-+			if (!nskb) {
- 				printk(KERN_WARNING "nf_queue: OOM "
- 				      "in mangle, dropping packet\n");
--				return err;
-+				return -ENOMEM;
- 			}
-+			kfree_skb(e->skb);
-+			e->skb = nskb;
- 		}
- 		skb_put(e->skb, diff);
- 	}
-diff --git a/net/netfilter/xt_time.c b/net/netfilter/xt_time.c
-index f9c55dc..5222a97 100644
---- a/net/netfilter/xt_time.c
-+++ b/net/netfilter/xt_time.c
-@@ -95,8 +95,11 @@ static inline void localtime_2(struct xtm *r, time_t time)
- 	 */
- 	r->dse = time / 86400;
- 
--	/* 1970-01-01 (w=0) was a Thursday (4). */
--	r->weekday = (4 + r->dse) % 7;
-+	/*
-+	 * 1970-01-01 (w=0) was a Thursday (4).
-+	 * -1 and +1 map Sunday properly onto 7.
-+	 */
-+	r->weekday = (4 + r->dse - 1) % 7 + 1;
- }
- 
- static void localtime_3(struct xtm *r, time_t time)
-diff --git a/security/commoncap.c b/security/commoncap.c
-index ea61bc7..e87422e 100644
---- a/security/commoncap.c
-+++ b/security/commoncap.c
-@@ -539,7 +539,7 @@ int cap_task_kill(struct task_struct *p, struct siginfo *info,
- 	 * allowed.
- 	 * We must preserve legacy signal behavior in this case.
- 	 */
--	if (p->euid == 0 && p->uid == current->uid)
-+	if (p->uid == current->uid)
- 		return 0;
- 
- 	/* sigcont is permitted within same session */

Copied: genpatches-2.6/trunk/2.6.24/1003_linux-2.6.24.4.patch (from rev 1291, genpatches-2.6/trunk/2.6.24/1003-linux-2.6.24.4.patch)
===================================================================
--- genpatches-2.6/trunk/2.6.24/1003_linux-2.6.24.4.patch	                        (rev 0)
+++ genpatches-2.6/trunk/2.6.24/1003_linux-2.6.24.4.patch	2008-04-19 09:58:26 UTC (rev 1296)
@@ -0,0 +1,3643 @@
+diff --git a/arch/arm/mach-pxa/clock.c b/arch/arm/mach-pxa/clock.c
+index 83ef5ec..df5ae27 100644
+--- a/arch/arm/mach-pxa/clock.c
++++ b/arch/arm/mach-pxa/clock.c
+@@ -23,18 +23,27 @@ static LIST_HEAD(clocks);
+ static DEFINE_MUTEX(clocks_mutex);
+ static DEFINE_SPINLOCK(clocks_lock);
+ 
++static struct clk *clk_lookup(struct device *dev, const char *id)
++{
++	struct clk *p;
++
++	list_for_each_entry(p, &clocks, node)
++		if (strcmp(id, p->name) == 0 && p->dev == dev)
++			return p;
++
++	return NULL;
++}
++
+ struct clk *clk_get(struct device *dev, const char *id)
+ {
+ 	struct clk *p, *clk = ERR_PTR(-ENOENT);
+ 
+ 	mutex_lock(&clocks_mutex);
+-	list_for_each_entry(p, &clocks, node) {
+-		if (strcmp(id, p->name) == 0 &&
+-		    (p->dev == NULL || p->dev == dev)) {
+-			clk = p;
+-			break;
+-		}
+-	}
++	p = clk_lookup(dev, id);
++	if (!p)
++		p = clk_lookup(NULL, id);
++	if (p)
++		clk = p;
+ 	mutex_unlock(&clocks_mutex);
+ 
+ 	return clk;
+diff --git a/arch/mips/kernel/i8259.c b/arch/mips/kernel/i8259.c
+index 4710135..9158dd8 100644
+--- a/arch/mips/kernel/i8259.c
++++ b/arch/mips/kernel/i8259.c
+@@ -338,8 +338,10 @@ void __init init_i8259_irqs(void)
+ 
+ 	init_8259A(0);
+ 
+-	for (i = I8259A_IRQ_BASE; i < I8259A_IRQ_BASE + 16; i++)
++	for (i = I8259A_IRQ_BASE; i < I8259A_IRQ_BASE + 16; i++) {
+ 		set_irq_chip_and_handler(i, &i8259A_chip, handle_level_irq);
++		set_irq_probe(i);
++	}
+ 
+ 	setup_irq(I8259A_IRQ_BASE + PIC_CASCADE_IR, &irq2);
+ }
+diff --git a/arch/mips/kernel/irq.c b/arch/mips/kernel/irq.c
+index d06e9c9..e3309ff 100644
+--- a/arch/mips/kernel/irq.c
++++ b/arch/mips/kernel/irq.c
+@@ -145,6 +145,11 @@ __setup("nokgdb", nokgdb);
+ 
+ void __init init_IRQ(void)
+ {
++	int i;
++
++	for (i = 0; i < NR_IRQS; i++)
++		set_irq_noprobe(i);
++
+ 	arch_init_irq();
+ 
+ #ifdef CONFIG_KGDB
+diff --git a/arch/s390/lib/uaccess_pt.c b/arch/s390/lib/uaccess_pt.c
+index 7e8efaa..5efdfe9 100644
+--- a/arch/s390/lib/uaccess_pt.c
++++ b/arch/s390/lib/uaccess_pt.c
+@@ -406,6 +406,8 @@ int futex_atomic_cmpxchg_pt(int __user *uaddr, int oldval, int newval)
+ {
+ 	int ret;
+ 
++	if (!current->mm)
++		return -EFAULT;
+ 	spin_lock(&current->mm->page_table_lock);
+ 	uaddr = (int __user *) __dat_user_addr((unsigned long) uaddr);
+ 	if (!uaddr) {
+diff --git a/arch/sparc/kernel/Makefile b/arch/sparc/kernel/Makefile
+index e795f28..bf1b15d 100644
+--- a/arch/sparc/kernel/Makefile
++++ b/arch/sparc/kernel/Makefile
+@@ -1,4 +1,4 @@
+-# $Id: Makefile,v 1.62 2000/12/15 00:41:17 davem Exp $
++#
+ # Makefile for the linux kernel.
+ #
+ 
+@@ -12,7 +12,8 @@ obj-y    := entry.o wof.o wuf.o etrap.o rtrap.o traps.o $(IRQ_OBJS) \
+ 	    sys_sparc.o sunos_asm.o systbls.o \
+ 	    time.o windows.o cpu.o devices.o sclow.o \
+ 	    tadpole.o tick14.o ptrace.o sys_solaris.o \
+-	    unaligned.o muldiv.o semaphore.o prom.o of_device.o devres.o
++	    unaligned.o una_asm.o muldiv.o semaphore.o \
++	    prom.o of_device.o devres.o
+ 
+ devres-y = ../../../kernel/irq/devres.o
+ 
+diff --git a/arch/sparc/kernel/una_asm.S b/arch/sparc/kernel/una_asm.S
+new file mode 100644
+index 0000000..8cc0345
+--- /dev/null
++++ b/arch/sparc/kernel/una_asm.S
+@@ -0,0 +1,153 @@
++/* una_asm.S: Kernel unaligned trap assembler helpers.
++ *
++ * Copyright (C) 1996,2005,2008 David S. Miller (davem@×××××××××.net)
++ * Copyright (C) 1996,1997 Jakub Jelinek (jj@××××××××××××××××.cz)
++ */
++
++#include <linux/errno.h>
++
++	.text
++
++retl_efault:
++	retl
++	 mov	-EFAULT, %o0
++
++	/* int __do_int_store(unsigned long *dst_addr, int size,
++	 *                    unsigned long *src_val)
++	 *
++	 * %o0 = dest_addr
++	 * %o1 = size
++	 * %o2 = src_val
++	 *
++	 * Return '0' on success, -EFAULT on failure.
++	 */
++	.globl	__do_int_store
++__do_int_store:
++	ld	[%o2], %g1
++	cmp	%1, 2
++	be	2f
++	 cmp	%1, 4
++	be	1f
++	 srl	%g1, 24, %g2
++	srl	%g1, 16, %g7
++4:	stb	%g2, [%o0]
++	srl	%g1, 8, %g2
++5:	stb	%g7, [%o0 + 1]
++	ld	[%o2 + 4], %g7
++6:	stb	%g2, [%o0 + 2]
++	srl	%g7, 24, %g2
++7:	stb	%g1, [%o0 + 3]
++	srl	%g7, 16, %g1
++8:	stb	%g2, [%o0 + 4]
++	srl	%g7, 8, %g2
++9:	stb	%g1, [%o0 + 5]
++10:	stb	%g2, [%o0 + 6]
++	b	0f
++11:	 stb	%g7, [%o0 + 7]
++1:	srl	%g1, 16, %g7
++12:	stb	%g2, [%o0]
++	srl	%g1, 8, %g2
++13:	stb	%g7, [%o0 + 1]
++14:	stb	%g2, [%o0 + 2]
++	b	0f
++15:	 stb	%g1, [%o0 + 3]
++2:	srl	%g1, 8, %g2
++16:	stb	%g2, [%o0]
++17:	stb	%g1, [%o0 + 1]
++0:	retl
++	 mov	0, %o0
++
++	.section __ex_table,#alloc
++	.word	4b, retl_efault
++	.word	5b, retl_efault
++	.word	6b, retl_efault
++	.word	7b, retl_efault
++	.word	8b, retl_efault
++	.word	9b, retl_efault
++	.word	10b, retl_efault
++	.word	11b, retl_efault
++	.word	12b, retl_efault
++	.word	13b, retl_efault
++	.word	14b, retl_efault
++	.word	15b, retl_efault
++	.word	16b, retl_efault
++	.word	17b, retl_efault
++	.previous
++
++	/* int do_int_load(unsigned long *dest_reg, int size,
++	 *                 unsigned long *saddr, int is_signed)
++	 *
++	 * %o0 = dest_reg
++	 * %o1 = size
++	 * %o2 = saddr
++	 * %o3 = is_signed
++	 *
++	 * Return '0' on success, -EFAULT on failure.
++	 */
++	.globl	do_int_load
++do_int_load:
++	cmp	%o1, 8
++	be	9f
++	 cmp	%o1, 4
++	be	6f
++4:	 ldub	[%o2], %g1
++5:	ldub	[%o2 + 1], %g2
++	sll	%g1, 8, %g1
++	tst	%o3
++	be	3f
++	 or	%g1, %g2, %g1
++	sll	%g1, 16, %g1
++	sra	%g1, 16, %g1
++3:	b	0f
++	 st	%g1, [%o0]
++6:	ldub	[%o2 + 1], %g2
++	sll	%g1, 24, %g1
++7:	ldub	[%o2 + 2], %g7
++	sll	%g2, 16, %g2
++8:	ldub	[%o2 + 3], %g3
++	sll	%g7, 8, %g7
++	or	%g3, %g2, %g3
++	or	%g7, %g3, %g7
++	or	%g1, %g7, %g1
++	b	0f
++	 st	%g1, [%o0]
++9:	ldub	[%o2], %g1
++10:	ldub	[%o2 + 1], %g2
++	sll	%g1, 24, %g1
++11:	ldub	[%o2 + 2], %g7
++	sll	%g2, 16, %g2
++12:	ldub	[%o2 + 3], %g3
++	sll	%g7, 8, %g7
++	or	%g1, %g2, %g1
++	or	%g7, %g3, %g7
++	or	%g1, %g7, %g7
++13:	ldub	[%o2 + 4], %g1
++	st	%g7, [%o0]
++14:	ldub	[%o2 + 5], %g2
++	sll	%g1, 24, %g1
++15:	ldub	[%o2 + 6], %g7
++	sll	%g2, 16, %g2
++16:	ldub	[%o2 + 7], %g3
++	sll	%g7, 8, %g7
++	or	%g1, %g2, %g1
++	or	%g7, %g3, %g7
++	or	%g1, %g7, %g7
++	st	%g7, [%o0 + 4]
++0:	retl
++	 mov	0, %o0
++
++	.section __ex_table,#alloc
++	.word	4b, retl_efault
++	.word	5b, retl_efault
++	.word	6b, retl_efault
++	.word	7b, retl_efault
++	.word	8b, retl_efault
++	.word	9b, retl_efault
++	.word	10b, retl_efault
++	.word	11b, retl_efault
++	.word	12b, retl_efault
++	.word	13b, retl_efault
++	.word	14b, retl_efault
++	.word	15b, retl_efault
++	.word	16b, retl_efault
++	.previous
+diff --git a/arch/sparc/kernel/unaligned.c b/arch/sparc/kernel/unaligned.c
+index a6330fb..33857be 100644
+--- a/arch/sparc/kernel/unaligned.c
++++ b/arch/sparc/kernel/unaligned.c
+@@ -175,157 +175,31 @@ static void unaligned_panic(char *str)
+ 	panic(str);
+ }
+ 
+-#define do_integer_load(dest_reg, size, saddr, is_signed, errh) ({		\
+-__asm__ __volatile__ (								\
+-	"cmp	%1, 8\n\t"							\
+-	"be	9f\n\t"								\
+-	" cmp	%1, 4\n\t"							\
+-	"be	6f\n"								\
+-"4:\t"	" ldub	[%2], %%l1\n"							\
+-"5:\t"	"ldub	[%2 + 1], %%l2\n\t"						\
+-	"sll	%%l1, 8, %%l1\n\t"						\
+-	"tst	%3\n\t"								\
+-	"be	3f\n\t"								\
+-	" add	%%l1, %%l2, %%l1\n\t"						\
+-	"sll	%%l1, 16, %%l1\n\t"						\
+-	"sra	%%l1, 16, %%l1\n"						\
+-"3:\t"	"b	0f\n\t"								\
+-	" st	%%l1, [%0]\n"							\
+-"6:\t"	"ldub	[%2 + 1], %%l2\n\t"						\
+-	"sll	%%l1, 24, %%l1\n"						\
+-"7:\t"	"ldub	[%2 + 2], %%g7\n\t"						\
+-	"sll	%%l2, 16, %%l2\n"						\
+-"8:\t"	"ldub	[%2 + 3], %%g1\n\t"						\
+-	"sll	%%g7, 8, %%g7\n\t"						\
+-	"or	%%l1, %%l2, %%l1\n\t"						\
+-	"or	%%g7, %%g1, %%g7\n\t"						\
+-	"or	%%l1, %%g7, %%l1\n\t"						\
+-	"b	0f\n\t"								\
+-	" st	%%l1, [%0]\n"							\
+-"9:\t"	"ldub	[%2], %%l1\n"							\
+-"10:\t"	"ldub	[%2 + 1], %%l2\n\t"						\
+-	"sll	%%l1, 24, %%l1\n"						\
+-"11:\t"	"ldub	[%2 + 2], %%g7\n\t"						\
+-	"sll	%%l2, 16, %%l2\n"						\
+-"12:\t"	"ldub	[%2 + 3], %%g1\n\t"						\
+-	"sll	%%g7, 8, %%g7\n\t"						\
+-	"or	%%l1, %%l2, %%l1\n\t"						\
+-	"or	%%g7, %%g1, %%g7\n\t"						\
+-	"or	%%l1, %%g7, %%g7\n"						\
+-"13:\t"	"ldub	[%2 + 4], %%l1\n\t"						\
+-	"st	%%g7, [%0]\n"							\
+-"14:\t"	"ldub	[%2 + 5], %%l2\n\t"						\
+-	"sll	%%l1, 24, %%l1\n"						\
+-"15:\t"	"ldub	[%2 + 6], %%g7\n\t"						\
+-	"sll	%%l2, 16, %%l2\n"						\
+-"16:\t"	"ldub	[%2 + 7], %%g1\n\t"						\
+-	"sll	%%g7, 8, %%g7\n\t"						\
+-	"or	%%l1, %%l2, %%l1\n\t"						\
+-	"or	%%g7, %%g1, %%g7\n\t"						\
+-	"or	%%l1, %%g7, %%g7\n\t"						\
+-	"st	%%g7, [%0 + 4]\n"						\
+-"0:\n\n\t"									\
+-	".section __ex_table,#alloc\n\t"					\
+-	".word	4b, " #errh "\n\t"						\
+-	".word	5b, " #errh "\n\t"						\
+-	".word	6b, " #errh "\n\t"						\
+-	".word	7b, " #errh "\n\t"						\
+-	".word	8b, " #errh "\n\t"						\
+-	".word	9b, " #errh "\n\t"						\
+-	".word	10b, " #errh "\n\t"						\
+-	".word	11b, " #errh "\n\t"						\
+-	".word	12b, " #errh "\n\t"						\
+-	".word	13b, " #errh "\n\t"						\
+-	".word	14b, " #errh "\n\t"						\
+-	".word	15b, " #errh "\n\t"						\
+-	".word	16b, " #errh "\n\n\t"						\
+-	".previous\n\t"								\
+-	: : "r" (dest_reg), "r" (size), "r" (saddr), "r" (is_signed)		\
+-	: "l1", "l2", "g7", "g1", "cc");					\
+-})
+-	
+-#define store_common(dst_addr, size, src_val, errh) ({				\
+-__asm__ __volatile__ (								\
+-	"ld	[%2], %%l1\n"							\
+-	"cmp	%1, 2\n\t"							\
+-	"be	2f\n\t"								\
+-	" cmp	%1, 4\n\t"							\
+-	"be	1f\n\t"								\
+-	" srl	%%l1, 24, %%l2\n\t"						\
+-	"srl	%%l1, 16, %%g7\n"						\
+-"4:\t"	"stb	%%l2, [%0]\n\t"							\
+-	"srl	%%l1, 8, %%l2\n"						\
+-"5:\t"	"stb	%%g7, [%0 + 1]\n\t"						\
+-	"ld	[%2 + 4], %%g7\n"						\
+-"6:\t"	"stb	%%l2, [%0 + 2]\n\t"						\
+-	"srl	%%g7, 24, %%l2\n"						\
+-"7:\t"	"stb	%%l1, [%0 + 3]\n\t"						\
+-	"srl	%%g7, 16, %%l1\n"						\
+-"8:\t"	"stb	%%l2, [%0 + 4]\n\t"						\
+-	"srl	%%g7, 8, %%l2\n"						\
+-"9:\t"	"stb	%%l1, [%0 + 5]\n"						\
+-"10:\t"	"stb	%%l2, [%0 + 6]\n\t"						\
+-	"b	0f\n"								\
+-"11:\t"	" stb	%%g7, [%0 + 7]\n"						\
+-"1:\t"	"srl	%%l1, 16, %%g7\n"						\
+-"12:\t"	"stb	%%l2, [%0]\n\t"							\
+-	"srl	%%l1, 8, %%l2\n"						\
+-"13:\t"	"stb	%%g7, [%0 + 1]\n"						\
+-"14:\t"	"stb	%%l2, [%0 + 2]\n\t"						\
+-	"b	0f\n"								\
+-"15:\t"	" stb	%%l1, [%0 + 3]\n"						\
+-"2:\t"	"srl	%%l1, 8, %%l2\n"						\
+-"16:\t"	"stb	%%l2, [%0]\n"							\
+-"17:\t"	"stb	%%l1, [%0 + 1]\n"						\
+-"0:\n\n\t"									\
+-	".section __ex_table,#alloc\n\t"					\
+-	".word	4b, " #errh "\n\t"						\
+-	".word	5b, " #errh "\n\t"						\
+-	".word	6b, " #errh "\n\t"						\
+-	".word	7b, " #errh "\n\t"						\
+-	".word	8b, " #errh "\n\t"						\
+-	".word	9b, " #errh "\n\t"						\
+-	".word	10b, " #errh "\n\t"						\
+-	".word	11b, " #errh "\n\t"						\
+-	".word	12b, " #errh "\n\t"						\
+-	".word	13b, " #errh "\n\t"						\
+-	".word	14b, " #errh "\n\t"						\
+-	".word	15b, " #errh "\n\t"						\
+-	".word	16b, " #errh "\n\t"						\
+-	".word	17b, " #errh "\n\n\t"						\
+-	".previous\n\t"								\
+-	: : "r" (dst_addr), "r" (size), "r" (src_val)				\
+-	: "l1", "l2", "g7", "g1", "cc");					\
+-})
+-
+-#define do_integer_store(reg_num, size, dst_addr, regs, errh) ({		\
+-	unsigned long *src_val;							\
+-	static unsigned long zero[2] = { 0, };					\
+-										\
+-	if (reg_num) src_val = fetch_reg_addr(reg_num, regs);			\
+-	else {									\
+-		src_val = &zero[0];						\
+-		if (size == 8)							\
+-			zero[1] = fetch_reg(1, regs);				\
+-	}									\
+-	store_common(dst_addr, size, src_val, errh);				\
+-})
++/* una_asm.S */
++extern int do_int_load(unsigned long *dest_reg, int size,
++		       unsigned long *saddr, int is_signed);
++extern int __do_int_store(unsigned long *dst_addr, int size,
++			  unsigned long *src_val);
++
++static int do_int_store(int reg_num, int size, unsigned long *dst_addr,
++			struct pt_regs *regs)
++{
++	unsigned long zero[2] = { 0, 0 };
++	unsigned long *src_val;
++
++	if (reg_num)
++		src_val = fetch_reg_addr(reg_num, regs);
++	else {
++		src_val = &zero[0];
++		if (size == 8)
++			zero[1] = fetch_reg(1, regs);
++	}
++	return __do_int_store(dst_addr, size, src_val);
++}
+ 
+ extern void smp_capture(void);
+ extern void smp_release(void);
+ 
+-#define do_atomic(srcdest_reg, mem, errh) ({					\
+-	unsigned long flags, tmp;						\
+-										\
+-	smp_capture();								\
+-	local_irq_save(flags);							\
+-	tmp = *srcdest_reg;							\
+-	do_integer_load(srcdest_reg, 4, mem, 0, errh);				\
+-	store_common(mem, 4, &tmp, errh);					\
+-	local_irq_restore(flags);						\
+-	smp_release();								\
+-})
+-
+ static inline void advance(struct pt_regs *regs)
+ {
+ 	regs->pc   = regs->npc;
+@@ -342,9 +216,7 @@ static inline int ok_for_kernel(unsigned int insn)
+ 	return !floating_point_load_or_store_p(insn);
+ }
+ 
+-void kernel_mna_trap_fault(struct pt_regs *regs, unsigned int insn) __asm__ ("kernel_mna_trap_fault");
+-
+-void kernel_mna_trap_fault(struct pt_regs *regs, unsigned int insn)
++static void kernel_mna_trap_fault(struct pt_regs *regs, unsigned int insn)
+ {
+ 	unsigned long g2 = regs->u_regs [UREG_G2];
+ 	unsigned long fixup = search_extables_range(regs->pc, &g2);
+@@ -379,48 +251,34 @@ asmlinkage void kernel_unaligned_trap(struct pt_regs *regs, unsigned int insn)
+ 		printk("Unsupported unaligned load/store trap for kernel at <%08lx>.\n",
+ 		       regs->pc);
+ 		unaligned_panic("Wheee. Kernel does fpu/atomic unaligned load/store.");
+-
+-		__asm__ __volatile__ ("\n"
+-"kernel_unaligned_trap_fault:\n\t"
+-		"mov	%0, %%o0\n\t"
+-		"call	kernel_mna_trap_fault\n\t"
+-		" mov	%1, %%o1\n\t"
+-		:
+-		: "r" (regs), "r" (insn)
+-		: "o0", "o1", "o2", "o3", "o4", "o5", "o7",
+-		  "g1", "g2", "g3", "g4", "g5", "g7", "cc");
+ 	} else {
+ 		unsigned long addr = compute_effective_address(regs, insn);
++		int err;
+ 
+ #ifdef DEBUG_MNA
+ 		printk("KMNA: pc=%08lx [dir=%s addr=%08lx size=%d] retpc[%08lx]\n",
+ 		       regs->pc, dirstrings[dir], addr, size, regs->u_regs[UREG_RETPC]);
+ #endif
+-		switch(dir) {
++		switch (dir) {
+ 		case load:
+-			do_integer_load(fetch_reg_addr(((insn>>25)&0x1f), regs),
+-					size, (unsigned long *) addr,
+-					decode_signedness(insn),
+-					kernel_unaligned_trap_fault);
++			err = do_int_load(fetch_reg_addr(((insn>>25)&0x1f),
++							 regs),
++					  size, (unsigned long *) addr,
++					  decode_signedness(insn));
+ 			break;
+ 
+ 		case store:
+-			do_integer_store(((insn>>25)&0x1f), size,
+-					 (unsigned long *) addr, regs,
+-					 kernel_unaligned_trap_fault);
++			err = do_int_store(((insn>>25)&0x1f), size,
++					   (unsigned long *) addr, regs);
+ 			break;
+-#if 0 /* unsupported */
+-		case both:
+-			do_atomic(fetch_reg_addr(((insn>>25)&0x1f), regs),
+-				  (unsigned long *) addr,
+-				  kernel_unaligned_trap_fault);
+-			break;
+-#endif
+ 		default:
+ 			panic("Impossible kernel unaligned trap.");
+ 			/* Not reached... */
+ 		}
+-		advance(regs);
++		if (err)
++			kernel_mna_trap_fault(regs, insn);
++		else
++			advance(regs);
+ 	}
+ }
+ 
+@@ -459,9 +317,7 @@ static inline int ok_for_user(struct pt_regs *regs, unsigned int insn,
+ 	return 0;
+ }
+ 
+-void user_mna_trap_fault(struct pt_regs *regs, unsigned int insn) __asm__ ("user_mna_trap_fault");
+-
+-void user_mna_trap_fault(struct pt_regs *regs, unsigned int insn)
++static void user_mna_trap_fault(struct pt_regs *regs, unsigned int insn)
+ {
+ 	siginfo_t info;
+ 
+@@ -485,7 +341,7 @@ asmlinkage void user_unaligned_trap(struct pt_regs *regs, unsigned int insn)
+ 	if(!ok_for_user(regs, insn, dir)) {
+ 		goto kill_user;
+ 	} else {
+-		int size = decode_access_size(insn);
++		int err, size = decode_access_size(insn);
+ 		unsigned long addr;
+ 
+ 		if(floating_point_load_or_store_p(insn)) {
+@@ -496,48 +352,34 @@ asmlinkage void user_unaligned_trap(struct pt_regs *regs, unsigned int insn)
+ 		addr = compute_effective_address(regs, insn);
+ 		switch(dir) {
+ 		case load:
+-			do_integer_load(fetch_reg_addr(((insn>>25)&0x1f), regs),
+-					size, (unsigned long *) addr,
+-					decode_signedness(insn),
+-					user_unaligned_trap_fault);
++			err = do_int_load(fetch_reg_addr(((insn>>25)&0x1f),
++							 regs),
++					  size, (unsigned long *) addr,
++					  decode_signedness(insn));
+ 			break;
+ 
+ 		case store:
+-			do_integer_store(((insn>>25)&0x1f), size,
+-					 (unsigned long *) addr, regs,
+-					 user_unaligned_trap_fault);
++			err = do_int_store(((insn>>25)&0x1f), size,
++					   (unsigned long *) addr, regs);
+ 			break;
+ 
+ 		case both:
+-#if 0 /* unsupported */
+-			do_atomic(fetch_reg_addr(((insn>>25)&0x1f), regs),
+-				  (unsigned long *) addr,
+-				  user_unaligned_trap_fault);
+-#else
+ 			/*
+ 			 * This was supported in 2.4. However, we question
+ 			 * the value of SWAP instruction across word boundaries.
+ 			 */
+ 			printk("Unaligned SWAP unsupported.\n");
+-			goto kill_user;
+-#endif
++			err = -EFAULT;
+ 			break;
+ 
+ 		default:
+ 			unaligned_panic("Impossible user unaligned trap.");
+-
+-			__asm__ __volatile__ ("\n"
+-"user_unaligned_trap_fault:\n\t"
+-			"mov	%0, %%o0\n\t"
+-			"call	user_mna_trap_fault\n\t"
+-			" mov	%1, %%o1\n\t"
+-			:
+-			: "r" (regs), "r" (insn)
+-			: "o0", "o1", "o2", "o3", "o4", "o5", "o7",
+-			  "g1", "g2", "g3", "g4", "g5", "g7", "cc");
+ 			goto out;
+ 		}
+-		advance(regs);
++		if (err)
++			goto kill_user;
++		else
++			advance(regs);
+ 		goto out;
+ 	}
+ 
+diff --git a/arch/sparc64/mm/fault.c b/arch/sparc64/mm/fault.c
+index e2027f2..2650d0d 100644
+--- a/arch/sparc64/mm/fault.c
++++ b/arch/sparc64/mm/fault.c
+@@ -244,16 +244,8 @@ static void do_kernel_fault(struct pt_regs *regs, int si_code, int fault_code,
+ 	if (regs->tstate & TSTATE_PRIV) {
+ 		const struct exception_table_entry *entry;
+ 
+-		if (asi == ASI_P && (insn & 0xc0800000) == 0xc0800000) {
+-			if (insn & 0x2000)
+-				asi = (regs->tstate >> 24);
+-			else
+-				asi = (insn >> 5);
+-		}
+-	
+-		/* Look in asi.h: All _S asis have LS bit set */
+-		if ((asi & 0x1) &&
+-		    (entry = search_exception_tables(regs->tpc))) {
++		entry = search_exception_tables(regs->tpc);
++		if (entry) {
+ 			regs->tpc = entry->fixup;
+ 			regs->tnpc = regs->tpc + 4;
+ 			return;
+@@ -294,7 +286,7 @@ asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
+ 		unsigned long tpc = regs->tpc;
+ 
+ 		/* Sanity check the PC. */
+-		if ((tpc >= KERNBASE && tpc < (unsigned long) _etext) ||
++		if ((tpc >= KERNBASE && tpc < (unsigned long) __init_end) ||
+ 		    (tpc >= MODULES_VADDR && tpc < MODULES_END)) {
+ 			/* Valid, no problems... */
+ 		} else {
+diff --git a/arch/x86/ia32/ia32_signal.c b/arch/x86/ia32/ia32_signal.c
+index 6ea19c2..4eaaf78 100644
+--- a/arch/x86/ia32/ia32_signal.c
++++ b/arch/x86/ia32/ia32_signal.c
+@@ -494,7 +494,7 @@ int ia32_setup_frame(int sig, struct k_sigaction *ka,
+ 	regs->ss = __USER32_DS; 
+ 
+ 	set_fs(USER_DS);
+-	regs->eflags &= ~TF_MASK;
++	regs->eflags &= ~(TF_MASK | X86_EFLAGS_DF);
+ 	if (test_thread_flag(TIF_SINGLESTEP))
+ 		ptrace_notify(SIGTRAP);
+ 
+@@ -600,7 +600,7 @@ int ia32_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
+ 	regs->ss = __USER32_DS; 
+ 
+ 	set_fs(USER_DS);
+-	regs->eflags &= ~TF_MASK;
++	regs->eflags &= ~(TF_MASK | X86_EFLAGS_DF);
+ 	if (test_thread_flag(TIF_SINGLESTEP))
+ 		ptrace_notify(SIGTRAP);
+ 
+diff --git a/arch/x86/kernel/apic_32.c b/arch/x86/kernel/apic_32.c
+index edb5108..c48fbb1 100644
+--- a/arch/x86/kernel/apic_32.c
++++ b/arch/x86/kernel/apic_32.c
+@@ -154,7 +154,7 @@ unsigned long safe_apic_wait_icr_idle(void)
+ /**
+  * enable_NMI_through_LVT0 - enable NMI through local vector table 0
+  */
+-void enable_NMI_through_LVT0 (void * dummy)
++void __cpuinit enable_NMI_through_LVT0(void)
+ {
+ 	unsigned int v = APIC_DM_NMI;
+ 
+diff --git a/arch/x86/kernel/apic_64.c b/arch/x86/kernel/apic_64.c
+index f28ccb5..0173007 100644
+--- a/arch/x86/kernel/apic_64.c
++++ b/arch/x86/kernel/apic_64.c
+@@ -151,7 +151,7 @@ unsigned int safe_apic_wait_icr_idle(void)
+ 	return send_status;
+ }
+ 
+-void enable_NMI_through_LVT0 (void * dummy)
++void enable_NMI_through_LVT0(void)
+ {
+ 	unsigned int v;
+ 
+diff --git a/arch/x86/kernel/io_apic_32.c b/arch/x86/kernel/io_apic_32.c
+index a6b1490..232fdeb 100644
+--- a/arch/x86/kernel/io_apic_32.c
++++ b/arch/x86/kernel/io_apic_32.c
+@@ -2080,7 +2080,7 @@ static struct irq_chip lapic_chip __read_mostly = {
+ 	.eoi		= ack_apic,
+ };
+ 
+-static void setup_nmi (void)
++static void __init setup_nmi(void)
+ {
+ 	/*
+  	 * Dirty trick to enable the NMI watchdog ...
+@@ -2093,7 +2093,7 @@ static void setup_nmi (void)
+ 	 */ 
+ 	apic_printk(APIC_VERBOSE, KERN_INFO "activating NMI Watchdog ...");
+ 
+-	on_each_cpu(enable_NMI_through_LVT0, NULL, 1, 1);
++	enable_NMI_through_LVT0();
+ 
+ 	apic_printk(APIC_VERBOSE, " done.\n");
+ }
+diff --git a/arch/x86/kernel/io_apic_64.c b/arch/x86/kernel/io_apic_64.c
+index cbac167..7119cb7 100644
+--- a/arch/x86/kernel/io_apic_64.c
++++ b/arch/x86/kernel/io_apic_64.c
+@@ -1565,7 +1565,7 @@ static struct hw_interrupt_type lapic_irq_type __read_mostly = {
+ 	.end = end_lapic_irq,
+ };
+ 
+-static void setup_nmi (void)
++static void __init setup_nmi(void)
+ {
+ 	/*
+  	 * Dirty trick to enable the NMI watchdog ...
+@@ -1578,7 +1578,7 @@ static void setup_nmi (void)
+ 	 */ 
+ 	printk(KERN_INFO "activating NMI Watchdog ...");
+ 
+-	enable_NMI_through_LVT0(NULL);
++	enable_NMI_through_LVT0();
+ 
+ 	printk(" done.\n");
+ }
+@@ -1654,7 +1654,7 @@ static inline void unlock_ExtINT_logic(void)
+  *
+  * FIXME: really need to revamp this for modern platforms only.
+  */
+-static inline void check_timer(void)
++static inline void __init check_timer(void)
+ {
+ 	struct irq_cfg *cfg = irq_cfg + 0;
+ 	int apic1, pin1, apic2, pin2;
+diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
+index ab79e1d..d7f7132 100644
+--- a/arch/x86/kernel/process_64.c
++++ b/arch/x86/kernel/process_64.c
+@@ -212,14 +212,13 @@ void cpu_idle (void)
+ 	current_thread_info()->status |= TS_POLLING;
+ 	/* endless idle loop with no priority at all */
+ 	while (1) {
++		tick_nohz_stop_sched_tick();
+ 		while (!need_resched()) {
+ 			void (*idle)(void);
+ 
+ 			if (__get_cpu_var(cpu_idle_state))
+ 				__get_cpu_var(cpu_idle_state) = 0;
+ 
+-			tick_nohz_stop_sched_tick();
+-
+ 			rmb();
+ 			idle = pm_idle;
+ 			if (!idle)
+diff --git a/arch/x86/kernel/signal_32.c b/arch/x86/kernel/signal_32.c
+index 9bdd830..20056db 100644
+--- a/arch/x86/kernel/signal_32.c
++++ b/arch/x86/kernel/signal_32.c
+@@ -396,7 +396,7 @@ static int setup_frame(int sig, struct k_sigaction *ka,
+ 	 * The tracer may want to single-step inside the
+ 	 * handler too.
+ 	 */
+-	regs->eflags &= ~TF_MASK;
++	regs->eflags &= ~(TF_MASK | X86_EFLAGS_DF);
+ 	if (test_thread_flag(TIF_SINGLESTEP))
+ 		ptrace_notify(SIGTRAP);
+ 
+@@ -489,7 +489,7 @@ static int setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
+ 	 * The tracer may want to single-step inside the
+ 	 * handler too.
