[gentoo-commits] linux-patches r1573 - genpatches-2.6/trunk/2.6.30

[Mike Pagano (mpagano)]

Author: mpagano
Date: 2009-06-05 16:28:49 +0000 (Fri, 05 Jun 2009)
New Revision: 1573

Removed:
   genpatches-2.6/trunk/2.6.30/1000_linux-2.6.29.1.patch
   genpatches-2.6/trunk/2.6.30/1001_linux-2.6.29.2.patch
   genpatches-2.6/trunk/2.6.30/1002_linux-2.6.29.3.patch
   genpatches-2.6/trunk/2.6.30/1003_linux-2.6.29.4.patch
   genpatches-2.6/trunk/2.6.30/1915_ext4-automatically-allocate-delay-allocated-blocks-on-rename.patch
   genpatches-2.6/trunk/2.6.30/1916_ext4-automatically-allocate-delay-allocated-blocks-on-close.patch
   genpatches-2.6/trunk/2.6.30/1917_ext4-add-EXT4_IOC_ALLOC_DA_BLKS-ioctl.patch
   genpatches-2.6/trunk/2.6.30/1918_ext4-fix-discard-of-inode-prealloc-space-with-delayed-allocation.patch
   genpatches-2.6/trunk/2.6.30/2300_alpha-add-pci-resources.patch
   genpatches-2.6/trunk/2.6.30/2700_usblp-poll-for-status.patch
Modified:
   genpatches-2.6/trunk/2.6.30/0000_README
Log:
Preparing for 2.6.30 kernel

Modified: genpatches-2.6/trunk/2.6.30/0000_README
===================================================================
--- genpatches-2.6/trunk/2.6.30/0000_README	2009-06-05 16:26:11 UTC (rev 1572)
+++ genpatches-2.6/trunk/2.6.30/0000_README	2009-06-05 16:28:49 UTC (rev 1573)
@@ -39,46 +39,6 @@
 Individual Patch Descriptions:
 --------------------------------------------------------------------------
 
-Patch:  1000_linux-2.6.29.1.patch
-From:   http://www.kernel.org
-Desc:   Linux 2.6.29.1
-
-Patch:  1001_linux-2.6.29.2.patch
-From:   http://www.kernel.org
-Desc:   Linux 2.6.29.2
-
-Patch:  1002_linux-2.6.29.3.patch
-From:   http://www.kernel.org
-Desc:   Linux 2.6.29.3
-
-Patch:  1003_linux-2.6.29.4.patch
-From:   http://www.kernel.org
-Desc:   Linux 2.6.29.4
-
-Patch:  1915_ext4-automatically-allocate-delay-allocated-blocks-on-rename.patch
-From:   Theodore Ts'o <tytso@×××.edu>
-Desc:   ext4: Automatically allocate delay allocated blocks on rename
-
-Patch:  1916_ext4-automatically-allocate-delay-allocated-blocks-on-close.patch
-From:   Theodore Ts'o <tytso@×××.edu>
-Desc:   ext4: Automatically allocate delay allocated blocks on close
-
-Patch:  1917_ext4-add-EXT4_IOC_ALLOC_DA_BLKS-ioctl.patch
-From:   Theodore Ts'o <tytso@×××.edu>
-Desc:   ext4: add EXT4_IOC_ALLOC_DA_BLKS ioctl
-
-Patch:  1918_ext4-fix-discard-of-inode-prealloc-space-with-delayed-allocation.patch
-From:   Aneesh Kumar K.V <aneesh.kumar@××××××××××××××.com>
-Desc:   ext4: Fix discard of inode prealloc space with delayed allocation
-
-Patch:  2300_alpha-add-pci-resources.patch
-From:   http://bugs.gentoo.org/show_bug.cgi?id=270069
-Desc:   PCI/alpha: make PCI resources available
-
-Patch:  2700_usblp-poll-for-status.patch
-From:   http://bugs.gentoo.org/show_bug.cgi?id=251237
-Desc:   usblp: continuously poll for status
-
 Patch:	4100_dm-bbr.patch
 From:	EVMS 2.5.2
 Desc:	Bad block relocation support for LiveCD users

Deleted: genpatches-2.6/trunk/2.6.30/1000_linux-2.6.29.1.patch
===================================================================
--- genpatches-2.6/trunk/2.6.30/1000_linux-2.6.29.1.patch	2009-06-05 16:26:11 UTC (rev 1572)
+++ genpatches-2.6/trunk/2.6.30/1000_linux-2.6.29.1.patch	2009-06-05 16:28:49 UTC (rev 1573)
@@ -1,1243 +0,0 @@
-diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
-index a58378c..ce3b36e 100644
---- a/arch/arm/include/asm/elf.h
-+++ b/arch/arm/include/asm/elf.h
-@@ -50,6 +50,7 @@ typedef struct user_fp elf_fpregset_t;
- #define R_ARM_ABS32	2
- #define R_ARM_CALL	28
- #define R_ARM_JUMP24	29
-+#define R_ARM_V4BX	40
- 
- /*
-  * These are used to set parameters in the core dumps.
-diff --git a/arch/arm/kernel/module.c b/arch/arm/kernel/module.c
-index dab48f2..9f509fd 100644
---- a/arch/arm/kernel/module.c
-+++ b/arch/arm/kernel/module.c
-@@ -132,6 +132,15 @@ apply_relocate(Elf32_Shdr *sechdrs, const char *strtab, unsigned int symindex,
- 			*(u32 *)loc |= offset & 0x00ffffff;
- 			break;
- 
-+	       case R_ARM_V4BX:
-+		       /* Preserve Rm and the condition code. Alter
-+			* other bits to re-code instruction as
-+			* MOV PC,Rm.
-+			*/
-+		       *(u32 *)loc &= 0xf000000f;
-+		       *(u32 *)loc |= 0x01a0f000;
-+		       break;
-+
- 		default:
- 			printk(KERN_ERR "%s: unknown relocation: %u\n",
- 			       module->name, ELF32_R_TYPE(rel->r_info));
-diff --git a/arch/arm/mach-iop13xx/pci.c b/arch/arm/mach-iop13xx/pci.c
-index 673b0db..4873f26 100644
---- a/arch/arm/mach-iop13xx/pci.c
-+++ b/arch/arm/mach-iop13xx/pci.c
-@@ -1026,8 +1026,10 @@ int iop13xx_pci_setup(int nr, struct pci_sys_data *sys)
- 		which_atu = 0;
- 	}
- 
--	if (!which_atu)
-+	if (!which_atu) {
-+		kfree(res);
- 		return 0;
-+	}
- 
- 	switch(which_atu) {
- 	case IOP13XX_INIT_ATU_ATUX:
-@@ -1074,6 +1076,7 @@ int iop13xx_pci_setup(int nr, struct pci_sys_data *sys)
- 		sys->map_irq = iop13xx_pcie_map_irq;
- 		break;
- 	default:
-+		kfree(res);
- 		return 0;
- 	}
- 
-diff --git a/arch/arm/mach-omap2/mmc-twl4030.c b/arch/arm/mach-omap2/mmc-twl4030.c
-index 437f520..e1dadf7 100644
---- a/arch/arm/mach-omap2/mmc-twl4030.c
-+++ b/arch/arm/mach-omap2/mmc-twl4030.c
-@@ -397,6 +397,7 @@ void __init twl4030_mmc_init(struct twl4030_hsmmc_info *controllers)
- 			break;
- 		default:
- 			pr_err("MMC%d configuration not supported!\n", c->mmc);
-+			kfree(mmc);
- 			continue;
- 		}
- 		hsmmc_data[c->mmc - 1] = mmc;
-diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
-index d4d082c..5a89e57 100644
---- a/arch/arm/mm/mmu.c
-+++ b/arch/arm/mm/mmu.c
-@@ -694,7 +694,7 @@ static void __init sanity_check_meminfo(void)
- 		 * the vmalloc area.
- 		 */
- 		if (__va(bank->start) >= VMALLOC_MIN ||
--		    __va(bank->start) < PAGE_OFFSET) {
-+		    __va(bank->start) < (void *)PAGE_OFFSET) {
- 			printk(KERN_NOTICE "Ignoring RAM at %.8lx-%.8lx "
- 			       "(vmalloc region overlap).\n",
- 			       bank->start, bank->start + bank->size - 1);
-diff --git a/arch/sparc/include/asm/tlb_64.h b/arch/sparc/include/asm/tlb_64.h
-index ec81cde..0aaa086 100644
---- a/arch/sparc/include/asm/tlb_64.h
-+++ b/arch/sparc/include/asm/tlb_64.h
-@@ -58,6 +58,8 @@ static inline struct mmu_gather *tlb_gather_mmu(struct mm_struct *mm, unsigned i
- static inline void tlb_flush_mmu(struct mmu_gather *mp)
- {
- 	if (mp->need_flush) {
-+		if (!mp->fullmm)
-+			flush_tlb_pending();
- 		free_pages_and_swap_cache(mp->pages, mp->pages_nr);
- 		mp->pages_nr = 0;
- 		mp->need_flush = 0;
-@@ -78,8 +80,6 @@ static inline void tlb_finish_mmu(struct mmu_gather *mp, unsigned long start, un
- 
- 	if (mp->fullmm)
- 		mp->fullmm = 0;
--	else
--		flush_tlb_pending();
- 
- 	/* keep the page table cache within bounds */
- 	check_pgt_cache();
-diff --git a/arch/sparc/kernel/nmi.c b/arch/sparc/kernel/nmi.c
-index f357722..2c0cc72 100644
---- a/arch/sparc/kernel/nmi.c
-+++ b/arch/sparc/kernel/nmi.c
-@@ -13,6 +13,7 @@
- #include <linux/module.h>
- #include <linux/kprobes.h>
- #include <linux/kernel_stat.h>
-+#include <linux/reboot.h>
- #include <linux/slab.h>
- #include <linux/kdebug.h>
- #include <linux/delay.h>
-@@ -206,13 +207,33 @@ void nmi_adjust_hz(unsigned int new_hz)
- }
- EXPORT_SYMBOL_GPL(nmi_adjust_hz);
- 
-+static int nmi_shutdown(struct notifier_block *nb, unsigned long cmd, void *p)
-+{
-+	on_each_cpu(stop_watchdog, NULL, 1);
-+	return 0;
-+}
-+
-+static struct notifier_block nmi_reboot_notifier = {
-+	.notifier_call = nmi_shutdown,
-+};
-+
- int __init nmi_init(void)
- {
-+	int err;
-+
- 	nmi_usable = 1;
- 
- 	on_each_cpu(start_watchdog, NULL, 1);
- 
--	return check_nmi_watchdog();
-+	err = check_nmi_watchdog();
-+	if (!err) {
-+		err = register_reboot_notifier(&nmi_reboot_notifier);
-+		if (err) {
-+			nmi_usable = 0;
-+			on_each_cpu(stop_watchdog, NULL, 1);
-+		}
-+	}
-+	return err;
- }
- 
- static int __init setup_nmi_watchdog(char *str)
-diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
-index 6cd1a5b..79457f6 100644
---- a/arch/sparc/kernel/smp_64.c
-+++ b/arch/sparc/kernel/smp_64.c
-@@ -1031,7 +1031,7 @@ void smp_fetch_global_regs(void)
-  *    If the address space is non-shared (ie. mm->count == 1) we avoid
-  *    cross calls when we want to flush the currently running process's
-  *    tlb state.  This is done by clearing all cpu bits except the current
-- *    processor's in current->active_mm->cpu_vm_mask and performing the
-+ *    processor's in current->mm->cpu_vm_mask and performing the
-  *    flush locally only.  This will force any subsequent cpus which run
-  *    this task to flush the context from the local tlb if the process
-  *    migrates to another cpu (again).
-@@ -1074,7 +1074,7 @@ void smp_flush_tlb_pending(struct mm_struct *mm, unsigned long nr, unsigned long
- 	u32 ctx = CTX_HWBITS(mm->context);
- 	int cpu = get_cpu();
- 
--	if (mm == current->active_mm && atomic_read(&mm->mm_users) == 1)
-+	if (mm == current->mm && atomic_read(&mm->mm_users) == 1)
- 		mm->cpu_vm_mask = cpumask_of_cpu(cpu);
- 	else
- 		smp_cross_call_masked(&xcall_flush_tlb_pending,
-diff --git a/arch/x86/kernel/check.c b/arch/x86/kernel/check.c
-index 2ac0ab7..a7a50b2 100644
---- a/arch/x86/kernel/check.c
-+++ b/arch/x86/kernel/check.c
-@@ -86,12 +86,12 @@ void __init setup_bios_corruption_check(void)
- 		if (addr == 0)
- 			break;
- 
-+		if (addr >= corruption_check_size)
-+			break;
-+
- 		if ((addr + size) > corruption_check_size)
- 			size = corruption_check_size - addr;
- 
--		if (size == 0)
--			break;
--
- 		e820_update_range(addr, size, E820_RAM, E820_RESERVED);
- 		scan_areas[num_scan_areas].addr = addr;
- 		scan_areas[num_scan_areas].size = size;
-diff --git a/arch/x86/kernel/cpu/mtrr/generic.c b/arch/x86/kernel/cpu/mtrr/generic.c
-index 0c0a455..6f557e0 100644
---- a/arch/x86/kernel/cpu/mtrr/generic.c
-+++ b/arch/x86/kernel/cpu/mtrr/generic.c
-@@ -41,6 +41,32 @@ static int __init mtrr_debug(char *opt)
- }
- early_param("mtrr.show", mtrr_debug);
- 
-+/**
-+ * BIOS is expected to clear MtrrFixDramModEn bit, see for example
-+ * "BIOS and Kernel Developer's Guide for the AMD Athlon 64 and AMD
-+ * Opteron Processors" (26094 Rev. 3.30 February 2006), section
-+ * "13.2.1.2 SYSCFG Register": "The MtrrFixDramModEn bit should be set
-+ * to 1 during BIOS initalization of the fixed MTRRs, then cleared to
-+ * 0 for operation."
-+ */
-+static inline void k8_check_syscfg_dram_mod_en(void)
-+{
-+	u32 lo, hi;
-+
-+	if (!((boot_cpu_data.x86_vendor == X86_VENDOR_AMD) &&
-+	      (boot_cpu_data.x86 >= 0x0f)))
-+		return;
-+
-+	rdmsr(MSR_K8_SYSCFG, lo, hi);
-+	if (lo & K8_MTRRFIXRANGE_DRAM_MODIFY) {
-+		printk(KERN_ERR FW_WARN "MTRR: CPU %u: SYSCFG[MtrrFixDramModEn]"
-+		       " not cleared by BIOS, clearing this bit\n",
-+		       smp_processor_id());
-+		lo &= ~K8_MTRRFIXRANGE_DRAM_MODIFY;
-+		mtrr_wrmsr(MSR_K8_SYSCFG, lo, hi);
-+	}
-+}
-+
- /*
-  * Returns the effective MTRR type for the region
-  * Error returns:
-@@ -174,6 +200,8 @@ get_fixed_ranges(mtrr_type * frs)
- 	unsigned int *p = (unsigned int *) frs;
- 	int i;
- 
-+	k8_check_syscfg_dram_mod_en();
-+
- 	rdmsr(MTRRfix64K_00000_MSR, p[0], p[1]);
- 
- 	for (i = 0; i < 2; i++)
-@@ -308,27 +336,10 @@ void mtrr_wrmsr(unsigned msr, unsigned a, unsigned b)
- }
- 
- /**
-- * Enable and allow read/write of extended fixed-range MTRR bits on K8 CPUs
-- * see AMD publication no. 24593, chapter 3.2.1 for more information
-- */
--static inline void k8_enable_fixed_iorrs(void)
--{
--	unsigned lo, hi;
--
--	rdmsr(MSR_K8_SYSCFG, lo, hi);
--	mtrr_wrmsr(MSR_K8_SYSCFG, lo
--				| K8_MTRRFIXRANGE_DRAM_ENABLE
--				| K8_MTRRFIXRANGE_DRAM_MODIFY, hi);
--}
--
--/**
-  * set_fixed_range - checks & updates a fixed-range MTRR if it differs from the value it should have
-  * @msr: MSR address of the MTTR which should be checked and updated
-  * @changed: pointer which indicates whether the MTRR needed to be changed
-  * @msrwords: pointer to the MSR values which the MSR should have
-- *
-- * If K8 extentions are wanted, update the K8 SYSCFG MSR also.
-- * See AMD publication no. 24593, chapter 7.8.1, page 233 for more information.
-  */
- static void set_fixed_range(int msr, bool *changed, unsigned int *msrwords)
- {
-@@ -337,10 +348,6 @@ static void set_fixed_range(int msr, bool *changed, unsigned int *msrwords)
- 	rdmsr(msr, lo, hi);
- 
- 	if (lo != msrwords[0] || hi != msrwords[1]) {
--		if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD &&
--		    (boot_cpu_data.x86 >= 0x0f && boot_cpu_data.x86 <= 0x11) &&
--		    ((msrwords[0] | msrwords[1]) & K8_MTRR_RDMEM_WRMEM_MASK))
--			k8_enable_fixed_iorrs();
- 		mtrr_wrmsr(msr, msrwords[0], msrwords[1]);
- 		*changed = true;
- 	}
-@@ -419,6 +426,8 @@ static int set_fixed_ranges(mtrr_type * frs)
- 	bool changed = false;
- 	int block=-1, range;
- 
-+	k8_check_syscfg_dram_mod_en();
-+
- 	while (fixed_range_blocks[++block].ranges)
- 	    for (range=0; range < fixed_range_blocks[block].ranges; range++)
- 		set_fixed_range(fixed_range_blocks[block].base_msr + range,
-diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
-index 06ca07f..f7d38d6 100644
---- a/arch/x86/kernel/ptrace.c
-+++ b/arch/x86/kernel/ptrace.c
-@@ -690,9 +690,8 @@ static int ptrace_bts_config(struct task_struct *child,
- 		if (!cfg.signal)
- 			return -EINVAL;
- 
--		return -EOPNOTSUPP;
--
- 		child->thread.bts_ovfl_signal = cfg.signal;
-+		return -EOPNOTSUPP;
- 	}
- 
- 	if ((cfg.flags & PTRACE_BTS_O_ALLOC) &&
-diff --git a/arch/x86/kernel/tlb_uv.c b/arch/x86/kernel/tlb_uv.c
-index 6812b82..16e505a 100644
---- a/arch/x86/kernel/tlb_uv.c
-+++ b/arch/x86/kernel/tlb_uv.c
-@@ -742,7 +742,7 @@ static int __init uv_bau_init(void)
- 	int node;
- 	int nblades;
- 	int last_blade;
--	int cur_cpu = 0;
-+	int cur_cpu;
- 
- 	if (!is_uv_system())
- 		return 0;
-@@ -752,6 +752,7 @@ static int __init uv_bau_init(void)
- 	uv_mmask = (1UL << uv_hub_info->n_val) - 1;
- 	nblades = 0;
- 	last_blade = -1;
-+	cur_cpu = 0;
- 	for_each_online_node(node) {
- 		blade = uv_node_to_blade_id(node);
- 		if (blade == last_blade)
-diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
-index 9fd78b6..c95a67d 100644
---- a/arch/x86/kvm/paging_tmpl.h
-+++ b/arch/x86/kvm/paging_tmpl.h
-@@ -314,9 +314,9 @@ static int FNAME(shadow_walk_entry)(struct kvm_shadow_walk *_sw,
- 		return 0;
- 
- 	if (is_large_pte(*sptep)) {
-+		rmap_remove(vcpu->kvm, sptep);
- 		set_shadow_pte(sptep, shadow_trap_nonpresent_pte);
- 		kvm_flush_remote_tlbs(vcpu->kvm);
--		rmap_remove(vcpu->kvm, sptep);
- 	}
- 
- 	if (level == PT_DIRECTORY_LEVEL && gw->level == PT_DIRECTORY_LEVEL) {
-diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
-index a9e769e..da56821 100644
---- a/arch/x86/kvm/svm.c
-+++ b/arch/x86/kvm/svm.c
-@@ -760,20 +760,37 @@ static void svm_get_segment(struct kvm_vcpu *vcpu,
- 	var->db = (s->attrib >> SVM_SELECTOR_DB_SHIFT) & 1;
- 	var->g = (s->attrib >> SVM_SELECTOR_G_SHIFT) & 1;
- 
--	/*
--	 * SVM always stores 0 for the 'G' bit in the CS selector in
--	 * the VMCB on a VMEXIT. This hurts cross-vendor migration:
--	 * Intel's VMENTRY has a check on the 'G' bit.
--	 */
--	if (seg == VCPU_SREG_CS)
-+	switch (seg) {
-+	case VCPU_SREG_CS:
-+		/*
-+		 * SVM always stores 0 for the 'G' bit in the CS selector in
-+		 * the VMCB on a VMEXIT. This hurts cross-vendor migration:
-+		 * Intel's VMENTRY has a check on the 'G' bit.
-+		 */
- 		var->g = s->limit > 0xfffff;
--
--	/*
--	 * Work around a bug where the busy flag in the tr selector
--	 * isn't exposed
--	 */
--	if (seg == VCPU_SREG_TR)
-+		break;
-+	case VCPU_SREG_TR:
-+		/*
-+		 * Work around a bug where the busy flag in the tr selector
-+		 * isn't exposed
-+		 */
- 		var->type |= 0x2;
-+		break;
-+	case VCPU_SREG_DS:
-+	case VCPU_SREG_ES:
-+	case VCPU_SREG_FS:
-+	case VCPU_SREG_GS:
-+		/*
-+		 * The accessed bit must always be set in the segment
-+		 * descriptor cache, although it can be cleared in the
-+		 * descriptor, the cached bit always remains at 1. Since
-+		 * Intel has a check on this, set it here to support
-+		 * cross-vendor migration.
-+		 */
-+		if (!var->unusable)
-+			var->type |= 0x1;
-+		break;
-+	}
- 
- 	var->unusable = !var->present;
- }
-diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
-index 7611af5..90de444 100644
---- a/arch/x86/kvm/vmx.c
-+++ b/arch/x86/kvm/vmx.c
-@@ -928,11 +928,11 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 data)
- 	int ret = 0;
- 
- 	switch (msr_index) {
--#ifdef CONFIG_X86_64
- 	case MSR_EFER:
- 		vmx_load_host_state(vmx);
- 		ret = kvm_set_msr_common(vcpu, msr_index, data);
- 		break;
-+#ifdef CONFIG_X86_64
- 	case MSR_FS_BASE:
- 		vmcs_writel(GUEST_FS_BASE, data);
- 		break;
-diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
-index 960a8d9..4175cb4 100644
---- a/arch/x86/lguest/boot.c
-+++ b/arch/x86/lguest/boot.c
-@@ -485,11 +485,17 @@ static void lguest_write_cr4(unsigned long val)
-  * into a process' address space.  We set the entry then tell the Host the
-  * toplevel and address this corresponds to.  The Guest uses one pagetable per
-  * process, so we need to tell the Host which one we're changing (mm->pgd). */
-+static void lguest_pte_update(struct mm_struct *mm, unsigned long addr,
-+			       pte_t *ptep)
-+{
-+	lazy_hcall(LHCALL_SET_PTE, __pa(mm->pgd), addr, ptep->pte_low);
-+}
-+
- static void lguest_set_pte_at(struct mm_struct *mm, unsigned long addr,
- 			      pte_t *ptep, pte_t pteval)
- {
- 	*ptep = pteval;
--	lazy_hcall(LHCALL_SET_PTE, __pa(mm->pgd), addr, pteval.pte_low);
-+	lguest_pte_update(mm, addr, ptep);
- }
- 
- /* The Guest calls this to set a top-level entry.  Again, we set the entry then
-@@ -1034,6 +1040,8 @@ __init void lguest_init(void)
- 	pv_mmu_ops.read_cr3 = lguest_read_cr3;
- 	pv_mmu_ops.lazy_mode.enter = paravirt_enter_lazy_mmu;
- 	pv_mmu_ops.lazy_mode.leave = lguest_leave_lazy_mode;
-+	pv_mmu_ops.pte_update = lguest_pte_update;
-+	pv_mmu_ops.pte_update_defer = lguest_pte_update;
- 
- #ifdef CONFIG_X86_LOCAL_APIC
- 	/* apic read/write intercepts */
-diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
-index e0ab173..21bc1f7 100644
---- a/arch/x86/mm/pat.c
-+++ b/arch/x86/mm/pat.c
-@@ -641,10 +641,11 @@ static int reserve_pfn_range(u64 paddr, unsigned long size, pgprot_t *vma_prot,
- 	is_ram = pat_pagerange_is_ram(paddr, paddr + size);
- 
- 	/*
--	 * reserve_pfn_range() doesn't support RAM pages.
-+	 * reserve_pfn_range() doesn't support RAM pages. Maintain the current
-+	 * behavior with RAM pages by returning success.
- 	 */
- 	if (is_ram != 0)
--		return -EINVAL;
-+		return 0;
- 
- 	ret = reserve_memtype(paddr, paddr + size, want_flags, &flags);
- 	if (ret)
-diff --git a/arch/x86/pci/i386.c b/arch/x86/pci/i386.c
-index 5ead808..f234a37 100644
---- a/arch/x86/pci/i386.c
-+++ b/arch/x86/pci/i386.c
-@@ -319,6 +319,9 @@ int pci_mmap_page_range(struct pci_dev *dev, struct vm_area_struct *vma,
- 			return -EINVAL;
- 		}
- 		flags = new_flags;
-+		vma->vm_page_prot = __pgprot(
-+			(pgprot_val(vma->vm_page_prot) & ~_PAGE_CACHE_MASK) |
-+			flags);
- 	}
- 
- 	if (((vma->vm_pgoff < max_low_pfn_mapped) ||
-diff --git a/drivers/char/raw.c b/drivers/char/raw.c
-index 96adf28..20d90e6 100644
---- a/drivers/char/raw.c
-+++ b/drivers/char/raw.c
-@@ -90,6 +90,7 @@ out1:
- 	blkdev_put(bdev, filp->f_mode);
- out:
- 	mutex_unlock(&raw_mutex);
-+	unlock_kernel();
- 	return err;
- }
- 
-diff --git a/drivers/lguest/page_tables.c b/drivers/lguest/page_tables.c
-index 576a831..82ff484 100644
---- a/drivers/lguest/page_tables.c
-+++ b/drivers/lguest/page_tables.c
-@@ -373,8 +373,10 @@ unsigned long guest_pa(struct lg_cpu *cpu, unsigned long vaddr)
- 	/* First step: get the top-level Guest page table entry. */
- 	gpgd = lgread(cpu, gpgd_addr(cpu, vaddr), pgd_t);
- 	/* Toplevel not present?  We can't map it in. */
--	if (!(pgd_flags(gpgd) & _PAGE_PRESENT))
-+	if (!(pgd_flags(gpgd) & _PAGE_PRESENT)) {
- 		kill_guest(cpu, "Bad address %#lx", vaddr);
-+		return -1UL;
-+	}
- 
- 	gpte = lgread(cpu, gpte_addr(gpgd, vaddr), pte_t);
- 	if (!(pte_flags(gpte) & _PAGE_PRESENT))
-diff --git a/drivers/media/dvb/firewire/firedtv-avc.c b/drivers/media/dvb/firewire/firedtv-avc.c
-index b55d9cc..adc2ce9 100644
---- a/drivers/media/dvb/firewire/firedtv-avc.c
-+++ b/drivers/media/dvb/firewire/firedtv-avc.c
-@@ -135,6 +135,7 @@ static const char *debug_fcp_opcode(unsigned int opcode,
- 	case SFE_VENDOR_OPCODE_REGISTER_REMOTE_CONTROL:	return "RegisterRC";
- 	case SFE_VENDOR_OPCODE_LNB_CONTROL:		return "LNBControl";
- 	case SFE_VENDOR_OPCODE_TUNE_QPSK:		return "TuneQPSK";
-+	case SFE_VENDOR_OPCODE_TUNE_QPSK2:		return "TuneQPSK2";
- 	case SFE_VENDOR_OPCODE_HOST2CA:			return "Host2CA";
- 	case SFE_VENDOR_OPCODE_CA2HOST:			return "CA2Host";
- 	}
-@@ -266,7 +267,10 @@ static void avc_tuner_tuneqpsk(struct firedtv *fdtv,
- 	c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
- 	c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
- 	c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
--	c->operand[3] = SFE_VENDOR_OPCODE_TUNE_QPSK;
-+	if (fdtv->type == FIREDTV_DVB_S2)
-+		c->operand[3] = SFE_VENDOR_OPCODE_TUNE_QPSK2;
-+	else
-+		c->operand[3] = SFE_VENDOR_OPCODE_TUNE_QPSK;
- 
- 	c->operand[4] = (params->frequency >> 24) & 0xff;
- 	c->operand[5] = (params->frequency >> 16) & 0xff;
-diff --git a/drivers/media/video/v4l2-common.c b/drivers/media/video/v4l2-common.c
-index b8f2be8..907cd02 100644
---- a/drivers/media/video/v4l2-common.c
-+++ b/drivers/media/video/v4l2-common.c
-@@ -910,10 +910,10 @@ struct v4l2_subdev *v4l2_i2c_new_subdev(struct i2c_adapter *adapter,
- 	struct i2c_board_info info;
- 
- 	BUG_ON(!dev);
--#ifdef MODULE
-+
- 	if (module_name)
- 		request_module(module_name);
--#endif
-+
- 	/* Setup the i2c board info with the device type and
- 	   the device address. */
- 	memset(&info, 0, sizeof(info));
-@@ -958,10 +958,10 @@ struct v4l2_subdev *v4l2_i2c_new_probed_subdev(struct i2c_adapter *adapter,
- 	struct i2c_board_info info;
- 
- 	BUG_ON(!dev);
--#ifdef MODULE
-+
- 	if (module_name)
- 		request_module(module_name);
--#endif
-+
- 	/* Setup the i2c board info with the device type and
- 	   the device address. */
- 	memset(&info, 0, sizeof(info));
-diff --git a/drivers/net/dnet.c b/drivers/net/dnet.c
-index 1b40632..edf23c9 100644
---- a/drivers/net/dnet.c
-+++ b/drivers/net/dnet.c
-@@ -9,6 +9,7 @@
-  * published by the Free Software Foundation.
-  */
- #include <linux/version.h>
-+#include <linux/io.h>
- #include <linux/module.h>
- #include <linux/moduleparam.h>
- #include <linux/kernel.h>
-diff --git a/drivers/net/wireless/ath5k/base.c b/drivers/net/wireless/ath5k/base.c
-index 1d77ee9..6cf69d3 100644
---- a/drivers/net/wireless/ath5k/base.c
-+++ b/drivers/net/wireless/ath5k/base.c
-@@ -1090,8 +1090,18 @@ ath5k_mode_setup(struct ath5k_softc *sc)
- static inline int
- ath5k_hw_to_driver_rix(struct ath5k_softc *sc, int hw_rix)
- {
--	WARN_ON(hw_rix < 0 || hw_rix > AR5K_MAX_RATES);
--	return sc->rate_idx[sc->curband->band][hw_rix];
-+	int rix;
-+
-+	/* return base rate on errors */
-+	if (WARN(hw_rix < 0 || hw_rix >= AR5K_MAX_RATES,
-+			"hw_rix out of bounds: %x\n", hw_rix))
-+		return 0;
-+
-+	rix = sc->rate_idx[sc->curband->band][hw_rix];
-+	if (WARN(rix < 0, "invalid hw_rix: %x\n", hw_rix))
-+		rix = 0;
-+
-+	return rix;
- }
- 
- /***************\
-@@ -1668,7 +1678,6 @@ ath5k_check_ibss_tsf(struct ath5k_softc *sc, struct sk_buff *skb,
- 	}
- }
- 
--
- static void
- ath5k_tasklet_rx(unsigned long data)
- {
-@@ -2188,6 +2197,7 @@ static void
- ath5k_beacon_config(struct ath5k_softc *sc)
- {
- 	struct ath5k_hw *ah = sc->ah;
-+	unsigned long flags;
- 
- 	ath5k_hw_set_imr(ah, 0);
- 	sc->bmisscount = 0;
-@@ -2211,9 +2221,9 @@ ath5k_beacon_config(struct ath5k_softc *sc)
- 
- 		if (sc->opmode == NL80211_IFTYPE_ADHOC) {
- 			if (ath5k_hw_hasveol(ah)) {
--				spin_lock(&sc->block);
-+				spin_lock_irqsave(&sc->block, flags);
- 				ath5k_beacon_send(sc);
--				spin_unlock(&sc->block);
-+				spin_unlock_irqrestore(&sc->block, flags);
- 			}
- 		} else
- 			ath5k_beacon_update_timers(sc, -1);
-@@ -2259,7 +2269,7 @@ ath5k_init(struct ath5k_softc *sc, bool is_resume)
- 	sc->curband = &sc->sbands[sc->curchan->band];
- 	sc->imask = AR5K_INT_RXOK | AR5K_INT_RXERR | AR5K_INT_RXEOL |
- 		AR5K_INT_RXORN | AR5K_INT_TXDESC | AR5K_INT_TXEOL |
--		AR5K_INT_FATAL | AR5K_INT_GLOBAL | AR5K_INT_MIB;
-+		AR5K_INT_FATAL | AR5K_INT_GLOBAL;
- 	ret = ath5k_reset(sc, false, false);
- 	if (ret)
- 		goto done;
-diff --git a/drivers/net/wireless/ath5k/base.h b/drivers/net/wireless/ath5k/base.h
-index facc60d..d86ab39 100644
---- a/drivers/net/wireless/ath5k/base.h
-+++ b/drivers/net/wireless/ath5k/base.h
-@@ -112,7 +112,7 @@ struct ath5k_softc {
- 	struct ieee80211_supported_band sbands[IEEE80211_NUM_BANDS];
- 	struct ieee80211_channel channels[ATH_CHAN_MAX];
- 	struct ieee80211_rate	rates[IEEE80211_NUM_BANDS][AR5K_MAX_RATES];
--	u8			rate_idx[IEEE80211_NUM_BANDS][AR5K_MAX_RATES];
-+	s8			rate_idx[IEEE80211_NUM_BANDS][AR5K_MAX_RATES];
- 	enum nl80211_iftype	opmode;
- 	struct ath5k_hw		*ah;		/* Atheros HW */
- 
-diff --git a/drivers/net/wireless/ath9k/recv.c b/drivers/net/wireless/ath9k/recv.c
-index 462e08c..c114cb7 100644
---- a/drivers/net/wireless/ath9k/recv.c
-+++ b/drivers/net/wireless/ath9k/recv.c
-@@ -322,8 +322,13 @@ void ath_rx_cleanup(struct ath_softc *sc)
- 
- 	list_for_each_entry(bf, &sc->rx.rxbuf, list) {
- 		skb = bf->bf_mpdu;
--		if (skb)
-+		if (skb) {
-+			pci_unmap_single(sc->pdev,
-+					 bf->bf_buf_addr,
-+					 sc->rx.bufsize,
-+					 DMA_FROM_DEVICE);
- 			dev_kfree_skb(skb);
-+		}
- 	}
- 
- 	if (sc->rx.rxdma.dd_desc_len != 0)
-diff --git a/drivers/net/wireless/ath9k/xmit.c b/drivers/net/wireless/ath9k/xmit.c
-index c92f0c6..80af54e 100644
---- a/drivers/net/wireless/ath9k/xmit.c
-+++ b/drivers/net/wireless/ath9k/xmit.c
-@@ -2035,7 +2035,7 @@ struct ath_txq *ath_test_get_txq(struct ath_softc *sc, struct sk_buff *skb)
- 
- 	/* Try to avoid running out of descriptors */
- 	if (txq->axq_depth >= (ATH_TXBUF - 20)) {
--		DPRINTF(sc, ATH_DBG_FATAL,
-+		DPRINTF(sc, ATH_DBG_XMIT,
- 			"TX queue: %d is full, depth: %d\n",
- 			qnum, txq->axq_depth);
- 		ieee80211_stop_queue(sc->hw, skb_get_queue_mapping(skb));
-diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
-index eae9b80..12069e5 100644
---- a/drivers/net/wireless/b43/xmit.c
-+++ b/drivers/net/wireless/b43/xmit.c
-@@ -50,7 +50,7 @@ static int b43_plcp_get_bitrate_idx_cck(struct b43_plcp_hdr6 *plcp)
- }
- 
- /* Extract the bitrate index out of an OFDM PLCP header. */
--static u8 b43_plcp_get_bitrate_idx_ofdm(struct b43_plcp_hdr6 *plcp, bool aphy)
-+static int b43_plcp_get_bitrate_idx_ofdm(struct b43_plcp_hdr6 *plcp, bool aphy)
- {
- 	int base = aphy ? 0 : 4;
- 
-diff --git a/drivers/scsi/arm/cumana_2.c b/drivers/scsi/arm/cumana_2.c
-index 68a6412..ed502b7 100644
---- a/drivers/scsi/arm/cumana_2.c
-+++ b/drivers/scsi/arm/cumana_2.c
-@@ -318,7 +318,7 @@ cumanascsi_2_set_proc_info(struct Scsi_Host *host, char *buffer, int length)
- {
- 	int ret = length;
- 
--	if (length >= 11 && strcmp(buffer, "CUMANASCSI2") == 0) {
-+	if (length >= 11 && strncmp(buffer, "CUMANASCSI2", 11) == 0) {
- 		buffer += 11;
- 		length -= 11;
- 
-diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
-index 49e7f56..3922fa9 100644
---- a/drivers/usb/core/message.c
-+++ b/drivers/usb/core/message.c
-@@ -1719,7 +1719,8 @@ free_interfaces:
- 	}
- 	kfree(new_interfaces);
- 
--	if (cp->string == NULL)
-+	if (cp->string == NULL &&
-+			!(dev->quirks & USB_QUIRK_CONFIG_INTF_STRINGS))
- 		cp->string = usb_cache_string(dev, cp->desc.iConfiguration);
- 
- 	/* Now that all the interfaces are set up, register them
-diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
-index c070b34..ab93918 100644
---- a/drivers/usb/core/quirks.c
-+++ b/drivers/usb/core/quirks.c
-@@ -54,6 +54,10 @@ static const struct usb_device_id usb_quirk_list[] = {
- 	{ USB_DEVICE(0x0638, 0x0a13), .driver_info =
- 	  USB_QUIRK_STRING_FETCH_255 },
- 
-+	/* Saitek Cyborg Gold Joystick */
-+	{ USB_DEVICE(0x06a3, 0x0006), .driver_info =
-+			USB_QUIRK_CONFIG_INTF_STRINGS },
-+
- 	/* M-Systems Flash Disk Pioneers */
- 	{ USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
- 
-diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c
-index 4cc2456..c667891 100644
---- a/drivers/usb/core/sysfs.c
-+++ b/drivers/usb/core/sysfs.c
-@@ -13,6 +13,7 @@
- #include <linux/kernel.h>
- #include <linux/string.h>
- #include <linux/usb.h>
-+#include <linux/usb/quirks.h>
- #include "usb.h"
- 
- /* Active configuration fields */
-@@ -813,7 +814,8 @@ int usb_create_sysfs_intf_files(struct usb_interface *intf)
- 	if (intf->sysfs_files_created || intf->unregistering)
- 		return 0;
- 
--	if (alt->string == NULL)
-+	if (alt->string == NULL &&
-+			!(udev->quirks & USB_QUIRK_CONFIG_INTF_STRINGS))
- 		alt->string = usb_cache_string(udev, alt->desc.iInterface);
- 	if (alt->string)
- 		retval = device_create_file(&intf->dev, &dev_attr_interface);
-diff --git a/drivers/usb/gadget/f_rndis.c b/drivers/usb/gadget/f_rndis.c
-index 3a8bb53..fd7b356 100644
---- a/drivers/usb/gadget/f_rndis.c
-+++ b/drivers/usb/gadget/f_rndis.c
-@@ -437,7 +437,7 @@ invalid:
- 		DBG(cdev, "rndis req%02x.%02x v%04x i%04x l%d\n",
- 			ctrl->bRequestType, ctrl->bRequest,
- 			w_value, w_index, w_length);
--		req->zero = 0;
-+		req->zero = (value < w_length);
- 		req->length = value;
- 		value = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC);
- 		if (value < 0)
-diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
-index ecc9b66..01132ac 100644
---- a/drivers/usb/host/ehci-q.c
-+++ b/drivers/usb/host/ehci-q.c
-@@ -333,12 +333,40 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh)
- 		token = hc32_to_cpu(ehci, qtd->hw_token);
- 
- 		/* always clean up qtds the hc de-activated */
-+ retry_xacterr:
- 		if ((token & QTD_STS_ACTIVE) == 0) {
- 
- 			/* on STALL, error, and short reads this urb must
- 			 * complete and all its qtds must be recycled.