+ 	 */
+-	regs->eflags &= ~TF_MASK;
++	regs->eflags &= ~(TF_MASK | X86_EFLAGS_DF);
+ 	if (test_thread_flag(TIF_SINGLESTEP))
+ 		ptrace_notify(SIGTRAP);
+ 
+diff --git a/arch/x86/kernel/signal_64.c b/arch/x86/kernel/signal_64.c
+index ab086b0..62964c5 100644
+--- a/arch/x86/kernel/signal_64.c
++++ b/arch/x86/kernel/signal_64.c
+@@ -295,7 +295,7 @@ static int setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
+ 	   see include/asm-x86_64/uaccess.h for details. */
+ 	set_fs(USER_DS);
+ 
+-	regs->eflags &= ~TF_MASK;
++	regs->eflags &= ~(TF_MASK | X86_EFLAGS_DF);
+ 	if (test_thread_flag(TIF_SINGLESTEP))
+ 		ptrace_notify(SIGTRAP);
+ #ifdef DEBUG_SIG
+diff --git a/arch/x86/kernel/smpboot_32.c b/arch/x86/kernel/smpboot_32.c
+index 4ea80cb..fe200cf 100644
+--- a/arch/x86/kernel/smpboot_32.c
++++ b/arch/x86/kernel/smpboot_32.c
+@@ -405,7 +405,7 @@ static void __cpuinit start_secondary(void *unused)
+ 	setup_secondary_clock();
+ 	if (nmi_watchdog == NMI_IO_APIC) {
+ 		disable_8259A_irq(0);
+-		enable_NMI_through_LVT0(NULL);
++		enable_NMI_through_LVT0();
+ 		enable_8259A_irq(0);
+ 	}
+ 	/*
+diff --git a/arch/x86/kernel/smpboot_64.c b/arch/x86/kernel/smpboot_64.c
+index aaf4e12..eca8026 100644
+--- a/arch/x86/kernel/smpboot_64.c
++++ b/arch/x86/kernel/smpboot_64.c
+@@ -338,7 +338,7 @@ void __cpuinit start_secondary(void)
+ 
+ 	if (nmi_watchdog == NMI_IO_APIC) {
+ 		disable_8259A_irq(0);
+-		enable_NMI_through_LVT0(NULL);
++		enable_NMI_through_LVT0();
+ 		enable_8259A_irq(0);
+ 	}
+ 
+diff --git a/arch/x86/pci/mmconfig-shared.c b/arch/x86/pci/mmconfig-shared.c
+index 4df637e..6b521d3 100644
+--- a/arch/x86/pci/mmconfig-shared.c
++++ b/arch/x86/pci/mmconfig-shared.c
+@@ -22,42 +22,9 @@
+ #define MMCONFIG_APER_MIN	(2 * 1024*1024)
+ #define MMCONFIG_APER_MAX	(256 * 1024*1024)
+ 
+-DECLARE_BITMAP(pci_mmcfg_fallback_slots, 32*PCI_MMCFG_MAX_CHECK_BUS);
+-
+ /* Indicate if the mmcfg resources have been placed into the resource table. */
+ static int __initdata pci_mmcfg_resources_inserted;
+ 
+-/* K8 systems have some devices (typically in the builtin northbridge)
+-   that are only accessible using type1
+-   Normally this can be expressed in the MCFG by not listing them
+-   and assigning suitable _SEGs, but this isn't implemented in some BIOS.
+-   Instead try to discover all devices on bus 0 that are unreachable using MM
+-   and fallback for them. */
+-static void __init unreachable_devices(void)
+-{
+-	int i, bus;
+-	/* Use the max bus number from ACPI here? */
+-	for (bus = 0; bus < PCI_MMCFG_MAX_CHECK_BUS; bus++) {
+-		for (i = 0; i < 32; i++) {
+-			unsigned int devfn = PCI_DEVFN(i, 0);
+-			u32 val1, val2;
+-
+-			pci_conf1_read(0, bus, devfn, 0, 4, &val1);
+-			if (val1 == 0xffffffff)
+-				continue;
+-
+-			if (pci_mmcfg_arch_reachable(0, bus, devfn)) {
+-				raw_pci_ops->read(0, bus, devfn, 0, 4, &val2);
+-				if (val1 == val2)
+-					continue;
+-			}
+-			set_bit(i + 32 * bus, pci_mmcfg_fallback_slots);
+-			printk(KERN_NOTICE "PCI: No mmconfig possible on device"
+-			       " %02x:%02x\n", bus, i);
+-		}
+-	}
+-}
+-
+ static const char __init *pci_mmcfg_e7520(void)
+ {
+ 	u32 win;
+@@ -270,8 +237,6 @@ void __init pci_mmcfg_init(int type)
+ 		return;
+ 
+ 	if (pci_mmcfg_arch_init()) {
+-		if (type == 1)
+-			unreachable_devices();
+ 		if (known_bridge)
+ 			pci_mmcfg_insert_resources(IORESOURCE_BUSY);
+ 		pci_probe = (pci_probe & ~PCI_PROBE_MASK) | PCI_PROBE_MMCONF;
+diff --git a/arch/x86/pci/mmconfig_32.c b/arch/x86/pci/mmconfig_32.c
+index 1bf5816..7b75e65 100644
+--- a/arch/x86/pci/mmconfig_32.c
++++ b/arch/x86/pci/mmconfig_32.c
+@@ -30,10 +30,6 @@ static u32 get_base_addr(unsigned int seg, int bus, unsigned devfn)
+ 	struct acpi_mcfg_allocation *cfg;
+ 	int cfg_num;
+ 
+-	if (seg == 0 && bus < PCI_MMCFG_MAX_CHECK_BUS &&
+-	    test_bit(PCI_SLOT(devfn) + 32*bus, pci_mmcfg_fallback_slots))
+-		return 0;
+-
+ 	for (cfg_num = 0; cfg_num < pci_mmcfg_config_num; cfg_num++) {
+ 		cfg = &pci_mmcfg_config[cfg_num];
+ 		if (cfg->pci_segment == seg &&
+@@ -68,13 +64,16 @@ static int pci_mmcfg_read(unsigned int seg, unsigned int bus,
+ 	u32 base;
+ 
+ 	if ((bus > 255) || (devfn > 255) || (reg > 4095)) {
+-		*value = -1;
++err:		*value = -1;
+ 		return -EINVAL;
+ 	}
+ 
++	if (reg < 256)
++		return pci_conf1_read(seg,bus,devfn,reg,len,value);
++
+ 	base = get_base_addr(seg, bus, devfn);
+ 	if (!base)
+-		return pci_conf1_read(seg,bus,devfn,reg,len,value);
++		goto err;
+ 
+ 	spin_lock_irqsave(&pci_config_lock, flags);
+ 
+@@ -105,9 +104,12 @@ static int pci_mmcfg_write(unsigned int seg, unsigned int bus,
+ 	if ((bus > 255) || (devfn > 255) || (reg > 4095))
+ 		return -EINVAL;
+ 
++	if (reg < 256)
++		return pci_conf1_write(seg,bus,devfn,reg,len,value);
++
+ 	base = get_base_addr(seg, bus, devfn);
+ 	if (!base)
+-		return pci_conf1_write(seg,bus,devfn,reg,len,value);
++		return -EINVAL;
+ 
+ 	spin_lock_irqsave(&pci_config_lock, flags);
+ 
+@@ -134,12 +136,6 @@ static struct pci_raw_ops pci_mmcfg = {
+ 	.write =	pci_mmcfg_write,
+ };
+ 
+-int __init pci_mmcfg_arch_reachable(unsigned int seg, unsigned int bus,
+-				    unsigned int devfn)
+-{
+-	return get_base_addr(seg, bus, devfn) != 0;
+-}
+-
+ int __init pci_mmcfg_arch_init(void)
+ {
+ 	printk(KERN_INFO "PCI: Using MMCONFIG\n");
+diff --git a/arch/x86/pci/mmconfig_64.c b/arch/x86/pci/mmconfig_64.c
+index 4095e4d..c4cf318 100644
+--- a/arch/x86/pci/mmconfig_64.c
++++ b/arch/x86/pci/mmconfig_64.c
+@@ -40,9 +40,7 @@ static char __iomem *get_virt(unsigned int seg, unsigned bus)
+ static char __iomem *pci_dev_base(unsigned int seg, unsigned int bus, unsigned int devfn)
+ {
+ 	char __iomem *addr;
+-	if (seg == 0 && bus < PCI_MMCFG_MAX_CHECK_BUS &&
+-		test_bit(32*bus + PCI_SLOT(devfn), pci_mmcfg_fallback_slots))
+-		return NULL;
++
+ 	addr = get_virt(seg, bus);
+ 	if (!addr)
+ 		return NULL;
+@@ -56,13 +54,16 @@ static int pci_mmcfg_read(unsigned int seg, unsigned int bus,
+ 
+ 	/* Why do we have this when nobody checks it. How about a BUG()!? -AK */
+ 	if (unlikely((bus > 255) || (devfn > 255) || (reg > 4095))) {
+-		*value = -1;
++err:		*value = -1;
+ 		return -EINVAL;
+ 	}
+ 
++	if (reg < 256)
++		return pci_conf1_read(seg,bus,devfn,reg,len,value);
++
+ 	addr = pci_dev_base(seg, bus, devfn);
+ 	if (!addr)
+-		return pci_conf1_read(seg,bus,devfn,reg,len,value);
++		goto err;
+ 
+ 	switch (len) {
+ 	case 1:
+@@ -88,9 +89,12 @@ static int pci_mmcfg_write(unsigned int seg, unsigned int bus,
+ 	if (unlikely((bus > 255) || (devfn > 255) || (reg > 4095)))
+ 		return -EINVAL;
+ 
++	if (reg < 256)
++		return pci_conf1_write(seg,bus,devfn,reg,len,value);
++
+ 	addr = pci_dev_base(seg, bus, devfn);
+ 	if (!addr)
+-		return pci_conf1_write(seg,bus,devfn,reg,len,value);
++		return -EINVAL;
+ 
+ 	switch (len) {
+ 	case 1:
+@@ -126,12 +130,6 @@ static void __iomem * __init mcfg_ioremap(struct acpi_mcfg_allocation *cfg)
+ 	return addr;
+ }
+ 
+-int __init pci_mmcfg_arch_reachable(unsigned int seg, unsigned int bus,
+-				    unsigned int devfn)
+-{
+-	return pci_dev_base(seg, bus, devfn) != NULL;
+-}
+-
+ int __init pci_mmcfg_arch_init(void)
+ {
+ 	int i;
+diff --git a/arch/x86/pci/pci.h b/arch/x86/pci/pci.h
+index ac56d39..36cb44c 100644
+--- a/arch/x86/pci/pci.h
++++ b/arch/x86/pci/pci.h
+@@ -98,13 +98,6 @@ extern void pcibios_sort(void);
+ 
+ /* pci-mmconfig.c */
+ 
+-/* Verify the first 16 busses. We assume that systems with more busses
+-   get MCFG right. */
+-#define PCI_MMCFG_MAX_CHECK_BUS 16
+-extern DECLARE_BITMAP(pci_mmcfg_fallback_slots, 32*PCI_MMCFG_MAX_CHECK_BUS);
+-
+-extern int __init pci_mmcfg_arch_reachable(unsigned int seg, unsigned int bus,
+-					   unsigned int devfn);
+ extern int __init pci_mmcfg_arch_init(void);
+ 
+ /*
+diff --git a/crypto/async_tx/async_xor.c b/crypto/async_tx/async_xor.c
+index 2575f67..5c579d2 100644
+--- a/crypto/async_tx/async_xor.c
++++ b/crypto/async_tx/async_xor.c
+@@ -264,7 +264,7 @@ async_xor_zero_sum(struct page *dest, struct page **src_list,
+ 
+ 	BUG_ON(src_cnt <= 1);
+ 
+-	if (tx) {
++	if (tx && src_cnt <= device->max_xor) {
+ 		dma_addr_t dma_addr;
+ 		enum dma_data_direction dir;
+ 
+diff --git a/crypto/xcbc.c b/crypto/xcbc.c
+index ac68f3b..a957373 100644
+--- a/crypto/xcbc.c
++++ b/crypto/xcbc.c
+@@ -124,6 +124,11 @@ static int crypto_xcbc_digest_update2(struct hash_desc *pdesc,
+ 		unsigned int offset = sg[i].offset;
+ 		unsigned int slen = sg[i].length;
+ 
++		if (unlikely(slen > nbytes))
++			slen = nbytes;
++
++		nbytes -= slen;
++
+ 		while (slen > 0) {
+ 			unsigned int len = min(slen, ((unsigned int)(PAGE_SIZE)) - offset);
+ 			char *p = crypto_kmap(pg, 0) + offset;
+@@ -177,7 +182,6 @@ static int crypto_xcbc_digest_update2(struct hash_desc *pdesc,
+ 			offset = 0;
+ 			pg++;
+ 		}
+-		nbytes-=sg[i].length;
+ 		i++;
+ 	} while (nbytes>0);
+ 
+diff --git a/crypto/xts.c b/crypto/xts.c
+index 8eb08bf..d87b0f3 100644
+--- a/crypto/xts.c
++++ b/crypto/xts.c
+@@ -77,16 +77,16 @@ static int setkey(struct crypto_tfm *parent, const u8 *key,
+ }
+ 
+ struct sinfo {
+-	be128 t;
++	be128 *t;
+ 	struct crypto_tfm *tfm;
+ 	void (*fn)(struct crypto_tfm *, u8 *, const u8 *);
+ };
+ 
+ static inline void xts_round(struct sinfo *s, void *dst, const void *src)
+ {
+-	be128_xor(dst, &s->t, src);		/* PP <- T xor P */
++	be128_xor(dst, s->t, src);		/* PP <- T xor P */
+ 	s->fn(s->tfm, dst, dst);		/* CC <- E(Key1,PP) */
+-	be128_xor(dst, dst, &s->t);		/* C <- T xor CC */
++	be128_xor(dst, dst, s->t);		/* C <- T xor CC */
+ }
+ 
+ static int crypt(struct blkcipher_desc *d,
+@@ -101,7 +101,6 @@ static int crypt(struct blkcipher_desc *d,
+ 		.tfm = crypto_cipher_tfm(ctx->child),
+ 		.fn = fn
+ 	};
+-	be128 *iv;
+ 	u8 *wsrc;
+ 	u8 *wdst;
+ 
+@@ -109,20 +108,20 @@ static int crypt(struct blkcipher_desc *d,
+ 	if (!w->nbytes)
+ 		return err;
+ 
++	s.t = (be128 *)w->iv;
+ 	avail = w->nbytes;
+ 
+ 	wsrc = w->src.virt.addr;
+ 	wdst = w->dst.virt.addr;
+ 
+ 	/* calculate first value of T */
+-	iv = (be128 *)w->iv;
+-	tw(crypto_cipher_tfm(ctx->tweak), (void *)&s.t, w->iv);
++	tw(crypto_cipher_tfm(ctx->tweak), w->iv, w->iv);
+ 
+ 	goto first;
+ 
+ 	for (;;) {
+ 		do {
+-			gf128mul_x_ble(&s.t, &s.t);
++			gf128mul_x_ble(s.t, s.t);
+ 
+ first:
+ 			xts_round(&s, wdst, wsrc);
+diff --git a/drivers/acorn/char/defkeymap-l7200.c b/drivers/acorn/char/defkeymap-l7200.c
+index 28a5fbc..93d80a1 100644
+--- a/drivers/acorn/char/defkeymap-l7200.c
++++ b/drivers/acorn/char/defkeymap-l7200.c
+@@ -347,40 +347,40 @@ char *func_table[MAX_NR_FUNC] = {
+ };
+ 
+ struct kbdiacruc accent_table[MAX_DIACR] = {
+-	{'`', 'A', '\300'},	{'`', 'a', '\340'},
+-	{'\'', 'A', '\301'},	{'\'', 'a', '\341'},
+-	{'^', 'A', '\302'},	{'^', 'a', '\342'},
+-	{'~', 'A', '\303'},	{'~', 'a', '\343'},
+-	{'"', 'A', '\304'},	{'"', 'a', '\344'},
+-	{'O', 'A', '\305'},	{'o', 'a', '\345'},
+-	{'0', 'A', '\305'},	{'0', 'a', '\345'},
+-	{'A', 'A', '\305'},	{'a', 'a', '\345'},
+-	{'A', 'E', '\306'},	{'a', 'e', '\346'},
+-	{',', 'C', '\307'},	{',', 'c', '\347'},
+-	{'`', 'E', '\310'},	{'`', 'e', '\350'},
+-	{'\'', 'E', '\311'},	{'\'', 'e', '\351'},
+-	{'^', 'E', '\312'},	{'^', 'e', '\352'},
+-	{'"', 'E', '\313'},	{'"', 'e', '\353'},
+-	{'`', 'I', '\314'},	{'`', 'i', '\354'},
+-	{'\'', 'I', '\315'},	{'\'', 'i', '\355'},
+-	{'^', 'I', '\316'},	{'^', 'i', '\356'},
+-	{'"', 'I', '\317'},	{'"', 'i', '\357'},
+-	{'-', 'D', '\320'},	{'-', 'd', '\360'},
+-	{'~', 'N', '\321'},	{'~', 'n', '\361'},
+-	{'`', 'O', '\322'},	{'`', 'o', '\362'},
+-	{'\'', 'O', '\323'},	{'\'', 'o', '\363'},
+-	{'^', 'O', '\324'},	{'^', 'o', '\364'},
+-	{'~', 'O', '\325'},	{'~', 'o', '\365'},
+-	{'"', 'O', '\326'},	{'"', 'o', '\366'},
+-	{'/', 'O', '\330'},	{'/', 'o', '\370'},
+-	{'`', 'U', '\331'},	{'`', 'u', '\371'},
+-	{'\'', 'U', '\332'},	{'\'', 'u', '\372'},
+-	{'^', 'U', '\333'},	{'^', 'u', '\373'},
+-	{'"', 'U', '\334'},	{'"', 'u', '\374'},
+-	{'\'', 'Y', '\335'},	{'\'', 'y', '\375'},
+-	{'T', 'H', '\336'},	{'t', 'h', '\376'},
+-	{'s', 's', '\337'},	{'"', 'y', '\377'},
+-	{'s', 'z', '\337'},	{'i', 'j', '\377'},
++	{'`', 'A', 0300},	{'`', 'a', 0340},
++	{'\'', 'A', 0301},	{'\'', 'a', 0341},
++	{'^', 'A', 0302},	{'^', 'a', 0342},
++	{'~', 'A', 0303},	{'~', 'a', 0343},
++	{'"', 'A', 0304},	{'"', 'a', 0344},
++	{'O', 'A', 0305},	{'o', 'a', 0345},
++	{'0', 'A', 0305},	{'0', 'a', 0345},
++	{'A', 'A', 0305},	{'a', 'a', 0345},
++	{'A', 'E', 0306},	{'a', 'e', 0346},
++	{',', 'C', 0307},	{',', 'c', 0347},
++	{'`', 'E', 0310},	{'`', 'e', 0350},
++	{'\'', 'E', 0311},	{'\'', 'e', 0351},
++	{'^', 'E', 0312},	{'^', 'e', 0352},
++	{'"', 'E', 0313},	{'"', 'e', 0353},
++	{'`', 'I', 0314},	{'`', 'i', 0354},
++	{'\'', 'I', 0315},	{'\'', 'i', 0355},
++	{'^', 'I', 0316},	{'^', 'i', 0356},
++	{'"', 'I', 0317},	{'"', 'i', 0357},
++	{'-', 'D', 0320},	{'-', 'd', 0360},
++	{'~', 'N', 0321},	{'~', 'n', 0361},
++	{'`', 'O', 0322},	{'`', 'o', 0362},
++	{'\'', 'O', 0323},	{'\'', 'o', 0363},
++	{'^', 'O', 0324},	{'^', 'o', 0364},
++	{'~', 'O', 0325},	{'~', 'o', 0365},
++	{'"', 'O', 0326},	{'"', 'o', 0366},
++	{'/', 'O', 0330},	{'/', 'o', 0370},
++	{'`', 'U', 0331},	{'`', 'u', 0371},
++	{'\'', 'U', 0332},	{'\'', 'u', 0372},
++	{'^', 'U', 0333},	{'^', 'u', 0373},
++	{'"', 'U', 0334},	{'"', 'u', 0374},
++	{'\'', 'Y', 0335},	{'\'', 'y', 0375},
++	{'T', 'H', 0336},	{'t', 'h', 0376},
++	{'s', 's', 0337},	{'"', 'y', 0377},
++	{'s', 'z', 0337},	{'i', 'j', 0377},
+ };
+ 
+ unsigned int accent_table_size = 68;
+diff --git a/drivers/ata/pata_hpt366.c b/drivers/ata/pata_hpt366.c
+index 0713872..a742efa 100644
+--- a/drivers/ata/pata_hpt366.c
++++ b/drivers/ata/pata_hpt366.c
+@@ -27,7 +27,7 @@
+ #include <linux/libata.h>
+ 
+ #define DRV_NAME	"pata_hpt366"
+-#define DRV_VERSION	"0.6.1"
++#define DRV_VERSION	"0.6.2"
+ 
+ struct hpt_clock {
+ 	u8	xfer_speed;
+@@ -180,9 +180,9 @@ static unsigned long hpt366_filter(struct ata_device *adev, unsigned long mask)
+ 		if (hpt_dma_blacklisted(adev, "UDMA",  bad_ata33))
+ 			mask &= ~ATA_MASK_UDMA;
+ 		if (hpt_dma_blacklisted(adev, "UDMA3", bad_ata66_3))
+-			mask &= ~(0x07 << ATA_SHIFT_UDMA);
++			mask &= ~(0xF8 << ATA_SHIFT_UDMA);
+ 		if (hpt_dma_blacklisted(adev, "UDMA4", bad_ata66_4))
+-			mask &= ~(0x0F << ATA_SHIFT_UDMA);
++			mask &= ~(0xF0 << ATA_SHIFT_UDMA);
+ 	}
+ 	return ata_pci_default_filter(adev, mask);
+ }
+diff --git a/drivers/ata/pata_hpt37x.c b/drivers/ata/pata_hpt37x.c
+index c79f066..eac6a2b 100644
+--- a/drivers/ata/pata_hpt37x.c
++++ b/drivers/ata/pata_hpt37x.c
+@@ -24,7 +24,7 @@
+ #include <linux/libata.h>
+ 
+ #define DRV_NAME	"pata_hpt37x"
+-#define DRV_VERSION	"0.6.9"
++#define DRV_VERSION	"0.6.11"
+ 
+ struct hpt_clock {
+ 	u8	xfer_speed;
+@@ -281,7 +281,7 @@ static unsigned long hpt370_filter(struct ata_device *adev, unsigned long mask)
+ 		if (hpt_dma_blacklisted(adev, "UDMA", bad_ata33))
+ 			mask &= ~ATA_MASK_UDMA;
+ 		if (hpt_dma_blacklisted(adev, "UDMA100", bad_ata100_5))
+-			mask &= ~(0x1F << ATA_SHIFT_UDMA);
++			mask &= ~(0xE0 << ATA_SHIFT_UDMA);
+ 	}
+ 	return ata_pci_default_filter(adev, mask);
+ }
+@@ -297,7 +297,7 @@ static unsigned long hpt370a_filter(struct ata_device *adev, unsigned long mask)
+ {
+ 	if (adev->class == ATA_DEV_ATA) {
+ 		if (hpt_dma_blacklisted(adev, "UDMA100", bad_ata100_5))
+-			mask &= ~ (0x1F << ATA_SHIFT_UDMA);
++			mask &= ~(0xE0 << ATA_SHIFT_UDMA);
+ 	}
+ 	return ata_pci_default_filter(adev, mask);
+ }
+diff --git a/drivers/ata/pata_serverworks.c b/drivers/ata/pata_serverworks.c
+index 8bed888..004cac7 100644
+--- a/drivers/ata/pata_serverworks.c
++++ b/drivers/ata/pata_serverworks.c
+@@ -226,7 +226,7 @@ static unsigned long serverworks_csb_filter(struct ata_device *adev, unsigned lo
+ 
+ 	for (i = 0; (p = csb_bad_ata100[i]) != NULL; i++) {
+ 		if (!strcmp(p, model_num))
+-			mask &= ~(0x1F << ATA_SHIFT_UDMA);
++			mask &= ~(0xE0 << ATA_SHIFT_UDMA);
+ 	}
+ 	return ata_pci_default_filter(adev, mask);
+ }
+diff --git a/drivers/base/platform.c b/drivers/base/platform.c
+index fb56092..39d8b7b 100644
+--- a/drivers/base/platform.c
++++ b/drivers/base/platform.c
+@@ -647,7 +647,7 @@ u64 dma_get_required_mask(struct device *dev)
+ 		high_totalram += high_totalram - 1;
+ 		mask = (((u64)high_totalram) << 32) + 0xffffffff;
+ 	}
+-	return mask & *dev->dma_mask;
++	return mask;
+ }
+ EXPORT_SYMBOL_GPL(dma_get_required_mask);
+ #endif
+diff --git a/drivers/block/ub.c b/drivers/block/ub.c
+index 08e909d..7aca466 100644
+--- a/drivers/block/ub.c
++++ b/drivers/block/ub.c
+@@ -657,7 +657,6 @@ static int ub_request_fn_1(struct ub_lun *lun, struct request *rq)
+ 	if ((cmd = ub_get_cmd(lun)) == NULL)
+ 		return -1;
+ 	memset(cmd, 0, sizeof(struct ub_scsi_cmd));
+-	sg_init_table(cmd->sgv, UB_MAX_REQ_SG);
+ 
+ 	blkdev_dequeue_request(rq);
+ 
+@@ -668,6 +667,7 @@ static int ub_request_fn_1(struct ub_lun *lun, struct request *rq)
+ 	/*
+ 	 * get scatterlist from block layer
+ 	 */
++	sg_init_table(&urq->sgv[0], UB_MAX_REQ_SG);
+ 	n_elem = blk_rq_map_sg(lun->disk->queue, rq, &urq->sgv[0]);
+ 	if (n_elem < 0) {
+ 		/* Impossible, because blk_rq_map_sg should not hit ENOMEM. */
+diff --git a/drivers/char/defkeymap.c_shipped b/drivers/char/defkeymap.c_shipped
+index 0aa419a..d2208df 100644
+--- a/drivers/char/defkeymap.c_shipped
++++ b/drivers/char/defkeymap.c_shipped
+@@ -223,40 +223,40 @@ char *func_table[MAX_NR_FUNC] = {
+ };
+ 
+ struct kbdiacruc accent_table[MAX_DIACR] = {
+-	{'`', 'A', '\300'},	{'`', 'a', '\340'},
+-	{'\'', 'A', '\301'},	{'\'', 'a', '\341'},
+-	{'^', 'A', '\302'},	{'^', 'a', '\342'},
+-	{'~', 'A', '\303'},	{'~', 'a', '\343'},
+-	{'"', 'A', '\304'},	{'"', 'a', '\344'},
+-	{'O', 'A', '\305'},	{'o', 'a', '\345'},
+-	{'0', 'A', '\305'},	{'0', 'a', '\345'},
+-	{'A', 'A', '\305'},	{'a', 'a', '\345'},
+-	{'A', 'E', '\306'},	{'a', 'e', '\346'},
+-	{',', 'C', '\307'},	{',', 'c', '\347'},
+-	{'`', 'E', '\310'},	{'`', 'e', '\350'},
+-	{'\'', 'E', '\311'},	{'\'', 'e', '\351'},
+-	{'^', 'E', '\312'},	{'^', 'e', '\352'},
+-	{'"', 'E', '\313'},	{'"', 'e', '\353'},
+-	{'`', 'I', '\314'},	{'`', 'i', '\354'},
+-	{'\'', 'I', '\315'},	{'\'', 'i', '\355'},
+-	{'^', 'I', '\316'},	{'^', 'i', '\356'},
+-	{'"', 'I', '\317'},	{'"', 'i', '\357'},
+-	{'-', 'D', '\320'},	{'-', 'd', '\360'},
+-	{'~', 'N', '\321'},	{'~', 'n', '\361'},
+-	{'`', 'O', '\322'},	{'`', 'o', '\362'},
+-	{'\'', 'O', '\323'},	{'\'', 'o', '\363'},
+-	{'^', 'O', '\324'},	{'^', 'o', '\364'},
+-	{'~', 'O', '\325'},	{'~', 'o', '\365'},
+-	{'"', 'O', '\326'},	{'"', 'o', '\366'},
+-	{'/', 'O', '\330'},	{'/', 'o', '\370'},
+-	{'`', 'U', '\331'},	{'`', 'u', '\371'},
+-	{'\'', 'U', '\332'},	{'\'', 'u', '\372'},
+-	{'^', 'U', '\333'},	{'^', 'u', '\373'},
+-	{'"', 'U', '\334'},	{'"', 'u', '\374'},
+-	{'\'', 'Y', '\335'},	{'\'', 'y', '\375'},
+-	{'T', 'H', '\336'},	{'t', 'h', '\376'},
+-	{'s', 's', '\337'},	{'"', 'y', '\377'},
+-	{'s', 'z', '\337'},	{'i', 'j', '\377'},
++	{'`', 'A', 0300},	{'`', 'a', 0340},
++	{'\'', 'A', 0301},	{'\'', 'a', 0341},
++	{'^', 'A', 0302},	{'^', 'a', 0342},
++	{'~', 'A', 0303},	{'~', 'a', 0343},
++	{'"', 'A', 0304},	{'"', 'a', 0344},
++	{'O', 'A', 0305},	{'o', 'a', 0345},
++	{'0', 'A', 0305},	{'0', 'a', 0345},
++	{'A', 'A', 0305},	{'a', 'a', 0345},
++	{'A', 'E', 0306},	{'a', 'e', 0346},
++	{',', 'C', 0307},	{',', 'c', 0347},
++	{'`', 'E', 0310},	{'`', 'e', 0350},
++	{'\'', 'E', 0311},	{'\'', 'e', 0351},
++	{'^', 'E', 0312},	{'^', 'e', 0352},
++	{'"', 'E', 0313},	{'"', 'e', 0353},
++	{'`', 'I', 0314},	{'`', 'i', 0354},
++	{'\'', 'I', 0315},	{'\'', 'i', 0355},
++	{'^', 'I', 0316},	{'^', 'i', 0356},
++	{'"', 'I', 0317},	{'"', 'i', 0357},
++	{'-', 'D', 0320},	{'-', 'd', 0360},
++	{'~', 'N', 0321},	{'~', 'n', 0361},
++	{'`', 'O', 0322},	{'`', 'o', 0362},
++	{'\'', 'O', 0323},	{'\'', 'o', 0363},
++	{'^', 'O', 0324},	{'^', 'o', 0364},
++	{'~', 'O', 0325},	{'~', 'o', 0365},
++	{'"', 'O', 0326},	{'"', 'o', 0366},
++	{'/', 'O', 0330},	{'/', 'o', 0370},
++	{'`', 'U', 0331},	{'`', 'u', 0371},
++	{'\'', 'U', 0332},	{'\'', 'u', 0372},
++	{'^', 'U', 0333},	{'^', 'u', 0373},
++	{'"', 'U', 0334},	{'"', 'u', 0374},
++	{'\'', 'Y', 0335},	{'\'', 'y', 0375},
++	{'T', 'H', 0336},	{'t', 'h', 0376},
++	{'s', 's', 0337},	{'"', 'y', 0377},
++	{'s', 'z', 0337},	{'i', 'j', 0377},
+ };
+ 
+ unsigned int accent_table_size = 68;
+diff --git a/drivers/char/vt.c b/drivers/char/vt.c
+index 7a5badf..93cfe4a 100644
+--- a/drivers/char/vt.c
++++ b/drivers/char/vt.c
+@@ -702,6 +702,7 @@ void redraw_screen(struct vc_data *vc, int is_switch)
+ 	if (is_switch) {
+ 		set_leds();
+ 		compute_shiftstate();
++		notify_update(vc);
+ 	}
+ }
+ 
+diff --git a/drivers/dma/ioat_dma.c b/drivers/dma/ioat_dma.c
+index 45e7b46..8cf542b 100644
+--- a/drivers/dma/ioat_dma.c
++++ b/drivers/dma/ioat_dma.c
+@@ -726,6 +726,7 @@ static struct dma_async_tx_descriptor *ioat1_dma_prep_memcpy(
+ 
+ 	if (new) {
+ 		new->len = len;
++		new->async_tx.ack = 0;
+ 		return &new->async_tx;
+ 	} else
+ 		return NULL;
+@@ -749,6 +750,7 @@ static struct dma_async_tx_descriptor *ioat2_dma_prep_memcpy(
+ 
+ 	if (new) {
+ 		new->len = len;
++		new->async_tx.ack = 0;
+ 		return &new->async_tx;
+ 	} else
+ 		return NULL;
+diff --git a/drivers/message/fusion/mptsas.c b/drivers/message/fusion/mptsas.c
+index e4c94f9..c8d3ffb 100644
+--- a/drivers/message/fusion/mptsas.c
++++ b/drivers/message/fusion/mptsas.c
+@@ -1699,6 +1699,11 @@ mptsas_sas_expander_pg0(MPT_ADAPTER *ioc, struct mptsas_portinfo *port_info,
+ 	if (error)
+ 		goto out_free_consistent;
+ 
++	if (!buffer->NumPhys) {
++		error = -ENODEV;
++		goto out_free_consistent;
++	}
++
+ 	/* save config data */
+ 	port_info->num_phys = buffer->NumPhys;
+ 	port_info->phy_info = kcalloc(port_info->num_phys,
+diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
+index 9cc5a6b..55584ee 100644
+--- a/drivers/net/e1000e/netdev.c
++++ b/drivers/net/e1000e/netdev.c
+@@ -1686,6 +1686,9 @@ static void e1000_setup_rctl(struct e1000_adapter *adapter)
+ 	else
+ 		rctl |= E1000_RCTL_LPE;
+ 
++	/* Enable hardware CRC frame stripping */
++	rctl |= E1000_RCTL_SECRC;
++
+ 	/* Setup buffer sizes */
+ 	rctl &= ~E1000_RCTL_SZ_4096;
+ 	rctl |= E1000_RCTL_BSEX;
+@@ -1751,9 +1754,6 @@ static void e1000_setup_rctl(struct e1000_adapter *adapter)
+ 
+ 		/* Enable Packet split descriptors */
+ 		rctl |= E1000_RCTL_DTYP_PS;
+-		
+-		/* Enable hardware CRC frame stripping */
+-		rctl |= E1000_RCTL_SECRC;
+ 
+ 		psrctl |= adapter->rx_ps_bsize0 >>
+ 			E1000_PSRCTL_BSIZE0_SHIFT;
+diff --git a/drivers/net/macb.c b/drivers/net/macb.c
+index e10528e..c796948 100644
+--- a/drivers/net/macb.c
++++ b/drivers/net/macb.c
+@@ -148,7 +148,7 @@ static void macb_handle_link_change(struct net_device *dev)
+ 
+ 			if (phydev->duplex)
+ 				reg |= MACB_BIT(FD);
+-			if (phydev->speed)
++			if (phydev->speed == SPEED_100)
+ 				reg |= MACB_BIT(SPD);
+ 
+ 			macb_writel(bp, NCFGR, reg);
+diff --git a/drivers/net/niu.c b/drivers/net/niu.c
+index 5f6beab..226dc54 100644
+--- a/drivers/net/niu.c
++++ b/drivers/net/niu.c
+@@ -33,8 +33,8 @@
+ 
+ #define DRV_MODULE_NAME		"niu"
+ #define PFX DRV_MODULE_NAME	": "
+-#define DRV_MODULE_VERSION	"0.6"
+-#define DRV_MODULE_RELDATE	"January 5, 2008"
++#define DRV_MODULE_VERSION	"0.7"
++#define DRV_MODULE_RELDATE	"February 18, 2008"
+ 
+ static char version[] __devinitdata =
+ 	DRV_MODULE_NAME ".c:v" DRV_MODULE_VERSION " (" DRV_MODULE_RELDATE ")\n";
+@@ -1616,12 +1616,13 @@ static int niu_enable_alt_mac(struct niu *np, int index, int on)
+ 	if (index >= niu_num_alt_addr(np))
+ 		return -EINVAL;
+ 
+-	if (np->flags & NIU_FLAGS_XMAC)
++	if (np->flags & NIU_FLAGS_XMAC) {
+ 		reg = XMAC_ADDR_CMPEN;
+-	else
++		mask = 1 << index;
++	} else {
+ 		reg = BMAC_ADDR_CMPEN;
+-
+-	mask = 1 << index;
++		mask = 1 << (index + 1);
++	}
+ 
+ 	val = nr64_mac(reg);
+ 	if (on)
+@@ -5147,7 +5148,12 @@ static void niu_set_rx_mode(struct net_device *dev)
+ 			index++;
+ 		}
+ 	} else {
+-		for (i = 0; i < niu_num_alt_addr(np); i++) {
++		int alt_start;
++		if (np->flags & NIU_FLAGS_XMAC)
++			alt_start = 0;
++		else
++			alt_start = 1;
++		for (i = alt_start; i < niu_num_alt_addr(np); i++) {
+ 			err = niu_enable_alt_mac(np, i, 0);
+ 			if (err)
+ 				printk(KERN_WARNING PFX "%s: Error %d "
+diff --git a/drivers/net/niu.h b/drivers/net/niu.h
+index 0e8626a..59dc05f 100644
+--- a/drivers/net/niu.h
++++ b/drivers/net/niu.h
+@@ -499,7 +499,7 @@
+ #define BMAC_ADDR2			0x00110UL
+ #define  BMAC_ADDR2_ADDR2		0x000000000000ffffULL
+ 
+-#define BMAC_NUM_ALT_ADDR		7
++#define BMAC_NUM_ALT_ADDR		6
+ 
+ #define BMAC_ALT_ADDR0(NUM)		(0x00118UL + (NUM)*0x18UL)
+ #define  BMAC_ALT_ADDR0_ADDR0		0x000000000000ffffULL
+diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
+index 559a9a9..ddcc0c4 100644
+--- a/drivers/net/wireless/b43/dma.c
++++ b/drivers/net/wireless/b43/dma.c
+@@ -165,7 +165,7 @@ static void op64_fill_descriptor(struct b43_dmaring *ring,
+ 	addrhi = (((u64) dmaaddr >> 32) & ~SSB_DMA_TRANSLATION_MASK);
+ 	addrext = (((u64) dmaaddr >> 32) & SSB_DMA_TRANSLATION_MASK)
+ 	    >> SSB_DMA_TRANSLATION_SHIFT;
+-	addrhi |= ssb_dma_translation(ring->dev->dev);
++	addrhi |= (ssb_dma_translation(ring->dev->dev) << 1);
+ 	if (slot == ring->nr_slots - 1)
+ 		ctl0 |= B43_DMA64_DCTL0_DTABLEEND;
+ 	if (start)
+@@ -426,9 +426,21 @@ static inline
+ static int alloc_ringmemory(struct b43_dmaring *ring)
+ {
+ 	struct device *dev = ring->dev->dev->dev;
+-
++	gfp_t flags = GFP_KERNEL;
++
++	/* The specs call for 4K buffers for 30- and 32-bit DMA with 4K
++	 * alignment and 8K buffers for 64-bit DMA with 8K alignment. Testing
++	 * has shown that 4K is sufficient for the latter as long as the buffer
++	 * does not cross an 8K boundary.