- 			 */
- 			if ((token & QTD_STS_HALT) != 0) {
-+
-+				/* retry transaction errors until we
-+				 * reach the software xacterr limit
-+				 */
-+				if ((token & QTD_STS_XACT) &&
-+						QTD_CERR(token) == 0 &&
-+						--qh->xacterrs > 0 &&
-+						!urb->unlinked) {
-+					ehci_dbg(ehci,
-+	"detected XactErr len %d/%d retry %d\n",
-+	qtd->length - QTD_LENGTH(token), qtd->length,
-+	QH_XACTERR_MAX - qh->xacterrs);
-+
-+					/* reset the token in the qtd and the
-+					 * qh overlay (which still contains
-+					 * the qtd) so that we pick up from
-+					 * where we left off
-+					 */
-+					token &= ~QTD_STS_HALT;
-+					token |= QTD_STS_ACTIVE |
-+							(EHCI_TUNE_CERR << 10);
-+					qtd->hw_token = cpu_to_hc32(ehci,
-+							token);
-+					wmb();
-+					qh->hw_token = cpu_to_hc32(ehci, token);
-+					goto retry_xacterr;
-+				}
- 				stopped = 1;
- 
- 			/* magic dummy for some short reads; qh won't advance.
-@@ -421,6 +449,9 @@ halt:
- 		/* remove qtd; it's recycled after possible urb completion */
- 		list_del (&qtd->qtd_list);
- 		last = qtd;
-+
-+		/* reinit the xacterr counter for the next qtd */
-+		qh->xacterrs = QH_XACTERR_MAX;
- 	}
- 
- 	/* last urb's completion might still need calling */
-@@ -862,6 +893,7 @@ static void qh_link_async (struct ehci_hcd *ehci, struct ehci_qh *qh)
- 	head->qh_next.qh = qh;
- 	head->hw_next = dma;
- 
-+	qh->xacterrs = QH_XACTERR_MAX;
- 	qh->qh_state = QH_STATE_LINKED;
- 	/* qtd completions reported later by interrupt */
- }
-diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
-index 262b00c..c7385f2 100644
---- a/drivers/usb/host/ehci.h
-+++ b/drivers/usb/host/ehci.h
-@@ -376,6 +376,9 @@ struct ehci_qh {
- #define	QH_STATE_UNLINK_WAIT	4		/* LINKED and on reclaim q */
- #define	QH_STATE_COMPLETING	5		/* don't touch token.HALT */
- 
-+	u8			xacterrs;	/* XactErr retry counter */
-+#define	QH_XACTERR_MAX		32		/* XactErr retry limit */
-+
- 	/* periodic schedule info */
- 	u8			usecs;		/* intr bandwidth */
- 	u8			gap_uf;		/* uframes split/csplit gap */
-diff --git a/drivers/usb/storage/cypress_atacb.c b/drivers/usb/storage/cypress_atacb.c
-index 898e67d..9466a99 100644
---- a/drivers/usb/storage/cypress_atacb.c
-+++ b/drivers/usb/storage/cypress_atacb.c
-@@ -133,19 +133,18 @@ void cypress_atacb_passthrough(struct scsi_cmnd *srb, struct us_data *us)
- 
- 		/* build the command for
- 		 * reading the ATA registers */
--		scsi_eh_prep_cmnd(srb, &ses, NULL, 0, 0);
--		srb->sdb.length = sizeof(regs);
--		sg_init_one(&ses.sense_sgl, regs, srb->sdb.length);
--		srb->sdb.table.sgl = &ses.sense_sgl;
--		srb->sc_data_direction = DMA_FROM_DEVICE;
--		srb->sdb.table.nents = 1;
-+		scsi_eh_prep_cmnd(srb, &ses, NULL, 0, sizeof(regs));
-+
- 		/* we use the same command as before, but we set
- 		 * the read taskfile bit, for not executing atacb command,
- 		 * but reading register selected in srb->cmnd[4]
- 		 */
-+		srb->cmd_len = 16;
-+		srb->cmnd = ses.cmnd;
- 		srb->cmnd[2] = 1;
- 
- 		usb_stor_transparent_scsi_command(srb, us);
-+		memcpy(regs, srb->sense_buffer, sizeof(regs));
- 		tmp_result = srb->result;
- 		scsi_eh_restore_cmnd(srb, &ses);
- 		/* we fail to get registers, report invalid command */
-@@ -162,8 +161,8 @@ void cypress_atacb_passthrough(struct scsi_cmnd *srb, struct us_data *us)
- 
- 		/* XXX we should generate sk, asc, ascq from status and error
- 		 * regs
--		 * (see 11.1 Error translation ­ ATA device error to SCSI error map)
--		 * and ata_to_sense_error from libata.
-+		 * (see 11.1 Error translation ATA device error to SCSI error
-+		 *  map, and ata_to_sense_error from libata.)
- 		 */
- 
- 		/* Sense data is current and format is descriptor. */
-diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
-index 727c506..ed710bc 100644
---- a/drivers/usb/storage/scsiglue.c
-+++ b/drivers/usb/storage/scsiglue.c
-@@ -135,6 +135,12 @@ static int slave_configure(struct scsi_device *sdev)
- 		if (sdev->request_queue->max_sectors > max_sectors)
- 			blk_queue_max_sectors(sdev->request_queue,
- 					      max_sectors);
-+	} else if (sdev->type == TYPE_TAPE) {
-+		/* Tapes need much higher max_sector limits, so just
-+		 * raise it to the maximum possible (4 GB / 512) and
-+		 * let the queue segment size sort out the real limit.
-+		 */
-+		blk_queue_max_sectors(sdev->request_queue, 0x7FFFFF);
- 	}
- 
- 	/* Some USB host controllers can't do DMA; they have to use PIO.
-diff --git a/drivers/video/pxafb.c b/drivers/video/pxafb.c
-index 2552b9f..642c1d4 100644
---- a/drivers/video/pxafb.c
-+++ b/drivers/video/pxafb.c
-@@ -883,10 +883,21 @@ static void __devinit init_pxafb_overlay(struct pxafb_info *fbi,
- 	init_completion(&ofb->branch_done);
- }
- 
-+static inline int pxafb_overlay_supported(void)
-+{
-+	if (cpu_is_pxa27x() || cpu_is_pxa3xx())
-+		return 1;
-+
-+	return 0;
-+}
-+
- static int __devinit pxafb_overlay_init(struct pxafb_info *fbi)
- {
- 	int i, ret;
- 
-+	if (!pxafb_overlay_supported())
-+		return 0;
-+
- 	for (i = 0; i < 2; i++) {
- 		init_pxafb_overlay(fbi, &fbi->overlay[i], i);
- 		ret = register_framebuffer(&fbi->overlay[i].fb);
-@@ -909,6 +920,9 @@ static void __devexit pxafb_overlay_exit(struct pxafb_info *fbi)
- {
- 	int i;
- 
-+	if (!pxafb_overlay_supported())
-+		return;
-+
- 	for (i = 0; i < 2; i++)
- 		unregister_framebuffer(&fbi->overlay[i].fb);
- }
-diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
-index 851388f..6562eb0 100644
---- a/fs/cifs/CHANGES
-+++ b/fs/cifs/CHANGES
-@@ -7,6 +7,9 @@ are authenticated as guest, as reconnections, invalidating the earlier
- user's smb session.  This fix allows cifs to mount multiple times to the
- same server with different userids without risking invalidating earlier
- established security contexts.
-+Fix "redzone overwritten" bug in cifs_put_tcon (CIFSTcon may allocate too
-+little memory for the "nativeFileSystem" field returned by the server
-+during mount). 
- 
- Version 1.56
- ------------
-diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
-index 939e2f7..71ae000 100644
---- a/fs/cifs/cifssmb.c
-+++ b/fs/cifs/cifssmb.c
-@@ -2356,8 +2356,10 @@ winCreateHardLinkRetry:
- 				     PATH_MAX, nls_codepage, remap);
- 		name_len++;	/* trailing null */
- 		name_len *= 2;
--		pSMB->OldFileName[name_len] = 0;	/* pad */
--		pSMB->OldFileName[name_len + 1] = 0x04;
-+
-+		/* protocol specifies ASCII buffer format (0x04) for unicode */
-+		pSMB->OldFileName[name_len] = 0x04;
-+		pSMB->OldFileName[name_len + 1] = 0x00; /* pad */
- 		name_len2 =
- 		    cifsConvertToUCS((__le16 *)&pSMB->OldFileName[name_len + 2],
- 				     toName, PATH_MAX, nls_codepage, remap);
-diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
-index da0f4ff..4b64f39 100644
---- a/fs/cifs/connect.c
-+++ b/fs/cifs/connect.c
-@@ -3667,7 +3667,7 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
- 			    BCC(smb_buffer_response)) {
- 				kfree(tcon->nativeFileSystem);
- 				tcon->nativeFileSystem =
--				    kzalloc(length + 2, GFP_KERNEL);
-+				    kzalloc(2*(length + 1), GFP_KERNEL);
- 				if (tcon->nativeFileSystem)
- 					cifs_strfromUCS_le(
- 						tcon->nativeFileSystem,
-diff --git a/fs/fuse/file.c b/fs/fuse/file.c
-index d9fdb7c..821d10f 100644
---- a/fs/fuse/file.c
-+++ b/fs/fuse/file.c
-@@ -1465,7 +1465,7 @@ static loff_t fuse_file_llseek(struct file *file, loff_t offset, int origin)
- 	case SEEK_END:
- 		retval = fuse_update_attributes(inode, NULL, file, NULL);
- 		if (retval)
--			return retval;
-+			goto exit;
- 		offset += i_size_read(inode);
- 		break;
- 	case SEEK_CUR:
-@@ -1479,6 +1479,7 @@ static loff_t fuse_file_llseek(struct file *file, loff_t offset, int origin)
- 		}
- 		retval = offset;
- 	}
-+exit:
- 	mutex_unlock(&inode->i_mutex);
- 	return retval;
- }
-diff --git a/include/linux/mm.h b/include/linux/mm.h
-index 065cdf8..3daa05f 100644
---- a/include/linux/mm.h
-+++ b/include/linux/mm.h
-@@ -98,7 +98,7 @@ extern unsigned int kobjsize(const void *objp);
- #define VM_HUGETLB	0x00400000	/* Huge TLB Page VM */
- #define VM_NONLINEAR	0x00800000	/* Is non-linear (remap_file_pages) */
- #define VM_MAPPED_COPY	0x01000000	/* T if mapped copy of data (nommu mmap) */
--#define VM_INSERTPAGE	0x02000000	/* The vma has had "vm_insert_page()" done on it */
-+#define VM_INSERTPAGE	0x02000000	/* The vma has had "vm_insert_page()" done on it. Refer note in VM_PFNMAP_AT_MMAP below */
- #define VM_ALWAYSDUMP	0x04000000	/* Always include in core dumps */
- 
- #define VM_CAN_NONLINEAR 0x08000000	/* Has ->fault & does nonlinear pages */
-@@ -127,6 +127,17 @@ extern unsigned int kobjsize(const void *objp);
- #define VM_SPECIAL (VM_IO | VM_DONTEXPAND | VM_RESERVED | VM_PFNMAP)
- 
- /*
-+ * pfnmap vmas that are fully mapped at mmap time (not mapped on fault).
-+ * Used by x86 PAT to identify such PFNMAP mappings and optimize their handling.
-+ * Note VM_INSERTPAGE flag is overloaded here. i.e,
-+ * VM_INSERTPAGE && !VM_PFNMAP implies
-+ *     The vma has had "vm_insert_page()" done on it
-+ * VM_INSERTPAGE && VM_PFNMAP implies
-+ *     The vma is PFNMAP with full mapping at mmap time
-+ */
-+#define VM_PFNMAP_AT_MMAP (VM_INSERTPAGE | VM_PFNMAP)
-+
-+/*
-  * mapping from the currently active vm_flags protection bits (the
-  * low four bits) to a page protection mask..
-  */
-@@ -145,7 +156,7 @@ extern pgprot_t protection_map[16];
-  */
- static inline int is_linear_pfn_mapping(struct vm_area_struct *vma)
- {
--	return ((vma->vm_flags & VM_PFNMAP) && vma->vm_pgoff);
-+	return ((vma->vm_flags & VM_PFNMAP_AT_MMAP) == VM_PFNMAP_AT_MMAP);
- }
- 
- static inline int is_pfn_mapping(struct vm_area_struct *vma)
-diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h
-index 7f6c603..2526f3b 100644
---- a/include/linux/usb/quirks.h
-+++ b/include/linux/usb/quirks.h
-@@ -16,4 +16,7 @@
- /* device can't handle Set-Interface requests */
- #define USB_QUIRK_NO_SET_INTF		0x00000004
- 
-+/* device can't handle its Configuration or Interface strings */
-+#define USB_QUIRK_CONFIG_INTF_STRINGS	0x00000008
-+
- #endif /* __LINUX_USB_QUIRKS_H */
-diff --git a/mm/memory.c b/mm/memory.c
-index baa999e..d7df5ba 100644
---- a/mm/memory.c
-+++ b/mm/memory.c
-@@ -1665,9 +1665,10 @@ int remap_pfn_range(struct vm_area_struct *vma, unsigned long addr,
- 	 * behaviour that some programs depend on. We mark the "original"
- 	 * un-COW'ed pages by matching them up with "vma->vm_pgoff".