++	 *
++	 * For unknown reasons - possibly a hardware error - the BCM4311 rev
++	 * 02, which uses 64-bit DMA, needs the ring buffer in very low memory,
++	 * which accounts for the GFP_DMA flag below.
++	 */
++	if (ring->dma64)
++		flags |= GFP_DMA;
+ 	ring->descbase = dma_alloc_coherent(dev, B43_DMA_RINGMEMSIZE,
+-					    &(ring->dmabase), GFP_KERNEL);
++					    &(ring->dmabase), flags);
+ 	if (!ring->descbase) {
+ 		b43err(ring->dev->wl, "DMA ringmemory allocation failed\n");
+ 		return -ENOMEM;
+@@ -483,7 +495,7 @@ int b43_dmacontroller_rx_reset(struct b43_wldev *dev, u16 mmio_base, int dma64)
+ 	return 0;
+ }
+ 
+-/* Reset the RX DMA channel */
++/* Reset the TX DMA channel */
+ int b43_dmacontroller_tx_reset(struct b43_wldev *dev, u16 mmio_base, int dma64)
+ {
+ 	int i;
+@@ -647,7 +659,7 @@ static int dmacontroller_setup(struct b43_dmaring *ring)
+ 			b43_dma_write(ring, B43_DMA64_TXRINGHI,
+ 				      ((ringbase >> 32) &
+ 				       ~SSB_DMA_TRANSLATION_MASK)
+-				      | trans);
++				      | (trans << 1));
+ 		} else {
+ 			u32 ringbase = (u32) (ring->dmabase);
+ 
+@@ -680,8 +692,9 @@ static int dmacontroller_setup(struct b43_dmaring *ring)
+ 			b43_dma_write(ring, B43_DMA64_RXRINGHI,
+ 				      ((ringbase >> 32) &
+ 				       ~SSB_DMA_TRANSLATION_MASK)
+-				      | trans);
+-			b43_dma_write(ring, B43_DMA64_RXINDEX, 200);
++				      | (trans << 1));
++			b43_dma_write(ring, B43_DMA64_RXINDEX, ring->nr_slots *
++				      sizeof(struct b43_dmadesc64));
+ 		} else {
+ 			u32 ringbase = (u32) (ring->dmabase);
+ 
+@@ -695,11 +708,12 @@ static int dmacontroller_setup(struct b43_dmaring *ring)
+ 			b43_dma_write(ring, B43_DMA32_RXRING,
+ 				      (ringbase & ~SSB_DMA_TRANSLATION_MASK)
+ 				      | trans);
+-			b43_dma_write(ring, B43_DMA32_RXINDEX, 200);
++			b43_dma_write(ring, B43_DMA32_RXINDEX, ring->nr_slots *
++				      sizeof(struct b43_dmadesc32));
+ 		}
+ 	}
+ 
+-      out:
++out:
+ 	return err;
+ }
+ 
+diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
+index 69795fd..36a1de2 100644
+--- a/drivers/net/wireless/b43/main.c
++++ b/drivers/net/wireless/b43/main.c
+@@ -101,6 +101,7 @@ static const struct ssb_device_id b43_ssb_tbl[] = {
+ 	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
+ 	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
+ 	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
++	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
+ 	SSB_DEVTABLE_END
+ };
+ 
+@@ -3079,7 +3080,7 @@ static int b43_phy_versioning(struct b43_wldev *dev)
+ 			unsupported = 1;
+ 		break;
+ 	case B43_PHYTYPE_G:
+-		if (phy_rev > 8)
++		if (phy_rev > 9)
+ 			unsupported = 1;
+ 		break;
+ 	default:
+diff --git a/drivers/s390/char/defkeymap.c b/drivers/s390/char/defkeymap.c
+index 389346c..07c7f31 100644
+--- a/drivers/s390/char/defkeymap.c
++++ b/drivers/s390/char/defkeymap.c
+@@ -151,8 +151,8 @@ char *func_table[MAX_NR_FUNC] = {
+ };
+ 
+ struct kbdiacruc accent_table[MAX_DIACR] = {
+-	{'^', 'c', '\003'},	{'^', 'd', '\004'},
+-	{'^', 'z', '\032'},	{'^', '\012', '\000'},
++	{'^', 'c', 0003},	{'^', 'd', 0004},
++	{'^', 'z', 0032},	{'^', 0012, 0000},
+ };
+ 
+ unsigned int accent_table_size = 4;
+diff --git a/drivers/scsi/advansys.c b/drivers/scsi/advansys.c
+index 38a1ee2..f40417b 100644
+--- a/drivers/scsi/advansys.c
++++ b/drivers/scsi/advansys.c
+@@ -566,7 +566,7 @@ typedef struct asc_dvc_var {
+ 	ASC_SCSI_BIT_ID_TYPE unit_not_ready;
+ 	ASC_SCSI_BIT_ID_TYPE queue_full_or_busy;
+ 	ASC_SCSI_BIT_ID_TYPE start_motor;
+-	uchar overrun_buf[ASC_OVERRUN_BSIZE] __aligned(8);
++	uchar *overrun_buf;
+ 	dma_addr_t overrun_dma;
+ 	uchar scsi_reset_wait;
+ 	uchar chip_no;
+@@ -6439,7 +6439,7 @@ static int AdvLoadMicrocode(AdvPortAddr iop_base, unsigned char *buf, int size,
+ 			i += 2;
+ 			len += 2;
+ 		} else {
+-			unsigned char off = buf[i] * 2;
++			unsigned int off = buf[i] * 2;
+ 			unsigned short word = (buf[off + 1] << 8) | buf[off];
+ 			AdvWriteWordAutoIncLram(iop_base, word);
+ 			len += 2;
+@@ -13833,6 +13833,12 @@ static int __devinit advansys_board_found(struct Scsi_Host *shost,
+ 	 */
+ 	if (ASC_NARROW_BOARD(boardp)) {
+ 		ASC_DBG(2, "AscInitAsc1000Driver()\n");
++
++		asc_dvc_varp->overrun_buf = kzalloc(ASC_OVERRUN_BSIZE, GFP_KERNEL);
++		if (!asc_dvc_varp->overrun_buf) {
++			ret = -ENOMEM;
++			goto err_free_wide_mem;
++		}
+ 		warn_code = AscInitAsc1000Driver(asc_dvc_varp);
+ 
+ 		if (warn_code || asc_dvc_varp->err_code) {
+@@ -13840,8 +13846,10 @@ static int __devinit advansys_board_found(struct Scsi_Host *shost,
+ 					"warn 0x%x, error 0x%x\n",
+ 					asc_dvc_varp->init_state, warn_code,
+ 					asc_dvc_varp->err_code);
+-			if (asc_dvc_varp->err_code)
++			if (asc_dvc_varp->err_code) {
+ 				ret = -ENODEV;
++				kfree(asc_dvc_varp->overrun_buf);
++			}
+ 		}
+ 	} else {
+ 		if (advansys_wide_init_chip(shost))
+@@ -13894,6 +13902,7 @@ static int advansys_release(struct Scsi_Host *shost)
+ 		dma_unmap_single(board->dev,
+ 					board->dvc_var.asc_dvc_var.overrun_dma,
+ 					ASC_OVERRUN_BSIZE, DMA_FROM_DEVICE);
++		kfree(board->dvc_var.asc_dvc_var.overrun_buf);
+ 	} else {
+ 		iounmap(board->ioremap_addr);
+ 		advansys_wide_free_mem(board);
+diff --git a/drivers/scsi/aic94xx/aic94xx_scb.c b/drivers/scsi/aic94xx/aic94xx_scb.c
+index db6ab1a..eae2d97 100644
+--- a/drivers/scsi/aic94xx/aic94xx_scb.c
++++ b/drivers/scsi/aic94xx/aic94xx_scb.c
+@@ -458,13 +458,19 @@ static void escb_tasklet_complete(struct asd_ascb *ascb,
+ 		tc_abort = le16_to_cpu(tc_abort);
+ 
+ 		list_for_each_entry_safe(a, b, &asd_ha->seq.pend_q, list) {
+-			struct sas_task *task = ascb->uldd_task;
++			struct sas_task *task = a->uldd_task;
++
++			if (a->tc_index != tc_abort)
++				continue;
+ 
+-			if (task && a->tc_index == tc_abort) {
++			if (task) {
+ 				failed_dev = task->dev;
+ 				sas_task_abort(task);
+-				break;
++			} else {
++				ASD_DPRINTK("R_T_A for non TASK scb 0x%x\n",
++					    a->scb->header.opcode);
+ 			}
++			break;
+ 		}
+ 
+ 		if (!failed_dev) {
+@@ -478,7 +484,7 @@ static void escb_tasklet_complete(struct asd_ascb *ascb,
+ 		 * that the EH will wake up and do something.
+ 		 */
+ 		list_for_each_entry_safe(a, b, &asd_ha->seq.pend_q, list) {
+-			struct sas_task *task = ascb->uldd_task;
++			struct sas_task *task = a->uldd_task;
+ 
+ 			if (task &&
+ 			    task->dev == failed_dev &&
+diff --git a/drivers/scsi/arcmsr/arcmsr_hba.c b/drivers/scsi/arcmsr/arcmsr_hba.c
+index d466a2d..dcd6c9a 100644
+--- a/drivers/scsi/arcmsr/arcmsr_hba.c
++++ b/drivers/scsi/arcmsr/arcmsr_hba.c
+@@ -1380,17 +1380,16 @@ static int arcmsr_iop_message_xfer(struct AdapterControlBlock *acb, \
+ 	switch(controlcode) {
+ 
+ 	case ARCMSR_MESSAGE_READ_RQBUFFER: {
+-		unsigned long *ver_addr;
+-		dma_addr_t buf_handle;
++		unsigned char *ver_addr;
+ 		uint8_t *pQbuffer, *ptmpQbuffer;
+ 		int32_t allxfer_len = 0;
+ 
+-		ver_addr = pci_alloc_consistent(acb->pdev, 1032, &buf_handle);
++		ver_addr = kmalloc(1032, GFP_ATOMIC);
+ 		if (!ver_addr) {
+ 			retvalue = ARCMSR_MESSAGE_FAIL;
+ 			goto message_out;
+ 		}
+-		ptmpQbuffer = (uint8_t *) ver_addr;
++		ptmpQbuffer = ver_addr;
+ 		while ((acb->rqbuf_firstindex != acb->rqbuf_lastindex)
+ 			&& (allxfer_len < 1031)) {
+ 			pQbuffer = &acb->rqbuffer[acb->rqbuf_firstindex];
+@@ -1419,25 +1418,24 @@ static int arcmsr_iop_message_xfer(struct AdapterControlBlock *acb, \
+ 			}
+ 			arcmsr_iop_message_read(acb);
+ 		}
+-		memcpy(pcmdmessagefld->messagedatabuffer, (uint8_t *)ver_addr, allxfer_len);
++		memcpy(pcmdmessagefld->messagedatabuffer, ver_addr, allxfer_len);
+ 		pcmdmessagefld->cmdmessage.Length = allxfer_len;
+ 		pcmdmessagefld->cmdmessage.ReturnCode = ARCMSR_MESSAGE_RETURNCODE_OK;
+-		pci_free_consistent(acb->pdev, 1032, ver_addr, buf_handle);
++		kfree(ver_addr);
+ 		}
+ 		break;
+ 
+ 	case ARCMSR_MESSAGE_WRITE_WQBUFFER: {
+-		unsigned long *ver_addr;
+-		dma_addr_t buf_handle;
++		unsigned char *ver_addr;
+ 		int32_t my_empty_len, user_len, wqbuf_firstindex, wqbuf_lastindex;
+ 		uint8_t *pQbuffer, *ptmpuserbuffer;
+ 
+-		ver_addr = pci_alloc_consistent(acb->pdev, 1032, &buf_handle);
++		ver_addr = kmalloc(1032, GFP_ATOMIC);
+ 		if (!ver_addr) {
+ 			retvalue = ARCMSR_MESSAGE_FAIL;
+ 			goto message_out;
+ 		}
+-		ptmpuserbuffer = (uint8_t *)ver_addr;
++		ptmpuserbuffer = ver_addr;
+ 		user_len = pcmdmessagefld->cmdmessage.Length;
+ 		memcpy(ptmpuserbuffer, pcmdmessagefld->messagedatabuffer, user_len);
+ 		wqbuf_lastindex = acb->wqbuf_lastindex;
+@@ -1483,7 +1481,7 @@ static int arcmsr_iop_message_xfer(struct AdapterControlBlock *acb, \
+ 				retvalue = ARCMSR_MESSAGE_FAIL;
+ 			}
+ 			}
+-			pci_free_consistent(acb->pdev, 1032, ver_addr, buf_handle);
++			kfree(ver_addr);
+ 		}
+ 		break;
+ 
+diff --git a/drivers/scsi/gdth.c b/drivers/scsi/gdth.c
+index 8eb78be..b8b67f6 100644
+--- a/drivers/scsi/gdth.c
++++ b/drivers/scsi/gdth.c
+@@ -160,7 +160,7 @@ static void gdth_readapp_event(gdth_ha_str *ha, unchar application,
+ static void gdth_clear_events(void);
+ 
+ static void gdth_copy_internal_data(gdth_ha_str *ha, Scsi_Cmnd *scp,
+-                                    char *buffer, ushort count, int to_buffer);
++                                    char *buffer, ushort count);
+ static int gdth_internal_cache_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp);
+ static int gdth_fill_cache_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp, ushort hdrive);
+ 
+@@ -183,7 +183,6 @@ static int gdth_ioctl(struct inode *inode, struct file *filep,
+                       unsigned int cmd, unsigned long arg);
+ 
+ static void gdth_flush(gdth_ha_str *ha);
+-static int gdth_halt(struct notifier_block *nb, ulong event, void *buf);
+ static int gdth_queuecommand(Scsi_Cmnd *scp,void (*done)(Scsi_Cmnd *));
+ static int __gdth_queuecommand(gdth_ha_str *ha, struct scsi_cmnd *scp,
+ 				struct gdth_cmndinfo *cmndinfo);
+@@ -418,12 +417,6 @@ static inline void gdth_set_sglist(struct scsi_cmnd *cmd,
+ #include "gdth_proc.h"
+ #include "gdth_proc.c"
+ 
+-/* notifier block to get a notify on system shutdown/halt/reboot */
+-static struct notifier_block gdth_notifier = {
+-    gdth_halt, NULL, 0
+-};
+-static int notifier_disabled = 0;
+-
+ static gdth_ha_str *gdth_find_ha(int hanum)
+ {
+ 	gdth_ha_str *ha;
+@@ -446,8 +439,8 @@ static struct gdth_cmndinfo *gdth_get_cmndinfo(gdth_ha_str *ha)
+ 	for (i=0; i<GDTH_MAXCMDS; ++i) {
+ 		if (ha->cmndinfo[i].index == 0) {
+ 			priv = &ha->cmndinfo[i];
+-			priv->index = i+1;
+ 			memset(priv, 0, sizeof(*priv));
++			priv->index = i+1;
+ 			break;
+ 		}
+ 	}
+@@ -494,7 +487,6 @@ int __gdth_execute(struct scsi_device *sdev, gdth_cmd_str *gdtcmd, char *cmnd,
+     gdth_ha_str *ha = shost_priv(sdev->host);
+     Scsi_Cmnd *scp;
+     struct gdth_cmndinfo cmndinfo;
+-    struct scatterlist one_sg;
+     DECLARE_COMPLETION_ONSTACK(wait);
+     int rval;
+ 
+@@ -508,13 +500,10 @@ int __gdth_execute(struct scsi_device *sdev, gdth_cmd_str *gdtcmd, char *cmnd,
+     /* use request field to save the ptr. to completion struct. */
+     scp->request = (struct request *)&wait;
+     scp->timeout_per_command = timeout*HZ;
+-    sg_init_one(&one_sg, gdtcmd, sizeof(*gdtcmd));
+-    gdth_set_sglist(scp, &one_sg);
+-    gdth_set_sg_count(scp, 1);
+-    gdth_set_bufflen(scp, sizeof(*gdtcmd));
+     scp->cmd_len = 12;
+     memcpy(scp->cmnd, cmnd, 12);
+     cmndinfo.priority = IOCTL_PRI;
++    cmndinfo.internal_cmd_str = gdtcmd;
+     cmndinfo.internal_command = 1;
+ 
+     TRACE(("__gdth_execute() cmd 0x%x\n", scp->cmnd[0]));
+@@ -2355,7 +2344,7 @@ static void gdth_next(gdth_ha_str *ha)
+  * buffers, kmap_atomic() as needed.
+  */
+ static void gdth_copy_internal_data(gdth_ha_str *ha, Scsi_Cmnd *scp,
+-                                    char *buffer, ushort count, int to_buffer)
++                                    char *buffer, ushort count)
+ {
+     ushort cpcount,i, max_sg = gdth_sg_count(scp);
+     ushort cpsum,cpnow;
+@@ -2381,10 +2370,7 @@ static void gdth_copy_internal_data(gdth_ha_str *ha, Scsi_Cmnd *scp,
+             }
+             local_irq_save(flags);
+             address = kmap_atomic(sg_page(sl), KM_BIO_SRC_IRQ) + sl->offset;
+-            if (to_buffer)
+-                memcpy(buffer, address, cpnow);
+-            else
+-                memcpy(address, buffer, cpnow);
++            memcpy(address, buffer, cpnow);
+             flush_dcache_page(sg_page(sl));
+             kunmap_atomic(address, KM_BIO_SRC_IRQ);
+             local_irq_restore(flags);
+@@ -2438,7 +2424,7 @@ static int gdth_internal_cache_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp)
+         strcpy(inq.vendor,ha->oem_name);
+         sprintf(inq.product,"Host Drive  #%02d",t);
+         strcpy(inq.revision,"   ");
+-        gdth_copy_internal_data(ha, scp, (char*)&inq, sizeof(gdth_inq_data), 0);
++        gdth_copy_internal_data(ha, scp, (char*)&inq, sizeof(gdth_inq_data));
+         break;
+ 
+       case REQUEST_SENSE:
+@@ -2448,7 +2434,7 @@ static int gdth_internal_cache_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp)
+         sd.key       = NO_SENSE;
+         sd.info      = 0;
+         sd.add_length= 0;
+-        gdth_copy_internal_data(ha, scp, (char*)&sd, sizeof(gdth_sense_data), 0);
++        gdth_copy_internal_data(ha, scp, (char*)&sd, sizeof(gdth_sense_data));
+         break;
+ 
+       case MODE_SENSE:
+@@ -2460,7 +2446,7 @@ static int gdth_internal_cache_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp)
+         mpd.bd.block_length[0] = (SECTOR_SIZE & 0x00ff0000) >> 16;
+         mpd.bd.block_length[1] = (SECTOR_SIZE & 0x0000ff00) >> 8;
+         mpd.bd.block_length[2] = (SECTOR_SIZE & 0x000000ff);
+-        gdth_copy_internal_data(ha, scp, (char*)&mpd, sizeof(gdth_modep_data), 0);
++        gdth_copy_internal_data(ha, scp, (char*)&mpd, sizeof(gdth_modep_data));
+         break;
+ 
+       case READ_CAPACITY:
+@@ -2470,7 +2456,7 @@ static int gdth_internal_cache_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp)
+         else
+             rdc.last_block_no = cpu_to_be32(ha->hdr[t].size-1);
+         rdc.block_length  = cpu_to_be32(SECTOR_SIZE);
+-        gdth_copy_internal_data(ha, scp, (char*)&rdc, sizeof(gdth_rdcap_data), 0);
++        gdth_copy_internal_data(ha, scp, (char*)&rdc, sizeof(gdth_rdcap_data));
+         break;
+ 
+       case SERVICE_ACTION_IN:
+@@ -2482,7 +2468,7 @@ static int gdth_internal_cache_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp)
+             rdc16.last_block_no = cpu_to_be64(ha->hdr[t].size-1);
+             rdc16.block_length  = cpu_to_be32(SECTOR_SIZE);
+             gdth_copy_internal_data(ha, scp, (char*)&rdc16,
+-                                                 sizeof(gdth_rdcap16_data), 0);
++                                                 sizeof(gdth_rdcap16_data));
+         } else { 
+             scp->result = DID_ABORT << 16;
+         }
+@@ -2852,6 +2838,7 @@ static int gdth_fill_raw_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp, unchar b)
+ static int gdth_special_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp)
+ {
+     register gdth_cmd_str *cmdp;
++    struct gdth_cmndinfo *cmndinfo = gdth_cmnd_priv(scp);
+     int cmd_index;
+ 
+     cmdp= ha->pccb;
+@@ -2860,7 +2847,7 @@ static int gdth_special_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp)
+     if (ha->type==GDT_EISA && ha->cmd_cnt>0) 
+         return 0;
+ 
+-    gdth_copy_internal_data(ha, scp, (char *)cmdp, sizeof(gdth_cmd_str), 1);
++    *cmdp = *cmndinfo->internal_cmd_str;
+     cmdp->RequestBuffer = scp;
+ 
+     /* search free command index */
+@@ -3793,6 +3780,8 @@ static void gdth_timeout(ulong data)
+     gdth_ha_str *ha;
+     ulong flags;
+ 
++    BUG_ON(list_empty(&gdth_instances));
++
+     ha = list_first_entry(&gdth_instances, gdth_ha_str, list);
+     spin_lock_irqsave(&ha->smp_lock, flags);
+ 
+@@ -4668,45 +4657,6 @@ static void gdth_flush(gdth_ha_str *ha)
+     }
+ }
+ 
+-/* shutdown routine */
+-static int gdth_halt(struct notifier_block *nb, ulong event, void *buf)
+-{
+-    gdth_ha_str *ha;
+-#ifndef __alpha__
+-    gdth_cmd_str    gdtcmd;
+-    char            cmnd[MAX_COMMAND_SIZE];   
+-#endif
+-
+-    if (notifier_disabled)
+-        return NOTIFY_OK;
+-
+-    TRACE2(("gdth_halt() event %d\n",(int)event));
+-    if (event != SYS_RESTART && event != SYS_HALT && event != SYS_POWER_OFF)
+-        return NOTIFY_DONE;
+-
+-    notifier_disabled = 1;
+-    printk("GDT-HA: Flushing all host drives .. ");
+-    list_for_each_entry(ha, &gdth_instances, list) {
+-        gdth_flush(ha);
+-
+-#ifndef __alpha__
+-        /* controller reset */
+-        memset(cmnd, 0xff, MAX_COMMAND_SIZE);
+-        gdtcmd.BoardNode = LOCALBOARD;
+-        gdtcmd.Service = CACHESERVICE;
+-        gdtcmd.OpCode = GDT_RESET;
+-        TRACE2(("gdth_halt(): reset controller %d\n", ha->hanum));
+-        gdth_execute(ha->shost, &gdtcmd, cmnd, 10, NULL);
+-#endif
+-    }
+-    printk("Done.\n");
+-
+-#ifdef GDTH_STATISTICS
+-    del_timer(&gdth_timer);
+-#endif
+-    return NOTIFY_OK;
+-}
+-
+ /* configure lun */
+ static int gdth_slave_configure(struct scsi_device *sdev)
+ {
+@@ -5141,13 +5091,13 @@ static void gdth_remove_one(gdth_ha_str *ha)
+ 
+ 	scsi_remove_host(shp);
+ 
++	gdth_flush(ha);
++
+ 	if (ha->sdev) {
+ 		scsi_free_host_dev(ha->sdev);
+ 		ha->sdev = NULL;
+ 	}
+ 
+-	gdth_flush(ha);
+-
+ 	if (shp->irq)
+ 		free_irq(shp->irq,ha);
+ 
+@@ -5173,6 +5123,24 @@ static void gdth_remove_one(gdth_ha_str *ha)
+ 	scsi_host_put(shp);
+ }
+ 
++static int gdth_halt(struct notifier_block *nb, ulong event, void *buf)
++{
++	gdth_ha_str *ha;
++
++	TRACE2(("gdth_halt() event %d\n", (int)event));
++	if (event != SYS_RESTART && event != SYS_HALT && event != SYS_POWER_OFF)
++		return NOTIFY_DONE;
++
++	list_for_each_entry(ha, &gdth_instances, list)
++		gdth_flush(ha);
++
++	return NOTIFY_OK;
++}
++
++static struct notifier_block gdth_notifier = {
++    gdth_halt, NULL, 0
++};
++
+ static int __init gdth_init(void)
+ {
+ 	if (disable) {
+@@ -5235,7 +5203,6 @@ static int __init gdth_init(void)
+ 	add_timer(&gdth_timer);
+ #endif
+ 	major = register_chrdev(0,"gdth", &gdth_fops);
+-	notifier_disabled = 0;
+ 	register_reboot_notifier(&gdth_notifier);
+ 	gdth_polling = FALSE;
+ 	return 0;
+@@ -5245,14 +5212,15 @@ static void __exit gdth_exit(void)
+ {
+ 	gdth_ha_str *ha;
+ 
+-	list_for_each_entry(ha, &gdth_instances, list)
+-		gdth_remove_one(ha);
++	unregister_chrdev(major, "gdth");
++	unregister_reboot_notifier(&gdth_notifier);
+ 
+ #ifdef GDTH_STATISTICS
+-	del_timer(&gdth_timer);
++	del_timer_sync(&gdth_timer);
+ #endif
+-	unregister_chrdev(major,"gdth");
+-	unregister_reboot_notifier(&gdth_notifier);
++
++	list_for_each_entry(ha, &gdth_instances, list)
++		gdth_remove_one(ha);
+ }
+ 
+ module_init(gdth_init);
+diff --git a/drivers/scsi/gdth.h b/drivers/scsi/gdth.h
+index 1434c6b..26e4e92 100644
+--- a/drivers/scsi/gdth.h
++++ b/drivers/scsi/gdth.h
+@@ -915,6 +915,7 @@ typedef struct {
+     struct gdth_cmndinfo {                      /* per-command private info */
+         int index;
+         int internal_command;                   /* don't call scsi_done */
++        gdth_cmd_str *internal_cmd_str;         /* crier for internal messages*/
+         dma_addr_t sense_paddr;                 /* sense dma-addr */
+         unchar priority;
+         int timeout;
+diff --git a/drivers/scsi/gdth_proc.c b/drivers/scsi/gdth_proc.c
+index de57734..ce0228e 100644
+--- a/drivers/scsi/gdth_proc.c
++++ b/drivers/scsi/gdth_proc.c
+@@ -694,15 +694,13 @@ static void gdth_ioctl_free(gdth_ha_str *ha, int size, char *buf, ulong64 paddr)
+ {
+     ulong flags;
+ 
+-    spin_lock_irqsave(&ha->smp_lock, flags);
+-
+     if (buf == ha->pscratch) {
++	spin_lock_irqsave(&ha->smp_lock, flags);
+         ha->scratch_busy = FALSE;
++	spin_unlock_irqrestore(&ha->smp_lock, flags);
+     } else {
+         pci_free_consistent(ha->pdev, size, buf, paddr);
+     }
+-
+-    spin_unlock_irqrestore(&ha->smp_lock, flags);
+ }
+ 
+ #ifdef GDTH_IOCTL_PROC
+diff --git a/drivers/scsi/ips.c b/drivers/scsi/ips.c
+index 5c5a9b2..f4e9c8d 100644
+--- a/drivers/scsi/ips.c
++++ b/drivers/scsi/ips.c
+@@ -1580,7 +1580,7 @@ ips_make_passthru(ips_ha_t *ha, struct scsi_cmnd *SC, ips_scb_t *scb, int intr)
+ 	METHOD_TRACE("ips_make_passthru", 1);
+ 
+         scsi_for_each_sg(SC, sg, scsi_sg_count(SC), i)
+-                length += sg[i].length;
++		length += sg->length;
+ 
+ 	if (length < sizeof (ips_passthru_t)) {
+ 		/* wrong size */
+@@ -6842,13 +6842,10 @@ ips_register_scsi(int index)
+ 	if (request_irq(ha->irq, do_ipsintr, IRQF_SHARED, ips_name, ha)) {
+ 		IPS_PRINTK(KERN_WARNING, ha->pcidev,
+ 			   "Unable to install interrupt handler\n");
+-		scsi_host_put(sh);
+-		return -1;
++		goto err_out_sh;
+ 	}
+ 
+ 	kfree(oldha);
+-	ips_sh[index] = sh;
+-	ips_ha[index] = ha;
+ 
+ 	/* Store away needed values for later use */
+ 	sh->io_port = ha->io_addr;
+@@ -6867,10 +6864,21 @@ ips_register_scsi(int index)
+ 	sh->max_channel = ha->nbus - 1;
+ 	sh->can_queue = ha->max_cmds - 1;
+ 
+-	scsi_add_host(sh, NULL);
++	if (scsi_add_host(sh, &ha->pcidev->dev))
++		goto err_out;
++
++	ips_sh[index] = sh;
++	ips_ha[index] = ha;
++
+ 	scsi_scan_host(sh);
+ 
+ 	return 0;
++
++err_out:
++	free_irq(ha->pcidev->irq, ha);
++err_out_sh:
++	scsi_host_put(sh);
++	return -1;
+ }
+ 
+ /*---------------------------------------------------------------------------*/
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index a9ac5b1..273728e 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -298,7 +298,6 @@ static int scsi_req_map_sg(struct request *rq, struct scatterlist *sgl,
+ 		page = sg_page(sg);
+ 		off = sg->offset;
+ 		len = sg->length;
+- 		data_len += len;
+ 
+ 		while (len > 0 && data_len > 0) {
+ 			/*
+diff --git a/drivers/spi/atmel_spi.c b/drivers/spi/atmel_spi.c
+index ff10808..e9d7959 100644
+--- a/drivers/spi/atmel_spi.c
++++ b/drivers/spi/atmel_spi.c
+@@ -85,6 +85,16 @@ static void cs_activate(struct atmel_spi *as, struct spi_device *spi)
+ 	unsigned gpio = (unsigned) spi->controller_data;
+ 	unsigned active = spi->mode & SPI_CS_HIGH;
+ 	u32 mr;
++	int i;
++	u32 csr;
++	u32 cpol = (spi->mode & SPI_CPOL) ? SPI_BIT(CPOL) : 0;
++
++	/* Make sure clock polarity is correct */
++	for (i = 0; i < spi->master->num_chipselect; i++) {
++		csr = spi_readl(as, CSR0 + 4 * i);
++		if ((csr ^ cpol) & SPI_BIT(CPOL))
++			spi_writel(as, CSR0 + 4 * i, csr ^ SPI_BIT(CPOL));
++	}
+ 
+ 	mr = spi_readl(as, MR);
+ 	mr = SPI_BFINS(PCS, ~(1 << spi->chip_select), mr);
+diff --git a/drivers/spi/pxa2xx_spi.c b/drivers/spi/pxa2xx_spi.c
+index 1c2ab54..840e682 100644
+--- a/drivers/spi/pxa2xx_spi.c
++++ b/drivers/spi/pxa2xx_spi.c
+@@ -48,13 +48,19 @@ MODULE_LICENSE("GPL");
+ #define RESET_DMA_CHANNEL (DCSR_NODESC | DMA_INT_MASK)
+ #define IS_DMA_ALIGNED(x) (((u32)(x)&0x07)==0)
+ 
+-/* for testing SSCR1 changes that require SSP restart, basically
+- * everything except the service and interrupt enables */
+-#define SSCR1_CHANGE_MASK (SSCR1_TTELP | SSCR1_TTE | SSCR1_EBCEI | SSCR1_SCFR \
++/*
++ * for testing SSCR1 changes that require SSP restart, basically
++ * everything except the service and interrupt enables, the pxa270 developer
++ * manual says only SSCR1_SCFR, SSCR1_SPH, SSCR1_SPO need to be in this
++ * list, but the PXA255 dev man says all bits without really meaning the
++ * service and interrupt enables
++ */
++#define SSCR1_CHANGE_MASK (SSCR1_TTELP | SSCR1_TTE | SSCR1_SCFR \
+ 				| SSCR1_ECRA | SSCR1_ECRB | SSCR1_SCLKDIR \
+-				| SSCR1_RWOT | SSCR1_TRAIL | SSCR1_PINTE \
+-				| SSCR1_STRF | SSCR1_EFWR |SSCR1_RFT \
+-				| SSCR1_TFT | SSCR1_SPH | SSCR1_SPO | SSCR1_LBM)
++				| SSCR1_SFRMDIR | SSCR1_RWOT | SSCR1_TRAIL \
++				| SSCR1_IFS | SSCR1_STRF | SSCR1_EFWR \
++				| SSCR1_RFT | SSCR1_TFT | SSCR1_MWDS \
++				| SSCR1_SPH | SSCR1_SPO | SSCR1_LBM)
+ 
+ #define DEFINE_SSP_REG(reg, off) \
+ static inline u32 read_##reg(void *p) { return __raw_readl(p + (off)); } \
+@@ -961,9 +967,6 @@ static void pump_transfers(unsigned long data)
+ 		if (drv_data->ssp_type == PXA25x_SSP)
+ 			DCMD(drv_data->tx_channel) |= DCMD_ENDIRQEN;
+ 
+-		/* Fix me, need to handle cs polarity */
+-		drv_data->cs_control(PXA2XX_CS_ASSERT);
+-
+ 		/* Clear status and start DMA engine */
+ 		cr1 = chip->cr1 | dma_thresh | drv_data->dma_cr1;
+ 		write_SSSR(drv_data->clear_sr, reg);
+@@ -973,9 +976,6 @@ static void pump_transfers(unsigned long data)
+ 		/* Ensure we have the correct interrupt handler	*/
+ 		drv_data->transfer_handler = interrupt_transfer;
+ 
+-		/* Fix me, need to handle cs polarity */
+-		drv_data->cs_control(PXA2XX_CS_ASSERT);
+-
+ 		/* Clear status  */
+ 		cr1 = chip->cr1 | chip->threshold | drv_data->int_cr1;
+ 		write_SSSR(drv_data->clear_sr, reg);
+@@ -986,16 +986,29 @@ static void pump_transfers(unsigned long data)
+ 		|| (read_SSCR1(reg) & SSCR1_CHANGE_MASK) !=
+ 			(cr1 & SSCR1_CHANGE_MASK)) {
+ 
++		/* stop the SSP, and update the other bits */
+ 		write_SSCR0(cr0 & ~SSCR0_SSE, reg);
+ 		if (drv_data->ssp_type != PXA25x_SSP)
+ 			write_SSTO(chip->timeout, reg);
+-		write_SSCR1(cr1, reg);
++		/* first set CR1 without interrupt and service enables */
++		write_SSCR1(cr1 & SSCR1_CHANGE_MASK, reg);
++		/* restart the SSP */
+ 		write_SSCR0(cr0, reg);
++
+ 	} else {
+ 		if (drv_data->ssp_type != PXA25x_SSP)
+ 			write_SSTO(chip->timeout, reg);
+-		write_SSCR1(cr1, reg);
+ 	}
++
++	/* FIXME, need to handle cs polarity,
++	 * this driver uses struct pxa2xx_spi_chip.cs_control to
++	 * specify a CS handling function, and it ignores most
++	 * struct spi_device.mode[s], including SPI_CS_HIGH */
++	drv_data->cs_control(PXA2XX_CS_ASSERT);
++
++	/* after chip select, release the data by enabling service
++	 * requests and interrupts, without changing any mode bits */
++	write_SSCR1(cr1, reg);
+ }
+ 
+ static void pump_messages(struct work_struct *work)
+diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
+index b10f39c..d1df9e9 100644
+--- a/drivers/usb/host/ehci-q.c
++++ b/drivers/usb/host/ehci-q.c
+@@ -315,10 +315,10 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh)
+ 			if (likely (last->urb != urb)) {
+ 				ehci_urb_done(ehci, last->urb, last_status);
+ 				count++;
++				last_status = -EINPROGRESS;
+ 			}
+ 			ehci_qtd_free (ehci, last);
+ 			last = NULL;
+-			last_status = -EINPROGRESS;
+ 		}
+ 
+ 		/* ignore urbs submitted during completions we reported */
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 1382af9..c04beac 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -310,6 +310,7 @@ struct ftdi_sio_quirk {
+ };
+ 
+ static int   ftdi_olimex_probe		(struct usb_serial *serial);
++static int   ftdi_mtxorb_hack_setup	(struct usb_serial *serial);
+ static void  ftdi_USB_UIRT_setup	(struct ftdi_private *priv);
+ static void  ftdi_HE_TIRA1_setup	(struct ftdi_private *priv);
+ 
+@@ -317,6 +318,10 @@ static struct ftdi_sio_quirk ftdi_olimex_quirk = {
+ 	.probe	= ftdi_olimex_probe,
+ };
+ 
++static struct ftdi_sio_quirk ftdi_mtxorb_hack_quirk = {
++	.probe  = ftdi_mtxorb_hack_setup,
++};
++
+ static struct ftdi_sio_quirk ftdi_USB_UIRT_quirk = {
+ 	.port_probe = ftdi_USB_UIRT_setup,
+ };
+@@ -379,6 +384,8 @@ static struct usb_device_id id_table_combined [] = {
+ 	{ USB_DEVICE(FTDI_VID, FTDI_MTXORB_4_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_MTXORB_5_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_MTXORB_6_PID) },
++	{ USB_DEVICE(MTXORB_VK_VID, MTXORB_VK_PID),
++		.driver_info = (kernel_ulong_t)&ftdi_mtxorb_hack_quirk },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_PERLE_ULTRAPORT_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_PIEGROUP_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_TNC_X_PID) },
+@@ -492,6 +499,7 @@ static struct usb_device_id id_table_combined [] = {
+ 	{ USB_DEVICE(FTDI_VID, FTDI_ELV_FS20SIG_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_ELV_WS300PC_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_ELV_FHZ1300PC_PID) },
++	{ USB_DEVICE(FTDI_VID, FTDI_ELV_EM1010PC_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_ELV_WS500_PID) },
+ 	{ USB_DEVICE(FTDI_VID, LINX_SDMUSBQSS_PID) },
+ 	{ USB_DEVICE(FTDI_VID, LINX_MASTERDEVEL2_PID) },
+@@ -1301,6 +1309,23 @@ static int ftdi_olimex_probe(struct usb_serial *serial)
+ 	return 0;
+ }
+ 
++/*
++ * The Matrix Orbital VK204-25-USB has an invalid IN endpoint.