- 	 */
--	if (addr == vma->vm_start && end == vma->vm_end)
-+	if (addr == vma->vm_start && end == vma->vm_end) {
- 		vma->vm_pgoff = pfn;
--	else if (is_cow_mapping(vma->vm_flags))
-+		vma->vm_flags |= VM_PFNMAP_AT_MMAP;
-+	} else if (is_cow_mapping(vma->vm_flags))
- 		return -EINVAL;
- 
- 	vma->vm_flags |= VM_IO | VM_RESERVED | VM_PFNMAP;
-@@ -1679,6 +1680,7 @@ int remap_pfn_range(struct vm_area_struct *vma, unsigned long addr,
- 		 * needed from higher level routine calling unmap_vmas
- 		 */
- 		vma->vm_flags &= ~(VM_IO | VM_RESERVED | VM_PFNMAP);
-+		vma->vm_flags &= ~VM_PFNMAP_AT_MMAP;
- 		return -EINVAL;
- 	}
- 
-diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
-index 727c5c5..8a96672 100644
---- a/net/bridge/br_if.c
-+++ b/net/bridge/br_if.c
-@@ -426,7 +426,6 @@ err2:
- err1:
- 	kobject_del(&p->kobj);
- err0:
--	kobject_put(&p->kobj);
- 	dev_set_promiscuity(dev, -1);
- put_back:
- 	dev_put(dev);
-diff --git a/net/core/dev.c b/net/core/dev.c
-index e3fe5c7..e438f54 100644
---- a/net/core/dev.c
-+++ b/net/core/dev.c
-@@ -2588,18 +2588,15 @@ static int process_backlog(struct napi_struct *napi, int quota)
- 		local_irq_disable();
- 		skb = __skb_dequeue(&queue->input_pkt_queue);
- 		if (!skb) {
-+			__napi_complete(napi);
- 			local_irq_enable();
--			napi_complete(napi);
--			goto out;
-+			break;
- 		}
- 		local_irq_enable();
- 
--		napi_gro_receive(napi, skb);
-+		netif_receive_skb(skb);
- 	} while (++work < quota && jiffies == start_time);
- 
--	napi_gro_flush(napi);
--
--out:
- 	return work;
- }
- 
-diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
-index c47c989..c8bee18 100644
---- a/net/ipv4/udp.c
-+++ b/net/ipv4/udp.c
-@@ -1614,7 +1614,8 @@ static struct sock *udp_get_next(struct seq_file *seq, struct sock *sk)
- 	} while (sk && (!net_eq(sock_net(sk), net) || sk->sk_family != state->family));
- 
- 	if (!sk) {
--		spin_unlock_bh(&state->udp_table->hash[state->bucket].lock);
-+		if (state->bucket < UDP_HTABLE_SIZE)
-+			spin_unlock_bh(&state->udp_table->hash[state->bucket].lock);
- 		return udp_get_first(seq, state->bucket + 1);
- 	}
- 	return sk;
-@@ -1632,6 +1633,9 @@ static struct sock *udp_get_idx(struct seq_file *seq, loff_t pos)
- 
- static void *udp_seq_start(struct seq_file *seq, loff_t *pos)
- {
-+	struct udp_iter_state *state = seq->private;
-+	state->bucket = UDP_HTABLE_SIZE;
-+
- 	return *pos ? udp_get_idx(seq, *pos-1) : SEQ_START_TOKEN;
- }
- 
-diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
-index f171e8d..8f04bd9 100644
---- a/net/ipv6/ip6_input.c
-+++ b/net/ipv6/ip6_input.c
-@@ -75,8 +75,7 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
- 	if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL ||
- 	    !idev || unlikely(idev->cnf.disable_ipv6)) {
- 		IP6_INC_STATS_BH(net, idev, IPSTATS_MIB_INDISCARDS);
--		rcu_read_unlock();
--		goto out;
-+		goto drop;
- 	}
- 
- 	memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
-@@ -147,7 +146,6 @@ err:
- drop:
- 	rcu_read_unlock();
- 	kfree_skb(skb);
--out:
- 	return 0;
- }
- 
-diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
-index f3fd154..56ac4ee 100644
---- a/net/netfilter/nf_conntrack_proto_tcp.c
-+++ b/net/netfilter/nf_conntrack_proto_tcp.c
-@@ -15,6 +15,7 @@
- #include <linux/skbuff.h>
- #include <linux/ipv6.h>
- #include <net/ip6_checksum.h>
-+#include <asm/unaligned.h>
- 
- #include <net/tcp.h>
- 
-@@ -466,7 +467,7 @@ static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff,
- 				for (i = 0;
- 				     i < (opsize - TCPOLEN_SACK_BASE);
- 				     i += TCPOLEN_SACK_PERBLOCK) {
--					tmp = ntohl(*((__be32 *)(ptr+i)+1));
-+					tmp = get_unaligned_be32((__be32 *)(ptr+i)+1);
- 
- 					if (after(tmp, *sack))
- 						*sack = tmp;
-diff --git a/net/wireless/reg.c b/net/wireless/reg.c
-index bd0a16c..4f9ff2a 100644
---- a/net/wireless/reg.c
-+++ b/net/wireless/reg.c
-@@ -1083,6 +1083,8 @@ EXPORT_SYMBOL(regulatory_hint);
- static bool reg_same_country_ie_hint(struct wiphy *wiphy,
- 			u32 country_ie_checksum)
- {
-+	if (unlikely(last_request->initiator != REGDOM_SET_BY_COUNTRY_IE))
-+		return false;
- 	if (!last_request->wiphy)
- 		return false;
- 	if (likely(last_request->wiphy != wiphy))
-@@ -1133,7 +1135,9 @@ void regulatory_hint_11d(struct wiphy *wiphy,
- 	/* We will run this for *every* beacon processed for the BSSID, so
- 	 * we optimize an early check to exit out early if we don't have to
- 	 * do anything */
--	if (likely(last_request->wiphy)) {
-+	if (likely(last_request->initiator ==
-+	    REGDOM_SET_BY_COUNTRY_IE &&
-+	    likely(last_request->wiphy))) {
- 		struct cfg80211_registered_device *drv_last_ie;
- 
- 		drv_last_ie = wiphy_to_dev(last_request->wiphy);
-@@ -1469,13 +1473,20 @@ int regulatory_init(void)
- 
- 	printk(KERN_INFO "cfg80211: Using static regulatory domain info\n");
- 	print_regdomain_info(cfg80211_regdomain);
--	/* The old code still requests for a new regdomain and if
-+	/*
-+	 * The old code still requests for a new regdomain and if
- 	 * you have CRDA you get it updated, otherwise you get
- 	 * stuck with the static values. We ignore "EU" code as
--	 * that is not a valid ISO / IEC 3166 alpha2 */
--	if (ieee80211_regdom[0] != 'E' || ieee80211_regdom[1] != 'U')
--		err = __regulatory_hint(NULL, REGDOM_SET_BY_CORE,
--					ieee80211_regdom, 0, ENVIRON_ANY);
-+	 * that is not a valid ISO / IEC 3166 alpha2
-+	 * stuck with the static values. Since "EU" is not a valid
-+	 * ISO / IEC 3166 alpha2 code we can't expect userpace to
-+	 * give us a regulatory domain for it. We need last_request
-+	 * iniitalized though so lets just send a request which we
-+	 * know will be ignored... this crap will be removed once
-+	 * OLD_REG dies.
-+	 */
-+	err = __regulatory_hint(NULL, REGDOM_SET_BY_CORE,
-+				ieee80211_regdom, 0, ENVIRON_ANY);
- #else
- 	cfg80211_regdomain = cfg80211_world_regdom;
- 
-diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
-index 62a5425..8227172 100644
---- a/net/xfrm/xfrm_state.c
-+++ b/net/xfrm/xfrm_state.c
-@@ -1615,7 +1615,7 @@ void xfrm_state_walk_done(struct xfrm_state_walk *walk)
- 
- 	spin_lock_bh(&xfrm_state_lock);
- 	list_del(&walk->all);
--	spin_lock_bh(&xfrm_state_lock);
-+	spin_unlock_bh(&xfrm_state_lock);
- }
- EXPORT_SYMBOL(xfrm_state_walk_done);
- 

Deleted: genpatches-2.6/trunk/2.6.30/1001_linux-2.6.29.2.patch
===================================================================
--- genpatches-2.6/trunk/2.6.30/1001_linux-2.6.29.2.patch	2009-06-05 16:26:11 UTC (rev 1572)
+++ genpatches-2.6/trunk/2.6.30/1001_linux-2.6.29.2.patch	2009-06-05 16:28:49 UTC (rev 1573)
@@ -1,4591 +0,0 @@
-diff --git a/Documentation/networking/bonding.txt b/Documentation/networking/bonding.txt
-index 5ede747..0876275 100644
---- a/Documentation/networking/bonding.txt
-+++ b/Documentation/networking/bonding.txt
-@@ -1242,7 +1242,7 @@ monitoring is enabled, and vice-versa.
- To add ARP targets:
- # echo +192.168.0.100 > /sys/class/net/bond0/bonding/arp_ip_target
- # echo +192.168.0.101 > /sys/class/net/bond0/bonding/arp_ip_target
--	NOTE:  up to 10 target addresses may be specified.
-+	NOTE:  up to 16 target addresses may be specified.
- 
- To remove an ARP target:
- # echo -192.168.0.100 > /sys/class/net/bond0/bonding/arp_ip_target
-diff --git a/arch/ia64/kvm/Kconfig b/arch/ia64/kvm/Kconfig
-index f833a0b..0a2d6b8 100644
---- a/arch/ia64/kvm/Kconfig
-+++ b/arch/ia64/kvm/Kconfig
-@@ -4,6 +4,10 @@
- config HAVE_KVM
- 	bool
- 
-+config HAVE_KVM_IRQCHIP
-+       bool
-+       default y
-+
- menuconfig VIRTUALIZATION
- 	bool "Virtualization"
- 	depends on HAVE_KVM || IA64
-diff --git a/arch/mips/kernel/linux32.c b/arch/mips/kernel/linux32.c
-index 1a86f84..5abcc7f 100644
---- a/arch/mips/kernel/linux32.c
-+++ b/arch/mips/kernel/linux32.c
-@@ -134,9 +134,9 @@ SYSCALL_DEFINE4(32_ftruncate64, unsigned long, fd, unsigned long, __dummy,
- 	return sys_ftruncate(fd, merge_64(a2, a3));
- }
- 
--SYSCALL_DEFINE5(32_llseek, unsigned long, fd, unsigned long, offset_high,
--	unsigned long, offset_low, loff_t __user *, result,
--	unsigned long, origin)
-+SYSCALL_DEFINE5(32_llseek, unsigned int, fd, unsigned int, offset_high,
-+		unsigned int, offset_low, loff_t __user *, result,
-+		unsigned int, origin)
- {
- 	return sys_llseek(fd, offset_high, offset_low, result, origin);
- }
-diff --git a/arch/powerpc/include/asm/futex.h b/arch/powerpc/include/asm/futex.h
-index 6d406c5..9696cc3 100644
---- a/arch/powerpc/include/asm/futex.h
-+++ b/arch/powerpc/include/asm/futex.h
-@@ -27,7 +27,7 @@
- 	PPC_LONG "1b,4b,2b,4b\n" \
- 	".previous" \
- 	: "=&r" (oldval), "=&r" (ret) \
--	: "b" (uaddr), "i" (-EFAULT), "1" (oparg) \
-+	: "b" (uaddr), "i" (-EFAULT), "r" (oparg) \
- 	: "cr0", "memory")
- 
- static inline int futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
-@@ -47,19 +47,19 @@ static inline int futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
- 
- 	switch (op) {
- 	case FUTEX_OP_SET:
--		__futex_atomic_op("", ret, oldval, uaddr, oparg);
-+		__futex_atomic_op("mr %1,%4\n", ret, oldval, uaddr, oparg);
- 		break;
- 	case FUTEX_OP_ADD:
--		__futex_atomic_op("add %1,%0,%1\n", ret, oldval, uaddr, oparg);
-+		__futex_atomic_op("add %1,%0,%4\n", ret, oldval, uaddr, oparg);
- 		break;
- 	case FUTEX_OP_OR:
--		__futex_atomic_op("or %1,%0,%1\n", ret, oldval, uaddr, oparg);
-+		__futex_atomic_op("or %1,%0,%4\n", ret, oldval, uaddr, oparg);
- 		break;
- 	case FUTEX_OP_ANDN:
--		__futex_atomic_op("andc %1,%0,%1\n", ret, oldval, uaddr, oparg);
-+		__futex_atomic_op("andc %1,%0,%4\n", ret, oldval, uaddr, oparg);
- 		break;
- 	case FUTEX_OP_XOR:
--		__futex_atomic_op("xor %1,%0,%1\n", ret, oldval, uaddr, oparg);
-+		__futex_atomic_op("xor %1,%0,%4\n", ret, oldval, uaddr, oparg);
- 		break;
- 	default:
- 		ret = -ENOSYS;
-diff --git a/arch/powerpc/kvm/Kconfig b/arch/powerpc/kvm/Kconfig
-index 6dbdc48..03becdf 100644
---- a/arch/powerpc/kvm/Kconfig
-+++ b/arch/powerpc/kvm/Kconfig
-@@ -2,6 +2,9 @@
- # KVM configuration
- #
- 
-+config HAVE_KVM_IRQCHIP
-+       bool
-+
- menuconfig VIRTUALIZATION
- 	bool "Virtualization"
- 	---help---
-diff --git a/arch/s390/kvm/Kconfig b/arch/s390/kvm/Kconfig
-index e051cad..3e260b7 100644
---- a/arch/s390/kvm/Kconfig
-+++ b/arch/s390/kvm/Kconfig
-@@ -4,6 +4,9 @@
- config HAVE_KVM
-        bool
- 
-+config HAVE_KVM_IRQCHIP
-+       bool
-+
- menuconfig VIRTUALIZATION
- 	bool "Virtualization"
- 	default y
-diff --git a/arch/sparc/include/asm/tlb_64.h b/arch/sparc/include/asm/tlb_64.h
-index 0aaa086..ee38e73 100644
---- a/arch/sparc/include/asm/tlb_64.h
-+++ b/arch/sparc/include/asm/tlb_64.h
-@@ -57,9 +57,9 @@ static inline struct mmu_gather *tlb_gather_mmu(struct mm_struct *mm, unsigned i
- 
- static inline void tlb_flush_mmu(struct mmu_gather *mp)
- {
-+	if (!mp->fullmm)
-+		flush_tlb_pending();
- 	if (mp->need_flush) {
--		if (!mp->fullmm)
--			flush_tlb_pending();
- 		free_pages_and_swap_cache(mp->pages, mp->pages_nr);
- 		mp->pages_nr = 0;
- 		mp->need_flush = 0;
-diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
-index c98d52e..6ed3aca 100644
---- a/arch/x86/Kconfig.cpu
-+++ b/arch/x86/Kconfig.cpu
-@@ -523,6 +523,7 @@ config X86_PTRACE_BTS
- 	bool "Branch Trace Store"
- 	default y
- 	depends on X86_DEBUGCTLMSR
-+	depends on BROKEN
- 	help
- 	  This adds a ptrace interface to the hardware's branch trace store.
- 
-diff --git a/arch/x86/boot/memory.c b/arch/x86/boot/memory.c
-index 8c3c25f..a99dbbe 100644
---- a/arch/x86/boot/memory.c
-+++ b/arch/x86/boot/memory.c
-@@ -27,13 +27,14 @@ static int detect_memory_e820(void)
- 	do {
- 		size = sizeof(struct e820entry);
- 
--		/* Important: %edx is clobbered by some BIOSes,
--		   so it must be either used for the error output
-+		/* Important: %edx and %esi are clobbered by some BIOSes,
-+		   so they must be either used for the error output
- 		   or explicitly marked clobbered. */
- 		asm("int $0x15; setc %0"
- 		    : "=d" (err), "+b" (next), "=a" (id), "+c" (size),
- 		      "=m" (*desc)
--		    : "D" (desc), "d" (SMAP), "a" (0xe820));
-+		    : "D" (desc), "d" (SMAP), "a" (0xe820)
-+		    : "esi");
- 
- 		/* BIOSes which terminate the chain with CF = 1 as opposed
- 		   to %ebx = 0 don't always report the SMAP signature on
-diff --git a/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c b/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c
-index 4b1c319..89c676d 100644
---- a/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c
-+++ b/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c
-@@ -680,6 +680,18 @@ static int acpi_cpufreq_cpu_init(struct cpufreq_policy *policy)
- 			    perf->states[i].transition_latency * 1000;
- 	}
- 
-+	/* Check for high latency (>20uS) from buggy BIOSes, like on T42 */
-+	if (perf->control_register.space_id == ACPI_ADR_SPACE_FIXED_HARDWARE &&
-+	    policy->cpuinfo.transition_latency > 20 * 1000) {
-+		static int print_once;
-+		policy->cpuinfo.transition_latency = 20 * 1000;
-+		if (!print_once) {
-+			print_once = 1;
-+			printk(KERN_INFO "Capping off P-state tranision latency"
-+				" at 20 uS\n");
-+		}
-+	}
-+
- 	data->max_freq = perf->states[0].core_frequency * 1000;
- 	/* table init */
- 	for (i=0; i<perf->state_count; i++) {
-diff --git a/arch/x86/kernel/io_apic.c b/arch/x86/kernel/io_apic.c
-index bc7ac4d..7086b24 100644
---- a/arch/x86/kernel/io_apic.c
-+++ b/arch/x86/kernel/io_apic.c
-@@ -2475,6 +2475,7 @@ asmlinkage void smp_irq_move_cleanup_interrupt(void)
- 	me = smp_processor_id();
- 	for (vector = FIRST_EXTERNAL_VECTOR; vector < NR_VECTORS; vector++) {
- 		unsigned int irq;
-+		unsigned int irr;
- 		struct irq_desc *desc;
- 		struct irq_cfg *cfg;
- 		irq = __get_cpu_var(vector_irq)[vector];
-@@ -2494,6 +2495,18 @@ asmlinkage void smp_irq_move_cleanup_interrupt(void)
- 		if (vector == cfg->vector && cpumask_test_cpu(me, cfg->domain))
- 			goto unlock;
- 
-+		irr = apic_read(APIC_IRR + (vector / 32 * 0x10));
-+		/*
-+		 * Check if the vector that needs to be cleanedup is
-+		 * registered at the cpu's IRR. If so, then this is not
-+		 * the best time to clean it up. Lets clean it up in the
-+		 * next attempt by sending another IRQ_MOVE_CLEANUP_VECTOR
-+		 * to myself.