++ * We have to correct it if we want to read from it.
++ */
++static int ftdi_mtxorb_hack_setup(struct usb_serial *serial)
++{
++	struct usb_host_endpoint *ep = serial->dev->ep_in[1];
++	struct usb_endpoint_descriptor *ep_desc = &ep->desc;
++
++	if (ep->enabled && ep_desc->wMaxPacketSize == 0) {
++		ep_desc->wMaxPacketSize = 0x40;
++		info("Fixing invalid wMaxPacketSize on read pipe");
++	}
++
++	return 0;
++}
++
+ /* ftdi_shutdown is called from usbserial:usb_serial_disconnect
+  *   it is called when the usb device is disconnected
+  *
+diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
+index f6053da..893b429 100644
+--- a/drivers/usb/serial/ftdi_sio.h
++++ b/drivers/usb/serial/ftdi_sio.h
+@@ -98,6 +98,13 @@
+ #define FTDI_MTXORB_5_PID      0xFA05  /* Matrix Orbital Product Id */
+ #define FTDI_MTXORB_6_PID      0xFA06  /* Matrix Orbital Product Id */
+ 
++/*
++ * The following are the values for the Matrix Orbital VK204-25-USB
++ * display, which use the FT232RL.
++ */
++#define MTXORB_VK_VID		0x1b3d
++#define MTXORB_VK_PID		0x0158
++
+ /* Interbiometrics USB I/O Board */
+ /* Developed for Interbiometrics by Rudolf Gugler */
+ #define INTERBIOMETRICS_VID              0x1209
+diff --git a/drivers/usb/storage/protocol.c b/drivers/usb/storage/protocol.c
+index 889622b..45262f3 100644
+--- a/drivers/usb/storage/protocol.c
++++ b/drivers/usb/storage/protocol.c
+@@ -194,7 +194,7 @@ unsigned int usb_stor_access_xfer_buf(unsigned char *buffer,
+ 		 * and the starting offset within the page, and update
+ 		 * the *offset and *index values for the next loop. */
+ 		cnt = 0;
+-		while (cnt < buflen) {
++		while (cnt < buflen && sg) {
+ 			struct page *page = sg_page(sg) +
+ 					((sg->offset + *offset) >> PAGE_SHIFT);
+ 			unsigned int poff =
+@@ -249,7 +249,8 @@ void usb_stor_set_xfer_buf(unsigned char *buffer,
+ 	unsigned int offset = 0;
+ 	struct scatterlist *sg = NULL;
+ 
+-	usb_stor_access_xfer_buf(buffer, buflen, srb, &sg, &offset,
++	buflen = min(buflen, srb->request_bufflen);
++	buflen = usb_stor_access_xfer_buf(buffer, buflen, srb, &sg, &offset,
+ 			TO_XFER_BUF);
+ 	if (buflen < srb->request_bufflen)
+ 		srb->resid = srb->request_bufflen - buflen;
+diff --git a/fs/aio.c b/fs/aio.c
+index 9dec7d2..758f911 100644
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -997,6 +997,14 @@ put_rq:
+ 	/* everything turned out well, dispose of the aiocb. */
+ 	ret = __aio_put_req(ctx, iocb);
+ 
++	/*
++	 * We have to order our ring_info tail store above and test
++	 * of the wait list below outside the wait lock.  This is
++	 * like in wake_up_bit() where clearing a bit has to be
++	 * ordered with the unlocked test.
++	 */
++	smp_mb();
++
+ 	if (waitqueue_active(&ctx->wait))
+ 		wake_up(&ctx->wait);
+ 
+diff --git a/fs/ecryptfs/mmap.c b/fs/ecryptfs/mmap.c
+index 32c5711..a985a8f 100644
+--- a/fs/ecryptfs/mmap.c
++++ b/fs/ecryptfs/mmap.c
+@@ -263,52 +263,102 @@ out:
+ 	return 0;
+ }
+ 
+-/* This function must zero any hole we create */
++/**
++ * ecryptfs_prepare_write
++ * @file: The eCryptfs file
++ * @page: The eCryptfs page
++ * @from: The start byte from which we will write
++ * @to: The end byte to which we will write
++ *
++ * This function must zero any hole we create
++ *
++ * Returns zero on success; non-zero otherwise
++ */
+ static int ecryptfs_prepare_write(struct file *file, struct page *page,
+ 				  unsigned from, unsigned to)
+ {
+-	int rc = 0;
+ 	loff_t prev_page_end_size;
++	int rc = 0;
+ 
+ 	if (!PageUptodate(page)) {
+-		rc = ecryptfs_read_lower_page_segment(page, page->index, 0,
+-						      PAGE_CACHE_SIZE,
+-						      page->mapping->host);
+-		if (rc) {
+-			printk(KERN_ERR "%s: Error attemping to read lower "
+-			       "page segment; rc = [%d]\n", __FUNCTION__, rc);
+-			ClearPageUptodate(page);
+-			goto out;
+-		} else
++		struct ecryptfs_crypt_stat *crypt_stat =
++			&ecryptfs_inode_to_private(
++				file->f_path.dentry->d_inode)->crypt_stat;
++
++		if (!(crypt_stat->flags & ECRYPTFS_ENCRYPTED)
++		    || (crypt_stat->flags & ECRYPTFS_NEW_FILE)) {
++			rc = ecryptfs_read_lower_page_segment(
++				page, page->index, 0, PAGE_CACHE_SIZE,
++				page->mapping->host);
++			if (rc) {
++				printk(KERN_ERR "%s: Error attemping to read "
++				       "lower page segment; rc = [%d]\n",
++				       __FUNCTION__, rc);
++				ClearPageUptodate(page);
++				goto out;
++			} else
++				SetPageUptodate(page);
++		} else if (crypt_stat->flags & ECRYPTFS_VIEW_AS_ENCRYPTED) {
++			if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR) {
++				rc = ecryptfs_copy_up_encrypted_with_header(
++					page, crypt_stat);
++				if (rc) {
++					printk(KERN_ERR "%s: Error attempting "
++					       "to copy the encrypted content "
++					       "from the lower file whilst "
++					       "inserting the metadata from "
++					       "the xattr into the header; rc "
++					       "= [%d]\n", __FUNCTION__, rc);
++					ClearPageUptodate(page);
++					goto out;
++				}
++				SetPageUptodate(page);
++			} else {
++				rc = ecryptfs_read_lower_page_segment(
++					page, page->index, 0, PAGE_CACHE_SIZE,
++					page->mapping->host);
++				if (rc) {
++					printk(KERN_ERR "%s: Error reading "
++					       "page; rc = [%d]\n",
++					       __FUNCTION__, rc);
++					ClearPageUptodate(page);
++					goto out;
++				}
++				SetPageUptodate(page);
++			}
++		} else {
++			rc = ecryptfs_decrypt_page(page);
++			if (rc) {
++				printk(KERN_ERR "%s: Error decrypting page "
++				       "at index [%ld]; rc = [%d]\n",
++				       __FUNCTION__, page->index, rc);
++				ClearPageUptodate(page);
++				goto out;
++			}
+ 			SetPageUptodate(page);
++		}
+ 	}
+-
+ 	prev_page_end_size = ((loff_t)page->index << PAGE_CACHE_SHIFT);
+-
+-	/*
+-	 * If creating a page or more of holes, zero them out via truncate.
+-	 * Note, this will increase i_size.
+-	 */
++	/* If creating a page or more of holes, zero them out via truncate.
++	 * Note, this will increase i_size. */
+ 	if (page->index != 0) {
+ 		if (prev_page_end_size > i_size_read(page->mapping->host)) {
+ 			rc = ecryptfs_truncate(file->f_path.dentry,
+ 					       prev_page_end_size);
+ 			if (rc) {
+-				printk(KERN_ERR "Error on attempt to "
++				printk(KERN_ERR "%s: Error on attempt to "
+ 				       "truncate to (higher) offset [%lld];"
+-				       " rc = [%d]\n", prev_page_end_size, rc);
++				       " rc = [%d]\n", __FUNCTION__,
++				       prev_page_end_size, rc);
+ 				goto out;
+ 			}
+ 		}
+ 	}
+-	/*
+-	 * Writing to a new page, and creating a small hole from start of page?
+-	 * Zero it out.
+-	 */
+-	if ((i_size_read(page->mapping->host) == prev_page_end_size) &&
+-	    (from != 0)) {
++	/* Writing to a new page, and creating a small hole from start
++	 * of page?  Zero it out. */
++	if ((i_size_read(page->mapping->host) == prev_page_end_size)
++	    && (from != 0))
+ 		zero_user_page(page, 0, PAGE_CACHE_SIZE, KM_USER0);
+-	}
+ out:
+ 	return rc;
+ }
+diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
+index 80d2f52..dcac591 100644
+--- a/fs/fuse/dir.c
++++ b/fs/fuse/dir.c
+@@ -905,7 +905,7 @@ static int fuse_permission(struct inode *inode, int mask, struct nameidata *nd)
+ 	}
+ 
+ 	if (fc->flags & FUSE_DEFAULT_PERMISSIONS) {
+-		int err = generic_permission(inode, mask, NULL);
++		err = generic_permission(inode, mask, NULL);
+ 
+ 		/* If permission is denied, try to refresh file
+ 		   attributes.  This is also needed, because the root
+diff --git a/fs/isofs/compress.c b/fs/isofs/compress.c
+index 37dbd64..defb932 100644
+--- a/fs/isofs/compress.c
++++ b/fs/isofs/compress.c
+@@ -72,6 +72,17 @@ static int zisofs_readpage(struct file *file, struct page *page)
+ 	offset = index & ~zisofs_block_page_mask;
+ 	blockindex = offset >> zisofs_block_page_shift;
+ 	maxpage = (inode->i_size + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
++
++	/*
++	 * If this page is wholly outside i_size we just return zero;
++	 * do_generic_file_read() will handle this for us
++	 */
++	if (page->index >= maxpage) {
++		SetPageUptodate(page);
++		unlock_page(page);
++		return 0;
++	}
++
+ 	maxpage = min(zisofs_block_pages, maxpage-offset);
+ 
+ 	for ( i = 0 ; i < maxpage ; i++, offset++ ) {
+diff --git a/fs/jbd/recovery.c b/fs/jbd/recovery.c
+index c5d9694..9aaa4fa 100644
+--- a/fs/jbd/recovery.c
++++ b/fs/jbd/recovery.c
+@@ -478,7 +478,7 @@ static int do_one_pass(journal_t *journal,
+ 					memcpy(nbh->b_data, obh->b_data,
+ 							journal->j_blocksize);
+ 					if (flags & JFS_FLAG_ESCAPE) {
+-						*((__be32 *)bh->b_data) =
++						*((__be32 *)nbh->b_data) =
+ 						cpu_to_be32(JFS_MAGIC_NUMBER);
+ 					}
+ 
+diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c
+index d0ce627..fa0d4e9 100644
+--- a/fs/jbd2/recovery.c
++++ b/fs/jbd2/recovery.c
+@@ -488,7 +488,7 @@ static int do_one_pass(journal_t *journal,
+ 					memcpy(nbh->b_data, obh->b_data,
+ 							journal->j_blocksize);
+ 					if (flags & JBD2_FLAG_ESCAPE) {
+-						*((__be32 *)bh->b_data) =
++						*((__be32 *)nbh->b_data) =
+ 						cpu_to_be32(JBD2_MAGIC_NUMBER);
+ 					}
+ 
+diff --git a/fs/nfsd/nfsfh.c b/fs/nfsd/nfsfh.c
+index 468f17a..429cec2 100644
+--- a/fs/nfsd/nfsfh.c
++++ b/fs/nfsd/nfsfh.c
+@@ -231,6 +231,7 @@ fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, int access)
+ 		fhp->fh_dentry = dentry;
+ 		fhp->fh_export = exp;
+ 		nfsd_nr_verified++;
++		cache_get(&exp->h);
+ 	} else {
+ 		/*
+ 		 * just rechecking permissions
+@@ -240,6 +241,7 @@ fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, int access)
+ 		dprintk("nfsd: fh_verify - just checking\n");
+ 		dentry = fhp->fh_dentry;
+ 		exp = fhp->fh_export;
++		cache_get(&exp->h);
+ 		/*
+ 		 * Set user creds for this exportpoint; necessary even
+ 		 * in the "just checking" case because this may be a
+@@ -251,8 +253,6 @@ fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, int access)
+ 		if (error)
+ 			goto out;
+ 	}
+-	cache_get(&exp->h);
+-
+ 
+ 	error = nfsd_mode_check(rqstp, dentry->d_inode->i_mode, type);
+ 	if (error)
+diff --git a/fs/ufs/util.h b/fs/ufs/util.h
+index b26fc4d..23ceed8 100644
+--- a/fs/ufs/util.h
++++ b/fs/ufs/util.h
+@@ -58,7 +58,7 @@ ufs_set_fs_state(struct super_block *sb, struct ufs_super_block_first *usb1,
+ {
+ 	switch (UFS_SB(sb)->s_flags & UFS_ST_MASK) {
+ 	case UFS_ST_SUNOS:
+-		if (fs32_to_cpu(sb, usb3->fs_postblformat == UFS_42POSTBLFMT)) {
++		if (fs32_to_cpu(sb, usb3->fs_postblformat) == UFS_42POSTBLFMT) {
+ 			usb1->fs_u0.fs_sun.fs_state = cpu_to_fs32(sb, value);
+ 			break;
+ 		}
+diff --git a/include/asm-arm/arch-pxa/pxa-regs.h b/include/asm-arm/arch-pxa/pxa-regs.h
+index 1bd398d..c12c294 100644
+--- a/include/asm-arm/arch-pxa/pxa-regs.h
++++ b/include/asm-arm/arch-pxa/pxa-regs.h
+@@ -1669,6 +1669,7 @@
+ #define SSCR1_RSRE		(1 << 20)	/* Receive Service Request Enable */
+ #define SSCR1_TINTE		(1 << 19)	/* Receiver Time-out Interrupt enable */
+ #define SSCR1_PINTE		(1 << 18)	/* Peripheral Trailing Byte Interupt Enable */
++#define SSCR1_IFS		(1 << 16)	/* Invert Frame Signal */
+ #define SSCR1_STRF		(1 << 15)	/* Select FIFO or EFWR */
+ #define SSCR1_EFWR		(1 << 14)	/* Enable FIFO Write/Read */
+ 
+diff --git a/include/asm-x86/apic_32.h b/include/asm-x86/apic_32.h
+index be158b2..04fbe7f 100644
+--- a/include/asm-x86/apic_32.h
++++ b/include/asm-x86/apic_32.h
+@@ -109,7 +109,7 @@ extern void setup_boot_APIC_clock (void);
+ extern void setup_secondary_APIC_clock (void);
+ extern int APIC_init_uniprocessor (void);
+ 
+-extern void enable_NMI_through_LVT0 (void * dummy);
++extern void enable_NMI_through_LVT0(void);
+ 
+ #define ARCH_APICTIMER_STOPS_ON_C3	1
+ 
+diff --git a/include/asm-x86/futex_32.h b/include/asm-x86/futex_32.h
+index 438ef0e..80964fd 100644
+--- a/include/asm-x86/futex_32.h
++++ b/include/asm-x86/futex_32.h
+@@ -28,7 +28,7 @@
+ "1:	movl	%2, %0\n\
+ 	movl	%0, %3\n"					\
+ 	insn "\n"						\
+-"2:	" LOCK_PREFIX "cmpxchgl %3, %2\n\
++"2:	lock ; cmpxchgl %3, %2\n\
+ 	jnz	1b\n\
+ 3:	.section .fixup,\"ax\"\n\
+ 4:	mov	%5, %1\n\
+@@ -68,7 +68,7 @@ futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
+ #endif
+ 		switch (op) {
+ 		case FUTEX_OP_ADD:
+-			__futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret,
++			__futex_atomic_op1("lock ; xaddl %0, %2", ret,
+ 					   oldval, uaddr, oparg);
+ 			break;
+ 		case FUTEX_OP_OR:
+@@ -111,7 +111,7 @@ futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval, int newval)
+ 		return -EFAULT;
+ 
+ 	__asm__ __volatile__(
+-		"1:	" LOCK_PREFIX "cmpxchgl %3, %1		\n"
++		"1:	lock ; cmpxchgl %3, %1			\n"
+ 
+ 		"2:	.section .fixup, \"ax\"			\n"
+ 		"3:	mov     %2, %0				\n"
+diff --git a/include/asm-x86/futex_64.h b/include/asm-x86/futex_64.h
+index 5cdfb08..423c051 100644
+--- a/include/asm-x86/futex_64.h
++++ b/include/asm-x86/futex_64.h
+@@ -27,7 +27,7 @@
+ "1:	movl	%2, %0\n\
+ 	movl	%0, %3\n"					\
+ 	insn "\n"						\
+-"2:	" LOCK_PREFIX "cmpxchgl %3, %2\n\
++"2:	lock ; cmpxchgl %3, %2\n\
+ 	jnz	1b\n\
+ 3:	.section .fixup,\"ax\"\n\
+ 4:	mov	%5, %1\n\
+@@ -62,7 +62,7 @@ futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
+ 		__futex_atomic_op1("xchgl %0, %2", ret, oldval, uaddr, oparg);
+ 		break;
+ 	case FUTEX_OP_ADD:
+-		__futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret, oldval,
++		__futex_atomic_op1("lock ; xaddl %0, %2", ret, oldval,
+ 				   uaddr, oparg);
+ 		break;
+ 	case FUTEX_OP_OR:
+@@ -101,7 +101,7 @@ futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval, int newval)
+ 		return -EFAULT;
+ 
+ 	__asm__ __volatile__(
+-		"1:	" LOCK_PREFIX "cmpxchgl %3, %1		\n"
++		"1:	lock ; cmpxchgl %3, %1			\n"
+ 
+ 		"2:	.section .fixup, \"ax\"			\n"
+ 		"3:	mov     %2, %0				\n"
+diff --git a/include/asm-x86/io_apic_64.h b/include/asm-x86/io_apic_64.h
+index e2c1367..1913ad0 100644
+--- a/include/asm-x86/io_apic_64.h
++++ b/include/asm-x86/io_apic_64.h
+@@ -129,7 +129,7 @@ extern int io_apic_set_pci_routing (int ioapic, int pin, int irq, int, int);
+ 
+ extern int sis_apic_bug; /* dummy */ 
+ 
+-void enable_NMI_through_LVT0 (void * dummy);
++void enable_NMI_through_LVT0(void);
+ 
+ extern spinlock_t i8259A_lock;
+ 
+diff --git a/include/asm-x86/processor_32.h b/include/asm-x86/processor_32.h
+index 13976b0..787ee2e 100644
+--- a/include/asm-x86/processor_32.h
++++ b/include/asm-x86/processor_32.h
+@@ -712,9 +712,10 @@ static inline unsigned int cpuid_edx(unsigned int op)
+ #define ASM_NOP6 K7_NOP6
+ #define ASM_NOP7 K7_NOP7
+ #define ASM_NOP8 K7_NOP8
+-#elif defined(CONFIG_M686) || defined(CONFIG_MPENTIUMII) || \
++#elif (defined(CONFIG_M686) || defined(CONFIG_MPENTIUMII) || \
+       defined(CONFIG_MPENTIUMIII) || defined(CONFIG_MPENTIUMM) || \
+-      defined(CONFIG_MCORE2) || defined(CONFIG_PENTIUM4)
++      defined(CONFIG_MCORE2) || defined(CONFIG_PENTIUM4)) && \
++      !defined(CONFIG_X86_GENERIC)
+ #define ASM_NOP1 P6_NOP1
+ #define ASM_NOP2 P6_NOP2
+ #define ASM_NOP3 P6_NOP3
+diff --git a/include/linux/Kbuild b/include/linux/Kbuild
+index 4b32bb1..f30fa92 100644
+--- a/include/linux/Kbuild
++++ b/include/linux/Kbuild
+@@ -217,7 +217,6 @@ unifdef-y += i2o-dev.h
+ unifdef-y += icmp.h
+ unifdef-y += icmpv6.h
+ unifdef-y += if_addr.h
+-unifdef-y += if_addrlabel.h
+ unifdef-y += if_arp.h
+ unifdef-y += if_bridge.h
+ unifdef-y += if_ec.h
+diff --git a/include/linux/futex.h b/include/linux/futex.h
+index 92d420f..e5f3b84 100644
+--- a/include/linux/futex.h
++++ b/include/linux/futex.h
+@@ -153,6 +153,7 @@ union futex_key {
+ #ifdef CONFIG_FUTEX
+ extern void exit_robust_list(struct task_struct *curr);
+ extern void exit_pi_state_list(struct task_struct *curr);
++extern int futex_cmpxchg_enabled;
+ #else
+ static inline void exit_robust_list(struct task_struct *curr)
+ {
+diff --git a/include/linux/irq.h b/include/linux/irq.h
+index 4669be0..1fc1cb8 100644
+--- a/include/linux/irq.h
++++ b/include/linux/irq.h
+@@ -367,6 +367,9 @@ set_irq_chained_handler(unsigned int irq,
+ 	__set_irq_handler(irq, handle, 1, NULL);
+ }
+ 
++extern void set_irq_noprobe(unsigned int irq);
++extern void set_irq_probe(unsigned int irq);
++
+ /* Handle dynamic irq creation and destruction */
+ extern int create_irq(void);
+ extern void destroy_irq(unsigned int irq);
+diff --git a/include/linux/moduleparam.h b/include/linux/moduleparam.h
+index 13410b2..c1d64c2 100644
+--- a/include/linux/moduleparam.h
++++ b/include/linux/moduleparam.h
+@@ -62,6 +62,16 @@ struct kparam_array
+ 	void *elem;
+ };
+ 
++/* On alpha, ia64 and ppc64 relocations to global data cannot go into
++   read-only sections (which is part of respective UNIX ABI on these
++   platforms). So 'const' makes no sense and even causes compile failures
++   with some compilers. */
++#if defined(CONFIG_ALPHA) || defined(CONFIG_IA64) || defined(CONFIG_PPC64)
++#define __moduleparam_const
++#else
++#define __moduleparam_const const
++#endif
++
+ /* This is the fundamental function for registering boot/module
+    parameters.  perm sets the visibility in sysfs: 000 means it's
+    not there, read bits mean it's readable, write bits mean it's
+@@ -71,7 +81,7 @@ struct kparam_array
+ 	static int __param_perm_check_##name __attribute__((unused)) =	\
+ 	BUILD_BUG_ON_ZERO((perm) < 0 || (perm) > 0777 || ((perm) & 2));	\
+ 	static const char __param_str_##name[] = prefix #name;		\
+-	static struct kernel_param const __param_##name			\
++	static struct kernel_param __moduleparam_const __param_##name	\
+ 	__attribute_used__						\
+     __attribute__ ((unused,__section__ ("__param"),aligned(sizeof(void *)))) \
+ 	= { __param_str_##name, perm, set, get, { arg } }
+diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
+index 70013c5..89cd011 100644
+--- a/include/net/inet_sock.h
++++ b/include/net/inet_sock.h
+@@ -175,7 +175,8 @@ extern void build_ehash_secret(void);
+ static inline unsigned int inet_ehashfn(const __be32 laddr, const __u16 lport,
+ 					const __be32 faddr, const __be16 fport)
+ {
+-	return jhash_2words((__force __u32) laddr ^ (__force __u32) faddr,
++	return jhash_3words((__force __u32) laddr,
++			    (__force __u32) faddr,
+ 			    ((__u32) lport) << 16 | (__force __u32)fport,
+ 			    inet_ehash_secret);
+ }
+diff --git a/kernel/futex.c b/kernel/futex.c
+index 55d78b5..d166080 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -60,6 +60,8 @@
+ 
+ #include "rtmutex_common.h"
+ 
++int __read_mostly futex_cmpxchg_enabled;
++
+ #define FUTEX_HASHBITS (CONFIG_BASE_SMALL ? 4 : 8)
+ 
+ /*
+@@ -466,6 +468,8 @@ void exit_pi_state_list(struct task_struct *curr)
+ 	struct futex_hash_bucket *hb;
+ 	union futex_key key;
+ 
++	if (!futex_cmpxchg_enabled)
++		return;
+ 	/*
+ 	 * We are a ZOMBIE and nobody can enqueue itself on
+ 	 * pi_state_list anymore, but we have to be careful
+@@ -1854,6 +1858,8 @@ asmlinkage long
+ sys_set_robust_list(struct robust_list_head __user *head,
+ 		    size_t len)
+ {
++	if (!futex_cmpxchg_enabled)
++		return -ENOSYS;
+ 	/*
+ 	 * The kernel knows only one size for now:
+ 	 */
+@@ -1878,6 +1884,9 @@ sys_get_robust_list(int pid, struct robust_list_head __user * __user *head_ptr,
+ 	struct robust_list_head __user *head;
+ 	unsigned long ret;
+ 
++	if (!futex_cmpxchg_enabled)
++		return -ENOSYS;
++
+ 	if (!pid)
+ 		head = current->robust_list;
+ 	else {
+@@ -1980,6 +1989,9 @@ void exit_robust_list(struct task_struct *curr)
+ 	unsigned long futex_offset;
+ 	int rc;
+ 
++	if (!futex_cmpxchg_enabled)
++		return;
++
+ 	/*
+ 	 * Fetch the list head (which was registered earlier, via
+ 	 * sys_set_robust_list()):
+@@ -2034,7 +2046,7 @@ void exit_robust_list(struct task_struct *curr)
+ long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
+ 		u32 __user *uaddr2, u32 val2, u32 val3)
+ {
+-	int ret;
++	int ret = -ENOSYS;
+ 	int cmd = op & FUTEX_CMD_MASK;
+ 	struct rw_semaphore *fshared = NULL;
+ 
+@@ -2062,13 +2074,16 @@ long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
+ 		ret = futex_wake_op(uaddr, fshared, uaddr2, val, val2, val3);
+ 		break;
+ 	case FUTEX_LOCK_PI:
+-		ret = futex_lock_pi(uaddr, fshared, val, timeout, 0);
++		if (futex_cmpxchg_enabled)
++			ret = futex_lock_pi(uaddr, fshared, val, timeout, 0);
+ 		break;
+ 	case FUTEX_UNLOCK_PI:
+-		ret = futex_unlock_pi(uaddr, fshared);
++		if (futex_cmpxchg_enabled)
++			ret = futex_unlock_pi(uaddr, fshared);
+ 		break;
+ 	case FUTEX_TRYLOCK_PI:
+-		ret = futex_lock_pi(uaddr, fshared, 0, timeout, 1);
++		if (futex_cmpxchg_enabled)
++			ret = futex_lock_pi(uaddr, fshared, 0, timeout, 1);
+ 		break;
+ 	default:
+ 		ret = -ENOSYS;
+@@ -2123,8 +2138,29 @@ static struct file_system_type futex_fs_type = {
+ 
+ static int __init init(void)
+ {
+-	int i = register_filesystem(&futex_fs_type);
++	u32 curval;
++	int i;
++
++	/*
++	 * This will fail and we want it. Some arch implementations do
++	 * runtime detection of the futex_atomic_cmpxchg_inatomic()
++	 * functionality. We want to know that before we call in any
++	 * of the complex code paths. Also we want to prevent
++	 * registration of robust lists in that case. NULL is
++	 * guaranteed to fault and we get -EFAULT on functional
++	 * implementation, the non functional ones will return
++	 * -ENOSYS.
++	 */
++	curval = cmpxchg_futex_value_locked(NULL, 0, 0);
++	if (curval == -EFAULT)
++		futex_cmpxchg_enabled = 1;
+ 
++	for (i = 0; i < ARRAY_SIZE(futex_queues); i++) {
++		plist_head_init(&futex_queues[i].chain, &futex_queues[i].lock);
++		spin_lock_init(&futex_queues[i].lock);
++	}
++
++	i = register_filesystem(&futex_fs_type);
+ 	if (i)
+ 		return i;
+ 
+@@ -2134,10 +2170,6 @@ static int __init init(void)
+ 		return PTR_ERR(futex_mnt);
+ 	}
+ 
+-	for (i = 0; i < ARRAY_SIZE(futex_queues); i++) {
+-		plist_head_init(&futex_queues[i].chain, &futex_queues[i].lock);
+-		spin_lock_init(&futex_queues[i].lock);
+-	}
+ 	return 0;
+ }
+ __initcall(init);
+diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c
+index 8682c79..d95f79b 100644
+--- a/kernel/futex_compat.c
++++ b/kernel/futex_compat.c
+@@ -54,6 +54,9 @@ void compat_exit_robust_list(struct task_struct *curr)
+ 	compat_long_t futex_offset;
+ 	int rc;
+ 
++	if (!futex_cmpxchg_enabled)
++		return;
++
+ 	/*
+ 	 * Fetch the list head (which was registered earlier, via
+ 	 * sys_set_robust_list()):
+@@ -115,6 +118,9 @@ asmlinkage long
+ compat_sys_set_robust_list(struct compat_robust_list_head __user *head,
+ 			   compat_size_t len)
+ {
++	if (!futex_cmpxchg_enabled)
++		return -ENOSYS;
++
+ 	if (unlikely(len != sizeof(*head)))
+ 		return -EINVAL;
+ 
+@@ -130,6 +136,9 @@ compat_sys_get_robust_list(int pid, compat_uptr_t __user *head_ptr,
+ 	struct compat_robust_list_head __user *head;
+ 	unsigned long ret;
+ 
++	if (!futex_cmpxchg_enabled)
++		return -ENOSYS;
++
+ 	if (!pid)
+ 		head = current->compat_robust_list;
+ 	else {
+diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
+index 465c69c..e4e1c99 100644
+--- a/kernel/irq/chip.c
++++ b/kernel/irq/chip.c
+@@ -607,3 +607,39 @@ set_irq_chip_and_handler_name(unsigned int irq, struct irq_chip *chip,
+ 	set_irq_chip(irq, chip);
+ 	__set_irq_handler(irq, handle, 0, name);
+ }
++
++void __init set_irq_noprobe(unsigned int irq)
++{
++	struct irq_desc *desc;
++	unsigned long flags;
++
++	if (irq >= NR_IRQS) {
++		printk(KERN_ERR "Trying to mark IRQ%d non-probeable\n", irq);
++
++		return;
++	}
++
++	desc = irq_desc + irq;
++
++	spin_lock_irqsave(&desc->lock, flags);
++	desc->status |= IRQ_NOPROBE;
++	spin_unlock_irqrestore(&desc->lock, flags);
++}
++
++void __init set_irq_probe(unsigned int irq)
++{
++	struct irq_desc *desc;
++	unsigned long flags;
++
++	if (irq >= NR_IRQS) {
++		printk(KERN_ERR "Trying to mark IRQ%d probeable\n", irq);
++
++		return;
++	}
++
++	desc = irq_desc + irq;
++
++	spin_lock_irqsave(&desc->lock, flags);
++	desc->status &= ~IRQ_NOPROBE;
++	spin_unlock_irqrestore(&desc->lock, flags);
++}
+diff --git a/kernel/relay.c b/kernel/relay.c
+index 7c03733..889102a 100644
+--- a/kernel/relay.c
++++ b/kernel/relay.c
+@@ -1072,7 +1072,7 @@ static int subbuf_splice_actor(struct file *in,
+ 			       unsigned int flags,
+ 			       int *nonpad_ret)
+ {
+-	unsigned int pidx, poff, total_len, subbuf_pages, ret;
++	unsigned int pidx, poff, total_len, subbuf_pages, nr_pages, ret;
+ 	struct rchan_buf *rbuf = in->private_data;
+ 	unsigned int subbuf_size = rbuf->chan->subbuf_size;
+ 	uint64_t pos = (uint64_t) *ppos;
+@@ -1103,8 +1103,9 @@ static int subbuf_splice_actor(struct file *in,
+ 	subbuf_pages = rbuf->chan->alloc_size >> PAGE_SHIFT;
+ 	pidx = (read_start / PAGE_SIZE) % subbuf_pages;
+ 	poff = read_start & ~PAGE_MASK;
++	nr_pages = min_t(unsigned int, subbuf_pages, PIPE_BUFFERS);
+ 
+-	for (total_len = 0; spd.nr_pages < subbuf_pages; spd.nr_pages++) {
++	for (total_len = 0; spd.nr_pages < nr_pages; spd.nr_pages++) {
+ 		unsigned int this_len, this_end, private;
+ 		unsigned int cur_pos = read_start + total_len;
+ 
+diff --git a/kernel/sched.c b/kernel/sched.c
+index e76b11c..5ba5db9 100644
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -4028,11 +4028,10 @@ void rt_mutex_setprio(struct task_struct *p, int prio)
+ 	oldprio = p->prio;
+ 	on_rq = p->se.on_rq;
+ 	running = task_current(rq, p);
+-	if (on_rq) {
++	if (on_rq)
+ 		dequeue_task(rq, p, 0);
+-		if (running)
+-			p->sched_class->put_prev_task(rq, p);
+-	}
++	if (running)
++		p->sched_class->put_prev_task(rq, p);
+ 
+ 	if (rt_prio(prio))
+ 		p->sched_class = &rt_sched_class;
+@@ -4041,9 +4040,9 @@ void rt_mutex_setprio(struct task_struct *p, int prio)
+ 
+ 	p->prio = prio;
+ 
++	if (running)
++		p->sched_class->set_curr_task(rq);
+ 	if (on_rq) {
+-		if (running)
+-			p->sched_class->set_curr_task(rq);
+ 		enqueue_task(rq, p, 0);
+ 		/*
+ 		 * Reschedule if we are currently running on this runqueue and
+@@ -4339,18 +4338,17 @@ recheck:
+ 	update_rq_clock(rq);
+ 	on_rq = p->se.on_rq;
+ 	running = task_current(rq, p);
+-	if (on_rq) {
++	if (on_rq)
+ 		deactivate_task(rq, p, 0);
+-		if (running)
+-			p->sched_class->put_prev_task(rq, p);
+-	}
++	if (running)
++		p->sched_class->put_prev_task(rq, p);
+ 
+ 	oldprio = p->prio;
+ 	__setscheduler(rq, p, policy, param->sched_priority);
+ 
++	if (running)
++		p->sched_class->set_curr_task(rq);
+ 	if (on_rq) {
+-		if (running)
+-			p->sched_class->set_curr_task(rq);
+ 		activate_task(rq, p, 0);
+ 		/*
+ 		 * Reschedule if we are currently running on this runqueue and
+@@ -7110,19 +7108,17 @@ void sched_move_task(struct task_struct *tsk)
+ 	running = task_current(rq, tsk);
+ 	on_rq = tsk->se.on_rq;
+ 
+-	if (on_rq) {
++	if (on_rq)
+ 		dequeue_task(rq, tsk, 0);
+-		if (unlikely(running))
+-			tsk->sched_class->put_prev_task(rq, tsk);
+-	}
++	if (unlikely(running))
++		tsk->sched_class->put_prev_task(rq, tsk);
+ 
+ 	set_task_cfs_rq(tsk, task_cpu(tsk));
+ 
+-	if (on_rq) {
+-		if (unlikely(running))
+-			tsk->sched_class->set_curr_task(rq);
++	if (unlikely(running))
++		tsk->sched_class->set_curr_task(rq);
++	if (on_rq)
+ 		enqueue_task(rq, tsk, 0);
+-	}
+ 
+ done:
+ 	task_rq_unlock(rq, &flags);
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index e3e0ee3..397ff8c 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -306,7 +306,7 @@ static struct ctl_table kern_table[] = {
+ 		.procname	= "sched_nr_migrate",
+ 		.data		= &sysctl_sched_nr_migrate,
+ 		.maxlen		= sizeof(unsigned int),
+-		.mode		= 644,
++		.mode		= 0644,
+ 		.proc_handler	= &proc_dointvec,
+ 	},
+ #endif
+diff --git a/mm/filemap.c b/mm/filemap.c
+index 69430d2..76b036f 100644
+--- a/mm/filemap.c
++++ b/mm/filemap.c
+@@ -1725,21 +1725,27 @@ size_t iov_iter_copy_from_user(struct page *page,
+ }
+ EXPORT_SYMBOL(iov_iter_copy_from_user);
+ 
+-static void __iov_iter_advance_iov(struct iov_iter *i, size_t bytes)
++void iov_iter_advance(struct iov_iter *i, size_t bytes)
+ {
++	BUG_ON(i->count < bytes);
++
+ 	if (likely(i->nr_segs == 1)) {
+ 		i->iov_offset += bytes;
++		i->count -= bytes;
+ 	} else {
+ 		const struct iovec *iov = i->iov;
+ 		size_t base = i->iov_offset;
+ 
+ 		/*
+ 		 * The !iov->iov_len check ensures we skip over unlikely
+-		 * zero-length segments.
++		 * zero-length segments (without overruning the iovec).
+ 		 */
+-		while (bytes || !iov->iov_len) {
+-			int copy = min(bytes, iov->iov_len - base);
++		while (bytes || unlikely(!iov->iov_len && i->count)) {
++			int copy;
+ 
++			copy = min(bytes, iov->iov_len - base);
++			BUG_ON(!i->count || i->count < copy);
++			i->count -= copy;
+ 			bytes -= copy;
+ 			base += copy;
+ 			if (iov->iov_len == base) {
+@@ -1751,14 +1757,6 @@ static void __iov_iter_advance_iov(struct iov_iter *i, size_t bytes)
+ 		i->iov_offset = base;
+ 	}
+ }
+-
+-void iov_iter_advance(struct iov_iter *i, size_t bytes)
+-{
+-	BUG_ON(i->count < bytes);
+-
+-	__iov_iter_advance_iov(i, bytes);
+-	i->count -= bytes;
+-}
+ EXPORT_SYMBOL(iov_iter_advance);
+ 
+ /*
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 9c746cb..d95ce35 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -119,6 +119,7 @@ static void free_huge_page(struct page *page)
+ 	struct address_space *mapping;
+ 
+ 	mapping = (struct address_space *) page_private(page);
++	set_page_private(page, 0);
+ 	BUG_ON(page_count(page));
+ 	INIT_LIST_HEAD(&page->lru);
+ 
+@@ -133,7 +134,6 @@ static void free_huge_page(struct page *page)
+ 	spin_unlock(&hugetlb_lock);
+ 	if (mapping)
+ 		hugetlb_put_quota(mapping, 1);
+-	set_page_private(page, 0);
+ }
+ 
+ /*
+diff --git a/mm/slab.c b/mm/slab.c
+index ff31261..79c3be0 100644
+--- a/mm/slab.c
++++ b/mm/slab.c
+@@ -2961,11 +2961,10 @@ static void *cache_alloc_refill(struct kmem_cache *cachep, gfp_t flags)
+ 	struct array_cache *ac;
+ 	int node;
+ 
+-	node = numa_node_id();
+-
++retry:
+ 	check_irq_off();
++	node = numa_node_id();
+ 	ac = cpu_cache_get(cachep);
+-retry:
+ 	batchcount = ac->batchcount;
+ 	if (!ac->touched && batchcount > BATCHREFILL_LIMIT) {
+ 		/*
+diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
+index 2726adc..e13cf5e 100644
+--- a/net/bluetooth/hci_sysfs.c
++++ b/net/bluetooth/hci_sysfs.c
+@@ -282,6 +282,7 @@ static void add_conn(struct work_struct *work)
+ 	int i;
+ 
+ 	flush_workqueue(btdelconn);
++
+ 	if (device_add(&conn->dev) < 0) {
+ 		BT_ERR("Failed to register connection device");
+ 		return;
+@@ -317,7 +318,6 @@ void hci_conn_add_sysfs(struct hci_conn *conn)
+ 	INIT_WORK(&conn->work, add_conn);
+ 
+ 	queue_work(btaddconn, &conn->work);
+-	schedule_work(&conn->work);
+ }
+ 
+ static int __match_tty(struct device *dev, void *data)
+@@ -354,7 +354,6 @@ void hci_conn_del_sysfs(struct hci_conn *conn)
+ 	INIT_WORK(&conn->work, del_conn);
+ 
+ 	queue_work(btdelconn, &conn->work);
+-	schedule_work(&conn->work);
+ }
+ 
+ int hci_register_sysfs(struct hci_dev *hdev)
+@@ -408,6 +407,7 @@ int __init bt_sysfs_init(void)
+ 		err = -ENOMEM;
+ 		goto out;
+ 	}
++
+ 	btdelconn = create_singlethread_workqueue("btdelconn");
+ 	if (!btdelconn) {
+ 		err = -ENOMEM;
+@@ -447,8 +447,12 @@ out:
+ void bt_sysfs_cleanup(void)
+ {
+ 	destroy_workqueue(btaddconn);
++
+ 	destroy_workqueue(btdelconn);
++
+ 	class_destroy(bt_class);
++
+ 	bus_unregister(&bt_bus);
++
+ 	platform_device_unregister(bt_platform);
+ }
+diff --git a/net/bridge/netfilter/ebt_dnat.c b/net/bridge/netfilter/ebt_dnat.c
+index 74262e9..1024511 100644
+--- a/net/bridge/netfilter/ebt_dnat.c
++++ b/net/bridge/netfilter/ebt_dnat.c
+@@ -20,8 +20,8 @@ static int ebt_target_dnat(struct sk_buff *skb, unsigned int hooknr,
+ {
+ 	struct ebt_nat_info *info = (struct ebt_nat_info *)data;
+ 
+-	if (skb_make_writable(skb, 0))
+-		return NF_DROP;
++	if (!skb_make_writable(skb, 0))
++		return EBT_DROP;
+ 
+ 	memcpy(eth_hdr(skb)->h_dest, info->mac, ETH_ALEN);
+ 	return info->target;
+diff --git a/net/bridge/netfilter/ebt_redirect.c b/net/bridge/netfilter/ebt_redirect.c
+index 422cb83..88afc34 100644
+--- a/net/bridge/netfilter/ebt_redirect.c
++++ b/net/bridge/netfilter/ebt_redirect.c
+@@ -21,8 +21,8 @@ static int ebt_target_redirect(struct sk_buff *skb, unsigned int hooknr,
+ {
+ 	struct ebt_redirect_info *info = (struct ebt_redirect_info *)data;
+ 
+-	if (skb_make_writable(skb, 0))
+-		return NF_DROP;
++	if (!skb_make_writable(skb, 0))
++		return EBT_DROP;
+ 
+ 	if (hooknr != NF_BR_BROUTING)
+ 		memcpy(eth_hdr(skb)->h_dest,
+diff --git a/net/bridge/netfilter/ebt_snat.c b/net/bridge/netfilter/ebt_snat.c
+index 425ac92..4c5a5a9 100644
+--- a/net/bridge/netfilter/ebt_snat.c
++++ b/net/bridge/netfilter/ebt_snat.c
+@@ -22,8 +22,8 @@ static int ebt_target_snat(struct sk_buff *skb, unsigned int hooknr,
+ {
+ 	struct ebt_nat_info *info = (struct ebt_nat_info *) data;
+ 
+-	if (skb_make_writable(skb, 0))
+-		return NF_DROP;
++	if (!skb_make_writable(skb, 0))
++		return EBT_DROP;
+ 
+ 	memcpy(eth_hdr(skb)->h_source, info->mac, ETH_ALEN);
+ 	if (!(info->target & NAT_ARP_BIT) &&
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 0879f52..4d44372 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -1068,8 +1068,6 @@ int dev_close(struct net_device *dev)
+ 	 */
+ 	call_netdevice_notifiers(NETDEV_GOING_DOWN, dev);
+ 
+-	dev_deactivate(dev);
+-
+ 	clear_bit(__LINK_STATE_START, &dev->state);
+ 
+ 	/* Synchronize to scheduled poll. We cannot touch poll list,
+@@ -1080,6 +1078,8 @@ int dev_close(struct net_device *dev)
+ 	 */
+ 	smp_mb__after_clear_bit(); /* Commit netif_running(). */
+ 
++	dev_deactivate(dev);
++
+ 	/*
+ 	 *	Call the device specific close. This cannot fail.
+ 	 *	Only if device is UP
+@@ -2906,7 +2906,7 @@ int __dev_addr_add(struct dev_addr_list **list, int *count,
+ 		}
+ 	}
+ 
+-	da = kmalloc(sizeof(*da), GFP_ATOMIC);
++	da = kzalloc(sizeof(*da), GFP_ATOMIC);
+ 	if (da == NULL)
+ 		return -ENOMEM;
+ 	memcpy(da->da_addr, addr, alen);
+diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
+index 82817e5..7794e17 100644
+--- a/net/ipv4/ip_sockglue.c
++++ b/net/ipv4/ip_sockglue.c
+@@ -514,11 +514,6 @@ static int do_ip_setsockopt(struct sock *sk, int level,
+ 			val &= ~3;
+ 			val |= inet->tos & 3;
+ 		}
+-		if (IPTOS_PREC(val) >= IPTOS_PREC_CRITIC_ECP &&
+-		    !capable(CAP_NET_ADMIN)) {
+-			err = -EPERM;
+-			break;
+-		}
+ 		if (inet->tos != val) {
+ 			inet->tos = val;
+ 			sk->sk_priority = rt_tos2priority(val);
+diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
+index 80cab8c..b284b4e 100644
+--- a/net/ipv4/ipcomp.c
++++ b/net/ipv4/ipcomp.c
+@@ -108,8 +108,11 @@ static int ipcomp_compress(struct xfrm_state *x, struct sk_buff *skb)
+ 	const int cpu = get_cpu();
+ 	u8 *scratch = *per_cpu_ptr(ipcomp_scratches, cpu);
+ 	struct crypto_comp *tfm = *per_cpu_ptr(ipcd->tfms, cpu);
+-	int err = crypto_comp_compress(tfm, start, plen, scratch, &dlen);
++	int err;
+ 
++	local_bh_disable();
++	err = crypto_comp_compress(tfm, start, plen, scratch, &dlen);
++	local_bh_enable();
+ 	if (err)
+ 		goto out;
+ 
+diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
+index b8f7763..15dc11e 100644
+--- a/net/ipv4/ipconfig.c
++++ b/net/ipv4/ipconfig.c
+@@ -739,9 +739,9 @@ static void __init ic_bootp_send_if(struct ic_device *d, unsigned long jiffies_d
+ 		printk("Unknown ARP type 0x%04x for device %s\n", dev->type, dev->name);
+ 		b->htype = dev->type; /* can cause undefined behavior */
+ 	}
++
++	/* server_ip and your_ip address are both already zero per RFC2131 */
+ 	b->hlen = dev->addr_len;
+-	b->your_ip = NONE;
+-	b->server_ip = NONE;
+ 	memcpy(b->hw_addr, dev->dev_addr, dev->addr_len);
+ 	b->secs = htons(jiffies_diff / HZ);
+ 	b->xid = d->xid;
+diff --git a/net/ipv4/netfilter/arpt_mangle.c b/net/ipv4/netfilter/arpt_mangle.c
+index 45fa4e2..3f4222b 100644
+--- a/net/ipv4/netfilter/arpt_mangle.c
++++ b/net/ipv4/netfilter/arpt_mangle.c
+@@ -19,7 +19,7 @@ target(struct sk_buff *skb,
+ 	unsigned char *arpptr;
+ 	int pln, hln;
+ 
+-	if (skb_make_writable(skb, skb->len))
++	if (!skb_make_writable(skb, skb->len))
+ 		return NF_DROP;
+ 
+ 	arp = arp_hdr(skb);
+diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
+index 14d64a3..16d0fb3 100644
+--- a/net/ipv4/netfilter/ip_queue.c
++++ b/net/ipv4/netfilter/ip_queue.c
+@@ -336,8 +336,8 @@ static int
+ ipq_mangle_ipv4(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
+ {
+ 	int diff;
+-	int err;
+ 	struct iphdr *user_iph = (struct iphdr *)v->payload;
++	struct sk_buff *nskb;
+ 
+ 	if (v->data_len < sizeof(*user_iph))
+ 		return 0;
+@@ -349,14 +349,16 @@ ipq_mangle_ipv4(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
+ 		if (v->data_len > 0xFFFF)
+ 			return -EINVAL;
+ 		if (diff > skb_tailroom(e->skb)) {
+-			err = pskb_expand_head(e->skb, 0,
++			nskb = skb_copy_expand(e->skb, 0,
+ 					       diff - skb_tailroom(e->skb),
+ 					       GFP_ATOMIC);
+-			if (err) {
++			if (!nskb) {
+ 				printk(KERN_WARNING "ip_queue: error "
+-				      "in mangle, dropping packet: %d\n", -err);
+-				return err;
++				      "in mangle, dropping packet\n");
++				return -ENOMEM;
+ 			}
++			kfree_skb(e->skb);
++			e->skb = nskb;
+ 		}
+ 		skb_put(e->skb, diff);
+ 	}
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 2f59baa..5b4095b 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -593,7 +593,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
+ 	 * or if the skb it not generated by a local socket.  (This last
+ 	 * check should be redundant, but it's free.)
+ 	 */
+-	if (!np || np->pmtudisc >= IPV6_PMTUDISC_DO) {
++	if (!skb->local_df) {
+ 		skb->dev = skb->dst->dev;
+ 		icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
+ 		IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_FRAGFAILS);
+@@ -1389,6 +1389,10 @@ int ip6_push_pending_frames(struct sock *sk)
+ 		tmp_skb->sk = NULL;
+ 	}
+ 
++	/* Allow local fragmentation. */
++	if (np->pmtudisc < IPV6_PMTUDISC_DO)
++		skb->local_df = 1;
++
+ 	ipv6_addr_copy(final_dst, &fl->fl6_dst);
+ 	__skb_pull(skb, skb_network_header_len(skb));
+ 	if (opt && opt->opt_flen)
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index 5383b33..81941a1 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -550,6 +550,7 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
+ 			ip_rt_put(rt);
+ 			goto out;
+ 		}
++		skb2->dst = (struct dst_entry *)rt;
+ 	} else {
+ 		ip_rt_put(rt);
+ 		if (ip_route_input(skb2, eiph->daddr, eiph->saddr, eiph->tos,
+diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
+index 1c5b09f..f46c38f 100644
+--- a/net/ipv6/ipcomp6.c
++++ b/net/ipv6/ipcomp6.c
+@@ -146,7 +146,9 @@ static int ipcomp6_output(struct xfrm_state *x, struct sk_buff *skb)
+ 	scratch = *per_cpu_ptr(ipcomp6_scratches, cpu);
+ 	tfm = *per_cpu_ptr(ipcd->tfms, cpu);
+ 
++	local_bh_disable();
+ 	err = crypto_comp_compress(tfm, start, plen, scratch, &dlen);
++	local_bh_enable();
+ 	if (err || (dlen + sizeof(*ipch)) >= plen) {
+ 		put_cpu();
+ 		goto out_ok;
+diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
+index e273605..710a04f 100644
+--- a/net/ipv6/netfilter/ip6_queue.c
++++ b/net/ipv6/netfilter/ip6_queue.c
+@@ -333,8 +333,8 @@ static int
+ ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
+ {
+ 	int diff;
+-	int err;
+ 	struct ipv6hdr *user_iph = (struct ipv6hdr *)v->payload;
++	struct sk_buff *nskb;
+ 
+ 	if (v->data_len < sizeof(*user_iph))
+ 		return 0;
+@@ -346,14 +346,16 @@ ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
+ 		if (v->data_len > 0xFFFF)
+ 			return -EINVAL;
+ 		if (diff > skb_tailroom(e->skb)) {
+-			err = pskb_expand_head(e->skb, 0,
++			nskb = skb_copy_expand(e->skb, 0,
+ 					       diff - skb_tailroom(e->skb),
+ 					       GFP_ATOMIC);
+-			if (err) {
++			if (!nskb) {
+ 				printk(KERN_WARNING "ip6_queue: OOM "
+ 				      "in mangle, dropping packet\n");
+-				return err;
++				return -ENOMEM;
+ 			}
++			kfree_skb(e->skb);
++			e->skb = nskb;
+ 		}
+ 		skb_put(e->skb, diff);
+ 	}
+diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
+index 6569767..dc22909 100644
+--- a/net/ipv6/xfrm6_output.c
++++ b/net/ipv6/xfrm6_output.c
+@@ -34,7 +34,7 @@ static int xfrm6_tunnel_check_size(struct sk_buff *skb)
+ 	if (mtu < IPV6_MIN_MTU)
+ 		mtu = IPV6_MIN_MTU;
+ 
+-	if (skb->len > mtu) {
++	if (!skb->local_df && skb->len > mtu) {
+ 		skb->dev = dst->dev;
+ 		icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
+ 		ret = -EMSGSIZE;
+diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
+index 2c7bd2e..dc43df1 100644
+--- a/net/netfilter/nfnetlink_log.c
++++ b/net/netfilter/nfnetlink_log.c
+@@ -594,7 +594,7 @@ nfulnl_log_packet(unsigned int pf,
+ 	/* FIXME: do we want to make the size calculation conditional based on
+ 	 * what is actually present?  way more branches and checks, but more
+ 	 * memory efficient... */
+-	size =    NLMSG_ALIGN(sizeof(struct nfgenmsg))
++	size =    NLMSG_SPACE(sizeof(struct nfgenmsg))
+ 		+ nla_total_size(sizeof(struct nfulnl_msg_packet_hdr))
+ 		+ nla_total_size(sizeof(u_int32_t))	/* ifindex */
+ 		+ nla_total_size(sizeof(u_int32_t))	/* ifindex */
+diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
+index 3ceeffc..7c3646c 100644
+--- a/net/netfilter/nfnetlink_queue.c
++++ b/net/netfilter/nfnetlink_queue.c
+@@ -353,7 +353,7 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
+ 
+ 	QDEBUG("entered\n");
+ 
+-	size =    NLMSG_ALIGN(sizeof(struct nfgenmsg))
++	size =    NLMSG_SPACE(sizeof(struct nfgenmsg))
+ 		+ nla_total_size(sizeof(struct nfqnl_msg_packet_hdr))
+ 		+ nla_total_size(sizeof(u_int32_t))	/* ifindex */
+ 		+ nla_total_size(sizeof(u_int32_t))	/* ifindex */
+@@ -616,8 +616,8 @@ err_out_put:
+ static int
+ nfqnl_mangle(void *data, int data_len, struct nfqnl_queue_entry *e)
+ {
++	struct sk_buff *nskb;
+ 	int diff;
+-	int err;
+ 
+ 	diff = data_len - e->skb->len;
+ 	if (diff < 0) {
+@@ -627,14 +627,16 @@ nfqnl_mangle(void *data, int data_len, struct nfqnl_queue_entry *e)
+ 		if (data_len > 0xFFFF)
+ 			return -EINVAL;
+ 		if (diff > skb_tailroom(e->skb)) {
+-			err = pskb_expand_head(e->skb, 0,
++			nskb = skb_copy_expand(e->skb, 0,
+ 					       diff - skb_tailroom(e->skb),
+ 					       GFP_ATOMIC);
+-			if (err) {
++			if (!nskb) {
+ 				printk(KERN_WARNING "nf_queue: OOM "
+ 				      "in mangle, dropping packet\n");
+-				return err;
++				return -ENOMEM;
+ 			}
++			kfree_skb(e->skb);
++			e->skb = nskb;
+ 		}
+ 		skb_put(e->skb, diff);
+ 	}
+diff --git a/net/netfilter/xt_time.c b/net/netfilter/xt_time.c
+index f9c55dc..5222a97 100644
+--- a/net/netfilter/xt_time.c
++++ b/net/netfilter/xt_time.c
+@@ -95,8 +95,11 @@ static inline void localtime_2(struct xtm *r, time_t time)
+ 	 */
+ 	r->dse = time / 86400;
+ 
+-	/* 1970-01-01 (w=0) was a Thursday (4). */
+-	r->weekday = (4 + r->dse) % 7;
++	/*
++	 * 1970-01-01 (w=0) was a Thursday (4).
++	 * -1 and +1 map Sunday properly onto 7.
++	 */
++	r->weekday = (4 + r->dse - 1) % 7 + 1;
+ }
+ 
+ static void localtime_3(struct xtm *r, time_t time)
+diff --git a/security/commoncap.c b/security/commoncap.c
+index ea61bc7..e87422e 100644
+--- a/security/commoncap.c
++++ b/security/commoncap.c
+@@ -539,7 +539,7 @@ int cap_task_kill(struct task_struct *p, struct siginfo *info,
+ 	 * allowed.
+ 	 * We must preserve legacy signal behavior in this case.
+ 	 */
+-	if (p->euid == 0 && p->uid == current->uid)
++	if (p->uid == current->uid)
+ 		return 0;
+ 
+ 	/* sigcont is permitted within same session */

Added: genpatches-2.6/trunk/2.6.24/1004_linux-2.6.24.5.patch
===================================================================
--- genpatches-2.6/trunk/2.6.24/1004_linux-2.6.24.5.patch	                        (rev 0)
+++ genpatches-2.6/trunk/2.6.24/1004_linux-2.6.24.5.patch	2008-04-19 09:58:26 UTC (rev 1296)
@@ -0,0 +1,2396 @@
+diff --git a/Makefile b/Makefile
+index 254de79..822d1ba 100644
+--- a/Makefile
++++ b/Makefile
+@@ -189,7 +189,7 @@ SUBARCH := $(shell uname -m | sed -e s/i.86/i386/ -e s/sun4u/sparc64/ \
+ # Alternatively CROSS_COMPILE can be set in the environment.
+ # Default value for CROSS_COMPILE is not to prefix executables
+ # Note: Some architectures assign CROSS_COMPILE in their arch/*/Makefile
+-
++export KBUILD_BUILDHOST := $(SUBARCH)
+ ARCH		?= $(SUBARCH)
+ CROSS_COMPILE	?=
+ 
+diff --git a/arch/parisc/kernel/firmware.c b/arch/parisc/kernel/firmware.c
+index 4ab83d5..7177a6c 100644
+--- a/arch/parisc/kernel/firmware.c
++++ b/arch/parisc/kernel/firmware.c
+@@ -1080,6 +1080,9 @@ void pdc_io_reset_devices(void)
+ 	spin_unlock_irqrestore(&pdc_lock, flags);
+ }
+ 
++/* locked by pdc_console_lock */
++static int __attribute__((aligned(8)))   iodc_retbuf[32];
++static char __attribute__((aligned(64))) iodc_dbuf[4096];
+ 
+ /**
+  * pdc_iodc_print - Console print using IODC.
+@@ -1091,24 +1094,20 @@ void pdc_io_reset_devices(void)
+  * Since the HP console requires CR+LF to perform a 'newline', we translate
+  * "\n" to "\r\n".
+  */
+-int pdc_iodc_print(unsigned char *str, unsigned count)
++int pdc_iodc_print(const unsigned char *str, unsigned count)
+ {
+-	/* XXX Should we spinlock posx usage */
+ 	static int posx;        /* for simple TAB-Simulation... */
+-	int __attribute__((aligned(8)))   iodc_retbuf[32];
+-	char __attribute__((aligned(64))) iodc_dbuf[4096];
+ 	unsigned int i;
+ 	unsigned long flags;
+ 
+-	memset(iodc_dbuf, 0, 4096);
+-	for (i = 0; i < count && i < 2048;) {
++	for (i = 0; i < count && i < 79;) {
+ 		switch(str[i]) {
+ 		case '\n':
+ 			iodc_dbuf[i+0] = '\r';
+ 			iodc_dbuf[i+1] = '\n';
+ 			i += 2;
+ 			posx = 0;
+-			break;
++			goto print;
+ 		case '\t':
+ 			while (posx & 7) {
+ 				iodc_dbuf[i] = ' ';
+@@ -1124,6 +1123,16 @@ int pdc_iodc_print(unsigned char *str, unsigned count)
+ 		}
+ 	}
+ 
++	/* if we're at the end of line, and not already inserting a newline,
++	 * insert one anyway. iodc console doesn't claim to support >79 char
++	 * lines. don't account for this in the return value.
++	 */
++	if (i == 79 && iodc_dbuf[i-1] != '\n') {
++		iodc_dbuf[i+0] = '\r';
++		iodc_dbuf[i+1] = '\n';
++	}
++
++print:
+         spin_lock_irqsave(&pdc_lock, flags);
+         real32_call(PAGE0->mem_cons.iodc_io,
+                     (unsigned long)PAGE0->mem_cons.hpa, ENTRY_IO_COUT,
+@@ -1142,11 +1151,9 @@ int pdc_iodc_print(unsigned char *str, unsigned count)
+  */
+ int pdc_iodc_getc(void)
+ {
+-	unsigned long flags;
+-        static int __attribute__((aligned(8)))   iodc_retbuf[32];
+-        static char __attribute__((aligned(64))) iodc_dbuf[4096];
+ 	int ch;
+ 	int status;
++	unsigned long flags;
+ 
+ 	/* Bail if no console input device. */
+ 	if (!PAGE0->mem_kbd.iodc_io)
+diff --git a/arch/parisc/kernel/pdc_cons.c b/arch/parisc/kernel/pdc_cons.c
+index 33b1f84..7f471a4 100644
+--- a/arch/parisc/kernel/pdc_cons.c
++++ b/arch/parisc/kernel/pdc_cons.c
+@@ -52,10 +52,18 @@
+ #include <linux/tty.h>
+ #include <asm/pdc.h>		/* for iodc_call() proto and friends */
+ 
++static spinlock_t pdc_console_lock = SPIN_LOCK_UNLOCKED;
+ 
+ static void pdc_console_write(struct console *co, const char *s, unsigned count)
+ {
+-	pdc_iodc_print(s, count);
++	int i = 0;
++	unsigned long flags;
++
++	spin_lock_irqsave(&pdc_console_lock, flags);
++	do {
++		i += pdc_iodc_print(s + i, count - i);
++	} while (i < count);
++	spin_unlock_irqrestore(&pdc_console_lock, flags);
+ }
+ 
+ void pdc_printf(const char *fmt, ...)
+@@ -73,7 +81,14 @@ void pdc_printf(const char *fmt, ...)
+ 
+ int pdc_console_poll_key(struct console *co)
+ {
+-	return pdc_iodc_getc();
++	int c;
++	unsigned long flags;
++
++	spin_lock_irqsave(&pdc_console_lock, flags);
++	c = pdc_iodc_getc();
++	spin_unlock_irqrestore(&pdc_console_lock, flags);
++
++	return c;
+ }
+ 
+ static int pdc_console_setup(struct console *co, char *options)
+diff --git a/arch/parisc/kernel/signal.c b/arch/parisc/kernel/signal.c
+index 2ce3806..e060d26 100644
+--- a/arch/parisc/kernel/signal.c
++++ b/arch/parisc/kernel/signal.c
+@@ -534,7 +534,8 @@ insert_restart_trampoline(struct pt_regs *regs)
+ 		 * Flushing one cacheline is cheap.
+ 		 * "sync" on bigger (> 4 way) boxes is not.
+ 		 */
+-		flush_icache_range(regs->gr[30], regs->gr[30] + 4);
++		flush_user_dcache_range(regs->gr[30], regs->gr[30] + 4);
++		flush_user_icache_range(regs->gr[30], regs->gr[30] + 4);
+ 
+ 		regs->gr[31] = regs->gr[30] + 8;
+ 		/* Preserve original r28. */
+diff --git a/arch/sparc64/kernel/ptrace.c b/arch/sparc64/kernel/ptrace.c
+index 81111a1..d4af131 100644
+--- a/arch/sparc64/kernel/ptrace.c
++++ b/arch/sparc64/kernel/ptrace.c
+@@ -127,6 +127,8 @@ void flush_ptrace_access(struct vm_area_struct *vma, struct page *page,
+ 	if (tlb_type == hypervisor)
+ 		return;
+ 
++	preempt_disable();
++
+ #ifdef DCACHE_ALIASING_POSSIBLE
+ 	/* If bit 13 of the kernel address we used to access the
+ 	 * user page is the same as the virtual address that page
+@@ -165,6 +167,8 @@ void flush_ptrace_access(struct vm_area_struct *vma, struct page *page,
+ 		for (; start < end; start += icache_line_size)
+ 			flushi(start);
+ 	}
++
++	preempt_enable();
+ }
+ 
+ asmlinkage void do_ptrace(struct pt_regs *regs)
+diff --git a/arch/sparc64/kernel/signal.c b/arch/sparc64/kernel/signal.c
+index fb13775..48afa08 100644
+--- a/arch/sparc64/kernel/signal.c
++++ b/arch/sparc64/kernel/signal.c
+@@ -354,7 +354,7 @@ static int invalid_frame_pointer(void __user *fp, int fplen)
+ static inline int
+ save_fpu_state(struct pt_regs *regs, __siginfo_fpu_t __user *fpu)
+ {
+-	unsigned long *fpregs = (unsigned long *)(regs+1);
++	unsigned long *fpregs = current_thread_info()->fpregs;
+ 	unsigned long fprs;
+ 	int err = 0;
+ 	
+diff --git a/arch/sparc64/mm/tlb.c b/arch/sparc64/mm/tlb.c
+index 3f10fc9..a0f000b 100644
+--- a/arch/sparc64/mm/tlb.c
++++ b/arch/sparc64/mm/tlb.c
+@@ -23,10 +23,11 @@ DEFINE_PER_CPU(struct mmu_gather, mmu_gathers) = { 0, };
+ 
+ void flush_tlb_pending(void)
+ {
+-	struct mmu_gather *mp = &__get_cpu_var(mmu_gathers);
++	struct mmu_gather *mp;
+ 
+ 	preempt_disable();
+ 
++	mp = &__get_cpu_var(mmu_gathers);
+ 	if (mp->tlb_nr) {
+ 		flush_tsb_user(mp);
+ 
+diff --git a/arch/x86/kernel/machine_kexec_64.c b/arch/x86/kernel/machine_kexec_64.c
+index aa3d2c8..1f09cd9 100644
+--- a/arch/x86/kernel/machine_kexec_64.c
++++ b/arch/x86/kernel/machine_kexec_64.c
+@@ -233,6 +233,7 @@ NORET_TYPE void machine_kexec(struct kimage *image)
+ 
+ void arch_crash_save_vmcoreinfo(void)
+ {
++	VMCOREINFO_SYMBOL(phys_base);
+ 	VMCOREINFO_SYMBOL(init_level4_pgt);
+ 
+ #ifdef CONFIG_ARCH_DISCONTIGMEM_ENABLE
+diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
+index 79ad152..f177f86 100644
+--- a/arch/x86/xen/enlighten.c
++++ b/arch/x86/xen/enlighten.c
+@@ -95,7 +95,7 @@ struct shared_info *HYPERVISOR_shared_info = (void *)&dummy_shared_info;
+  *
+  * 0: not available, 1: available
+  */
+-static int have_vcpu_info_placement = 0;
++static int have_vcpu_info_placement = 1;
+ 
+ static void __init xen_vcpu_setup(int cpu)
+ {
+@@ -103,6 +103,7 @@ static void __init xen_vcpu_setup(int cpu)
+ 	int err;
+ 	struct vcpu_info *vcpup;
+ 
++	BUG_ON(HYPERVISOR_shared_info == &dummy_shared_info);
+ 	per_cpu(xen_vcpu, cpu) = &HYPERVISOR_shared_info->vcpu_info[cpu];
+ 
+ 	if (!have_vcpu_info_placement)
+@@ -153,6 +154,7 @@ static void xen_cpuid(unsigned int *eax, unsigned int *ebx,
+ 	if (*eax == 1)
+ 		maskedx = ~((1 << X86_FEATURE_APIC) |  /* disable APIC */
+ 			    (1 << X86_FEATURE_ACPI) |  /* disable ACPI */
++			    (1 << X86_FEATURE_SEP)  |  /* disable SEP */
+ 			    (1 << X86_FEATURE_ACC));   /* thermal monitoring */
+ 
+ 	asm(XEN_EMULATE_PREFIX "cpuid"
+@@ -791,30 +793,40 @@ static __init void xen_pagetable_setup_start(pgd_t *base)
+ 	xen_write_cr3(__pa(base));
+ }
+ 
+-static __init void xen_pagetable_setup_done(pgd_t *base)
++static __init void setup_shared_info(void)
+ {
+-	/* This will work as long as patching hasn't happened yet
+-	   (which it hasn't) */
+-	pv_mmu_ops.alloc_pt = xen_alloc_pt;
+-	pv_mmu_ops.set_pte = xen_set_pte;
+-
+ 	if (!xen_feature(XENFEAT_auto_translated_physmap)) {
++		unsigned long addr = fix_to_virt(FIX_PARAVIRT_BOOTMAP);
++
+ 		/*
+ 		 * Create a mapping for the shared info page.
+ 		 * Should be set_fixmap(), but shared_info is a machine
+ 		 * address with no corresponding pseudo-phys address.
+ 		 */
+-		set_pte_mfn(fix_to_virt(FIX_PARAVIRT_BOOTMAP),
++		set_pte_mfn(addr,
+ 			    PFN_DOWN(xen_start_info->shared_info),
+ 			    PAGE_KERNEL);
+ 
+-		HYPERVISOR_shared_info =
+-			(struct shared_info *)fix_to_virt(FIX_PARAVIRT_BOOTMAP);
+-
++		HYPERVISOR_shared_info = (struct shared_info *)addr;
+ 	} else
+ 		HYPERVISOR_shared_info =
+ 			(struct shared_info *)__va(xen_start_info->shared_info);
+ 
++#ifndef CONFIG_SMP
++	/* In UP this is as good a place as any to set up shared info */
++	xen_setup_vcpu_info_placement();
++#endif
++}
++
++static __init void xen_pagetable_setup_done(pgd_t *base)
++{
++	/* This will work as long as patching hasn't happened yet
++	   (which it hasn't) */
++	pv_mmu_ops.alloc_pt = xen_alloc_pt;
++	pv_mmu_ops.set_pte = xen_set_pte;
++
++	setup_shared_info();
++
+ 	/* Actually pin the pagetable down, but we can't set PG_pinned
+ 	   yet because the page structures don't exist yet. */
+ 	{
+@@ -1165,15 +1177,9 @@ asmlinkage void __init xen_start_kernel(void)
+ 	x86_write_percpu(xen_cr3, __pa(pgd));
+ 	x86_write_percpu(xen_current_cr3, __pa(pgd));
+ 
+-#ifdef CONFIG_SMP
+ 	/* Don't do the full vcpu_info placement stuff until we have a
+-	   possible map. */
++	   possible map and a non-dummy shared_info. */
+ 	per_cpu(xen_vcpu, 0) = &HYPERVISOR_shared_info->vcpu_info[0];
+-#else
+-	/* May as well do it now, since there's no good time to call
+-	   it later on UP. */
+-	xen_setup_vcpu_info_placement();
+-#endif
+ 
+ 	pv_info.kernel_rpl = 1;
+ 	if (xen_feature(XENFEAT_supervisor_mode_kernel))
+diff --git a/arch/x86/xen/xen-asm.S b/arch/x86/xen/xen-asm.S
+index 1a43b60..6b71904 100644
+--- a/arch/x86/xen/xen-asm.S
++++ b/arch/x86/xen/xen-asm.S
+@@ -33,12 +33,17 @@
+ 	events, then enter the hypervisor to get them handled.
+  */
+ ENTRY(xen_irq_enable_direct)
+-	/* Clear mask and test pending */
+-	andw $0x00ff, PER_CPU_VAR(xen_vcpu_info)+XEN_vcpu_info_pending
++	/* Unmask events */
++	movb $0, PER_CPU_VAR(xen_vcpu_info)+XEN_vcpu_info_mask
++
+ 	/* Preempt here doesn't matter because that will deal with
+ 	   any pending interrupts.  The pending check may end up being
+ 	   run on the wrong CPU, but that doesn't hurt. */
++
++	/* Test for pending */
++	testb $0xff, PER_CPU_VAR(xen_vcpu_info)+XEN_vcpu_info_pending
+ 	jz 1f
++
+ 2:	call check_events
+ 1:
+ ENDPATCH(xen_irq_enable_direct)
+diff --git a/crypto/xcbc.c b/crypto/xcbc.c
+index a957373..25a1537 100644
+--- a/crypto/xcbc.c
++++ b/crypto/xcbc.c
+@@ -116,13 +116,11 @@ static int crypto_xcbc_digest_update2(struct hash_desc *pdesc,
+ 	struct crypto_xcbc_ctx *ctx = crypto_hash_ctx_aligned(parent);
+ 	struct crypto_cipher *tfm = ctx->child;
+ 	int bs = crypto_hash_blocksize(parent);
+-	unsigned int i = 0;
+ 
+-	do {
+-
+-		struct page *pg = sg_page(&sg[i]);
+-		unsigned int offset = sg[i].offset;
+-		unsigned int slen = sg[i].length;
++	for (;;) {
++		struct page *pg = sg_page(sg);
++		unsigned int offset = sg->offset;
++		unsigned int slen = sg->length;
+ 
+ 		if (unlikely(slen > nbytes))
+ 			slen = nbytes;
+@@ -182,8 +180,11 @@ static int crypto_xcbc_digest_update2(struct hash_desc *pdesc,
+ 			offset = 0;
+ 			pg++;
+ 		}
+-		i++;
+-	} while (nbytes>0);
++
++		if (!nbytes)
++			break;
++		sg = sg_next(sg);
++	}
+ 
+ 	return 0;
+ }
+diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
+index f4487c3..3401e2c 100644
+--- a/drivers/acpi/bus.c
++++ b/drivers/acpi/bus.c
+@@ -350,10 +350,11 @@ int acpi_bus_receive_event(struct acpi_bus_event *event)
+ 	}
+ 
+ 	spin_lock_irqsave(&acpi_bus_event_lock, flags);
+-	entry =
+-	    list_entry(acpi_bus_event_list.next, struct acpi_bus_event, node);
+-	if (entry)
++	if (!list_empty(&acpi_bus_event_list)) {
++		entry = list_entry(acpi_bus_event_list.next,
++				   struct acpi_bus_event, node);
+ 		list_del(&entry->node);
++	}
+ 	spin_unlock_irqrestore(&acpi_bus_event_lock, flags);
+ 
+ 	if (!entry)
+diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
+index e48ee4f..021153f 100644
+--- a/drivers/acpi/processor_core.c
++++ b/drivers/acpi/processor_core.c
+@@ -792,7 +792,7 @@ static int acpi_processor_remove(struct acpi_device *device, int type)
+ 	acpi_processor_remove_fs(device);
+ 
+ 	processors[pr->id] = NULL;
+-
++	processor_device_array[pr->id] = NULL;
+ 	kfree(pr);
+ 
+ 	return 0;
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 6380726..455a98c 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -1936,24 +1936,34 @@ int ata_dev_read_id(struct ata_device *dev, unsigned int *p_class,
+ 				     id, sizeof(id[0]) * ATA_ID_WORDS, 0);
+ 	if (err_mask) {
+ 		if (err_mask & AC_ERR_NODEV_HINT) {
+-			DPRINTK("ata%u.%d: NODEV after polling detection\n",
+-				ap->print_id, dev->devno);
++			ata_dev_printk(dev, KERN_DEBUG,
++				       "NODEV after polling detection\n");
+ 			return -ENOENT;
+ 		}
+ 
+-		/* Device or controller might have reported the wrong
+-		 * device class.  Give a shot at the other IDENTIFY if
+-		 * the current one is aborted by the device.