-+		 */
-+		if (irr  & (1 << (vector % 32))) {
-+			send_IPI_self(IRQ_MOVE_CLEANUP_VECTOR);
-+			goto unlock;
-+		}
- 		__get_cpu_var(vector_irq)[vector] = -1;
- 		cfg->move_cleanup_count--;
- unlock:
-diff --git a/arch/x86/kvm/Kconfig b/arch/x86/kvm/Kconfig
-index b81125f..0a303c3 100644
---- a/arch/x86/kvm/Kconfig
-+++ b/arch/x86/kvm/Kconfig
-@@ -4,6 +4,10 @@
- config HAVE_KVM
-        bool
- 
-+config HAVE_KVM_IRQCHIP
-+       bool
-+       default y
-+
- menuconfig VIRTUALIZATION
- 	bool "Virtualization"
- 	depends on HAVE_KVM || X86
-diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
-index 72bd275..3dceaef 100644
---- a/arch/x86/kvm/i8254.c
-+++ b/arch/x86/kvm/i8254.c
-@@ -536,6 +536,16 @@ void kvm_pit_reset(struct kvm_pit *pit)
- 	pit->pit_state.irq_ack = 1;
- }
- 
-+static void pit_mask_notifer(struct kvm_irq_mask_notifier *kimn, bool mask)
-+{
-+	struct kvm_pit *pit = container_of(kimn, struct kvm_pit, mask_notifier);
-+
-+	if (!mask) {
-+		atomic_set(&pit->pit_state.pit_timer.pending, 0);
-+		pit->pit_state.irq_ack = 1;
-+	}
-+}
-+
- struct kvm_pit *kvm_create_pit(struct kvm *kvm)
- {
- 	struct kvm_pit *pit;
-@@ -584,6 +594,9 @@ struct kvm_pit *kvm_create_pit(struct kvm *kvm)
- 
- 	kvm_pit_reset(pit);
- 
-+	pit->mask_notifier.func = pit_mask_notifer;
-+	kvm_register_irq_mask_notifier(kvm, 0, &pit->mask_notifier);
-+
- 	return pit;
- }
- 
-@@ -592,6 +605,8 @@ void kvm_free_pit(struct kvm *kvm)
- 	struct hrtimer *timer;
- 
- 	if (kvm->arch.vpit) {
-+		kvm_unregister_irq_mask_notifier(kvm, 0,
-+					       &kvm->arch.vpit->mask_notifier);
- 		mutex_lock(&kvm->arch.vpit->pit_state.lock);
- 		timer = &kvm->arch.vpit->pit_state.pit_timer.timer;
- 		hrtimer_cancel(timer);
-diff --git a/arch/x86/kvm/i8254.h b/arch/x86/kvm/i8254.h
-index 4178022..0dfb936 100644
---- a/arch/x86/kvm/i8254.h
-+++ b/arch/x86/kvm/i8254.h
-@@ -45,6 +45,7 @@ struct kvm_pit {
- 	struct kvm *kvm;
- 	struct kvm_kpit_state pit_state;
- 	int irq_source_id;
-+	struct kvm_irq_mask_notifier mask_notifier;
- };
- 
- #define KVM_PIT_BASE_ADDRESS	    0x40
-diff --git a/arch/x86/kvm/mmu.h b/arch/x86/kvm/mmu.h
-index 258e5d5..eaab214 100644
---- a/arch/x86/kvm/mmu.h
-+++ b/arch/x86/kvm/mmu.h
-@@ -54,7 +54,7 @@ static inline int kvm_mmu_reload(struct kvm_vcpu *vcpu)
- static inline int is_long_mode(struct kvm_vcpu *vcpu)
- {
- #ifdef CONFIG_X86_64
--	return vcpu->arch.shadow_efer & EFER_LME;
-+	return vcpu->arch.shadow_efer & EFER_LMA;
- #else
- 	return 0;
- #endif
-diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
-index c95a67d..89addbd 100644
---- a/arch/x86/kvm/paging_tmpl.h
-+++ b/arch/x86/kvm/paging_tmpl.h
-@@ -476,16 +476,20 @@ static int FNAME(shadow_invlpg_entry)(struct kvm_shadow_walk *_sw,
- 	if (level == PT_PAGE_TABLE_LEVEL ||
- 	    ((level == PT_DIRECTORY_LEVEL) && is_large_pte(*sptep))) {
- 		struct kvm_mmu_page *sp = page_header(__pa(sptep));
-+		int need_flush = 0;
- 
- 		sw->pte_gpa = (sp->gfn << PAGE_SHIFT);
- 		sw->pte_gpa += (sptep - sp->spt) * sizeof(pt_element_t);
- 
- 		if (is_shadow_present_pte(*sptep)) {
-+			need_flush = 1;
- 			rmap_remove(vcpu->kvm, sptep);
- 			if (is_large_pte(*sptep))
- 				--vcpu->kvm->stat.lpages;
- 		}
- 		set_shadow_pte(sptep, shadow_trap_nonpresent_pte);
-+		if (need_flush)
-+			kvm_flush_remote_tlbs(vcpu->kvm);
- 		return 1;
- 	}
- 	if (!is_shadow_present_pte(*sptep))
-diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
-index 90de444..898910c 100644
---- a/arch/x86/kvm/vmx.c
-+++ b/arch/x86/kvm/vmx.c
-@@ -1433,6 +1433,29 @@ continue_rmode:
- 	init_rmode(vcpu->kvm);
- }
- 
-+static void vmx_set_efer(struct kvm_vcpu *vcpu, u64 efer)
-+{
-+	struct vcpu_vmx *vmx = to_vmx(vcpu);
-+	struct kvm_msr_entry *msr = find_msr_entry(vmx, MSR_EFER);
-+
-+	vcpu->arch.shadow_efer = efer;
-+	if (!msr)
-+		return;
-+	if (efer & EFER_LMA) {
-+		vmcs_write32(VM_ENTRY_CONTROLS,
-+			     vmcs_read32(VM_ENTRY_CONTROLS) |
-+			     VM_ENTRY_IA32E_MODE);
-+		msr->data = efer;
-+	} else {
-+		vmcs_write32(VM_ENTRY_CONTROLS,
-+			     vmcs_read32(VM_ENTRY_CONTROLS) &
-+			     ~VM_ENTRY_IA32E_MODE);
-+
-+		msr->data = efer & ~EFER_LME;
-+	}
-+	setup_msrs(vmx);
-+}
-+
- #ifdef CONFIG_X86_64
- 
- static void enter_lmode(struct kvm_vcpu *vcpu)
-@@ -1447,13 +1470,8 @@ static void enter_lmode(struct kvm_vcpu *vcpu)
- 			     (guest_tr_ar & ~AR_TYPE_MASK)
- 			     | AR_TYPE_BUSY_64_TSS);
- 	}
--
- 	vcpu->arch.shadow_efer |= EFER_LMA;
--
--	find_msr_entry(to_vmx(vcpu), MSR_EFER)->data |= EFER_LMA | EFER_LME;
--	vmcs_write32(VM_ENTRY_CONTROLS,
--		     vmcs_read32(VM_ENTRY_CONTROLS)
--		     | VM_ENTRY_IA32E_MODE);
-+	vmx_set_efer(vcpu, vcpu->arch.shadow_efer);
- }
- 
- static void exit_lmode(struct kvm_vcpu *vcpu)
-@@ -1612,30 +1630,6 @@ static void vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
- 	vmcs_writel(GUEST_CR4, hw_cr4);
- }
- 
--static void vmx_set_efer(struct kvm_vcpu *vcpu, u64 efer)
--{
--	struct vcpu_vmx *vmx = to_vmx(vcpu);
--	struct kvm_msr_entry *msr = find_msr_entry(vmx, MSR_EFER);
--
--	vcpu->arch.shadow_efer = efer;
--	if (!msr)
--		return;
--	if (efer & EFER_LMA) {
--		vmcs_write32(VM_ENTRY_CONTROLS,
--				     vmcs_read32(VM_ENTRY_CONTROLS) |
--				     VM_ENTRY_IA32E_MODE);
--		msr->data = efer;
--
--	} else {
--		vmcs_write32(VM_ENTRY_CONTROLS,
--				     vmcs_read32(VM_ENTRY_CONTROLS) &
--				     ~VM_ENTRY_IA32E_MODE);
--
--		msr->data = efer & ~EFER_LME;
--	}
--	setup_msrs(vmx);
--}
--
- static u64 vmx_get_segment_base(struct kvm_vcpu *vcpu, int seg)
- {
- 	struct kvm_vmx_segment_field *sf = &kvm_vmx_segment_fields[seg];
-diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
-index 21bc1f7..441489c 100644
---- a/arch/x86/mm/pat.c
-+++ b/arch/x86/mm/pat.c
-@@ -713,29 +713,28 @@ static void free_pfn_range(u64 paddr, unsigned long size)
-  *
-  * If the vma has a linear pfn mapping for the entire range, we get the prot
-  * from pte and reserve the entire vma range with single reserve_pfn_range call.
-- * Otherwise, we reserve the entire vma range, my ging through the PTEs page
-- * by page to get physical address and protection.
-  */
- int track_pfn_vma_copy(struct vm_area_struct *vma)
- {
--	int retval = 0;
--	unsigned long i, j;
- 	resource_size_t paddr;
- 	unsigned long prot;
--	unsigned long vma_start = vma->vm_start;
--	unsigned long vma_end = vma->vm_end;
--	unsigned long vma_size = vma_end - vma_start;
-+	unsigned long vma_size = vma->vm_end - vma->vm_start;
- 	pgprot_t pgprot;
- 
- 	if (!pat_enabled)
- 		return 0;
- 
-+	/*
-+	 * For now, only handle remap_pfn_range() vmas where
-+	 * is_linear_pfn_mapping() == TRUE. Handling of
-+	 * vm_insert_pfn() is TBD.
-+	 */
- 	if (is_linear_pfn_mapping(vma)) {
- 		/*
- 		 * reserve the whole chunk covered by vma. We need the
- 		 * starting address and protection from pte.
- 		 */
--		if (follow_phys(vma, vma_start, 0, &prot, &paddr)) {
-+		if (follow_phys(vma, vma->vm_start, 0, &prot, &paddr)) {
- 			WARN_ON_ONCE(1);
- 			return -EINVAL;
- 		}
-@@ -743,28 +742,7 @@ int track_pfn_vma_copy(struct vm_area_struct *vma)
- 		return reserve_pfn_range(paddr, vma_size, &pgprot, 1);
- 	}
- 
--	/* reserve entire vma page by page, using pfn and prot from pte */
--	for (i = 0; i < vma_size; i += PAGE_SIZE) {
--		if (follow_phys(vma, vma_start + i, 0, &prot, &paddr))
--			continue;
--
--		pgprot = __pgprot(prot);
--		retval = reserve_pfn_range(paddr, PAGE_SIZE, &pgprot, 1);
--		if (retval)
--			goto cleanup_ret;
--	}
- 	return 0;
--
--cleanup_ret:
--	/* Reserve error: Cleanup partial reservation and return error */
--	for (j = 0; j < i; j += PAGE_SIZE) {
--		if (follow_phys(vma, vma_start + j, 0, &prot, &paddr))
--			continue;
--
--		free_pfn_range(paddr, PAGE_SIZE);
--	}
--
--	return retval;
- }
- 
- /*
-@@ -774,50 +752,28 @@ cleanup_ret:
-  * prot is passed in as a parameter for the new mapping. If the vma has a
-  * linear pfn mapping for the entire range reserve the entire vma range with
-  * single reserve_pfn_range call.
-- * Otherwise, we look t the pfn and size and reserve only the specified range
-- * page by page.
-- *
-- * Note that this function can be called with caller trying to map only a
-- * subrange/page inside the vma.
-  */
- int track_pfn_vma_new(struct vm_area_struct *vma, pgprot_t *prot,
- 			unsigned long pfn, unsigned long size)
- {
--	int retval = 0;
--	unsigned long i, j;
--	resource_size_t base_paddr;
- 	resource_size_t paddr;
--	unsigned long vma_start = vma->vm_start;
--	unsigned long vma_end = vma->vm_end;
--	unsigned long vma_size = vma_end - vma_start;
-+	unsigned long vma_size = vma->vm_end - vma->vm_start;
- 
- 	if (!pat_enabled)
- 		return 0;
- 
-+	/*
-+	 * For now, only handle remap_pfn_range() vmas where
-+	 * is_linear_pfn_mapping() == TRUE. Handling of
-+	 * vm_insert_pfn() is TBD.
-+	 */
- 	if (is_linear_pfn_mapping(vma)) {
- 		/* reserve the whole chunk starting from vm_pgoff */
- 		paddr = (resource_size_t)vma->vm_pgoff << PAGE_SHIFT;
- 		return reserve_pfn_range(paddr, vma_size, prot, 0);
- 	}
- 
--	/* reserve page by page using pfn and size */
--	base_paddr = (resource_size_t)pfn << PAGE_SHIFT;
--	for (i = 0; i < size; i += PAGE_SIZE) {
--		paddr = base_paddr + i;
--		retval = reserve_pfn_range(paddr, PAGE_SIZE, prot, 0);
--		if (retval)
--			goto cleanup_ret;
--	}
- 	return 0;
--
--cleanup_ret:
--	/* Reserve error: Cleanup partial reservation and return error */
--	for (j = 0; j < i; j += PAGE_SIZE) {
--		paddr = base_paddr + j;
--		free_pfn_range(paddr, PAGE_SIZE);
--	}
--
--	return retval;
- }
- 
- /*
-@@ -828,39 +784,23 @@ cleanup_ret:
- void untrack_pfn_vma(struct vm_area_struct *vma, unsigned long pfn,
- 			unsigned long size)
- {
--	unsigned long i;
- 	resource_size_t paddr;
--	unsigned long prot;
--	unsigned long vma_start = vma->vm_start;
--	unsigned long vma_end = vma->vm_end;
--	unsigned long vma_size = vma_end - vma_start;
-+	unsigned long vma_size = vma->vm_end - vma->vm_start;
- 
- 	if (!pat_enabled)
- 		return;
- 
-+	/*
-+	 * For now, only handle remap_pfn_range() vmas where
-+	 * is_linear_pfn_mapping() == TRUE. Handling of
-+	 * vm_insert_pfn() is TBD.
-+	 */
- 	if (is_linear_pfn_mapping(vma)) {
- 		/* free the whole chunk starting from vm_pgoff */
- 		paddr = (resource_size_t)vma->vm_pgoff << PAGE_SHIFT;
- 		free_pfn_range(paddr, vma_size);
- 		return;
- 	}
--
--	if (size != 0 && size != vma_size) {
--		/* free page by page, using pfn and size */
--		paddr = (resource_size_t)pfn << PAGE_SHIFT;
--		for (i = 0; i < size; i += PAGE_SIZE) {
--			paddr = paddr + i;
--			free_pfn_range(paddr, PAGE_SIZE);
--		}
--	} else {
--		/* free entire vma, page by page, using the pfn from pte */
--		for (i = 0; i < vma_size; i += PAGE_SIZE) {
--			if (follow_phys(vma, vma_start + i, 0, &prot, &paddr))
--				continue;
--
--			free_pfn_range(paddr, PAGE_SIZE);
--		}
--	}
- }
- 
- pgprot_t pgprot_writecombine(pgprot_t prot)
-diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c
-index 7d388d5..096b0ed 100644
---- a/arch/x86/pci/fixup.c
-+++ b/arch/x86/pci/fixup.c
-@@ -495,26 +495,6 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SIEMENS, 0x0015,
- 			  pci_siemens_interrupt_controller);
- 
- /*
-- * Regular PCI devices have 256 bytes, but AMD Family 10h/11h CPUs have
-- * 4096 bytes configuration space for each function of their processor
-- * configuration space.