+-		 */
+-		if (may_fallback &&
+-		    (err_mask == AC_ERR_DEV) && (tf.feature & ATA_ABORTED)) {
+-			may_fallback = 0;
++		if ((err_mask == AC_ERR_DEV) && (tf.feature & ATA_ABORTED)) {
++			/* Device or controller might have reported
++			 * the wrong device class.  Give a shot at the
++			 * other IDENTIFY if the current one is
++			 * aborted by the device.
++			 */
++			if (may_fallback) {
++				may_fallback = 0;
+ 
+-			if (class == ATA_DEV_ATA)
+-				class = ATA_DEV_ATAPI;
+-			else
+-				class = ATA_DEV_ATA;
+-			goto retry;
++				if (class == ATA_DEV_ATA)
++					class = ATA_DEV_ATAPI;
++				else
++					class = ATA_DEV_ATA;
++				goto retry;
++			}
++
++			/* Control reaches here iff the device aborted
++			 * both flavors of IDENTIFYs which happens
++			 * sometimes with phantom devices.
++			 */
++			ata_dev_printk(dev, KERN_DEBUG,
++				       "both IDENTIFYs aborted, assuming NODEV\n");
++			return -ENOENT;
+ 		}
+ 
+ 		rc = -EIO;
+diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
+index b2fb6ba..1c6440b 100644
+--- a/drivers/firmware/dmi_scan.c
++++ b/drivers/firmware/dmi_scan.c
+@@ -219,7 +219,7 @@ static void __init dmi_save_ipmi_device(const struct dmi_header *dm)
+ 	dev->name = "IPMI controller";
+ 	dev->device_data = data;
+ 
+-	list_add(&dev->list, &dmi_devices);
++	list_add_tail(&dev->list, &dmi_devices);
+ }
+ 
+ /*
+diff --git a/drivers/hwmon/w83781d.c b/drivers/hwmon/w83781d.c
+index e0fa752..92c0a7f 100644
+--- a/drivers/hwmon/w83781d.c
++++ b/drivers/hwmon/w83781d.c
+@@ -1380,7 +1380,8 @@ w83781d_isa_probe(struct platform_device *pdev)
+ 
+ 	/* Reserve the ISA region */
+ 	res = platform_get_resource(pdev, IORESOURCE_IO, 0);
+-	if (!request_region(res->start, W83781D_EXTENT, "w83781d")) {
++	if (!request_region(res->start + W83781D_ADDR_REG_OFFSET, 2,
++			    "w83781d")) {
+ 		err = -EBUSY;
+ 		goto exit;
+ 	}
+@@ -1432,7 +1433,7 @@ w83781d_isa_probe(struct platform_device *pdev)
+ 	device_remove_file(&pdev->dev, &dev_attr_name);
+ 	kfree(data);
+  exit_release_region:
+-	release_region(res->start, W83781D_EXTENT);
++	release_region(res->start + W83781D_ADDR_REG_OFFSET, 2);
+  exit:
+ 	return err;
+ }
+@@ -1446,7 +1447,7 @@ w83781d_isa_remove(struct platform_device *pdev)
+ 	sysfs_remove_group(&pdev->dev.kobj, &w83781d_group);
+ 	sysfs_remove_group(&pdev->dev.kobj, &w83781d_group_opt);
+ 	device_remove_file(&pdev->dev, &dev_attr_name);
+-	release_region(data->client.addr, W83781D_EXTENT);
++	release_region(data->client.addr + W83781D_ADDR_REG_OFFSET, 2);
+ 	kfree(data);
+ 
+ 	return 0;
+@@ -1820,8 +1821,17 @@ w83781d_isa_found(unsigned short address)
+ {
+ 	int val, save, found = 0;
+ 
+-	if (!request_region(address, W83781D_EXTENT, "w83781d"))
++	/* We have to request the region in two parts because some
++	   boards declare base+4 to base+7 as a PNP device */
++	if (!request_region(address, 4, "w83781d")) {
++		pr_debug("w83781d: Failed to request low part of region\n");
+ 		return 0;
++	}
++	if (!request_region(address + 4, 4, "w83781d")) {
++		pr_debug("w83781d: Failed to request high part of region\n");
++		release_region(address, 4);
++		return 0;
++	}
+ 
+ #define REALLY_SLOW_IO
+ 	/* We need the timeouts for at least some W83781D-like
+@@ -1896,7 +1906,8 @@ w83781d_isa_found(unsigned short address)
+ 			val == 0x30 ? "W83782D" : "W83781D", (int)address);
+ 
+  release:
+-	release_region(address, W83781D_EXTENT);
++	release_region(address + 4, 4);
++	release_region(address, 4);
+ 	return found;
+ }
+ 
+diff --git a/drivers/macintosh/via-pmu.c b/drivers/macintosh/via-pmu.c
+index 6123c70..8932906 100644
+--- a/drivers/macintosh/via-pmu.c
++++ b/drivers/macintosh/via-pmu.c
+@@ -2842,7 +2842,7 @@ EXPORT_SYMBOL(pmu_wait_complete);
+ EXPORT_SYMBOL(pmu_suspend);
+ EXPORT_SYMBOL(pmu_resume);
+ EXPORT_SYMBOL(pmu_unlock);
+-#if defined(CONFIG_PM_SLEEP) && defined(CONFIG_PPC32)
++#if defined(CONFIG_PPC32)
+ EXPORT_SYMBOL(pmu_enable_irled);
+ EXPORT_SYMBOL(pmu_battery_count);
+ EXPORT_SYMBOL(pmu_batteries);
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index cef9ebd..5113e8d 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -1847,17 +1847,6 @@ static struct rdev_sysfs_entry rdev_state =
+ __ATTR(state, S_IRUGO|S_IWUSR, state_show, state_store);
+ 
+ static ssize_t
+-super_show(mdk_rdev_t *rdev, char *page)
+-{
+-	if (rdev->sb_loaded && rdev->sb_size) {
+-		memcpy(page, page_address(rdev->sb_page), rdev->sb_size);
+-		return rdev->sb_size;
+-	} else
+-		return 0;
+-}
+-static struct rdev_sysfs_entry rdev_super = __ATTR_RO(super);
+-
+-static ssize_t
+ errors_show(mdk_rdev_t *rdev, char *page)
+ {
+ 	return sprintf(page, "%d\n", atomic_read(&rdev->corrected_errors));
+@@ -1959,7 +1948,6 @@ __ATTR(size, S_IRUGO|S_IWUSR, rdev_size_show, rdev_size_store);
+ 
+ static struct attribute *rdev_default_attrs[] = {
+ 	&rdev_state.attr,
+-	&rdev_super.attr,
+ 	&rdev_errors.attr,
+ 	&rdev_slot.attr,
+ 	&rdev_offset.attr,
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index e8c8157..032e36d 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -2348,25 +2348,15 @@ static void handle_issuing_new_write_requests6(raid5_conf_t *conf,
+ static void handle_parity_checks5(raid5_conf_t *conf, struct stripe_head *sh,
+ 				struct stripe_head_state *s, int disks)
+ {
++	int canceled_check = 0;
++
+ 	set_bit(STRIPE_HANDLE, &sh->state);
+-	/* Take one of the following actions:
+-	 * 1/ start a check parity operation if (uptodate == disks)
+-	 * 2/ finish a check parity operation and act on the result
+-	 * 3/ skip to the writeback section if we previously
+-	 *    initiated a recovery operation
+-	 */
+-	if (s->failed == 0 &&
+-	    !test_bit(STRIPE_OP_MOD_REPAIR_PD, &sh->ops.pending)) {
+-		if (!test_and_set_bit(STRIPE_OP_CHECK, &sh->ops.pending)) {
+-			BUG_ON(s->uptodate != disks);
+-			clear_bit(R5_UPTODATE, &sh->dev[sh->pd_idx].flags);
+-			sh->ops.count++;
+-			s->uptodate--;
+-		} else if (
+-		       test_and_clear_bit(STRIPE_OP_CHECK, &sh->ops.complete)) {
+-			clear_bit(STRIPE_OP_CHECK, &sh->ops.ack);
+-			clear_bit(STRIPE_OP_CHECK, &sh->ops.pending);
+ 
++	/* complete a check operation */
++	if (test_and_clear_bit(STRIPE_OP_CHECK, &sh->ops.complete)) {
++	    clear_bit(STRIPE_OP_CHECK, &sh->ops.ack);
++	    clear_bit(STRIPE_OP_CHECK, &sh->ops.pending);
++		if (s->failed == 0) {
+ 			if (sh->ops.zero_sum_result == 0)
+ 				/* parity is correct (on disc,
+ 				 * not in buffer any more)
+@@ -2391,7 +2381,8 @@ static void handle_parity_checks5(raid5_conf_t *conf, struct stripe_head *sh,
+ 					s->uptodate++;
+ 				}
+ 			}
+-		}
++		} else
++			canceled_check = 1; /* STRIPE_INSYNC is not set */
+ 	}
+ 
+ 	/* check if we can clear a parity disk reconstruct */
+@@ -2404,12 +2395,28 @@ static void handle_parity_checks5(raid5_conf_t *conf, struct stripe_head *sh,
+ 		clear_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.pending);
+ 	}
+ 
++	/* start a new check operation if there are no failures, the stripe is
++	 * not insync, and a repair is not in flight
++	 */
++	if (s->failed == 0 &&
++	    !test_bit(STRIPE_INSYNC, &sh->state) &&
++	    !test_bit(STRIPE_OP_MOD_REPAIR_PD, &sh->ops.pending)) {
++		if (!test_and_set_bit(STRIPE_OP_CHECK, &sh->ops.pending)) {
++			BUG_ON(s->uptodate != disks);
++			clear_bit(R5_UPTODATE, &sh->dev[sh->pd_idx].flags);
++			sh->ops.count++;
++			s->uptodate--;
++		}
++	}
++
+ 	/* Wait for check parity and compute block operations to complete
+-	 * before write-back
++	 * before write-back.  If a failure occurred while the check operation
++	 * was in flight we need to cycle this stripe through handle_stripe
++	 * since the parity block may not be uptodate
+ 	 */
+-	if (!test_bit(STRIPE_INSYNC, &sh->state) &&
+-		!test_bit(STRIPE_OP_CHECK, &sh->ops.pending) &&
+-		!test_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.pending)) {
++	if (!canceled_check && !test_bit(STRIPE_INSYNC, &sh->state) &&
++	    !test_bit(STRIPE_OP_CHECK, &sh->ops.pending) &&
++	    !test_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.pending)) {
+ 		struct r5dev *dev;
+ 		/* either failed parity check, or recovery is happening */
+ 		if (s->failed == 0)
+diff --git a/drivers/media/dvb/dvb-usb/ttusb2.c b/drivers/media/dvb/dvb-usb/ttusb2.c
+index 88dc436..3b9da9c 100644
+--- a/drivers/media/dvb/dvb-usb/ttusb2.c
++++ b/drivers/media/dvb/dvb-usb/ttusb2.c
+@@ -144,6 +144,7 @@ static int ttusb2_power_ctrl(struct dvb_usb_device *d, int onoff)
+ static struct tda10086_config tda10086_config = {
+ 	.demod_address = 0x0e,
+ 	.invert = 0,
++	.diseqc_tone = 1,
+ };
+ 
+ static int ttusb2_frontend_attach(struct dvb_usb_adapter *adap)
+diff --git a/drivers/media/dvb/frontends/tda10086.c b/drivers/media/dvb/frontends/tda10086.c
+index 9d26ace..0d2b69a 100644
+--- a/drivers/media/dvb/frontends/tda10086.c
++++ b/drivers/media/dvb/frontends/tda10086.c
+@@ -106,9 +106,12 @@ static int tda10086_write_mask(struct tda10086_state *state, int reg, int mask,
+ static int tda10086_init(struct dvb_frontend* fe)
+ {
+ 	struct tda10086_state* state = fe->demodulator_priv;
++	u8 t22k_off = 0x80;
+ 
+ 	dprintk ("%s\n", __FUNCTION__);
+ 
++	if (state->config->diseqc_tone)
++		t22k_off = 0;
+ 	// reset
+ 	tda10086_write_byte(state, 0x00, 0x00);
+ 	msleep(10);
+@@ -158,7 +161,7 @@ static int tda10086_init(struct dvb_frontend* fe)
+ 	tda10086_write_byte(state, 0x3d, 0x80);
+ 
+ 	// setup SEC
+-	tda10086_write_byte(state, 0x36, 0x80); // all SEC off, no 22k tone
++	tda10086_write_byte(state, 0x36, t22k_off); // all SEC off, 22k tone
+ 	tda10086_write_byte(state, 0x34, (((1<<19) * (22000/1000)) / (SACLK/1000)));      // } tone frequency
+ 	tda10086_write_byte(state, 0x35, (((1<<19) * (22000/1000)) / (SACLK/1000)) >> 8); // }
+ 
+@@ -180,16 +183,20 @@ static void tda10086_diseqc_wait(struct tda10086_state *state)
+ static int tda10086_set_tone (struct dvb_frontend* fe, fe_sec_tone_mode_t tone)
+ {
+ 	struct tda10086_state* state = fe->demodulator_priv;
++	u8 t22k_off = 0x80;
+ 
+ 	dprintk ("%s\n", __FUNCTION__);
+ 
++	if (state->config->diseqc_tone)
++		t22k_off = 0;
++
+ 	switch (tone) {
+ 	case SEC_TONE_OFF:
+-		tda10086_write_byte(state, 0x36, 0x80);
++		tda10086_write_byte(state, 0x36, t22k_off);
+ 		break;
+ 
+ 	case SEC_TONE_ON:
+-		tda10086_write_byte(state, 0x36, 0x81);
++		tda10086_write_byte(state, 0x36, 0x01 + t22k_off);
+ 		break;
+ 	}
+ 
+@@ -202,9 +209,13 @@ static int tda10086_send_master_cmd (struct dvb_frontend* fe,
+ 	struct tda10086_state* state = fe->demodulator_priv;
+ 	int i;
+ 	u8 oldval;
++	u8 t22k_off = 0x80;
+ 
+ 	dprintk ("%s\n", __FUNCTION__);
+ 
++	if (state->config->diseqc_tone)
++		t22k_off = 0;
++
+ 	if (cmd->msg_len > 6)
+ 		return -EINVAL;
+ 	oldval = tda10086_read_byte(state, 0x36);
+@@ -212,7 +223,8 @@ static int tda10086_send_master_cmd (struct dvb_frontend* fe,
+ 	for(i=0; i< cmd->msg_len; i++) {
+ 		tda10086_write_byte(state, 0x48+i, cmd->msg[i]);
+ 	}
+-	tda10086_write_byte(state, 0x36, 0x88 | ((cmd->msg_len - 1) << 4));
++	tda10086_write_byte(state, 0x36, (0x08 + t22k_off)
++					| ((cmd->msg_len - 1) << 4));
+ 
+ 	tda10086_diseqc_wait(state);
+ 
+@@ -225,16 +237,20 @@ static int tda10086_send_burst (struct dvb_frontend* fe, fe_sec_mini_cmd_t minic
+ {
+ 	struct tda10086_state* state = fe->demodulator_priv;
+ 	u8 oldval = tda10086_read_byte(state, 0x36);
++	u8 t22k_off = 0x80;
+ 
+ 	dprintk ("%s\n", __FUNCTION__);
+ 
++	if (state->config->diseqc_tone)
++		t22k_off = 0;
++
+ 	switch(minicmd) {
+ 	case SEC_MINI_A:
+-		tda10086_write_byte(state, 0x36, 0x84);
++		tda10086_write_byte(state, 0x36, 0x04 + t22k_off);
+ 		break;
+ 
+ 	case SEC_MINI_B:
+-		tda10086_write_byte(state, 0x36, 0x86);
++		tda10086_write_byte(state, 0x36, 0x06 + t22k_off);
+ 		break;
+ 	}
+ 
+diff --git a/drivers/media/dvb/frontends/tda10086.h b/drivers/media/dvb/frontends/tda10086.h
+index ed584a8..eeceaee 100644
+--- a/drivers/media/dvb/frontends/tda10086.h
++++ b/drivers/media/dvb/frontends/tda10086.h
+@@ -33,6 +33,9 @@ struct tda10086_config
+ 
+ 	/* does the "inversion" need inverted? */
+ 	u8 invert;
++
++	/* do we need the diseqc signal with carrier? */
++	u8 diseqc_tone;
+ };
+ 
+ #if defined(CONFIG_DVB_TDA10086) || (defined(CONFIG_DVB_TDA10086_MODULE) && defined(MODULE))
+diff --git a/drivers/media/dvb/ttpci/budget.c b/drivers/media/dvb/ttpci/budget.c
+index 9268a82..14b00f5 100644
+--- a/drivers/media/dvb/ttpci/budget.c
++++ b/drivers/media/dvb/ttpci/budget.c
+@@ -351,6 +351,7 @@ static struct s5h1420_config s5h1420_config = {
+ static struct tda10086_config tda10086_config = {
+ 	.demod_address = 0x0e,
+ 	.invert = 0,
++	.diseqc_tone = 1,
+ };
+ 
+ static u8 read_pwm(struct budget* budget)
+diff --git a/drivers/media/video/ivtv/ivtv-driver.c b/drivers/media/video/ivtv/ivtv-driver.c
+index 6d2dd87..9aa5b14 100644
+--- a/drivers/media/video/ivtv/ivtv-driver.c
++++ b/drivers/media/video/ivtv/ivtv-driver.c
+@@ -687,6 +687,9 @@ static int __devinit ivtv_init_struct1(struct ivtv *itv)
+ 	itv->vbi.in.type = V4L2_BUF_TYPE_SLICED_VBI_CAPTURE;
+ 	itv->vbi.sliced_in = &itv->vbi.in.fmt.sliced;
+ 
++	/* Init the sg table for osd/yuv output */
++	sg_init_table(itv->udma.SGlist, IVTV_DMA_SG_OSD_ENT);
++
+ 	/* OSD */
+ 	itv->osd_global_alpha_state = 1;
+ 	itv->osd_global_alpha = 255;
+diff --git a/drivers/media/video/saa7134/saa7134-dvb.c b/drivers/media/video/saa7134/saa7134-dvb.c
+index e1ab099..e204773 100644
+--- a/drivers/media/video/saa7134/saa7134-dvb.c
++++ b/drivers/media/video/saa7134/saa7134-dvb.c
+@@ -826,6 +826,7 @@ static struct tda1004x_config ads_tech_duo_config = {
+ static struct tda10086_config flydvbs = {
+ 	.demod_address = 0x0e,
+ 	.invert = 0,
++	.diseqc_tone = 0,
+ };
+ 
+ /* ==================================================================
+diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
+index 1707f98..dbbe9a7 100644
+--- a/drivers/mtd/chips/cfi_cmdset_0001.c
++++ b/drivers/mtd/chips/cfi_cmdset_0001.c
+@@ -669,7 +669,7 @@ static int chip_ready (struct map_info *map, struct flchip *chip, unsigned long
+ 			/* Someone else might have been playing with it. */
+ 			return -EAGAIN;
+ 		}
+-
++		/* Fall through */
+ 	case FL_READY:
+ 	case FL_CFI_QUERY:
+ 	case FL_JEDEC_QUERY:
+@@ -729,14 +729,14 @@ static int chip_ready (struct map_info *map, struct flchip *chip, unsigned long
+ 		chip->state = FL_READY;
+ 		return 0;
+ 
++	case FL_SHUTDOWN:
++		/* The machine is rebooting now,so no one can get chip anymore */
++		return -EIO;
+ 	case FL_POINT:
+ 		/* Only if there's no operation suspended... */
+ 		if (mode == FL_READY && chip->oldstate == FL_READY)
+ 			return 0;
+-
+-	case FL_SHUTDOWN:
+-		/* The machine is rebooting now,so no one can get chip anymore */
+-		return -EIO;
++		/* Fall through */
+ 	default:
+ 	sleep:
+ 		set_current_state(TASK_UNINTERRUPTIBLE);
+diff --git a/drivers/mtd/devices/block2mtd.c b/drivers/mtd/devices/block2mtd.c
+index be4b994..84038ca 100644
+--- a/drivers/mtd/devices/block2mtd.c
++++ b/drivers/mtd/devices/block2mtd.c
+@@ -408,7 +408,6 @@ static int block2mtd_setup2(const char *val)
+ 	if (token[1]) {
+ 		ret = parse_num(&erase_size, token[1]);
+ 		if (ret) {
+-			kfree(name);
+ 			parse_err("illegal erase size");
+ 		}
+ 	}
+diff --git a/drivers/net/macb.c b/drivers/net/macb.c
+index c796948..20838f9 100644
+--- a/drivers/net/macb.c
++++ b/drivers/net/macb.c
+@@ -1257,6 +1257,8 @@ static int __devexit macb_remove(struct platform_device *pdev)
+ 
+ 	if (dev) {
+ 		bp = netdev_priv(dev);
++		if (bp->phy_dev)
++			phy_disconnect(bp->phy_dev);
+ 		mdiobus_unregister(&bp->mii_bus);
+ 		kfree(bp->mii_bus.irq);
+ 		unregister_netdev(dev);
+diff --git a/drivers/net/plip.c b/drivers/net/plip.c
+index 57c9866..0f40c00 100644
+--- a/drivers/net/plip.c
++++ b/drivers/net/plip.c
+@@ -903,17 +903,18 @@ plip_interrupt(void *dev_id)
+ 	struct net_local *nl;
+ 	struct plip_local *rcv;
+ 	unsigned char c0;
++	unsigned long flags;
+ 
+ 	nl = netdev_priv(dev);
+ 	rcv = &nl->rcv_data;
+ 
+-	spin_lock_irq (&nl->lock);
++	spin_lock_irqsave (&nl->lock, flags);
+ 
+ 	c0 = read_status(dev);
+ 	if ((c0 & 0xf8) != 0xc0) {
+ 		if ((dev->irq != -1) && (net_debug > 1))
+ 			printk(KERN_DEBUG "%s: spurious interrupt\n", dev->name);
+-		spin_unlock_irq (&nl->lock);
++		spin_unlock_irqrestore (&nl->lock, flags);
+ 		return;
+ 	}
+ 
+@@ -942,7 +943,7 @@ plip_interrupt(void *dev_id)
+ 		break;
+ 	}
+ 
+-	spin_unlock_irq(&nl->lock);
++	spin_unlock_irqrestore(&nl->lock, flags);
+ }
+ 
+ static int
+diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c
+index a7556cd..88a7e4e 100644
+--- a/drivers/net/pppol2tp.c
++++ b/drivers/net/pppol2tp.c
+@@ -302,14 +302,14 @@ pppol2tp_session_find(struct pppol2tp_tunnel *tunnel, u16 session_id)
+ 	struct pppol2tp_session *session;
+ 	struct hlist_node *walk;
+ 
+-	read_lock(&tunnel->hlist_lock);
++	read_lock_bh(&tunnel->hlist_lock);
+ 	hlist_for_each_entry(session, walk, session_list, hlist) {
+ 		if (session->tunnel_addr.s_session == session_id) {
+-			read_unlock(&tunnel->hlist_lock);
++			read_unlock_bh(&tunnel->hlist_lock);
+ 			return session;
+ 		}
+ 	}
+-	read_unlock(&tunnel->hlist_lock);
++	read_unlock_bh(&tunnel->hlist_lock);
+ 
+ 	return NULL;
+ }
+@@ -320,14 +320,14 @@ static struct pppol2tp_tunnel *pppol2tp_tunnel_find(u16 tunnel_id)
+ {
+ 	struct pppol2tp_tunnel *tunnel = NULL;
+ 
+-	read_lock(&pppol2tp_tunnel_list_lock);
++	read_lock_bh(&pppol2tp_tunnel_list_lock);
+ 	list_for_each_entry(tunnel, &pppol2tp_tunnel_list, list) {
+ 		if (tunnel->stats.tunnel_id == tunnel_id) {
+-			read_unlock(&pppol2tp_tunnel_list_lock);
++			read_unlock_bh(&pppol2tp_tunnel_list_lock);
+ 			return tunnel;
+ 		}
+ 	}
+-	read_unlock(&pppol2tp_tunnel_list_lock);
++	read_unlock_bh(&pppol2tp_tunnel_list_lock);
+ 
+ 	return NULL;
+ }
+@@ -342,10 +342,11 @@ static struct pppol2tp_tunnel *pppol2tp_tunnel_find(u16 tunnel_id)
+ static void pppol2tp_recv_queue_skb(struct pppol2tp_session *session, struct sk_buff *skb)
+ {
+ 	struct sk_buff *skbp;
++	struct sk_buff *tmp;
+ 	u16 ns = PPPOL2TP_SKB_CB(skb)->ns;
+ 
+-	spin_lock(&session->reorder_q.lock);
+-	skb_queue_walk(&session->reorder_q, skbp) {
++	spin_lock_bh(&session->reorder_q.lock);
++	skb_queue_walk_safe(&session->reorder_q, skbp, tmp) {
+ 		if (PPPOL2TP_SKB_CB(skbp)->ns > ns) {
+ 			__skb_insert(skb, skbp->prev, skbp, &session->reorder_q);
+ 			PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,
+@@ -360,7 +361,7 @@ static void pppol2tp_recv_queue_skb(struct pppol2tp_session *session, struct sk_
+ 	__skb_queue_tail(&session->reorder_q, skb);
+ 
+ out:
+-	spin_unlock(&session->reorder_q.lock);
++	spin_unlock_bh(&session->reorder_q.lock);
+ }
+ 
+ /* Dequeue a single skb.
+@@ -371,10 +372,9 @@ static void pppol2tp_recv_dequeue_skb(struct pppol2tp_session *session, struct s
+ 	int length = PPPOL2TP_SKB_CB(skb)->length;
+ 	struct sock *session_sock = NULL;
+ 
+-	/* We're about to requeue the skb, so unlink it and return resources
++	/* We're about to requeue the skb, so return resources
+ 	 * to its current owner (a socket receive buffer).
+ 	 */
+-	skb_unlink(skb, &session->reorder_q);
+ 	skb_orphan(skb);
+ 
+ 	tunnel->stats.rx_packets++;
+@@ -442,7 +442,7 @@ static void pppol2tp_recv_dequeue(struct pppol2tp_session *session)
+ 	 * expect to send up next, dequeue it and any other
+ 	 * in-sequence packets behind it.
+ 	 */
+-	spin_lock(&session->reorder_q.lock);
++	spin_lock_bh(&session->reorder_q.lock);
+ 	skb_queue_walk_safe(&session->reorder_q, skb, tmp) {
+ 		if (time_after(jiffies, PPPOL2TP_SKB_CB(skb)->expires)) {
+ 			session->stats.rx_seq_discards++;
+@@ -469,13 +469,18 @@ static void pppol2tp_recv_dequeue(struct pppol2tp_session *session)
+ 				goto out;
+ 			}
+ 		}
+-		spin_unlock(&session->reorder_q.lock);
++		__skb_unlink(skb, &session->reorder_q);
++
++		/* Process the skb. We release the queue lock while we
++		 * do so to let other contexts process the queue.
++		 */
++		spin_unlock_bh(&session->reorder_q.lock);
+ 		pppol2tp_recv_dequeue_skb(session, skb);
+-		spin_lock(&session->reorder_q.lock);
++		spin_lock_bh(&session->reorder_q.lock);
+ 	}
+ 
+ out:
+-	spin_unlock(&session->reorder_q.lock);
++	spin_unlock_bh(&session->reorder_q.lock);
+ }
+ 
+ /* Internal receive frame. Do the real work of receiving an L2TP data frame
+@@ -1058,7 +1063,7 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
+ 
+ 	/* Get routing info from the tunnel socket */
+ 	dst_release(skb->dst);
+-	skb->dst = sk_dst_get(sk_tun);
++	skb->dst = dst_clone(__sk_dst_get(sk_tun));
+ 	skb_orphan(skb);
+ 	skb->sk = sk_tun;
+ 
+@@ -1106,7 +1111,7 @@ static void pppol2tp_tunnel_closeall(struct pppol2tp_tunnel *tunnel)
+ 	PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
+ 	       "%s: closing all sessions...\n", tunnel->name);
+ 
+-	write_lock(&tunnel->hlist_lock);
++	write_lock_bh(&tunnel->hlist_lock);
+ 	for (hash = 0; hash < PPPOL2TP_HASH_SIZE; hash++) {
+ again:
+ 		hlist_for_each_safe(walk, tmp, &tunnel->session_hlist[hash]) {
+@@ -1126,7 +1131,7 @@ again:
+ 			 * disappear as we're jumping between locks.
+ 			 */
+ 			sock_hold(sk);
+-			write_unlock(&tunnel->hlist_lock);
++			write_unlock_bh(&tunnel->hlist_lock);
+ 			lock_sock(sk);
+ 
+ 			if (sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) {
+@@ -1148,11 +1153,11 @@ again:
+ 			 * list so we are guaranteed to make forward
+ 			 * progress.
+ 			 */
+-			write_lock(&tunnel->hlist_lock);
++			write_lock_bh(&tunnel->hlist_lock);
+ 			goto again;
+ 		}
+ 	}
+-	write_unlock(&tunnel->hlist_lock);
++	write_unlock_bh(&tunnel->hlist_lock);
+ }
+ 
+ /* Really kill the tunnel.
+@@ -1161,9 +1166,9 @@ again:
+ static void pppol2tp_tunnel_free(struct pppol2tp_tunnel *tunnel)
+ {
+ 	/* Remove from socket list */
+-	write_lock(&pppol2tp_tunnel_list_lock);
++	write_lock_bh(&pppol2tp_tunnel_list_lock);
+ 	list_del_init(&tunnel->list);
+-	write_unlock(&pppol2tp_tunnel_list_lock);
++	write_unlock_bh(&pppol2tp_tunnel_list_lock);
+ 
+ 	atomic_dec(&pppol2tp_tunnel_count);
+ 	kfree(tunnel);
+@@ -1239,9 +1244,9 @@ static void pppol2tp_session_destruct(struct sock *sk)
+ 				/* Delete the session socket from the
+ 				 * hash
+ 				 */
+-				write_lock(&tunnel->hlist_lock);
++				write_lock_bh(&tunnel->hlist_lock);
+ 				hlist_del_init(&session->hlist);
+-				write_unlock(&tunnel->hlist_lock);
++				write_unlock_bh(&tunnel->hlist_lock);
+ 
+ 				atomic_dec(&pppol2tp_session_count);
+ 			}
+@@ -1386,9 +1391,9 @@ static struct sock *pppol2tp_prepare_tunnel_socket(int fd, u16 tunnel_id,
+ 
+ 	/* Add tunnel to our list */
+ 	INIT_LIST_HEAD(&tunnel->list);
+-	write_lock(&pppol2tp_tunnel_list_lock);
++	write_lock_bh(&pppol2tp_tunnel_list_lock);
+ 	list_add(&tunnel->list, &pppol2tp_tunnel_list);
+-	write_unlock(&pppol2tp_tunnel_list_lock);
++	write_unlock_bh(&pppol2tp_tunnel_list_lock);
+ 	atomic_inc(&pppol2tp_tunnel_count);
+ 
+ 	/* Bump the reference count. The tunnel context is deleted
+@@ -1593,11 +1598,11 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
+ 	sk->sk_user_data = session;
+ 
+ 	/* Add session to the tunnel's hash list */
+-	write_lock(&tunnel->hlist_lock);
++	write_lock_bh(&tunnel->hlist_lock);
+ 	hlist_add_head(&session->hlist,
+ 		       pppol2tp_session_id_hash(tunnel,
+ 						session->tunnel_addr.s_session));
+-	write_unlock(&tunnel->hlist_lock);
++	write_unlock_bh(&tunnel->hlist_lock);
+ 
+ 	atomic_inc(&pppol2tp_session_count);
+ 
+@@ -2199,7 +2204,7 @@ static struct pppol2tp_session *next_session(struct pppol2tp_tunnel *tunnel, str
+ 	int next = 0;
+ 	int i;
+ 
+-	read_lock(&tunnel->hlist_lock);
++	read_lock_bh(&tunnel->hlist_lock);
+ 	for (i = 0; i < PPPOL2TP_HASH_SIZE; i++) {
+ 		hlist_for_each_entry(session, walk, &tunnel->session_hlist[i], hlist) {
+ 			if (curr == NULL) {
+@@ -2217,7 +2222,7 @@ static struct pppol2tp_session *next_session(struct pppol2tp_tunnel *tunnel, str
+ 		}
+ 	}
+ out:
+-	read_unlock(&tunnel->hlist_lock);
++	read_unlock_bh(&tunnel->hlist_lock);
+ 	if (!found)
+ 		session = NULL;
+ 
+@@ -2228,13 +2233,13 @@ static struct pppol2tp_tunnel *next_tunnel(struct pppol2tp_tunnel *curr)
+ {
+ 	struct pppol2tp_tunnel *tunnel = NULL;
+ 
+-	read_lock(&pppol2tp_tunnel_list_lock);
++	read_lock_bh(&pppol2tp_tunnel_list_lock);
+ 	if (list_is_last(&curr->list, &pppol2tp_tunnel_list)) {
+ 		goto out;
+ 	}
+ 	tunnel = list_entry(curr->list.next, struct pppol2tp_tunnel, list);
+ out:
+-	read_unlock(&pppol2tp_tunnel_list_lock);
++	read_unlock_bh(&pppol2tp_tunnel_list_lock);
+ 
+ 	return tunnel;
+ }
+diff --git a/drivers/net/sis190.c b/drivers/net/sis190.c
+index b570402..053eab6 100644
+--- a/drivers/net/sis190.c
++++ b/drivers/net/sis190.c
+@@ -1632,13 +1632,18 @@ static inline void sis190_init_rxfilter(struct net_device *dev)
+ 
+ static int sis190_get_mac_addr(struct pci_dev *pdev, struct net_device *dev)
+ {
+-	u8 from;
++	int rc;
++
++	rc = sis190_get_mac_addr_from_eeprom(pdev, dev);
++	if (rc < 0) {
++		u8 reg;
+ 
+-	pci_read_config_byte(pdev, 0x73, &from);
++		pci_read_config_byte(pdev, 0x73, &reg);
+ 
+-	return (from & 0x00000001) ?
+-		sis190_get_mac_addr_from_apc(pdev, dev) :
+-		sis190_get_mac_addr_from_eeprom(pdev, dev);
++		if (reg & 0x00000001)
++			rc = sis190_get_mac_addr_from_apc(pdev, dev);
++	}
++	return rc;
+ }
+ 
+ static void sis190_set_speed_auto(struct net_device *dev)
+diff --git a/drivers/net/sungem.c b/drivers/net/sungem.c
+index 6887214..6fac216 100644
+--- a/drivers/net/sungem.c
++++ b/drivers/net/sungem.c
+@@ -910,7 +910,7 @@ static int gem_poll(struct napi_struct *napi, int budget)
+ 		 * rx ring - must call napi_disable(), which
+ 		 * schedule_timeout()'s if polling is already disabled.
+ 		 */
+-		work_done += gem_rx(gp, budget);
++		work_done += gem_rx(gp, budget - work_done);
+ 
+ 		if (work_done >= budget)
+ 			return work_done;
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 72e0bd5..05cdda9 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -950,6 +950,12 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,	PCI_DEVICE_ID_INTEL_82375,	quirk_e
+  * accesses to the SMBus registers, with potentially bad effects. Thus you
+  * should be very careful when adding new entries: if SMM is accessing the
+  * Intel SMBus, this is a very good reason to leave it hidden.
++ *
++ * Likewise, many recent laptops use ACPI for thermal management. If the
++ * ACPI DSDT code accesses the SMBus, then Linux should not access it
++ * natively, and keeping the SMBus hidden is the right thing to do. If you
++ * are about to add an entry in the table below, please first disassemble
++ * the DSDT and double-check that there is no code accessing the SMBus.