-- */
--static void amd_cpu_pci_cfg_space_size(struct pci_dev *dev)
--{
--	dev->cfg_size = pci_cfg_space_size_ext(dev);
--}
--DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1200, amd_cpu_pci_cfg_space_size);
--DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1201, amd_cpu_pci_cfg_space_size);
--DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1202, amd_cpu_pci_cfg_space_size);
--DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1203, amd_cpu_pci_cfg_space_size);
--DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1204, amd_cpu_pci_cfg_space_size);
--DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1300, amd_cpu_pci_cfg_space_size);
--DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1301, amd_cpu_pci_cfg_space_size);
--DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1302, amd_cpu_pci_cfg_space_size);
--DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1303, amd_cpu_pci_cfg_space_size);
--DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1304, amd_cpu_pci_cfg_space_size);
--
--/*
-  * SB600: Disable BAR1 on device 14.0 to avoid HPET resources from
-  * confusing the PCI engine:
-  */
-diff --git a/crypto/shash.c b/crypto/shash.c
-index d5a2b61..6792a67 100644
---- a/crypto/shash.c
-+++ b/crypto/shash.c
-@@ -82,6 +82,9 @@ static int shash_update_unaligned(struct shash_desc *desc, const u8 *data,
- 	u8 buf[shash_align_buffer_size(unaligned_len, alignmask)]
- 		__attribute__ ((aligned));
- 
-+	if (unaligned_len > len)
-+		unaligned_len = len;
-+
- 	memcpy(buf, data, unaligned_len);
- 
- 	return shash->update(desc, buf, unaligned_len) ?:
-diff --git a/drivers/acpi/dock.c b/drivers/acpi/dock.c
-index 35094f2..8f62fa0 100644
---- a/drivers/acpi/dock.c
-+++ b/drivers/acpi/dock.c
-@@ -1146,9 +1146,10 @@ static int __init dock_init(void)
- static void __exit dock_exit(void)
- {
- 	struct dock_station *dock_station;
-+	struct dock_station *tmp;
- 
- 	unregister_acpi_bus_notifier(&dock_acpi_notifier);
--	list_for_each_entry(dock_station, &dock_stations, sibiling)
-+	list_for_each_entry_safe(dock_station, tmp, &dock_stations, sibiling)
- 		dock_remove(dock_station);
- }
- 
-diff --git a/drivers/ata/pata_hpt37x.c b/drivers/ata/pata_hpt37x.c
-index 4216399..233a5fd 100644
---- a/drivers/ata/pata_hpt37x.c
-+++ b/drivers/ata/pata_hpt37x.c
-@@ -8,7 +8,7 @@
-  * Copyright (C) 1999-2003		Andre Hedrick <andre@×××××××××.org>
-  * Portions Copyright (C) 2001	        Sun Microsystems, Inc.
-  * Portions Copyright (C) 2003		Red Hat Inc
-- * Portions Copyright (C) 2005-2007	MontaVista Software, Inc.
-+ * Portions Copyright (C) 2005-2009	MontaVista Software, Inc.
-  *
-  * TODO
-  *	Look into engine reset on timeout errors. Should not be	required.
-@@ -24,7 +24,7 @@
- #include <linux/libata.h>
- 
- #define DRV_NAME	"pata_hpt37x"
--#define DRV_VERSION	"0.6.11"
-+#define DRV_VERSION	"0.6.12"
- 
- struct hpt_clock {
- 	u8	xfer_speed;
-@@ -445,23 +445,6 @@ static void hpt370_set_dmamode(struct ata_port *ap, struct ata_device *adev)
- }
- 
- /**
-- *	hpt370_bmdma_start		-	DMA engine begin
-- *	@qc: ATA command
-- *
-- *	The 370 and 370A want us to reset the DMA engine each time we
-- *	use it. The 372 and later are fine.
-- */
--
--static void hpt370_bmdma_start(struct ata_queued_cmd *qc)
--{
--	struct ata_port *ap = qc->ap;
--	struct pci_dev *pdev = to_pci_dev(ap->host->dev);
--	pci_write_config_byte(pdev, 0x50 + 4 * ap->port_no, 0x37);
--	udelay(10);
--	ata_bmdma_start(qc);
--}
--
--/**
-  *	hpt370_bmdma_end		-	DMA engine stop
-  *	@qc: ATA command
-  *
-@@ -598,7 +581,6 @@ static struct scsi_host_template hpt37x_sht = {
- static struct ata_port_operations hpt370_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 
--	.bmdma_start 	= hpt370_bmdma_start,
- 	.bmdma_stop	= hpt370_bmdma_stop,
- 
- 	.mode_filter	= hpt370_filter,
-diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c
-index 10d6cbd..2224b76 100644
---- a/drivers/char/agp/generic.c
-+++ b/drivers/char/agp/generic.c
-@@ -1226,7 +1226,7 @@ int agp_generic_alloc_pages(struct agp_bridge_data *bridge, struct agp_memory *m
- 	int i, ret = -ENOMEM;
- 
- 	for (i = 0; i < num_pages; i++) {
--		page = alloc_page(GFP_KERNEL | GFP_DMA32);
-+		page = alloc_page(GFP_KERNEL | GFP_DMA32 | __GFP_ZERO);
- 		/* agp_free_memory() needs gart address */
- 		if (page == NULL)
- 			goto out;
-@@ -1257,7 +1257,7 @@ void *agp_generic_alloc_page(struct agp_bridge_data *bridge)
- {
- 	struct page * page;
- 
--	page = alloc_page(GFP_KERNEL | GFP_DMA32);
-+	page = alloc_page(GFP_KERNEL | GFP_DMA32 | __GFP_ZERO);
- 	if (page == NULL)
- 		return NULL;
- 
-diff --git a/drivers/char/vt.c b/drivers/char/vt.c
-index 7900bd6..60453ab 100644
---- a/drivers/char/vt.c
-+++ b/drivers/char/vt.c
-@@ -2271,7 +2271,7 @@ rescan_last_byte:
- 				    continue; /* nothing to display */
- 				}
- 				/* Glyph not found */
--				if ((!(vc->vc_utf && !vc->vc_disp_ctrl) && c < 128) && !(c & ~charmask)) {
-+				if ((!(vc->vc_utf && !vc->vc_disp_ctrl) || c < 128) && !(c & ~charmask)) {
- 				    /* In legacy mode use the glyph we get by a 1:1 mapping.
- 				       This would make absolutely no sense with Unicode in mind,
- 				       but do this for ASCII characters since a font may lack
-diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
-index 88d3368..7ee1ce1 100644
---- a/drivers/gpu/drm/drm_gem.c
-+++ b/drivers/gpu/drm/drm_gem.c
-@@ -505,7 +505,6 @@ int drm_gem_mmap(struct file *filp, struct vm_area_struct *vma)
- 	struct drm_map *map = NULL;
- 	struct drm_gem_object *obj;
- 	struct drm_hash_item *hash;
--	unsigned long prot;
- 	int ret = 0;
- 
- 	mutex_lock(&dev->struct_mutex);
-@@ -538,11 +537,7 @@ int drm_gem_mmap(struct file *filp, struct vm_area_struct *vma)
- 	vma->vm_ops = obj->dev->driver->gem_vm_ops;
- 	vma->vm_private_data = map->handle;
- 	/* FIXME: use pgprot_writecombine when available */
--	prot = pgprot_val(vma->vm_page_prot);
--#ifdef CONFIG_X86
--	prot |= _PAGE_CACHE_WC;
--#endif
--	vma->vm_page_prot = __pgprot(prot);
-+	vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot);
- 
- 	/* Take a ref for this mapping of the object, so that the fault
- 	 * handler can dereference the mmap offset's pointer to the object.
-diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
-index 6d21b9e..908d24e 100644
---- a/drivers/gpu/drm/i915/i915_dma.c
-+++ b/drivers/gpu/drm/i915/i915_dma.c
-@@ -41,7 +41,6 @@
- int i915_wait_ring(struct drm_device * dev, int n, const char *caller)
- {
- 	drm_i915_private_t *dev_priv = dev->dev_private;
--	struct drm_i915_master_private *master_priv = dev->primary->master->driver_priv;
- 	drm_i915_ring_buffer_t *ring = &(dev_priv->ring);
- 	u32 acthd_reg = IS_I965G(dev) ? ACTHD_I965 : ACTHD;
- 	u32 last_acthd = I915_READ(acthd_reg);
-@@ -58,8 +57,12 @@ int i915_wait_ring(struct drm_device * dev, int n, const char *caller)
- 		if (ring->space >= n)
- 			return 0;
- 
--		if (master_priv->sarea_priv)
--			master_priv->sarea_priv->perf_boxes |= I915_BOX_WAIT;
-+		if (dev->primary->master) {
-+			struct drm_i915_master_private *master_priv = dev->primary->master->driver_priv;
-+			if (master_priv->sarea_priv)
-+				master_priv->sarea_priv->perf_boxes |= I915_BOX_WAIT;
-+		}
-+
- 
- 		if (ring->head != last_head)
- 			i = 0;
-diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
-index 37427e4..fb6390a 100644
---- a/drivers/gpu/drm/i915/i915_gem.c
-+++ b/drivers/gpu/drm/i915/i915_gem.c
-@@ -603,6 +603,7 @@ int i915_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
- 	case -EAGAIN:
- 		return VM_FAULT_OOM;
- 	case -EFAULT:
-+	case -EINVAL:
- 		return VM_FAULT_SIGBUS;
- 	default:
- 		return VM_FAULT_NOPAGE;
-diff --git a/drivers/gpu/drm/i915/i915_gem_tiling.c b/drivers/gpu/drm/i915/i915_gem_tiling.c
-index 7fb4191..4cce1ae 100644
---- a/drivers/gpu/drm/i915/i915_gem_tiling.c
-+++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
-@@ -96,16 +96,16 @@ i915_gem_detect_bit_6_swizzle(struct drm_device *dev)
- 		 */
- 		swizzle_x = I915_BIT_6_SWIZZLE_NONE;
- 		swizzle_y = I915_BIT_6_SWIZZLE_NONE;
--	} else if ((!IS_I965G(dev) && !IS_G33(dev)) || IS_I965GM(dev) ||
--		   IS_GM45(dev)) {
-+	} else if (IS_MOBILE(dev)) {
- 		uint32_t dcc;
- 
--		/* On 915-945 and GM965, channel interleave by the CPU is
--		 * determined by DCC.  The CPU will alternate based on bit 6
--		 * in interleaved mode, and the GPU will then also alternate
--		 * on bit 6, 9, and 10 for X, but the CPU may also optionally
--		 * alternate based on bit 17 (XOR not disabled and XOR
--		 * bit == 17).
-+		/* On mobile 9xx chipsets, channel interleave by the CPU is
-+		 * determined by DCC.  For single-channel, neither the CPU
-+		 * nor the GPU do swizzling.  For dual channel interleaved,
-+		 * the GPU's interleave is bit 9 and 10 for X tiled, and bit
-+		 * 9 for Y tiled.  The CPU's interleave is independent, and
-+		 * can be based on either bit 11 (haven't seen this yet) or
-+		 * bit 17 (common).
- 		 */
- 		dcc = I915_READ(DCC);
- 		switch (dcc & DCC_ADDRESSING_MODE_MASK) {
-@@ -115,19 +115,18 @@ i915_gem_detect_bit_6_swizzle(struct drm_device *dev)
- 			swizzle_y = I915_BIT_6_SWIZZLE_NONE;
- 			break;
- 		case DCC_ADDRESSING_MODE_DUAL_CHANNEL_INTERLEAVED:
--			if (IS_I915G(dev) || IS_I915GM(dev) ||
--			    dcc & DCC_CHANNEL_XOR_DISABLE) {
-+			if (dcc & DCC_CHANNEL_XOR_DISABLE) {
-+				/* This is the base swizzling by the GPU for
-+				 * tiled buffers.
-+				 */
- 				swizzle_x = I915_BIT_6_SWIZZLE_9_10;
- 				swizzle_y = I915_BIT_6_SWIZZLE_9;
--			} else if ((IS_I965GM(dev) || IS_GM45(dev)) &&
--				   (dcc & DCC_CHANNEL_XOR_BIT_17) == 0) {
--				/* GM965/GM45 does either bit 11 or bit 17
--				 * swizzling.
--				 */
-+			} else if ((dcc & DCC_CHANNEL_XOR_BIT_17) == 0) {
-+				/* Bit 11 swizzling by the CPU in addition. */
- 				swizzle_x = I915_BIT_6_SWIZZLE_9_10_11;
- 				swizzle_y = I915_BIT_6_SWIZZLE_9_11;
- 			} else {
--				/* Bit 17 or perhaps other swizzling */
-+				/* Bit 17 swizzling by the CPU in addition. */
- 				swizzle_x = I915_BIT_6_SWIZZLE_UNKNOWN;
- 				swizzle_y = I915_BIT_6_SWIZZLE_UNKNOWN;
- 			}
-diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
-index 90600d8..cc2938d 100644
---- a/drivers/gpu/drm/i915/i915_reg.h
-+++ b/drivers/gpu/drm/i915/i915_reg.h
-@@ -629,6 +629,22 @@
- #define   TV_HOTPLUG_INT_EN			(1 << 18)
- #define   CRT_HOTPLUG_INT_EN			(1 << 9)
- #define   CRT_HOTPLUG_FORCE_DETECT		(1 << 3)
-+#define CRT_HOTPLUG_ACTIVATION_PERIOD_32	(0 << 8)
-+/* must use period 64 on GM45 according to docs */
-+#define CRT_HOTPLUG_ACTIVATION_PERIOD_64	(1 << 8)
-+#define CRT_HOTPLUG_DAC_ON_TIME_2M		(0 << 7)
-+#define CRT_HOTPLUG_DAC_ON_TIME_4M		(1 << 7)
-+#define CRT_HOTPLUG_VOLTAGE_COMPARE_40		(0 << 5)
-+#define CRT_HOTPLUG_VOLTAGE_COMPARE_50		(1 << 5)
-+#define CRT_HOTPLUG_VOLTAGE_COMPARE_60		(2 << 5)
-+#define CRT_HOTPLUG_VOLTAGE_COMPARE_70		(3 << 5)
-+#define CRT_HOTPLUG_VOLTAGE_COMPARE_MASK	(3 << 5)
-+#define CRT_HOTPLUG_DETECT_DELAY_1G		(0 << 4)
-+#define CRT_HOTPLUG_DETECT_DELAY_2G		(1 << 4)
-+#define CRT_HOTPLUG_DETECT_VOLTAGE_325MV	(0 << 2)
-+#define CRT_HOTPLUG_DETECT_VOLTAGE_475MV	(1 << 2)
-+#define CRT_HOTPLUG_MASK			(0x3fc) /* Bits 9-2 */
-+
- 
- #define PORT_HOTPLUG_STAT	0x61114
- #define   HDMIB_HOTPLUG_INT_STATUS		(1 << 29)
-diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
-index dcaed34..61c108e 100644
---- a/drivers/gpu/drm/i915/intel_crt.c
-+++ b/drivers/gpu/drm/i915/intel_crt.c
-@@ -133,20 +133,39 @@ static bool intel_crt_detect_hotplug(struct drm_connector *connector)
- {
- 	struct drm_device *dev = connector->dev;
- 	struct drm_i915_private *dev_priv = dev->dev_private;
--	u32 temp;
--
--	unsigned long timeout = jiffies + msecs_to_jiffies(1000);
--
--	temp = I915_READ(PORT_HOTPLUG_EN);
--
--	I915_WRITE(PORT_HOTPLUG_EN,
--		   temp | CRT_HOTPLUG_FORCE_DETECT | (1 << 5));
-+	u32 hotplug_en;
-+	int i, tries = 0;
-+	/*
-+	 * On 4 series desktop, CRT detect sequence need to be done twice
-+	 * to get a reliable result.