+  */
+ static int asus_hides_smbus;
+ 
+@@ -1022,11 +1028,6 @@ static void __init asus_hides_smbus_hostbridge(struct pci_dev *dev)
+ 			case 0x12bd: /* HP D530 */
+ 				asus_hides_smbus = 1;
+ 			}
+-		else if (dev->device == PCI_DEVICE_ID_INTEL_82915GM_HB)
+-			switch (dev->subsystem_device) {
+-			case 0x099c: /* HP Compaq nx6110 */
+-				asus_hides_smbus = 1;
+-			}
+        } else if (unlikely(dev->subsystem_vendor == PCI_VENDOR_ID_SAMSUNG)) {
+                if (dev->device ==  PCI_DEVICE_ID_INTEL_82855PM_HB)
+                        switch(dev->subsystem_device) {
+diff --git a/drivers/pnp/pnpacpi/rsparser.c b/drivers/pnp/pnpacpi/rsparser.c
+index 6b9840c..be22d23 100644
+--- a/drivers/pnp/pnpacpi/rsparser.c
++++ b/drivers/pnp/pnpacpi/rsparser.c
+@@ -85,7 +85,7 @@ static void pnpacpi_parse_allocated_irqresource(struct pnp_resource_table *res,
+ 	       i < PNP_MAX_IRQ)
+ 		i++;
+ 	if (i >= PNP_MAX_IRQ && !warned) {
+-		printk(KERN_ERR "pnpacpi: exceeded the max number of IRQ "
++		printk(KERN_WARNING "pnpacpi: exceeded the max number of IRQ "
+ 				"resources: %d \n", PNP_MAX_IRQ);
+ 		warned = 1;
+ 		return;
+@@ -187,7 +187,7 @@ static void pnpacpi_parse_allocated_dmaresource(struct pnp_resource_table *res,
+ 		res->dma_resource[i].start = dma;
+ 		res->dma_resource[i].end = dma;
+ 	} else if (!warned) {
+-		printk(KERN_ERR "pnpacpi: exceeded the max number of DMA "
++		printk(KERN_WARNING "pnpacpi: exceeded the max number of DMA "
+ 				"resources: %d \n", PNP_MAX_DMA);
+ 		warned = 1;
+ 	}
+@@ -213,7 +213,7 @@ static void pnpacpi_parse_allocated_ioresource(struct pnp_resource_table *res,
+ 		res->port_resource[i].start = io;
+ 		res->port_resource[i].end = io + len - 1;
+ 	} else if (!warned) {
+-		printk(KERN_ERR "pnpacpi: exceeded the max number of IO "
++		printk(KERN_WARNING "pnpacpi: exceeded the max number of IO "
+ 				"resources: %d \n", PNP_MAX_PORT);
+ 		warned = 1;
+ 	}
+@@ -241,7 +241,7 @@ static void pnpacpi_parse_allocated_memresource(struct pnp_resource_table *res,
+ 		res->mem_resource[i].start = mem;
+ 		res->mem_resource[i].end = mem + len - 1;
+ 	} else if (!warned) {
+-		printk(KERN_ERR "pnpacpi: exceeded the max number of mem "
++		printk(KERN_WARNING "pnpacpi: exceeded the max number of mem "
+ 				"resources: %d\n", PNP_MAX_MEM);
+ 		warned = 1;
+ 	}
+diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
+index 865f32b..b4e1022 100644
+--- a/drivers/uio/uio.c
++++ b/drivers/uio/uio.c
+@@ -447,6 +447,8 @@ static int uio_mmap_physical(struct vm_area_struct *vma)
+ 
+ 	vma->vm_flags |= VM_IO | VM_RESERVED;
+ 
++	vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
++
+ 	return remap_pfn_range(vma,
+ 			       vma->vm_start,
+ 			       idev->info->mem[mi].addr >> PAGE_SHIFT,
+diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
+index fcd40ec..d864239 100644
+--- a/drivers/usb/core/message.c
++++ b/drivers/usb/core/message.c
+@@ -1189,7 +1189,10 @@ int usb_set_interface(struct usb_device *dev, int interface, int alternate)
+ 		return -EINVAL;
+ 	}
+ 
+-	ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
++	if (dev->quirks & USB_QUIRK_NO_SET_INTF)
++		ret = -EPIPE;
++	else
++		ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
+ 				   USB_REQ_SET_INTERFACE, USB_RECIP_INTERFACE,
+ 				   alternate, interface, NULL, 0, 5000);
+ 
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index d42c561..fb552d7 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -39,6 +39,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ 	/* M-Systems Flash Disk Pioneers */
+ 	{ USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
+ 
++	/* X-Rite/Gretag-Macbeth Eye-One Pro display colorimeter */
++	{ USB_DEVICE(0x0971, 0x2000), .driver_info = USB_QUIRK_NO_SET_INTF },
++
+ 	/* Philips PSC805 audio device */
+ 	{ USB_DEVICE(0x0471, 0x0155), .driver_info = USB_QUIRK_RESET_RESUME },
+ 
+diff --git a/drivers/usb/serial/keyspan.h b/drivers/usb/serial/keyspan.h
+index 8a0d174..74ce8bc 100644
+--- a/drivers/usb/serial/keyspan.h
++++ b/drivers/usb/serial/keyspan.h
+@@ -637,6 +637,7 @@ static struct usb_serial_driver keyspan_pre_device = {
+ 	.description		= "Keyspan - (without firmware)",
+ 	.id_table		= keyspan_pre_ids,
+ 	.num_interrupt_in	= NUM_DONT_CARE,
++	.num_interrupt_out	= NUM_DONT_CARE,
+ 	.num_bulk_in		= NUM_DONT_CARE,
+ 	.num_bulk_out		= NUM_DONT_CARE,
+ 	.num_ports		= 1,
+@@ -651,6 +652,7 @@ static struct usb_serial_driver keyspan_1port_device = {
+ 	.description		= "Keyspan 1 port adapter",
+ 	.id_table		= keyspan_1port_ids,
+ 	.num_interrupt_in	= NUM_DONT_CARE,
++	.num_interrupt_out	= NUM_DONT_CARE,
+ 	.num_bulk_in		= NUM_DONT_CARE,
+ 	.num_bulk_out		= NUM_DONT_CARE,
+ 	.num_ports		= 1,
+@@ -678,6 +680,7 @@ static struct usb_serial_driver keyspan_2port_device = {
+ 	.description		= "Keyspan 2 port adapter",
+ 	.id_table		= keyspan_2port_ids,
+ 	.num_interrupt_in	= NUM_DONT_CARE,
++	.num_interrupt_out	= NUM_DONT_CARE,
+ 	.num_bulk_in		= NUM_DONT_CARE,
+ 	.num_bulk_out		= NUM_DONT_CARE,
+ 	.num_ports		= 2,
+@@ -705,6 +708,7 @@ static struct usb_serial_driver keyspan_4port_device = {
+ 	.description		= "Keyspan 4 port adapter",
+ 	.id_table		= keyspan_4port_ids,
+ 	.num_interrupt_in	= NUM_DONT_CARE,
++	.num_interrupt_out	= NUM_DONT_CARE,
+ 	.num_bulk_in		= NUM_DONT_CARE,
+ 	.num_bulk_out		= NUM_DONT_CARE,
+ 	.num_ports		= 4,
+diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
+index 1f01494..337f5ce 100644
+--- a/drivers/usb/serial/ti_usb_3410_5052.c
++++ b/drivers/usb/serial/ti_usb_3410_5052.c
+@@ -264,8 +264,8 @@ static struct usb_serial_driver ti_1port_device = {
+ 	.description		= "TI USB 3410 1 port adapter",
+ 	.usb_driver		= &ti_usb_driver,
+ 	.id_table		= ti_id_table_3410,
+-	.num_interrupt_in	= 1,
+-	.num_bulk_in		= 1,
++	.num_interrupt_in	= NUM_DONT_CARE,
++	.num_bulk_in		= NUM_DONT_CARE,
+ 	.num_bulk_out		= 1,
+ 	.num_ports		= 1,
+ 	.attach			= ti_startup,
+diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c
+index 7ee087f..762fb04 100644
+--- a/drivers/usb/serial/visor.c
++++ b/drivers/usb/serial/visor.c
+@@ -191,7 +191,7 @@ static struct usb_serial_driver handspring_device = {
+ 	.id_table =		id_table,
+ 	.num_interrupt_in =	NUM_DONT_CARE,
+ 	.num_bulk_in =		2,
+-	.num_bulk_out =		2,
++	.num_bulk_out =		NUM_DONT_CARE,
+ 	.num_ports =		2,
+ 	.open =			visor_open,
+ 	.close =		visor_close,
+diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c
+index c646750..ec3641e 100644
+--- a/drivers/usb/storage/transport.c
++++ b/drivers/usb/storage/transport.c
+@@ -1010,7 +1010,8 @@ int usb_stor_Bulk_transport(struct scsi_cmnd *srb, struct us_data *us)
+ 	US_DEBUGP("Bulk Status S 0x%x T 0x%x R %u Stat 0x%x\n",
+ 			le32_to_cpu(bcs->Signature), bcs->Tag, 
+ 			residue, bcs->Status);
+-	if (bcs->Tag != us->tag || bcs->Status > US_BULK_STAT_PHASE) {
++	if (!(bcs->Tag == us->tag || (us->flags & US_FL_BULK_IGNORE_TAG)) ||
++		bcs->Status > US_BULK_STAT_PHASE) {
+ 		US_DEBUGP("Bulk logical error\n");
+ 		return USB_STOR_TRANSPORT_ERROR;
+ 	}
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index fe12737..054f53c 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -1557,6 +1557,17 @@ UNUSUAL_DEV(  0x22b8, 0x4810, 0x0001, 0x0001,
+ 		US_SC_DEVICE, US_PR_DEVICE, NULL,
+ 		US_FL_FIX_CAPACITY),
+ 
++/*
++ * Patch by Constantin Baranov <const@×××××.ru>
++ * Report by Andreas Koenecke.
++ * Motorola ROKR Z6.
++ */
++UNUSUAL_DEV(  0x22b8, 0x6426, 0x0101, 0x0101,
++		"Motorola",
++		"MSnc.",
++		US_SC_DEVICE, US_PR_DEVICE, NULL,
++		US_FL_FIX_INQUIRY | US_FL_FIX_CAPACITY | US_FL_BULK_IGNORE_TAG),
++
+ /* Reported by Radovan Garabik <garabik@×××××××××××××××××××××.sk> */
+ UNUSUAL_DEV(  0x2735, 0x100b, 0x0000, 0x9999,
+ 		"MPIO",
+diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
+index 1194f5e..01072f4 100644
+--- a/drivers/video/fbmem.c
++++ b/drivers/video/fbmem.c
+@@ -1521,6 +1521,7 @@ module_init(fbmem_init);
+ static void __exit
+ fbmem_exit(void)
+ {
++	remove_proc_entry("fb", NULL);
+ 	class_destroy(fb_class);
+ 	unregister_chrdev(FB_MAJOR, "fb");
+ }
+diff --git a/fs/buffer.c b/fs/buffer.c
+index 7249e01..5bb5ffc 100644
+--- a/fs/buffer.c
++++ b/fs/buffer.c
+@@ -2565,14 +2565,13 @@ int nobh_write_end(struct file *file, struct address_space *mapping,
+ 	struct inode *inode = page->mapping->host;
+ 	struct buffer_head *head = fsdata;
+ 	struct buffer_head *bh;
++	BUG_ON(fsdata != NULL && page_has_buffers(page));
+ 
+-	if (!PageMappedToDisk(page)) {
+-		if (unlikely(copied < len) && !page_has_buffers(page))
+-			attach_nobh_buffers(page, head);
+-		if (page_has_buffers(page))
+-			return generic_write_end(file, mapping, pos, len,
+-						copied, page, fsdata);
+-	}
++	if (unlikely(copied < len) && !page_has_buffers(page))
++		attach_nobh_buffers(page, head);
++	if (page_has_buffers(page))
++		return generic_write_end(file, mapping, pos, len,
++					copied, page, fsdata);
+ 
+ 	SetPageUptodate(page);
+ 	set_page_dirty(page);
+diff --git a/fs/dcache.c b/fs/dcache.c
+index d9ca1e5..c369bf9 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -1408,9 +1408,6 @@ void d_delete(struct dentry * dentry)
+ 	if (atomic_read(&dentry->d_count) == 1) {
+ 		dentry_iput(dentry);
+ 		fsnotify_nameremove(dentry, isdir);
+-
+-		/* remove this and other inotify debug checks after 2.6.18 */
+-		dentry->d_flags &= ~DCACHE_INOTIFY_PARENT_WATCHED;
+ 		return;
+ 	}
+ 
+diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c
+index 1955ee6..078684f 100644
+--- a/fs/hfsplus/dir.c
++++ b/fs/hfsplus/dir.c
+@@ -340,16 +340,23 @@ static int hfsplus_unlink(struct inode *dir, struct dentry *dentry)
+ 
+ 	if (inode->i_nlink > 0)
+ 		drop_nlink(inode);
+-	hfsplus_delete_inode(inode);
+-	if (inode->i_ino != cnid && !inode->i_nlink) {
+-		if (!atomic_read(&HFSPLUS_I(inode).opencnt)) {
+-			res = hfsplus_delete_cat(inode->i_ino, HFSPLUS_SB(sb).hidden_dir, NULL);
+-			if (!res)
+-				hfsplus_delete_inode(inode);
++	if (inode->i_ino == cnid)
++		clear_nlink(inode);
++	if (!inode->i_nlink) {
++		if (inode->i_ino != cnid) {
++			HFSPLUS_SB(sb).file_count--;
++			if (!atomic_read(&HFSPLUS_I(inode).opencnt)) {
++				res = hfsplus_delete_cat(inode->i_ino,
++							 HFSPLUS_SB(sb).hidden_dir,
++							 NULL);
++				if (!res)
++					hfsplus_delete_inode(inode);
++			} else
++				inode->i_flags |= S_DEAD;
+ 		} else
+-			inode->i_flags |= S_DEAD;
++			hfsplus_delete_inode(inode);
+ 	} else
+-		clear_nlink(inode);
++		HFSPLUS_SB(sb).file_count--;
+ 	inode->i_ctime = CURRENT_TIME_SEC;
+ 	mark_inode_dirty(inode);
+ 
+diff --git a/fs/inotify.c b/fs/inotify.c
+index 2c5b921..690e725 100644
+--- a/fs/inotify.c
++++ b/fs/inotify.c
+@@ -168,20 +168,14 @@ static void set_dentry_child_flags(struct inode *inode, int watched)
+ 		struct dentry *child;
+ 
+ 		list_for_each_entry(child, &alias->d_subdirs, d_u.d_child) {
+-			if (!child->d_inode) {
+-				WARN_ON(child->d_flags & DCACHE_INOTIFY_PARENT_WATCHED);
++			if (!child->d_inode)
+ 				continue;
+-			}
++
+ 			spin_lock(&child->d_lock);
+-			if (watched) {
+-				WARN_ON(child->d_flags &
+-						DCACHE_INOTIFY_PARENT_WATCHED);
++			if (watched)
+ 				child->d_flags |= DCACHE_INOTIFY_PARENT_WATCHED;
+-			} else {
+-				WARN_ON(!(child->d_flags &
+-					DCACHE_INOTIFY_PARENT_WATCHED));
+-				child->d_flags&=~DCACHE_INOTIFY_PARENT_WATCHED;
+-			}
++			else
++				child->d_flags &=~DCACHE_INOTIFY_PARENT_WATCHED;
+ 			spin_unlock(&child->d_lock);
+ 		}
+ 	}
+@@ -253,7 +247,6 @@ void inotify_d_instantiate(struct dentry *entry, struct inode *inode)
+ 	if (!inode)
+ 		return;
+ 
+-	WARN_ON(entry->d_flags & DCACHE_INOTIFY_PARENT_WATCHED);
+ 	spin_lock(&entry->d_lock);
+ 	parent = entry->d_parent;
+ 	if (parent->d_inode && inotify_inode_watched(parent->d_inode))
+@@ -627,6 +620,7 @@ s32 inotify_add_watch(struct inotify_handle *ih, struct inotify_watch *watch,
+ 		      struct inode *inode, u32 mask)
+ {
+ 	int ret = 0;
++	int newly_watched;
+ 
+ 	/* don't allow invalid bits: we don't want flags set */
+ 	mask &= IN_ALL_EVENTS | IN_ONESHOT;
+@@ -653,12 +647,18 @@ s32 inotify_add_watch(struct inotify_handle *ih, struct inotify_watch *watch,
+ 	 */
+ 	watch->inode = igrab(inode);
+ 
+-	if (!inotify_inode_watched(inode))
+-		set_dentry_child_flags(inode, 1);
+-
+ 	/* Add the watch to the handle's and the inode's list */
++	newly_watched = !inotify_inode_watched(inode);
+ 	list_add(&watch->h_list, &ih->watches);
+ 	list_add(&watch->i_list, &inode->inotify_watches);
++	/*
++	 * Set child flags _after_ adding the watch, so there is no race
++	 * windows where newly instantiated children could miss their parent's
++	 * watched flag.
++	 */
++	if (newly_watched)
++		set_dentry_child_flags(inode, 1);
++
+ out:
+ 	mutex_unlock(&ih->mutex);
+ 	mutex_unlock(&inode->inotify_mutex);
+diff --git a/fs/locks.c b/fs/locks.c
+index 8b8388e..2fd29d9 100644
+--- a/fs/locks.c
++++ b/fs/locks.c
+@@ -1805,17 +1805,21 @@ again:
+ 	if (error)
+ 		goto out;
+ 
+-	for (;;) {
+-		error = vfs_lock_file(filp, cmd, file_lock, NULL);
+-		if (error != -EAGAIN || cmd == F_SETLK)
+-			break;
+-		error = wait_event_interruptible(file_lock->fl_wait,
+-				!file_lock->fl_next);
+-		if (!error)
+-			continue;
++	if (filp->f_op && filp->f_op->lock != NULL)
++		error = filp->f_op->lock(filp, cmd, file_lock);
++	else {
++		for (;;) {
++			error = posix_lock_file(filp, file_lock, NULL);
++			if (error != -EAGAIN || cmd == F_SETLK)
++				break;
++			error = wait_event_interruptible(file_lock->fl_wait,
++					!file_lock->fl_next);
++			if (!error)
++				continue;
+ 
+-		locks_delete_block(file_lock);
+-		break;
++			locks_delete_block(file_lock);
++			break;
++		}
+ 	}
+ 
+ 	/*
+@@ -1929,17 +1933,21 @@ again:
+ 	if (error)
+ 		goto out;
+ 
+-	for (;;) {
+-		error = vfs_lock_file(filp, cmd, file_lock, NULL);
+-		if (error != -EAGAIN || cmd == F_SETLK64)
+-			break;
+-		error = wait_event_interruptible(file_lock->fl_wait,
+-				!file_lock->fl_next);
+-		if (!error)
+-			continue;
++	if (filp->f_op && filp->f_op->lock != NULL)
++		error = filp->f_op->lock(filp, cmd, file_lock);
++	else {
++		for (;;) {
++			error = posix_lock_file(filp, file_lock, NULL);
++			if (error != -EAGAIN || cmd == F_SETLK64)
++				break;
++			error = wait_event_interruptible(file_lock->fl_wait,
++					!file_lock->fl_next);
++			if (!error)
++				continue;
+ 
+-		locks_delete_block(file_lock);
+-		break;
++			locks_delete_block(file_lock);
++			break;
++		}
+ 	}
+ 
+ 	/*
+diff --git a/fs/signalfd.c b/fs/signalfd.c
+index fb7f7e8..1b414ef 100644
+--- a/fs/signalfd.c
++++ b/fs/signalfd.c
+@@ -110,9 +110,14 @@ static int signalfd_copyinfo(struct signalfd_siginfo __user *uinfo,
+ 		err |= __put_user(kinfo->si_uid, &uinfo->ssi_uid);
+ 		err |= __put_user((long) kinfo->si_ptr, &uinfo->ssi_ptr);
+ 		break;
+-	default: /* this is just in case for now ... */
++	default:
++		/*
++		 * This case catches also the signals queued by sigqueue().
++		 */
+ 		err |= __put_user(kinfo->si_pid, &uinfo->ssi_pid);
+ 		err |= __put_user(kinfo->si_uid, &uinfo->ssi_uid);
++		err |= __put_user((long) kinfo->si_ptr, &uinfo->ssi_ptr);
++		err |= __put_user(kinfo->si_int, &uinfo->ssi_int);
+ 		break;
+ 	}
+ 
+diff --git a/include/asm-parisc/futex.h b/include/asm-parisc/futex.h
+index dbee6e6..fdc6d05 100644
+--- a/include/asm-parisc/futex.h
++++ b/include/asm-parisc/futex.h
+@@ -56,6 +56,12 @@ futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval, int newval)
+ 	int err = 0;
+ 	int uval;
+ 
++	/* futex.c wants to do a cmpxchg_inatomic on kernel NULL, which is
++	 * our gateway page, and causes no end of trouble...
++	 */
++	if (segment_eq(KERNEL_DS, get_fs()) && !uaddr)
++		return -EFAULT;
++
+ 	if (!access_ok(VERIFY_WRITE, uaddr, sizeof(int)))
+ 		return -EFAULT;
+ 
+@@ -67,5 +73,5 @@ futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval, int newval)
+ 	return uval;
+ }
+ 
+-#endif
+-#endif
++#endif /*__KERNEL__*/
++#endif /*_ASM_PARISC_FUTEX_H*/
+diff --git a/include/asm-parisc/pdc.h b/include/asm-parisc/pdc.h
+index deda8c3..9eaa794 100644
+--- a/include/asm-parisc/pdc.h
++++ b/include/asm-parisc/pdc.h
+@@ -645,8 +645,7 @@ int pdc_soft_power_button(int sw_control);
+ void pdc_io_reset(void);
+ void pdc_io_reset_devices(void);
+ int pdc_iodc_getc(void);
+-int pdc_iodc_print(unsigned char *str, unsigned count);
+-void pdc_printf(const char *fmt, ...);
++int pdc_iodc_print(const unsigned char *str, unsigned count);
+ 
+ void pdc_emergency_unlock(void);
+ int pdc_sti_call(unsigned long func, unsigned long flags,
+diff --git a/include/asm-sparc64/backoff.h b/include/asm-sparc64/backoff.h
+index dadd6c3..fa1fdf6 100644
+--- a/include/asm-sparc64/backoff.h
++++ b/include/asm-sparc64/backoff.h
+@@ -12,7 +12,8 @@
+ 	mov	reg, tmp; \
+ 88:	brnz,pt	tmp, 88b; \
+ 	 sub	tmp, 1, tmp; \
+-	cmp	reg, BACKOFF_LIMIT; \
++	set	BACKOFF_LIMIT, tmp; \
++	cmp	reg, tmp; \
+ 	bg,pn	%xcc, label; \
+ 	 nop; \
+ 	ba,pt	%xcc, label; \
+diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h
+index 71d4ada..3e6b68f 100644
+--- a/include/linux/ethtool.h
++++ b/include/linux/ethtool.h
+@@ -12,6 +12,7 @@
+ #ifndef _LINUX_ETHTOOL_H
+ #define _LINUX_ETHTOOL_H
+ 
++#include <linux/types.h>
+ 
+ /* This should work for both 32 and 64 bit userland. */
+ struct ethtool_cmd {
+diff --git a/include/linux/percpu.h b/include/linux/percpu.h
+index 926adaa..1702ab5 100644
+--- a/include/linux/percpu.h
++++ b/include/linux/percpu.h
+@@ -34,7 +34,7 @@
+ #ifdef CONFIG_SMP
+ 
+ struct percpu_data {
+-	void *ptrs[NR_CPUS];
++	void *ptrs[1];
+ };
+ 
+ #define __percpu_disguise(pdata) (struct percpu_data *)~(unsigned long)(pdata)
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index cc14656..59e00df 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -1449,6 +1449,12 @@ static inline void idle_task_exit(void) {}
+ 
+ extern void sched_idle_next(void);
+ 
++#if defined(CONFIG_NO_HZ) && defined(CONFIG_SMP)
++extern void wake_up_idle_cpu(int cpu);
++#else
++static inline void wake_up_idle_cpu(int cpu) { }
++#endif
++
+ #ifdef CONFIG_SCHED_DEBUG
+ extern unsigned int sysctl_sched_latency;
+ extern unsigned int sysctl_sched_min_granularity;
+diff --git a/include/linux/security.h b/include/linux/security.h
+index ac05083..d842ee3 100644
+--- a/include/linux/security.h
++++ b/include/linux/security.h
+@@ -62,7 +62,6 @@ extern int cap_inode_need_killpriv(struct dentry *dentry);
+ extern int cap_inode_killpriv(struct dentry *dentry);
+ extern int cap_task_post_setuid (uid_t old_ruid, uid_t old_euid, uid_t old_suid, int flags);
+ extern void cap_task_reparent_to_init (struct task_struct *p);
+-extern int cap_task_kill(struct task_struct *p, struct siginfo *info, int sig, u32 secid);
+ extern int cap_task_setscheduler (struct task_struct *p, int policy, struct sched_param *lp);
+ extern int cap_task_setioprio (struct task_struct *p, int ioprio);
+ extern int cap_task_setnice (struct task_struct *p, int nice);
+@@ -2112,7 +2111,7 @@ static inline int security_task_kill (struct task_struct *p,
+ 				      struct siginfo *info, int sig,
+ 				      u32 secid)
+ {
+-	return cap_task_kill(p, info, sig, secid);
++	return 0;
+ }
+ 
+ static inline int security_task_wait (struct task_struct *p)
+diff --git a/include/linux/time.h b/include/linux/time.h
+index b04136d..3e8fd9e 100644
+--- a/include/linux/time.h
++++ b/include/linux/time.h
+@@ -173,6 +173,10 @@ static inline void timespec_add_ns(struct timespec *a, u64 ns)
+ {
+ 	ns += a->tv_nsec;
+ 	while(unlikely(ns >= NSEC_PER_SEC)) {
++		/* The following asm() prevents the compiler from
++		 * optimising this loop into a modulo operation.  */
++		asm("" : "+r"(ns));
++
+ 		ns -= NSEC_PER_SEC;
+ 		a->tv_sec++;
+ 	}
+diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h
+index 2692ec9..1f999ec 100644
+--- a/include/linux/usb/quirks.h
++++ b/include/linux/usb/quirks.h
+@@ -9,3 +9,6 @@
+ 
+ /* device can't resume correctly so reset it instead */
+ #define USB_QUIRK_RESET_RESUME		0x00000002
++
++/* device can't handle Set-Interface requests */
++#define USB_QUIRK_NO_SET_INTF		0x00000004
+diff --git a/include/linux/usb_usual.h b/include/linux/usb_usual.h
+index a417b09..e3380e3 100644
+--- a/include/linux/usb_usual.h
++++ b/include/linux/usb_usual.h
+@@ -50,7 +50,9 @@
+ 	US_FLAG(CAPACITY_HEURISTICS,	0x00001000)		\
+ 		/* sometimes sizes is too big */		\
+ 	US_FLAG(MAX_SECTORS_MIN,0x00002000)			\
+-		/* Sets max_sectors to arch min */
++		/* Sets max_sectors to arch min */		\
++	US_FLAG(BULK_IGNORE_TAG,0x00004000)			\
++		/* Ignore tag mismatch in bulk operations */
+ 
+ 
+ #define US_FLAG(name, value)	US_FL_##name = value ,
+diff --git a/kernel/sched.c b/kernel/sched.c
+index 5ba5db9..f8dc213 100644
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -727,6 +727,49 @@ static void resched_cpu(int cpu)
+ 	resched_task(cpu_curr(cpu));
+ 	spin_unlock_irqrestore(&rq->lock, flags);
+ }
++
++#ifdef CONFIG_NO_HZ
++/*
++ * When add_timer_on() enqueues a timer into the timer wheel of an
++ * idle CPU then this timer might expire before the next timer event
++ * which is scheduled to wake up that CPU. In case of a completely
++ * idle system the next event might even be infinite time into the
++ * future. wake_up_idle_cpu() ensures that the CPU is woken up and
++ * leaves the inner idle loop so the newly added timer is taken into
++ * account when the CPU goes back to idle and evaluates the timer
++ * wheel for the next timer event.
++ */
++void wake_up_idle_cpu(int cpu)
++{
++	struct rq *rq = cpu_rq(cpu);
++
++	if (cpu == smp_processor_id())
++		return;
++
++	/*
++	 * This is safe, as this function is called with the timer
++	 * wheel base lock of (cpu) held. When the CPU is on the way
++	 * to idle and has not yet set rq->curr to idle then it will
++	 * be serialized on the timer wheel base lock and take the new
++	 * timer into account automatically.
++	 */
++	if (rq->curr != rq->idle)
++		return;
++
++	/*
++	 * We can set TIF_RESCHED on the idle task of the other CPU
++	 * lockless. The worst case is that the other CPU runs the
++	 * idle task through an additional NOOP schedule()
++	 */
++	set_tsk_thread_flag(rq->idle, TIF_NEED_RESCHED);
++
++	/* NEED_RESCHED must be visible before we test polling */
++	smp_mb();
++	if (!tsk_is_polling(rq->idle))
++		smp_send_reschedule(cpu);
++}
++#endif
++
+ #else
+ static inline void resched_task(struct task_struct *p)
+ {
+diff --git a/kernel/timer.c b/kernel/timer.c
+index 2a00c22..4ee4f89 100644
+--- a/kernel/timer.c
++++ b/kernel/timer.c
+@@ -453,10 +453,18 @@ void add_timer_on(struct timer_list *timer, int cpu)
+ 	spin_lock_irqsave(&base->lock, flags);
+ 	timer_set_base(timer, base);
+ 	internal_add_timer(base, timer);
++	/*
++	 * Check whether the other CPU is idle and needs to be
++	 * triggered to reevaluate the timer wheel when nohz is
++	 * active. We are protected against the other CPU fiddling
++	 * with the timer by holding the timer base lock. This also
++	 * makes sure that a CPU on the way to idle can not evaluate
++	 * the timer wheel.
++	 */
++	wake_up_idle_cpu(cpu);
+ 	spin_unlock_irqrestore(&base->lock, flags);
+ }
+ 
+-
+ /**
+  * mod_timer - modify a timer's timeout
+  * @timer: the timer to be modified
+diff --git a/mm/allocpercpu.c b/mm/allocpercpu.c
+index 00b0262..b0012e2 100644
+--- a/mm/allocpercpu.c
++++ b/mm/allocpercpu.c
+@@ -6,6 +6,10 @@
+ #include <linux/mm.h>
+ #include <linux/module.h>
+ 
++#ifndef cache_line_size
++#define cache_line_size()	L1_CACHE_BYTES
++#endif
++
+ /**
+  * percpu_depopulate - depopulate per-cpu data for given cpu
+  * @__pdata: per-cpu data to depopulate
+@@ -52,6 +56,11 @@ void *percpu_populate(void *__pdata, size_t size, gfp_t gfp, int cpu)
+ 	struct percpu_data *pdata = __percpu_disguise(__pdata);
+ 	int node = cpu_to_node(cpu);
+ 
++	/*
++	 * We should make sure each CPU gets private memory.
++	 */
++	size = roundup(size, cache_line_size());
++
+ 	BUG_ON(pdata->ptrs[cpu]);
+ 	if (node_online(node))
+ 		pdata->ptrs[cpu] = kmalloc_node(size, gfp|__GFP_ZERO, node);
+@@ -98,7 +107,11 @@ EXPORT_SYMBOL_GPL(__percpu_populate_mask);
+  */
+ void *__percpu_alloc_mask(size_t size, gfp_t gfp, cpumask_t *mask)
+ {
+-	void *pdata = kzalloc(sizeof(struct percpu_data), gfp);
++	/*
++	 * We allocate whole cache lines to avoid false sharing
++	 */
++	size_t sz = roundup(nr_cpu_ids * sizeof(void *), cache_line_size());
++	void *pdata = kzalloc(sz, gfp);
+ 	void *__pdata = __percpu_disguise(pdata);
+ 
+ 	if (unlikely(!pdata))
+diff --git a/mm/slab.c b/mm/slab.c
+index 79c3be0..8323e7d 100644
+--- a/mm/slab.c
++++ b/mm/slab.c
+@@ -1484,7 +1484,7 @@ void __init kmem_cache_init(void)
+ 	list_add(&cache_cache.next, &cache_chain);
+ 	cache_cache.colour_off = cache_line_size();
+ 	cache_cache.array[smp_processor_id()] = &initarray_cache.cache;
+-	cache_cache.nodelists[node] = &initkmem_list3[CACHE_CACHE];
++	cache_cache.nodelists[node] = &initkmem_list3[CACHE_CACHE + node];
+ 
+ 	/*
+ 	 * struct kmem_cache size depends on nr_node_ids, which
+@@ -1605,7 +1605,7 @@ void __init kmem_cache_init(void)
+ 		int nid;
+ 
+ 		for_each_online_node(nid) {
+-			init_list(&cache_cache, &initkmem_list3[CACHE_CACHE], nid);
++			init_list(&cache_cache, &initkmem_list3[CACHE_CACHE + nid], nid);
+ 
+ 			init_list(malloc_sizes[INDEX_AC].cs_cachep,
+ 				  &initkmem_list3[SIZE_AC + nid], nid);
+diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
+index 032bf44..156ad38 100644
+--- a/net/8021q/vlan.c
++++ b/net/8021q/vlan.c
+@@ -326,7 +326,7 @@ static int vlan_dev_init(struct net_device *dev)
+ 	int subclass = 0;
+ 
+ 	/* IFF_BROADCAST|IFF_MULTICAST; ??? */
+-	dev->flags  = real_dev->flags & ~IFF_UP;
++	dev->flags  = real_dev->flags & ~(IFF_UP | IFF_PROMISC | IFF_ALLMULTI);
+ 	dev->iflink = real_dev->ifindex;
+ 	dev->state  = (real_dev->state & ((1<<__LINK_STATE_NOCARRIER) |
+ 					  (1<<__LINK_STATE_DORMANT))) |
+diff --git a/net/ax25/ax25_out.c b/net/ax25/ax25_out.c
+index 92b517a..bf706f8 100644
+--- a/net/ax25/ax25_out.c
++++ b/net/ax25/ax25_out.c
+@@ -117,6 +117,12 @@ void ax25_output(ax25_cb *ax25, int paclen, struct sk_buff *skb)
+ 	unsigned char *p;
+ 	int frontlen, len, fragno, ka9qfrag, first = 1;
+ 
++	if (paclen < 16) {
++		WARN_ON_ONCE(1);
++		kfree_skb(skb);
++		return;
++	}
++
+ 	if ((skb->len - 1) > paclen) {
+ 		if (*skb->data == AX25_P_TEXT) {
+ 			skb_pull(skb, 1); /* skip PID */
+@@ -251,8 +257,6 @@ void ax25_kick(ax25_cb *ax25)
+ 	if (start == end)
+ 		return;
+ 
+-	ax25->vs = start;
+-
+ 	/*
+ 	 * Transmit data until either we're out of data to send or
+ 	 * the window is full. Send a poll on the final I frame if
+@@ -261,8 +265,13 @@ void ax25_kick(ax25_cb *ax25)
+ 
+ 	/*
+ 	 * Dequeue the frame and copy it.
++	 * Check for race with ax25_clear_queues().
+ 	 */
+ 	skb  = skb_dequeue(&ax25->write_queue);
++	if (!skb)
++		return;
++
++	ax25->vs = start;
+ 
+ 	do {
+ 		if ((skbn = skb_clone(skb, GFP_ATOMIC)) == NULL) {
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index 372b0d3..76f5f6f 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -901,8 +901,6 @@ int hci_unregister_dev(struct hci_dev *hdev)
+ 
+ 	BT_DBG("%p name %s type %d", hdev, hdev->name, hdev->type);
+ 
+-	hci_unregister_sysfs(hdev);
+-
+ 	write_lock_bh(&hci_dev_list_lock);
+ 	list_del(&hdev->list);
+ 	write_unlock_bh(&hci_dev_list_lock);
+@@ -914,6 +912,8 @@ int hci_unregister_dev(struct hci_dev *hdev)
+ 
+ 	hci_notify(hdev, HCI_DEV_UNREG);
+ 
++	hci_unregister_sysfs(hdev);
++
+ 	__hci_dev_put(hdev);
+ 
+ 	return 0;
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 4d44372..82f77ef 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -3240,7 +3240,7 @@ static int dev_ifsioc(struct net *net, struct ifreq *ifr, unsigned int cmd)
+ 			return -EOPNOTSUPP;
+ 
+ 		case SIOCADDMULTI:
+-			if (!dev->set_multicast_list ||
++			if ((!dev->set_multicast_list && !dev->set_rx_mode) ||
+ 			    ifr->ifr_hwaddr.sa_family != AF_UNSPEC)
+ 				return -EINVAL;
+ 			if (!netif_device_present(dev))
+@@ -3249,7 +3249,7 @@ static int dev_ifsioc(struct net *net, struct ifreq *ifr, unsigned int cmd)
+ 					  dev->addr_len, 1);
+ 
+ 		case SIOCDELMULTI:
+-			if (!dev->set_multicast_list ||
++			if ((!dev->set_multicast_list && !dev->set_rx_mode) ||
+ 			    ifr->ifr_hwaddr.sa_family != AF_UNSPEC)
+ 				return -EINVAL;
+ 			if (!netif_device_present(dev))
+diff --git a/net/core/netpoll.c b/net/core/netpoll.c
+index c499b5c..2386c5e 100644
+--- a/net/core/netpoll.c
++++ b/net/core/netpoll.c
+@@ -219,10 +219,12 @@ static void zap_completion_queue(void)
+ 		while (clist != NULL) {
+ 			struct sk_buff *skb = clist;
+ 			clist = clist->next;
+-			if (skb->destructor)
++			if (skb->destructor) {
++				atomic_inc(&skb->users);
+ 				dev_kfree_skb_any(skb); /* put this one back */
+-			else
++			} else {
+ 				__kfree_skb(skb);
++			}
+ 		}
+ 	}
+ 
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 8e65182..4305154 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -583,7 +583,7 @@ new_segment:
+ 		if (!(psize -= copy))
+ 			goto out;
+ 
+-		if (skb->len < mss_now || (flags & MSG_OOB))
++		if (skb->len < size_goal || (flags & MSG_OOB))
+ 			continue;
+ 
+ 		if (forced_push(tp)) {
+@@ -829,7 +829,7 @@ new_segment:
+ 			if ((seglen -= copy) == 0 && iovlen == 0)
+ 				goto out;
+ 
+-			if (skb->len < mss_now || (flags & MSG_OOB))
++			if (skb->len < size_goal || (flags & MSG_OOB))
+ 				continue;
+ 
+ 			if (forced_push(tp)) {
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index f4c1eef..52931e8 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -258,7 +258,7 @@ static u16 tcp_select_window(struct sock *sk)
+ 		 *
+ 		 * Relax Will Robinson.