-+	 */
- 
--	do {
--		if (!(I915_READ(PORT_HOTPLUG_EN) & CRT_HOTPLUG_FORCE_DETECT))
--			break;
--		msleep(1);
--	} while (time_after(timeout, jiffies));
-+	if (IS_G4X(dev) && !IS_GM45(dev))
-+		tries = 2;
-+	else
-+		tries = 1;
-+	hotplug_en = I915_READ(PORT_HOTPLUG_EN);
-+	hotplug_en &= ~(CRT_HOTPLUG_MASK);
-+	hotplug_en |= CRT_HOTPLUG_FORCE_DETECT;
-+
-+	if (IS_GM45(dev))
-+		hotplug_en |= CRT_HOTPLUG_ACTIVATION_PERIOD_64;
-+
-+	hotplug_en |= CRT_HOTPLUG_VOLTAGE_COMPARE_50;
-+
-+	for (i = 0; i < tries ; i++) {
-+		unsigned long timeout;
-+		/* turn on the FORCE_DETECT */
-+		I915_WRITE(PORT_HOTPLUG_EN, hotplug_en);
-+		timeout = jiffies + msecs_to_jiffies(1000);
-+		/* wait for FORCE_DETECT to go off */
-+		do {
-+			if (!(I915_READ(PORT_HOTPLUG_EN) &
-+					CRT_HOTPLUG_FORCE_DETECT))
-+				break;
-+			msleep(1);
-+		} while (time_after(timeout, jiffies));
-+	}
- 
- 	if ((I915_READ(PORT_HOTPLUG_STAT) & CRT_HOTPLUG_MONITOR_MASK) ==
- 	    CRT_HOTPLUG_MONITOR_COLOR)
-diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index a283427..601a76f 100644
---- a/drivers/gpu/drm/i915/intel_display.c
-+++ b/drivers/gpu/drm/i915/intel_display.c
-@@ -1474,13 +1474,21 @@ static void intel_setup_outputs(struct drm_device *dev)
- 
- 	if (IS_I9XX(dev)) {
- 		int found;
-+		u32 reg;
- 
- 		if (I915_READ(SDVOB) & SDVO_DETECTED) {
- 			found = intel_sdvo_init(dev, SDVOB);
- 			if (!found && SUPPORTS_INTEGRATED_HDMI(dev))
- 				intel_hdmi_init(dev, SDVOB);
- 		}
--		if (!IS_G4X(dev) || (I915_READ(SDVOB) & SDVO_DETECTED)) {
-+
-+		/* Before G4X SDVOC doesn't have its own detect register */
-+		if (IS_G4X(dev))
-+			reg = SDVOC;
-+		else
-+			reg = SDVOB;
-+
-+		if (I915_READ(reg) & SDVO_DETECTED) {
- 			found = intel_sdvo_init(dev, SDVOC);
- 			if (!found && SUPPORTS_INTEGRATED_HDMI(dev))
- 				intel_hdmi_init(dev, SDVOC);
-diff --git a/drivers/gpu/drm/i915/intel_tv.c b/drivers/gpu/drm/i915/intel_tv.c
-index 56485d6..b05cb67 100644
---- a/drivers/gpu/drm/i915/intel_tv.c
-+++ b/drivers/gpu/drm/i915/intel_tv.c
-@@ -1558,33 +1558,49 @@ intel_tv_set_property(struct drm_connector *connector, struct drm_property *prop
- 	struct drm_device *dev = connector->dev;
- 	struct intel_output *intel_output = to_intel_output(connector);
- 	struct intel_tv_priv *tv_priv = intel_output->dev_priv;
-+	struct drm_encoder *encoder = &intel_output->enc;
-+	struct drm_crtc *crtc = encoder->crtc;
- 	int ret = 0;
-+	bool changed = false;
- 
- 	ret = drm_connector_property_set_value(connector, property, val);
- 	if (ret < 0)
- 		goto out;
- 
--	if (property == dev->mode_config.tv_left_margin_property)
-+	if (property == dev->mode_config.tv_left_margin_property &&
-+		tv_priv->margin[TV_MARGIN_LEFT] != val) {
- 		tv_priv->margin[TV_MARGIN_LEFT] = val;
--	else if (property == dev->mode_config.tv_right_margin_property)
-+		changed = true;
-+	} else if (property == dev->mode_config.tv_right_margin_property &&
-+		tv_priv->margin[TV_MARGIN_RIGHT] != val) {
- 		tv_priv->margin[TV_MARGIN_RIGHT] = val;
--	else if (property == dev->mode_config.tv_top_margin_property)
-+		changed = true;
-+	} else if (property == dev->mode_config.tv_top_margin_property &&
-+		tv_priv->margin[TV_MARGIN_TOP] != val) {
- 		tv_priv->margin[TV_MARGIN_TOP] = val;
--	else if (property == dev->mode_config.tv_bottom_margin_property)
-+		changed = true;
-+	} else if (property == dev->mode_config.tv_bottom_margin_property &&
-+		tv_priv->margin[TV_MARGIN_BOTTOM] != val) {
- 		tv_priv->margin[TV_MARGIN_BOTTOM] = val;
--	else if (property == dev->mode_config.tv_mode_property) {
-+		changed = true;
-+	} else if (property == dev->mode_config.tv_mode_property) {
- 		if (val >= NUM_TV_MODES) {
- 			ret = -EINVAL;
- 			goto out;
- 		}
-+		if (!strcmp(tv_priv->tv_format, tv_modes[val].name))
-+			goto out;
-+
- 		tv_priv->tv_format = tv_modes[val].name;
--		intel_tv_mode_set(&intel_output->enc, NULL, NULL);
-+		changed = true;
- 	} else {
- 		ret = -EINVAL;
- 		goto out;
- 	}
- 
--	intel_tv_mode_set(&intel_output->enc, NULL, NULL);
-+	if (changed && crtc)
-+		drm_crtc_helper_set_mode(crtc, &crtc->mode, crtc->x,
-+				crtc->y, crtc->fb);
- out:
- 	return ret;
- }
-diff --git a/drivers/ide/hpt366.c b/drivers/ide/hpt366.c
-index 3eb9b5c..5ff6962 100644
---- a/drivers/ide/hpt366.c
-+++ b/drivers/ide/hpt366.c
-@@ -114,6 +114,8 @@
-  *   the register setting lists into the table indexed by the clock selected
-  * - set the correct hwif->ultra_mask for each individual chip
-  * - add Ultra and MW DMA mode filtering for the HPT37[24] based SATA cards
-+ * - stop resetting HPT370's state machine before each DMA transfer as that has
-+ *   caused more harm than good
-  *	Sergei Shtylyov, <sshtylyov@×××××××××.com> or <source@××××××.com>
-  */
- 
-@@ -133,7 +135,7 @@
- #define DRV_NAME "hpt366"
- 
- /* various tuning parameters */
--#define HPT_RESET_STATE_ENGINE
-+#undef	HPT_RESET_STATE_ENGINE
- #undef	HPT_DELAY_INTERRUPT
- 
- static const char *quirk_drives[] = {
-diff --git a/drivers/ide/ide-atapi.c b/drivers/ide/ide-atapi.c
-index e9d042d..53a9e8d 100644
---- a/drivers/ide/ide-atapi.c
-+++ b/drivers/ide/ide-atapi.c
-@@ -6,6 +6,8 @@
- #include <linux/cdrom.h>
- #include <linux/delay.h>
- #include <linux/ide.h>
-+#include <linux/scatterlist.h>
-+
- #include <scsi/scsi.h>
- 
- #ifdef DEBUG
-@@ -566,6 +568,10 @@ static ide_startstop_t ide_transfer_pc(ide_drive_t *drive)
- 					     : ide_pc_intr),
- 			timeout, expiry);
- 
-+	/* Send the actual packet */
-+	if ((drive->atapi_flags & IDE_AFLAG_ZIP_DRIVE) == 0)
-+		hwif->tp_ops->output_data(drive, NULL, rq->cmd, cmd_len);
-+
- 	/* Begin DMA, if necessary */
- 	if (dev_is_idecd(drive)) {
- 		if (drive->dma)
-@@ -577,10 +583,6 @@ static ide_startstop_t ide_transfer_pc(ide_drive_t *drive)
- 		}
- 	}
- 
--	/* Send the actual packet */
--	if ((drive->atapi_flags & IDE_AFLAG_ZIP_DRIVE) == 0)
--		hwif->tp_ops->output_data(drive, NULL, rq->cmd, cmd_len);
--
- 	return ide_started;
- }
- 
-diff --git a/drivers/ide/ide-io.c b/drivers/ide/ide-io.c
-index a9a6c20..af70777 100644
---- a/drivers/ide/ide-io.c
-+++ b/drivers/ide/ide-io.c
-@@ -736,11 +736,10 @@ repeat:
- 		prev_port = hwif->host->cur_port;
- 		hwif->rq = NULL;
- 
--		if (drive->dev_flags & IDE_DFLAG_SLEEPING) {
--			if (time_before(drive->sleep, jiffies)) {
--				ide_unlock_port(hwif);
--				goto plug_device;
--			}
-+		if (drive->dev_flags & IDE_DFLAG_SLEEPING &&
-+		    time_after(drive->sleep, jiffies)) {
-+			ide_unlock_port(hwif);
-+			goto plug_device;
- 		}
- 
- 		if ((hwif->host->host_flags & IDE_HFLAG_SERIALIZE) &&
-diff --git a/drivers/input/gameport/gameport.c b/drivers/input/gameport/gameport.c
-index ebf4be5..2d175b5 100644
---- a/drivers/input/gameport/gameport.c
-+++ b/drivers/input/gameport/gameport.c
-@@ -50,9 +50,8 @@ static LIST_HEAD(gameport_list);
- 
- static struct bus_type gameport_bus;
- 
--static void gameport_add_driver(struct gameport_driver *drv);
- static void gameport_add_port(struct gameport *gameport);
--static void gameport_destroy_port(struct gameport *gameport);
-+static void gameport_attach_driver(struct gameport_driver *drv);
- static void gameport_reconnect_port(struct gameport *gameport);
- static void gameport_disconnect_port(struct gameport *gameport);
- 
-@@ -230,7 +229,6 @@ static void gameport_find_driver(struct gameport *gameport)
- 
- enum gameport_event_type {
- 	GAMEPORT_REGISTER_PORT,
--	GAMEPORT_REGISTER_DRIVER,
- 	GAMEPORT_ATTACH_DRIVER,
- };
- 
-@@ -374,8 +372,8 @@ static void gameport_handle_event(void)
- 				gameport_add_port(event->object);
- 				break;
- 
--			case GAMEPORT_REGISTER_DRIVER:
--				gameport_add_driver(event->object);
-+			case GAMEPORT_ATTACH_DRIVER:
-+				gameport_attach_driver(event->object);
- 				break;
- 
- 			default:
-@@ -706,14 +704,14 @@ static int gameport_driver_remove(struct device *dev)
- 	return 0;
- }
- 
--static void gameport_add_driver(struct gameport_driver *drv)
-+static void gameport_attach_driver(struct gameport_driver *drv)
- {
- 	int error;
- 
--	error = driver_register(&drv->driver);
-+	error = driver_attach(&drv->driver);
- 	if (error)
- 		printk(KERN_ERR
--			"gameport: driver_register() failed for %s, error: %d\n",
-+			"gameport: driver_attach() failed for %s, error: %d\n",
- 			drv->driver.name, error);
- }
- 
-diff --git a/drivers/md/dm-bio-record.h b/drivers/md/dm-bio-record.h
-index d3ec217..3a8cfa2 100644
---- a/drivers/md/dm-bio-record.h
-+++ b/drivers/md/dm-bio-record.h
-@@ -16,30 +16,56 @@
-  * functions in this file help the target record and restore the
-  * original bio state.
-  */
-+
-+struct dm_bio_vec_details {
-+#if PAGE_SIZE < 65536
-+	__u16 bv_len;
-+	__u16 bv_offset;
-+#else
-+	unsigned bv_len;
-+	unsigned bv_offset;
-+#endif
-+};
-+
- struct dm_bio_details {
- 	sector_t bi_sector;
- 	struct block_device *bi_bdev;
- 	unsigned int bi_size;
- 	unsigned short bi_idx;
- 	unsigned long bi_flags;
-+	struct dm_bio_vec_details bi_io_vec[BIO_MAX_PAGES];
- };
- 
- static inline void dm_bio_record(struct dm_bio_details *bd, struct bio *bio)
- {
-+	unsigned i;
-+
- 	bd->bi_sector = bio->bi_sector;
- 	bd->bi_bdev = bio->bi_bdev;
- 	bd->bi_size = bio->bi_size;
- 	bd->bi_idx = bio->bi_idx;
- 	bd->bi_flags = bio->bi_flags;
-+
-+	for (i = 0; i < bio->bi_vcnt; i++) {
-+		bd->bi_io_vec[i].bv_len = bio->bi_io_vec[i].bv_len;
-+		bd->bi_io_vec[i].bv_offset = bio->bi_io_vec[i].bv_offset;
-+	}
- }
- 
- static inline void dm_bio_restore(struct dm_bio_details *bd, struct bio *bio)
- {
-+	unsigned i;
-+
- 	bio->bi_sector = bd->bi_sector;
- 	bio->bi_bdev = bd->bi_bdev;
- 	bio->bi_size = bd->bi_size;
- 	bio->bi_idx = bd->bi_idx;
- 	bio->bi_flags = bd->bi_flags;
-+
-+	for (i = 0; i < bio->bi_vcnt; i++) {
-+		bio->bi_io_vec[i].bv_len = bd->bi_io_vec[i].bv_len;
-+		bio->bi_io_vec[i].bv_offset = bd->bi_io_vec[i].bv_offset;
-+	}
- }
- 
- #endif
-diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c
-index 36e2b5e..e73aabd 100644
---- a/drivers/md/dm-io.c
-+++ b/drivers/md/dm-io.c
-@@ -370,16 +370,13 @@ static int sync_io(struct dm_io_client *client, unsigned int num_regions,
- 	while (1) {
- 		set_current_state(TASK_UNINTERRUPTIBLE);
- 
--		if (!atomic_read(&io.count) || signal_pending(current))
-+		if (!atomic_read(&io.count))
- 			break;
- 
- 		io_schedule();
- 	}
- 	set_current_state(TASK_RUNNING);
- 
--	if (atomic_read(&io.count))
--		return -EINTR;
--
- 	if (error_bits)
- 		*error_bits = io.error_bits;
- 
-diff --git a/drivers/md/dm-kcopyd.c b/drivers/md/dm-kcopyd.c
-index 0a225da..3e3fc06 100644
---- a/drivers/md/dm-kcopyd.c
-+++ b/drivers/md/dm-kcopyd.c
-@@ -297,7 +297,8 @@ static int run_complete_job(struct kcopyd_job *job)
- 	dm_kcopyd_notify_fn fn = job->fn;
- 	struct dm_kcopyd_client *kc = job->kc;
- 
--	kcopyd_put_pages(kc, job->pages);
-+	if (job->pages)
-+		kcopyd_put_pages(kc, job->pages);
- 	mempool_free(job, kc->job_pool);
- 	fn(read_err, write_err, context);
- 
-@@ -461,6 +462,7 @@ static void segment_complete(int read_err, unsigned long write_err,
- 	sector_t progress = 0;
- 	sector_t count = 0;
- 	struct kcopyd_job *job = (struct kcopyd_job *) context;
-+	struct dm_kcopyd_client *kc = job->kc;
- 
- 	mutex_lock(&job->lock);
- 
-@@ -490,7 +492,7 @@ static void segment_complete(int read_err, unsigned long write_err,
- 
- 	if (count) {
- 		int i;
--		struct kcopyd_job *sub_job = mempool_alloc(job->kc->job_pool,
-+		struct kcopyd_job *sub_job = mempool_alloc(kc->job_pool,
- 							   GFP_NOIO);
- 
- 		*sub_job = *job;
-@@ -509,13 +511,16 @@ static void segment_complete(int read_err, unsigned long write_err,
- 	} else if (atomic_dec_and_test(&job->sub_jobs)) {
- 
- 		/*
--		 * To avoid a race we must keep the job around
--		 * until after the notify function has completed.
--		 * Otherwise the client may try and stop the job
--		 * after we've completed.
-+		 * Queue the completion callback to the kcopyd thread.
-+		 *
-+		 * Some callers assume that all the completions are called
-+		 * from a single thread and don't race with each other.
-+		 *
-+		 * We must not call the callback directly here because this
-+		 * code may not be executing in the thread.
- 		 */
--		job->fn(read_err, write_err, job->context);
--		mempool_free(job, job->kc->job_pool);
-+		push(&kc->complete_jobs, job);
-+		wake(kc);
- 	}
- }
- 
-@@ -528,6 +533,8 @@ static void split_job(struct kcopyd_job *job)
- {
- 	int i;
- 
-+	atomic_inc(&job->kc->nr_jobs);
-+
- 	atomic_set(&job->sub_jobs, SPLIT_COUNT);
- 	for (i = 0; i < SPLIT_COUNT; i++)
- 		segment_complete(0, 0u, job);
-diff --git a/drivers/md/dm-path-selector.c b/drivers/md/dm-path-selector.c
-index 96ea226..42c04f0 100644
---- a/drivers/md/dm-path-selector.c
-+++ b/drivers/md/dm-path-selector.c
-@@ -17,9 +17,7 @@
- 
- struct ps_internal {
- 	struct path_selector_type pst;
--
- 	struct list_head list;
--	long use;
- };
- 
- #define pst_to_psi(__pst) container_of((__pst), struct ps_internal, pst)
-@@ -45,12 +43,8 @@ static struct ps_internal *get_path_selector(const char *name)
- 
- 	down_read(&_ps_lock);
- 	psi = __find_path_selector_type(name);
--	if (psi) {
--		if ((psi->use == 0) && !try_module_get(psi->pst.module))
--			psi = NULL;
--		else
--			psi->use++;
--	}
-+	if (psi && !try_module_get(psi->pst.module))
-+		psi = NULL;
- 	up_read(&_ps_lock);
- 
- 	return psi;
-@@ -84,11 +78,7 @@ void dm_put_path_selector(struct path_selector_type *pst)
- 	if (!psi)
- 		goto out;
- 
--	if (--psi->use == 0)
--		module_put(psi->pst.module);
--
--	BUG_ON(psi->use < 0);
--
-+	module_put(psi->pst.module);
- out:
- 	up_read(&_ps_lock);
- }
-@@ -136,11 +126,6 @@ int dm_unregister_path_selector(struct path_selector_type *pst)
- 		return -EINVAL;
- 	}
- 
--	if (psi->use) {
--		up_write(&_ps_lock);
--		return -ETXTBSY;
--	}
--
- 	list_del(&psi->list);
- 
- 	up_write(&_ps_lock);
-diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
-index 4d6bc10..62d5948 100644
---- a/drivers/md/dm-raid1.c
-+++ b/drivers/md/dm-raid1.c
-@@ -145,6 +145,8 @@ struct dm_raid1_read_record {
- 	struct dm_bio_details details;
- };
- 
-+static struct kmem_cache *_dm_raid1_read_record_cache;
-+
- /*
-  * Every mirror should look like this one.
-  */
-@@ -764,9 +766,9 @@ static struct mirror_set *alloc_context(unsigned int nr_mirrors,
- 	atomic_set(&ms->suspend, 0);
- 	atomic_set(&ms->default_mirror, DEFAULT_MIRROR);
- 
--	len = sizeof(struct dm_raid1_read_record);
--	ms->read_record_pool = mempool_create_kmalloc_pool(MIN_READ_RECORDS,
--							   len);
-+	ms->read_record_pool = mempool_create_slab_pool(MIN_READ_RECORDS,
-+						_dm_raid1_read_record_cache);
-+
- 	if (!ms->read_record_pool) {
- 		ti->error = "Error creating mirror read_record_pool";
- 		kfree(ms);
-@@ -1279,16 +1281,31 @@ static int __init dm_mirror_init(void)
- {
- 	int r;
- 
-+	_dm_raid1_read_record_cache = KMEM_CACHE(dm_raid1_read_record, 0);
-+	if (!_dm_raid1_read_record_cache) {
-+		DMERR("Can't allocate dm_raid1_read_record cache");
-+		r = -ENOMEM;
-+		goto bad_cache;
-+	}
-+
- 	r = dm_register_target(&mirror_target);
--	if (r < 0)
-+	if (r < 0) {
- 		DMERR("Failed to register mirror target");
-+		goto bad_target;
-+	}
-+
-+	return 0;
- 
-+bad_target:
-+	kmem_cache_destroy(_dm_raid1_read_record_cache);
-+bad_cache:
- 	return r;
- }
- 
- static void __exit dm_mirror_exit(void)
- {
- 	dm_unregister_target(&mirror_target);
-+	kmem_cache_destroy(_dm_raid1_read_record_cache);
- }
- 
- /* Module hooks */
-diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
-index 65ff82f..462750c 100644
---- a/drivers/md/dm-snap.c
-+++ b/drivers/md/dm-snap.c
-@@ -972,6 +972,17 @@ static void start_copy(struct dm_snap_pending_exception *pe)
- 		    &src, 1, &dest, 0, copy_callback, pe);
- }
- 
-+static struct dm_snap_pending_exception *
-+__lookup_pending_exception(struct dm_snapshot *s, chunk_t chunk)
-+{
-+	struct dm_snap_exception *e = lookup_exception(&s->pending, chunk);
-+
-+	if (!e)
-+		return NULL;
-+
-+	return container_of(e, struct dm_snap_pending_exception, e);
-+}
-+
- /*
-  * Looks to see if this snapshot already has a pending exception
-  * for this chunk, otherwise it allocates a new one and inserts
-@@ -981,40 +992,15 @@ static void start_copy(struct dm_snap_pending_exception *pe)
-  * this.