+ 		 */
+-		new_win = cur_win;
++		new_win = ALIGN(cur_win, 1 << tp->rx_opt.rcv_wscale);
+ 	}
+ 	tp->rcv_wnd = new_win;
+ 	tp->rcv_wup = tp->rcv_nxt;
+diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
+index e170c67..89f95f9 100644
+--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
+@@ -147,7 +147,9 @@ static __inline__ void fq_kill(struct nf_ct_frag6_queue *fq)
+ 
+ static void nf_ct_frag6_evictor(void)
+ {
++	local_bh_disable();
+ 	inet_frag_evictor(&nf_frags);
++	local_bh_enable();
+ }
+ 
+ static void nf_ct_frag6_expire(unsigned long data)
+diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
+index 46cf962..8c50eb4 100644
+--- a/net/llc/af_llc.c
++++ b/net/llc/af_llc.c
+@@ -155,6 +155,9 @@ static int llc_ui_create(struct net *net, struct socket *sock, int protocol)
+ 	struct sock *sk;
+ 	int rc = -ESOCKTNOSUPPORT;
+ 
++	if (!capable(CAP_NET_RAW))
++		return -EPERM;
++
+ 	if (net != &init_net)
+ 		return -EAFNOSUPPORT;
+ 
+diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
+index e595e65..7888955 100644
+--- a/net/sched/sch_generic.c
++++ b/net/sched/sch_generic.c
+@@ -178,10 +178,22 @@ static inline int qdisc_restart(struct net_device *dev)
+ 
+ void __qdisc_run(struct net_device *dev)
+ {
+-	do {
+-		if (!qdisc_restart(dev))
++	unsigned long start_time = jiffies;
++
++	while (qdisc_restart(dev)) {
++		if (netif_queue_stopped(dev))
++			break;
++
++		/*
++		 * Postpone processing if
++		 * 1. another process needs the CPU;
++		 * 2. we've been doing it for too long.
++		 */
++		if (need_resched() || jiffies != start_time) {
++			netif_schedule(dev);
+ 			break;
+-	} while (!netif_queue_stopped(dev));
++		}
++	}
+ 
+ 	clear_bit(__LINK_STATE_QDISC_RUNNING, &dev->state);
+ }
+diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
+index 5e608a6..88860dd 100644
+--- a/net/sched/sch_htb.c
++++ b/net/sched/sch_htb.c
+@@ -708,9 +708,11 @@ static void htb_charge_class(struct htb_sched *q, struct htb_class *cl,
+  */
+ static psched_time_t htb_do_events(struct htb_sched *q, int level)
+ {
+-	int i;
+-
+-	for (i = 0; i < 500; i++) {
++	/* don't run for longer than 2 jiffies; 2 is used instead of
++	   1 to simplify things when jiffy is going to be incremented
++	   too soon */
++	unsigned long stop_at = jiffies + 2;
++	while (time_before(jiffies, stop_at)) {
+ 		struct htb_class *cl;
+ 		long diff;
+ 		struct rb_node *p = rb_first(&q->wait_pq[level]);
+@@ -728,9 +730,8 @@ static psched_time_t htb_do_events(struct htb_sched *q, int level)
+ 		if (cl->cmode != HTB_CAN_SEND)
+ 			htb_add_to_wait_tree(q, cl, diff);
+ 	}
+-	if (net_ratelimit())
+-		printk(KERN_WARNING "htb: too many events !\n");
+-	return q->now + PSCHED_TICKS_PER_SEC / 10;
++	/* too much load - let's continue on next jiffie */
++	return q->now + PSCHED_TICKS_PER_SEC / HZ;
+ }
+ 
+ /* Returns class->node+prio from id-tree where classe's id is >= id. NULL
+diff --git a/net/sctp/bind_addr.c b/net/sctp/bind_addr.c
+index 6a7d010..a98c003 100644
+--- a/net/sctp/bind_addr.c
++++ b/net/sctp/bind_addr.c
+@@ -209,6 +209,7 @@ int sctp_add_bind_addr(struct sctp_bind_addr *bp, union sctp_addr *new,
+ int sctp_del_bind_addr(struct sctp_bind_addr *bp, union sctp_addr *del_addr)
+ {
+ 	struct sctp_sockaddr_entry *addr, *temp;
++	int found = 0;
+ 
+ 	/* We hold the socket lock when calling this function,
+ 	 * and that acts as a writer synchronizing lock.
+@@ -216,13 +217,14 @@ int sctp_del_bind_addr(struct sctp_bind_addr *bp, union sctp_addr *del_addr)
+ 	list_for_each_entry_safe(addr, temp, &bp->address_list, list) {
+ 		if (sctp_cmp_addr_exact(&addr->a, del_addr)) {
+ 			/* Found the exact match. */
++			found = 1;
+ 			addr->valid = 0;
+ 			list_del_rcu(&addr->list);
+ 			break;
+ 		}
+ 	}
+ 
+-	if (addr && !addr->valid) {
++	if (found) {
+ 		call_rcu(&addr->rcu, sctp_local_addr_free);
+ 		SCTP_DBG_OBJCNT_DEC(addr);
+ 		return 0;
+diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
+index 7f31ff6..1eaa1b5 100644
+--- a/net/sctp/ipv6.c
++++ b/net/sctp/ipv6.c
+@@ -89,6 +89,7 @@ static int sctp_inet6addr_event(struct notifier_block *this, unsigned long ev,
+ 	struct inet6_ifaddr *ifa = (struct inet6_ifaddr *)ptr;
+ 	struct sctp_sockaddr_entry *addr = NULL;
+ 	struct sctp_sockaddr_entry *temp;
++	int found = 0;
+ 
+ 	switch (ev) {
+ 	case NETDEV_UP:
+@@ -111,13 +112,14 @@ static int sctp_inet6addr_event(struct notifier_block *this, unsigned long ev,
+ 					&sctp_local_addr_list, list) {
+ 			if (ipv6_addr_equal(&addr->a.v6.sin6_addr,
+ 					     &ifa->addr)) {
++				found = 1;
+ 				addr->valid = 0;
+ 				list_del_rcu(&addr->list);
+ 				break;
+ 			}
+ 		}
+ 		spin_unlock_bh(&sctp_local_addr_lock);
+-		if (addr && !addr->valid)
++		if (found)
+ 			call_rcu(&addr->rcu, sctp_local_addr_free);
+ 		break;
+ 	}
+diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
+index d50f610..022adbd 100644
+--- a/net/sctp/protocol.c
++++ b/net/sctp/protocol.c
+@@ -626,6 +626,7 @@ static int sctp_inetaddr_event(struct notifier_block *this, unsigned long ev,
+ 	struct in_ifaddr *ifa = (struct in_ifaddr *)ptr;
+ 	struct sctp_sockaddr_entry *addr = NULL;
+ 	struct sctp_sockaddr_entry *temp;
++	int found = 0;
+ 
+ 	switch (ev) {
+ 	case NETDEV_UP:
+@@ -645,13 +646,14 @@ static int sctp_inetaddr_event(struct notifier_block *this, unsigned long ev,
+ 		list_for_each_entry_safe(addr, temp,
+ 					&sctp_local_addr_list, list) {
+ 			if (addr->a.v4.sin_addr.s_addr == ifa->ifa_local) {
++				found = 1;
+ 				addr->valid = 0;
+ 				list_del_rcu(&addr->list);
+ 				break;
+ 			}
+ 		}
+ 		spin_unlock_bh(&sctp_local_addr_lock);
+-		if (addr && !addr->valid)
++		if (found)
+ 			call_rcu(&addr->rcu, sctp_local_addr_free);
+ 		break;
+ 	}
+diff --git a/scripts/Makefile.modpost b/scripts/Makefile.modpost
+index d988f5d..f6b332c 100644
+--- a/scripts/Makefile.modpost
++++ b/scripts/Makefile.modpost
+@@ -53,6 +53,9 @@ modules   := $(patsubst %.o,%.ko, $(wildcard $(__modules:.ko=.o)))
+ # Stop after building .o files if NOFINAL is set. Makes compile tests quicker
+ _modpost: $(if $(KBUILD_MODPOST_NOFINAL), $(modules:.ko:.o),$(modules))
+ 
++ifneq ($(KBUILD_BUILDHOST),$(ARCH))
++        cross_build := 1
++endif
+ 
+ # Step 2), invoke modpost
+ #  Includes step 3,4
+@@ -62,7 +65,8 @@ modpost = scripts/mod/modpost                    \
+  $(if $(KBUILD_EXTMOD),-i,-o) $(kernelsymfile)   \
+  $(if $(KBUILD_EXTMOD),-I $(modulesymfile))      \
+  $(if $(KBUILD_EXTMOD),-o $(modulesymfile))      \
+- $(if $(KBUILD_EXTMOD)$(KBUILD_MODPOST_WARN),-w)
++ $(if $(KBUILD_EXTMOD)$(KBUILD_MODPOST_WARN),-w) \
++ $(if $(cross_build),-c)
+ 
+ quiet_cmd_modpost = MODPOST $(words $(filter-out vmlinux FORCE, $^)) modules
+       cmd_modpost = $(modpost) -s
+diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
+index 9ddf944..348d868 100644
+--- a/scripts/mod/file2alias.c
++++ b/scripts/mod/file2alias.c
+@@ -51,11 +51,13 @@ do {                                                            \
+                 sprintf(str + strlen(str), "*");                \
+ } while(0)
+ 
++unsigned int cross_build = 0;
+ /**
+  * Check that sizeof(device_id type) are consistent with size of section
+  * in .o file. If in-consistent then userspace and kernel does not agree
+  * on actual size which is a bug.
+  * Also verify that the final entry in the table is all zeros.
++ * Ignore both checks if build host differ from target host and size differs.
+  **/
+ static void device_id_check(const char *modname, const char *device_id,
+ 			    unsigned long size, unsigned long id_size,
+@@ -64,6 +66,8 @@ static void device_id_check(const char *modname, const char *device_id,
+ 	int i;
+ 
+ 	if (size % id_size || size < id_size) {
++		if (cross_build != 0)
++			return;
+ 		fatal("%s: sizeof(struct %s_device_id)=%lu is not a modulo "
+ 		      "of the size of section __mod_%s_device_table=%lu.\n"
+ 		      "Fix definition of struct %s_device_id "
+diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
+index 93ac52a..a990011 100644
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -1659,7 +1659,7 @@ int main(int argc, char **argv)
+ 	int opt;
+ 	int err;
+ 
+-	while ((opt = getopt(argc, argv, "i:I:mso:aw")) != -1) {
++	while ((opt = getopt(argc, argv, "i:I:cmso:aw")) != -1) {
+ 		switch(opt) {
+ 			case 'i':
+ 				kernel_read = optarg;
+@@ -1668,6 +1668,9 @@ int main(int argc, char **argv)
+ 				module_read = optarg;
+ 				external_module = 1;
+ 				break;
++		case 'c':
++			cross_build = 1;
++			break;
+ 			case 'm':
+ 				modversions = 1;
+ 				break;
+diff --git a/scripts/mod/modpost.h b/scripts/mod/modpost.h
+index 0ffed17..b50e3c9 100644
+--- a/scripts/mod/modpost.h
++++ b/scripts/mod/modpost.h
+@@ -130,6 +130,7 @@ struct elf_info {
+ };
+ 
+ /* file2alias.c */
++extern unsigned int cross_build;
+ void handle_moddevtable(struct module *mod, struct elf_info *info,
+ 			Elf_Sym *sym, const char *symname);
+ void add_moddevtable(struct buffer *buf, struct module *mod);
+diff --git a/security/capability.c b/security/capability.c
+index 9e99f36..2c6e06d 100644
+--- a/security/capability.c
++++ b/security/capability.c
+@@ -40,7 +40,6 @@ static struct security_operations capability_ops = {
+ 	.inode_need_killpriv =		cap_inode_need_killpriv,
+ 	.inode_killpriv =		cap_inode_killpriv,
+ 
+-	.task_kill =			cap_task_kill,
+ 	.task_setscheduler =		cap_task_setscheduler,
+ 	.task_setioprio =		cap_task_setioprio,
+ 	.task_setnice =			cap_task_setnice,
+diff --git a/security/commoncap.c b/security/commoncap.c
+index e87422e..6e9065c 100644
+--- a/security/commoncap.c
++++ b/security/commoncap.c
+@@ -527,40 +527,6 @@ int cap_task_setnice (struct task_struct *p, int nice)
+ 	return cap_safe_nice(p);
+ }
+ 
+-int cap_task_kill(struct task_struct *p, struct siginfo *info,
+-				int sig, u32 secid)
+-{
+-	if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
+-		return 0;
+-
+-	/*
+-	 * Running a setuid root program raises your capabilities.
+-	 * Killing your own setuid root processes was previously
+-	 * allowed.
+-	 * We must preserve legacy signal behavior in this case.
+-	 */
+-	if (p->uid == current->uid)
+-		return 0;
+-
+-	/* sigcont is permitted within same session */
+-	if (sig == SIGCONT && (task_session_nr(current) == task_session_nr(p)))
+-		return 0;
+-
+-	if (secid)
+-		/*
+-		 * Signal sent as a particular user.
+-		 * Capabilities are ignored.  May be wrong, but it's the
+-		 * only thing we can do at the moment.
+-		 * Used only by usb drivers?
+-		 */
+-		return 0;
+-	if (cap_issubset(p->cap_permitted, current->cap_permitted))
+-		return 0;
+-	if (capable(CAP_KILL))
+-		return 0;
+-
+-	return -EPERM;
+-}
+ #else
+ int cap_task_setscheduler (struct task_struct *p, int policy,
+ 			   struct sched_param *lp)
+@@ -575,11 +541,6 @@ int cap_task_setnice (struct task_struct *p, int nice)
+ {
+ 	return 0;
+ }
+-int cap_task_kill(struct task_struct *p, struct siginfo *info,
+-				int sig, u32 secid)
+-{
+-	return 0;
+-}
+ #endif
+ 
+ void cap_task_reparent_to_init (struct task_struct *p)

Deleted: genpatches-2.6/trunk/2.6.24/1400_prevent-gcc43-optimization-udivdi3.patch
===================================================================
--- genpatches-2.6/trunk/2.6.24/1400_prevent-gcc43-optimization-udivdi3.patch	2008-04-18 19:34:38 UTC (rev 1295)
+++ genpatches-2.6/trunk/2.6.24/1400_prevent-gcc43-optimization-udivdi3.patch	2008-04-19 09:58:26 UTC (rev 1296)
@@ -1,33 +0,0 @@
-From 38332cb98772f5ea757e6486bed7ed0381cb5f98 Mon Sep 17 00:00:00 2001
-From: Segher Boessenkool <segher@×××××××××××××××.org>
-Date: Tue, 4 Mar 2008 14:59:54 -0800
-Message-ID: <2d0a357f0803241147o351f9434y696cb33841ffe834@××××××××××.com>
-Subject: time: prevent the loop in timespec_add_ns() from being optimised away
-
-Since some architectures don't support __udivdi3().
-
-Signed-off-by: Segher Boessenkool <segher@×××××××××××××××.org>
-Cc: john stultz <johnstul@××××××.com>
-Cc: Ingo Molnar <mingo@××××.hu>
-Signed-off-by: Andrew Morton <akpm@××××××××××××××××.org>
-Signed-off-by: Thomas Gleixner <tglx@××××××××××.de>
-Cc:  Sedat Dilek <sedat.dilek@××××××××××.com>
-Signed-off-by: Chris Wright <chrisw@××××××××.org>
----
- include/linux/time.h |    4 ++++
- 1 file changed, 4 insertions(+)
-
---- a/include/linux/time.h
-+++ b/include/linux/time.h
-@@ -173,6 +173,10 @@ static inline void timespec_add_ns(struc
- {
- 	ns += a->tv_nsec;
- 	while(unlikely(ns >= NSEC_PER_SEC)) {
-+		/* The following asm() prevents the compiler from
-+		 * optimising this loop into a modulo operation.  */
-+		asm("" : "+r"(ns));
-+
- 		ns -= NSEC_PER_SEC;
- 		a->tv_sec++;
- 	}
-

Deleted: genpatches-2.6/trunk/2.6.24/1700-futex_cmpxchg_inatomic_impl_check.patch
===================================================================
--- genpatches-2.6/trunk/2.6.24/1700-futex_cmpxchg_inatomic_impl_check.patch	2008-04-18 19:34:38 UTC (rev 1295)
+++ genpatches-2.6/trunk/2.6.24/1700-futex_cmpxchg_inatomic_impl_check.patch	2008-04-19 09:58:26 UTC (rev 1296)
@@ -1,29 +0,0 @@
-c20a84c91048c76c1379011c96b1a5cee5c7d9a0
- include/asm-parisc/futex.h |   10 ++++++++--
- 1 files changed, 8 insertions(+), 2 deletions(-)
-
-diff --git a/include/asm-parisc/futex.h b/include/asm-parisc/futex.h
-index dbee6e6..fdc6d05 100644
---- a/include/asm-parisc/futex.h
-+++ b/include/asm-parisc/futex.h
-@@ -56,6 +56,12 @@ futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval, int newval)
- 	int err = 0;
- 	int uval;
- 
-+	/* futex.c wants to do a cmpxchg_inatomic on kernel NULL, which is
-+	 * our gateway page, and causes no end of trouble...
-+	 */
-+	if (segment_eq(KERNEL_DS, get_fs()) && !uaddr)
-+		return -EFAULT;
-+
- 	if (!access_ok(VERIFY_WRITE, uaddr, sizeof(int)))
- 		return -EFAULT;
- 
-@@ -67,5 +73,5 @@ futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval, int newval)
- 	return uval;
- }
- 
--#endif
--#endif
-+#endif /*__KERNEL__*/
-+#endif /*_ASM_PARISC_FUTEX_H*/

Deleted: genpatches-2.6/trunk/2.6.24/2103_ata-assume-no-device-attached.patch
===================================================================
--- genpatches-2.6/trunk/2.6.24/2103_ata-assume-no-device-attached.patch	2008-04-18 19:34:38 UTC (rev 1295)
+++ genpatches-2.6/trunk/2.6.24/2103_ata-assume-no-device-attached.patch	2008-04-19 09:58:26 UTC (rev 1296)
@@ -1,83 +0,0 @@
-From: Tejun Heo <htejun@×××××.com>
-Date: Sun, 23 Mar 2008 06:16:53 +0000 (+0900)
-Subject: libata: assume no device is attached if both IDENTIFYs are aborted
-X-Git-Tag: v2.6.25-rc7~10^2~3
-X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=1ffc151fcddf524d0c76709d7e7a2af0255acb6b
-
-libata: assume no device is attached if both IDENTIFYs are aborted
-
-This is to fix bugzilla #10254.  QSI cdrom attached to pata_sis as
-secondary master appears as phantom device for the slave.
-Interestingly, instead of not setting DRQ after IDENTIFY which
-triggers NODEV_HINT, it aborts both IDENTIFY and IDENTIFY PACKET which
-makes EH retry.
-
-Modify EH such that it assumes no device is attached if both flavors
-of IDENTIFY are aborted by the device.  There really isn't much point
-in retrying when the device actively aborts the commands.
-
-While at it, convert NODEV detection message to ata_dev_printk() to
-help debugging obscure detection problems.
-
-This problem was reported by Jan Bücken.
-
-Signed-off-by: Tejun Heo <htejun@×××××.com>
-Cc: Jan Bücken <jb.faq@×××.de>
-Acked-by: Alan Cox <alan@××××××.com>
-Signed-off-by: Jeff Garzik <jeff@××××××.org>
----
-
-diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
-index 4bbe31f..c9c5280 100644
---- a/drivers/ata/libata-core.c
-+++ b/drivers/ata/libata-core.c
-@@ -2092,24 +2092,34 @@ int ata_dev_read_id(struct ata_device *dev, unsigned int *p_class,
- 				     id, sizeof(id[0]) * ATA_ID_WORDS, 0);
- 	if (err_mask) {
- 		if (err_mask & AC_ERR_NODEV_HINT) {
--			DPRINTK("ata%u.%d: NODEV after polling detection\n",
--				ap->print_id, dev->devno);
-+			ata_dev_printk(dev, KERN_DEBUG,
-+				       "NODEV after polling detection\n");
- 			return -ENOENT;
- 		}
- 
--		/* Device or controller might have reported the wrong
--		 * device class.  Give a shot at the other IDENTIFY if
--		 * the current one is aborted by the device.
--		 */
--		if (may_fallback &&
--		    (err_mask == AC_ERR_DEV) && (tf.feature & ATA_ABORTED)) {
--			may_fallback = 0;
-+		if ((err_mask == AC_ERR_DEV) && (tf.feature & ATA_ABORTED)) {
-+			/* Device or controller might have reported
-+			 * the wrong device class.  Give a shot at the
-+			 * other IDENTIFY if the current one is
-+			 * aborted by the device.
-+			 */
-+			if (may_fallback) {
-+				may_fallback = 0;
- 
--			if (class == ATA_DEV_ATA)
--				class = ATA_DEV_ATAPI;
--			else
--				class = ATA_DEV_ATA;
--			goto retry;
-+				if (class == ATA_DEV_ATA)
-+					class = ATA_DEV_ATAPI;
-+				else
-+					class = ATA_DEV_ATA;
-+				goto retry;
-+			}
-+
-+			/* Control reaches here iff the device aborted
-+			 * both flavors of IDENTIFYs which happens
-+			 * sometimes with phantom devices.
-+			 */
-+			ata_dev_printk(dev, KERN_DEBUG,
-+				       "both IDENTIFYs aborted, assuming NODEV\n");
-+			return -ENOENT;
- 		}
- 
- 		rc = -EIO;
-

Deleted: genpatches-2.6/trunk/2.6.24/2200_ppc32-apm-export-fix.patch
===================================================================
--- genpatches-2.6/trunk/2.6.24/2200_ppc32-apm-export-fix.patch	2008-04-18 19:34:38 UTC (rev 1295)
+++ genpatches-2.6/trunk/2.6.24/2200_ppc32-apm-export-fix.patch	2008-04-19 09:58:26 UTC (rev 1296)
@@ -1,11 +0,0 @@
---- a/drivers/macintosh/via-pmu.c.orig	2008-04-14 10:45:01.000000000 -0400
-+++ a/drivers/macintosh/via-pmu.c	2008-04-14 10:49:39.000000000 -0400
-@@ -2842,7 +2842,7 @@ EXPORT_SYMBOL(pmu_wait_complete);
- EXPORT_SYMBOL(pmu_suspend);
- EXPORT_SYMBOL(pmu_resume);
- EXPORT_SYMBOL(pmu_unlock);
--#if defined(CONFIG_PM_SLEEP) && defined(CONFIG_PPC32)
-+#if defined(CONFIG_PPC32)
- EXPORT_SYMBOL(pmu_enable_irled);
- EXPORT_SYMBOL(pmu_battery_count);
- EXPORT_SYMBOL(pmu_batteries);

Deleted: genpatches-2.6/trunk/2.6.24/2305_bluetooth-suspend-oops.patch
===================================================================
--- genpatches-2.6/trunk/2.6.24/2305_bluetooth-suspend-oops.patch	2008-04-18 19:34:38 UTC (rev 1295)
+++ genpatches-2.6/trunk/2.6.24/2305_bluetooth-suspend-oops.patch	2008-04-19 09:58:26 UTC (rev 1296)
@@ -1,108 +0,0 @@
-From: Dave Young <hidave.darkstar@×××××.com>
-Date: Thu, 6 Mar 2008 02:45:59 +0000 (-0800)
-Subject: bluetooth: hci_core: defer hci_unregister_sysfs()
-X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Fdavem%2Fnet-2.6.git;a=commitdiff_plain;h=147e2d59833e994cc99341806a88b9e59be41391
-
-bluetooth: hci_core: defer hci_unregister_sysfs()
-
-Alon Bar-Lev reports:
-
- Feb 16 23:41:33 alon1 usb 3-1: configuration #1 chosen from 1 choice
-Feb 16 23:41:33 alon1 BUG: unable to handle kernel NULL pointer
-dereference at virtual address 00000008
-Feb 16 23:41:33 alon1 printing eip: c01b2db6 *pde = 00000000
-Feb 16 23:41:33 alon1 Oops: 0000 [#1] PREEMPT
-Feb 16 23:41:33 alon1 Modules linked in: ppp_deflate zlib_deflate
-zlib_inflate bsd_comp ppp_async rfcomm l2cap hci_usb vmnet(P)
-vmmon(P) tun radeon drm autofs4 ipv6 aes_generic crypto_algapi
-ieee80211_crypt_ccmp nf_nat_irc nf_nat_ftp nf_conntrack_irc
-nf_conntrack_ftp ipt_MASQUERADE iptable_nat nf_nat ipt_REJECT
-xt_tcpudp ipt_LOG xt_limit xt_state nf_conntrack_ipv4 nf_conntrack
-iptable_filter ip_tables x_tables snd_pcm_oss snd_mixer_oss
-snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device
-bluetooth ppp_generic slhc ioatdma dca cfq_iosched cpufreq_powersave
-cpufreq_ondemand cpufreq_conservative acpi_cpufreq freq_table uinput
-fan af_packet nls_cp1255 nls_iso8859_1 nls_utf8 nls_base pcmcia
-snd_intel8x0 snd_ac97_codec ac97_bus snd_pcm nsc_ircc snd_timer
-ipw2200 thinkpad_acpi irda snd ehci_hcd yenta_socket uhci_hcd
-psmouse ieee80211 soundcore intel_agp hwmon rsrc_nonstatic pcspkr
-e1000 crc_ccitt snd_page_alloc i2c_i801 ieee80211_crypt pcmcia_core
-agpgart thermal bat!
-tery nvram rtc sr_mod ac sg firmware_class button processor cdrom
-unix usbcore evdev ext3 jbd ext2 mbcache loop ata_piix libata sd_mod
-scsi_mod
-Feb 16 23:41:33 alon1
-Feb 16 23:41:33 alon1 Pid: 4, comm: events/0 Tainted: P
-(2.6.24-gentoo-r2 #1)
-Feb 16 23:41:33 alon1 EIP: 0060:[<c01b2db6>] EFLAGS: 00010282 CPU: 0
-Feb 16 23:41:33 alon1 EIP is at sysfs_get_dentry+0x26/0x80
-Feb 16 23:41:33 alon1 EAX: 00000000 EBX: 00000000 ECX: 00000000 EDX:
-f48a2210
-Feb 16 23:41:33 alon1 ESI: f72eb900 EDI: f4803ae0 EBP: f4803ae0 ESP:
-f7c49efc
-Feb 16 23:41:33 alon1 hcid[7004]: HCI dev 0 registered
-Feb 16 23:41:33 alon1 DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068
-Feb 16 23:41:33 alon1 Process events/0 (pid: 4, ti=f7c48000
-task=f7c3efc0 task.ti=f7c48000)
-Feb 16 23:41:33 alon1 Stack: f7cb6140 f4822668 f7e71e10 c01b304d
-ffffffff ffffffff fffffffe c030ba9c
-Feb 16 23:41:33 alon1 f7cb6140 f4822668 f6da6720 f7cb6140 f4822668
-f6da6720 c030ba8e c01ce20b
-Feb 16 23:41:33 alon1 f6e9dd00 c030ba8e f6da6720 f6e9dd00 f6e9dd00
-00000000 f4822600 00000000
-Feb 16 23:41:33 alon1 Call Trace:
-Feb 16 23:41:33 alon1 [<c01b304d>] sysfs_move_dir+0x3d/0x1f0
-Feb 16 23:41:33 alon1 [<c01ce20b>] kobject_move+0x9b/0x120
-Feb 16 23:41:33 alon1 [<c0241711>] device_move+0x51/0x110
-Feb 16 23:41:33 alon1 [<f9aaed80>] del_conn+0x0/0x70 [bluetooth]
-Feb 16 23:41:33 alon1 [<f9aaed99>] del_conn+0x19/0x70 [bluetooth]
-Feb 16 23:41:33 alon1 [<c012c1a1>] run_workqueue+0x81/0x140
-Feb 16 23:41:33 alon1 [<c02c0c88>] schedule+0x168/0x2e0
-Feb 16 23:41:33 alon1 [<c012fc70>] autoremove_wake_function+0x0/0x50
-Feb 16 23:41:33 alon1 [<c012c9cb>] worker_thread+0x9b/0xf0
-Feb 16 23:41:33 alon1 [<c012fc70>] autoremove_wake_function+0x0/0x50
-Feb 16 23:41:33 alon1 [<c012c930>] worker_thread+0x0/0xf0
-Feb 16 23:41:33 alon1 [<c012f962>] kthread+0x42/0x70
-Feb 16 23:41:33 alon1 [<c012f920>] kthread+0x0/0x70
-Feb 16 23:41:33 alon1 [<c0104c2f>] kernel_thread_helper+0x7/0x18
-Feb 16 23:41:33 alon1 =======================
-Feb 16 23:41:33 alon1 Code: 26 00 00 00 00 57 89 c7 a1 50 1b 3a c0
-56 53 8b 70 38 85 f6 74 08 8b 0e 85 c9 74 58 ff 06 8b 56 50 39 fa 74
-47 89 fb eb 02 89 c3 <8b> 43 08 39 c2 75 f7 8b 46 08 83 c0 68 e8 98
-e7 10 00 8b 43 10
-Feb 16 23:41:33 alon1 EIP: [<c01b2db6>] sysfs_get_dentry+0x26/0x80
-SS:ESP 0068:f7c49efc
-Feb 16 23:41:33 alon1 ---[ end trace aae864e9592acc1d ]---
-
-Defer hci_unregister_sysfs because hci device could be destructed
-while hci conn devices still there.
-
-Signed-off-by: Dave Young <hidave.darkstar@×××××.com>
-Tested-by: Stefan Seyfried <seife@××××.de>
-Acked-by: Alon Bar-Lev <alon.barlev@×××××.com>
-Signed-off-by: Andrew Morton <akpm@××××××××××××××××.org>
-Acked-by: Marcel Holtmann <marcel@××××××××.org>
----
-
-diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
-index 930b58e..aec6929 100644
---- a/net/bluetooth/hci_core.c
-+++ b/net/bluetooth/hci_core.c
-@@ -902,8 +902,6 @@ int hci_unregister_dev(struct hci_dev *hdev)
- 
- 	BT_DBG("%p name %s type %d", hdev, hdev->name, hdev->type);
- 
--	hci_unregister_sysfs(hdev);
--
- 	write_lock_bh(&hci_dev_list_lock);
- 	list_del(&hdev->list);
- 	write_unlock_bh(&hci_dev_list_lock);
-@@ -915,6 +913,8 @@ int hci_unregister_dev(struct hci_dev *hdev)
- 
- 	hci_notify(hdev, HCI_DEV_UNREG);
- 
-+	hci_unregister_sysfs(hdev);
-+
- 	__hci_dev_put(hdev);
- 
- 	return 0;

Deleted: genpatches-2.6/trunk/2.6.24/2405_sis190-eeprom-mac.patch
===================================================================
--- genpatches-2.6/trunk/2.6.24/2405_sis190-eeprom-mac.patch	2008-04-18 19:34:38 UTC (rev 1295)
+++ genpatches-2.6/trunk/2.6.24/2405_sis190-eeprom-mac.patch	2008-04-19 09:58:26 UTC (rev 1296)
@@ -1,45 +0,0 @@
-From: Francois Romieu <romieu@×××××××××.com>
-Date: Mon, 18 Feb 2008 20:20:32 +0000 (+0100)
-Subject: sis190: read the mac address from the eeprom first
-X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Fjgarzik%2Fnetdev-2.6.git;a=commitdiff_plain;h=563e0ae06ff18f0b280f11cf706ba0172255ce52
-
-sis190: read the mac address from the eeprom first
-
-Reading a serie of zero from the cmos sram area do not work
-well with is_valid_ether_addr(). Let's read the mac address
-from the eeprom first as it seems more reliable.
-
-Fix for http://bugzilla.kernel.org/show_bug.cgi?id=9831
-
-Signed-off-by: Francois Romieu <romieu@×××××××××.com>
-Signed-off-by: Jeff Garzik <jeff@××××××.org>
----
-
-diff --git a/drivers/net/sis190.c b/drivers/net/sis190.c
-index 202fdf3..20745fd 100644
---- a/drivers/net/sis190.c
-+++ b/drivers/net/sis190.c
-@@ -1633,13 +1633,18 @@ static inline void sis190_init_rxfilter(struct net_device *dev)
- static int __devinit sis190_get_mac_addr(struct pci_dev *pdev, 
- 					 struct net_device *dev)
- {
--	u8 from;
-+	int rc;
-+
-+	rc = sis190_get_mac_addr_from_eeprom(pdev, dev);
-+	if (rc < 0) {
-+		u8 reg;
- 
--	pci_read_config_byte(pdev, 0x73, &from);
-+		pci_read_config_byte(pdev, 0x73, &reg);
- 
--	return (from & 0x00000001) ?
--		sis190_get_mac_addr_from_apc(pdev, dev) :
--		sis190_get_mac_addr_from_eeprom(pdev, dev);
-+		if (reg & 0x00000001)
-+			rc = sis190_get_mac_addr_from_apc(pdev, dev);
-+	}
-+	return rc;
- }
- 
- static void sis190_set_speed_auto(struct net_device *dev)

Deleted: genpatches-2.6/trunk/2.6.24/2505_usb-storage-motorola-rokr.patch
===================================================================
--- genpatches-2.6/trunk/2.6.24/2505_usb-storage-motorola-rokr.patch	2008-04-18 19:34:38 UTC (rev 1295)
+++ genpatches-2.6/trunk/2.6.24/2505_usb-storage-motorola-rokr.patch	2008-04-19 09:58:26 UTC (rev 1296)
@@ -1,78 +0,0 @@
-[PATCH fixed] usb: add support for Motorola ROKR Z6 cellphone in mass storage mode
-
-From: Constantin Baranov <const@×××××.ru>
-
-Motorola ROKR Z6 cellphone has bugs in its USB, so it is impossible to use
-it as mass storage. Patch describes new "unusual" USB device for it with
-FIX_INQUIRY and FIX_CAPACITY flags and new BULK_IGNORE_TAG flag.
-Last flag relaxes check for equality of bcs->Tag and us->tag in
-usb_stor_Bulk_transport routine.
-
-Signed-off-by: Constantin Baranov <const@×××××.ru>
-Signed-off-by: Matthew Dharm <mdharm-usb@××××××××××××××.net>
-Signed-off-by: Daniel Drake <dsd@g.o>
----
-
-This patch was previously submitted by Constantin but it was line wrapped
-and hence does not apply. Here's a fixed version (no changes to the actual
-patch itself)
-
- drivers/usb/storage/transport.c    |    3 ++-
- drivers/usb/storage/unusual_devs.h |   11 +++++++++++
- include/linux/usb_usual.h          |    4 +++-
- 3 files changed, 16 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c
-index 5780ed1..bdd4334 100644
---- a/drivers/usb/storage/transport.c
-+++ b/drivers/usb/storage/transport.c
-@@ -1009,7 +1009,8 @@ int usb_stor_Bulk_transport(struct scsi_cmnd *srb, struct us_data *us)
- 	US_DEBUGP("Bulk Status S 0x%x T 0x%x R %u Stat 0x%x\n",
- 			le32_to_cpu(bcs->Signature), bcs->Tag, 
- 			residue, bcs->Status);
--	if (bcs->Tag != us->tag || bcs->Status > US_BULK_STAT_PHASE) {
-+	if (!(bcs->Tag == us->tag || (us->flags & US_FL_BULK_IGNORE_TAG)) ||
-+		bcs->Status > US_BULK_STAT_PHASE) {
- 		US_DEBUGP("Bulk logical error\n");
- 		return USB_STOR_TRANSPORT_ERROR;
- 	}
-diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
-index 99679a8..e5219a5 100644
---- a/drivers/usb/storage/unusual_devs.h
-+++ b/drivers/usb/storage/unusual_devs.h
-@@ -1589,6 +1589,17 @@ UNUSUAL_DEV(  0x22b8, 0x4810, 0x0001, 0x0001,
- 		US_SC_DEVICE, US_PR_DEVICE, NULL,
- 		US_FL_FIX_CAPACITY),
- 
-+/*
-+ * Patch by Constantin Baranov <const@×××××.ru>
-+ * Report by Andreas Koenecke.
-+ * Motorola ROKR Z6.
-+ */
-+UNUSUAL_DEV(  0x22b8, 0x6426, 0x0101, 0x0101,
-+		"Motorola",
-+		"MSnc.",
-+		US_SC_DEVICE, US_PR_DEVICE, NULL,
-+		US_FL_FIX_INQUIRY | US_FL_FIX_CAPACITY | US_FL_BULK_IGNORE_TAG),
-+
- /* Reported by Radovan Garabik <garabik@×××××××××××××××××××××.sk> */
- UNUSUAL_DEV(  0x2735, 0x100b, 0x0000, 0x9999,
- 		"MPIO",
-diff --git a/include/linux/usb_usual.h b/include/linux/usb_usual.h
-index cee0623..0a40dfa 100644
---- a/include/linux/usb_usual.h
-+++ b/include/linux/usb_usual.h
-@@ -50,7 +50,9 @@
- 	US_FLAG(CAPACITY_HEURISTICS,	0x00001000)		\
- 		/* sometimes sizes is too big */		\
- 	US_FLAG(MAX_SECTORS_MIN,0x00002000)			\
--		/* Sets max_sectors to arch min */
-+		/* Sets max_sectors to arch min */		\
-+	US_FLAG(BULK_IGNORE_TAG,0x00004000)			\
-+		/* Ignore tag mismatch in bulk operations */
- 
- 
- #define US_FLAG(name, value)	US_FL_##name = value ,
--- 
-1.5.4.3
-

-- 
gentoo-commits@l.g.o mailing list