-  */
- static struct dm_snap_pending_exception *
--__find_pending_exception(struct dm_snapshot *s, struct bio *bio)
-+__find_pending_exception(struct dm_snapshot *s,
-+			 struct dm_snap_pending_exception *pe, chunk_t chunk)
- {
--	struct dm_snap_exception *e;
--	struct dm_snap_pending_exception *pe;
--	chunk_t chunk = sector_to_chunk(s, bio->bi_sector);
--
--	/*
--	 * Is there a pending exception for this already ?
--	 */
--	e = lookup_exception(&s->pending, chunk);
--	if (e) {
--		/* cast the exception to a pending exception */
--		pe = container_of(e, struct dm_snap_pending_exception, e);
--		goto out;
--	}
--
--	/*
--	 * Create a new pending exception, we don't want
--	 * to hold the lock while we do this.
--	 */
--	up_write(&s->lock);
--	pe = alloc_pending_exception(s);
--	down_write(&s->lock);
--
--	if (!s->valid) {
--		free_pending_exception(pe);
--		return NULL;
--	}
-+	struct dm_snap_pending_exception *pe2;
- 
--	e = lookup_exception(&s->pending, chunk);
--	if (e) {
-+	pe2 = __lookup_pending_exception(s, chunk);
-+	if (pe2) {
- 		free_pending_exception(pe);
--		pe = container_of(e, struct dm_snap_pending_exception, e);
--		goto out;
-+		return pe2;
- 	}
- 
- 	pe->e.old_chunk = chunk;
-@@ -1032,7 +1018,6 @@ __find_pending_exception(struct dm_snapshot *s, struct bio *bio)
- 	get_pending_exception(pe);
- 	insert_exception(&s->pending, &pe->e);
- 
-- out:
- 	return pe;
- }
- 
-@@ -1083,11 +1068,31 @@ static int snapshot_map(struct dm_target *ti, struct bio *bio,
- 	 * writeable.
- 	 */
- 	if (bio_rw(bio) == WRITE) {
--		pe = __find_pending_exception(s, bio);
-+		pe = __lookup_pending_exception(s, chunk);
- 		if (!pe) {
--			__invalidate_snapshot(s, -ENOMEM);
--			r = -EIO;
--			goto out_unlock;
-+			up_write(&s->lock);
-+			pe = alloc_pending_exception(s);
-+			down_write(&s->lock);
-+
-+			if (!s->valid) {
-+				free_pending_exception(pe);
-+				r = -EIO;
-+				goto out_unlock;
-+			}
-+
-+			e = lookup_exception(&s->complete, chunk);
-+			if (e) {
-+				free_pending_exception(pe);
-+				remap_exception(s, e, bio, chunk);
-+				goto out_unlock;
-+			}
-+
-+			pe = __find_pending_exception(s, pe, chunk);
-+			if (!pe) {
-+				__invalidate_snapshot(s, -ENOMEM);
-+				r = -EIO;
-+				goto out_unlock;
-+			}
- 		}
- 
- 		remap_exception(s, &pe->e, bio, chunk);
-@@ -1217,10 +1222,28 @@ static int __origin_write(struct list_head *snapshots, struct bio *bio)
- 		if (e)
- 			goto next_snapshot;
- 
--		pe = __find_pending_exception(snap, bio);
-+		pe = __lookup_pending_exception(snap, chunk);
- 		if (!pe) {
--			__invalidate_snapshot(snap, -ENOMEM);
--			goto next_snapshot;
-+			up_write(&snap->lock);
-+			pe = alloc_pending_exception(snap);
-+			down_write(&snap->lock);
-+
-+			if (!snap->valid) {
-+				free_pending_exception(pe);
-+				goto next_snapshot;
-+			}
-+
-+			e = lookup_exception(&snap->complete, chunk);
-+			if (e) {
-+				free_pending_exception(pe);
-+				goto next_snapshot;
-+			}
-+
-+			pe = __find_pending_exception(snap, pe, chunk);
-+			if (!pe) {
-+				__invalidate_snapshot(snap, -ENOMEM);
-+				goto next_snapshot;
-+			}
- 		}
- 
- 		if (!primary_pe) {
-diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
-index 2fd66c3..e8361b1 100644
---- a/drivers/md/dm-table.c
-+++ b/drivers/md/dm-table.c
-@@ -399,28 +399,30 @@ static int check_device_area(struct dm_dev_internal *dd, sector_t start,
- }
- 
- /*
-- * This upgrades the mode on an already open dm_dev.  Being
-+ * This upgrades the mode on an already open dm_dev, being
-  * careful to leave things as they were if we fail to reopen the
-- * device.
-+ * device and not to touch the existing bdev field in case
-+ * it is accessed concurrently inside dm_table_any_congested().
-  */
- static int upgrade_mode(struct dm_dev_internal *dd, fmode_t new_mode,
- 			struct mapped_device *md)
- {
- 	int r;
--	struct dm_dev_internal dd_copy;
--	dev_t dev = dd->dm_dev.bdev->bd_dev;
-+	struct dm_dev_internal dd_new, dd_old;
- 
--	dd_copy = *dd;
-+	dd_new = dd_old = *dd;
-+
-+	dd_new.dm_dev.mode |= new_mode;
-+	dd_new.dm_dev.bdev = NULL;
-+
-+	r = open_dev(&dd_new, dd->dm_dev.bdev->bd_dev, md);
-+	if (r)
-+		return r;
- 
- 	dd->dm_dev.mode |= new_mode;
--	dd->dm_dev.bdev = NULL;
--	r = open_dev(dd, dev, md);
--	if (!r)
--		close_dev(&dd_copy, md);
--	else
--		*dd = dd_copy;
-+	close_dev(&dd_old, md);
- 
--	return r;
-+	return 0;
- }
- 
- /*
-diff --git a/drivers/md/dm-target.c b/drivers/md/dm-target.c
-index 7decf10..db72c94 100644
---- a/drivers/md/dm-target.c
-+++ b/drivers/md/dm-target.c
-@@ -18,7 +18,6 @@ struct tt_internal {
- 	struct target_type tt;
- 
- 	struct list_head list;
--	long use;
- };
- 
- static LIST_HEAD(_targets);
-@@ -44,12 +43,8 @@ static struct tt_internal *get_target_type(const char *name)
- 	down_read(&_lock);
- 
- 	ti = __find_target_type(name);
--	if (ti) {
--		if ((ti->use == 0) && !try_module_get(ti->tt.module))
--			ti = NULL;
--		else
--			ti->use++;
--	}
-+	if (ti && !try_module_get(ti->tt.module))
-+		ti = NULL;
- 
- 	up_read(&_lock);
- 	return ti;
-@@ -77,10 +72,7 @@ void dm_put_target_type(struct target_type *t)
- 	struct tt_internal *ti = (struct tt_internal *) t;
- 
- 	down_read(&_lock);
--	if (--ti->use == 0)
--		module_put(ti->tt.module);
--
--	BUG_ON(ti->use < 0);
-+	module_put(ti->tt.module);
- 	up_read(&_lock);
- 
- 	return;
-@@ -140,12 +132,6 @@ void dm_unregister_target(struct target_type *t)
- 		BUG();
- 	}
- 
--	if (ti->use) {
--		DMCRIT("Attempt to unregister target still in use: %s",
--		       t->name);
--		BUG();
--	}
--
- 	list_del(&ti->list);
- 	kfree(ti);
- 
-diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
-index e246642..4a25fa9 100644
---- a/drivers/md/raid1.c
-+++ b/drivers/md/raid1.c
-@@ -120,6 +120,7 @@ static void * r1buf_pool_alloc(gfp_t gfp_flags, void *data)
- 				goto out_free_pages;
- 
- 			bio->bi_io_vec[i].bv_page = page;
-+			bio->bi_vcnt = i+1;
- 		}
- 	}
- 	/* If not user-requests, copy the page pointers to all bios */
-@@ -135,9 +136,9 @@ static void * r1buf_pool_alloc(gfp_t gfp_flags, void *data)
- 	return r1_bio;
- 
- out_free_pages:
--	for (i=0; i < RESYNC_PAGES ; i++)
--		for (j=0 ; j < pi->raid_disks; j++)
--			safe_put_page(r1_bio->bios[j]->bi_io_vec[i].bv_page);
-+	for (j=0 ; j < pi->raid_disks; j++)
-+		for (i=0; i < r1_bio->bios[j]->bi_vcnt ; i++)
-+			put_page(r1_bio->bios[j]->bi_io_vec[i].bv_page);
- 	j = -1;
- out_free_bio:
- 	while ( ++j < pi->raid_disks )
-diff --git a/drivers/media/video/cx88/cx88-input.c b/drivers/media/video/cx88/cx88-input.c
-index 8683d10..5b107fa 100644
---- a/drivers/media/video/cx88/cx88-input.c
-+++ b/drivers/media/video/cx88/cx88-input.c
-@@ -48,8 +48,7 @@ struct cx88_IR {
- 
- 	/* poll external decoder */
- 	int polling;
--	struct work_struct work;
--	struct timer_list timer;
-+	struct delayed_work work;
- 	u32 gpio_addr;
- 	u32 last_gpio;
- 	u32 mask_keycode;
-@@ -143,27 +142,19 @@ static void cx88_ir_handle_key(struct cx88_IR *ir)
- 	}
- }
- 
--static void ir_timer(unsigned long data)
--{
--	struct cx88_IR *ir = (struct cx88_IR *)data;
--
--	schedule_work(&ir->work);
--}
--
- static void cx88_ir_work(struct work_struct *work)
- {
--	struct cx88_IR *ir = container_of(work, struct cx88_IR, work);
-+	struct cx88_IR *ir = container_of(work, struct cx88_IR, work.work);
- 
- 	cx88_ir_handle_key(ir);
--	mod_timer(&ir->timer, jiffies + msecs_to_jiffies(ir->polling));
-+	schedule_delayed_work(&ir->work, msecs_to_jiffies(ir->polling));
- }
- 
- void cx88_ir_start(struct cx88_core *core, struct cx88_IR *ir)
- {
- 	if (ir->polling) {
--		setup_timer(&ir->timer, ir_timer, (unsigned long)ir);
--		INIT_WORK(&ir->work, cx88_ir_work);
--		schedule_work(&ir->work);
-+		INIT_DELAYED_WORK(&ir->work, cx88_ir_work);
-+		schedule_delayed_work(&ir->work, 0);
- 	}
- 	if (ir->sampling) {
- 		core->pci_irqmask |= PCI_INT_IR_SMPINT;
-@@ -179,10 +170,8 @@ void cx88_ir_stop(struct cx88_core *core, struct cx88_IR *ir)
- 		core->pci_irqmask &= ~PCI_INT_IR_SMPINT;
- 	}
- 
--	if (ir->polling) {
--		del_timer_sync(&ir->timer);
--		flush_scheduled_work();
--	}
-+	if (ir->polling)
-+		cancel_delayed_work_sync(&ir->work);
- }
- 
- /* ---------------------------------------------------------------------- */
-diff --git a/drivers/message/fusion/mptbase.c b/drivers/message/fusion/mptbase.c
-index ea3aafb..6fc789e 100644
---- a/drivers/message/fusion/mptbase.c
-+++ b/drivers/message/fusion/mptbase.c
-@@ -5934,7 +5934,7 @@ mpt_config(MPT_ADAPTER *ioc, CONFIGPARMS *pCfg)
- 
- 	/* Initalize the timer
- 	 */
--	init_timer(&pCfg->timer);
-+	init_timer_on_stack(&pCfg->timer);
- 	pCfg->timer.data = (unsigned long) ioc;
- 	pCfg->timer.function = mpt_timer_expired;
- 	pCfg->wait_done = 0;
-diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
-index 3d76686..87045f8 100644
---- a/drivers/net/bonding/bond_main.c
-+++ b/drivers/net/bonding/bond_main.c
-@@ -2565,7 +2565,7 @@ static void bond_arp_send_all(struct bonding *bond, struct slave *slave)
- 
- 	for (i = 0; (i < BOND_MAX_ARP_TARGETS); i++) {
- 		if (!targets[i])
--			continue;
-+			break;
- 		pr_debug("basa: target %x\n", targets[i]);
- 		if (list_empty(&bond->vlan_list)) {
- 			pr_debug("basa: empty vlan: arp_send\n");
-@@ -2672,7 +2672,6 @@ static void bond_validate_arp(struct bonding *bond, struct slave *slave, __be32
- 	int i;
- 	__be32 *targets = bond->params.arp_targets;
- 
--	targets = bond->params.arp_targets;
- 	for (i = 0; (i < BOND_MAX_ARP_TARGETS) && targets[i]; i++) {
- 		pr_debug("bva: sip %pI4 tip %pI4 t[%d] %pI4 bhti(tip) %d\n",
- 			&sip, &tip, i, &targets[i], bond_has_this_ip(bond, tip));
-@@ -3294,7 +3293,7 @@ static void bond_info_show_master(struct seq_file *seq)
- 
- 		for(i = 0; (i < BOND_MAX_ARP_TARGETS) ;i++) {
- 			if (!bond->params.arp_targets[i])
--				continue;
-+				break;
- 			if (printed)
- 				seq_printf(seq, ",");
- 			seq_printf(seq, " %pI4", &bond->params.arp_targets[i]);
-diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
-index 18cf478..d287315 100644
---- a/drivers/net/bonding/bond_sysfs.c
-+++ b/drivers/net/bonding/bond_sysfs.c
-@@ -684,17 +684,15 @@ static ssize_t bonding_store_arp_targets(struct device *d,
- 			goto out;
- 		}
- 		/* look for an empty slot to put the target in, and check for dupes */
--		for (i = 0; (i < BOND_MAX_ARP_TARGETS); i++) {
-+		for (i = 0; (i < BOND_MAX_ARP_TARGETS) && !done; i++) {
- 			if (targets[i] == newtarget) { /* duplicate */
- 				printk(KERN_ERR DRV_NAME
- 				       ": %s: ARP target %pI4 is already present\n",
- 				       bond->dev->name, &newtarget);
--				if (done)
--					targets[i] = 0;
- 				ret = -EINVAL;
- 				goto out;
- 			}
--			if (targets[i] == 0 && !done) {
-+			if (targets[i] == 0) {
- 				printk(KERN_INFO DRV_NAME
- 				       ": %s: adding ARP target %pI4.\n",
- 				       bond->dev->name, &newtarget);
-@@ -720,12 +718,16 @@ static ssize_t bonding_store_arp_targets(struct device *d,
- 			goto out;
- 		}
- 
--		for (i = 0; (i < BOND_MAX_ARP_TARGETS); i++) {
-+		for (i = 0; (i < BOND_MAX_ARP_TARGETS) && !done; i++) {
- 			if (targets[i] == newtarget) {
-+				int j;
- 				printk(KERN_INFO DRV_NAME
- 				       ": %s: removing ARP target %pI4.\n",
- 				       bond->dev->name, &newtarget);
--				targets[i] = 0;
-+				for (j = i; (j < (BOND_MAX_ARP_TARGETS-1)) && targets[j+1]; j++)
-+					targets[j] = targets[j+1];
-+
-+				targets[j] = 0;
- 				done = 1;
- 			}
- 		}
-diff --git a/drivers/net/ixgbe/ixgbe_ethtool.c b/drivers/net/ixgbe/ixgbe_ethtool.c
-index 67f87a7..090ada6 100644
---- a/drivers/net/ixgbe/ixgbe_ethtool.c
-+++ b/drivers/net/ixgbe/ixgbe_ethtool.c
-@@ -691,9 +691,10 @@ static int ixgbe_set_ringparam(struct net_device *netdev,
-                                struct ethtool_ringparam *ring)
- {
- 	struct ixgbe_adapter *adapter = netdev_priv(netdev);
--	struct ixgbe_ring *temp_ring;
-+	struct ixgbe_ring *temp_tx_ring, *temp_rx_ring;
- 	int i, err;
- 	u32 new_rx_count, new_tx_count;
-+	bool need_update = false;
- 
- 	if ((ring->rx_mini_pending) || (ring->rx_jumbo_pending))
- 		return -EINVAL;
-@@ -712,80 +713,94 @@ static int ixgbe_set_ringparam(struct net_device *netdev,
- 		return 0;
- 	}
- 
--	temp_ring = kcalloc(adapter->num_tx_queues,
--	                    sizeof(struct ixgbe_ring), GFP_KERNEL);
--	if (!temp_ring)
--		return -ENOMEM;
--
- 	while (test_and_set_bit(__IXGBE_RESETTING, &adapter->state))
- 		msleep(1);
- 
--	if (new_tx_count != adapter->tx_ring->count) {
-+	temp_tx_ring = kcalloc(adapter->num_tx_queues,
-+	                       sizeof(struct ixgbe_ring), GFP_KERNEL);
-+	if (!temp_tx_ring) {
-+		err = -ENOMEM;
-+		goto err_setup;
-+	}
-+
-+	if (new_tx_count != adapter->tx_ring_count) {
-+		memcpy(temp_tx_ring, adapter->tx_ring,
-+		       adapter->num_tx_queues * sizeof(struct ixgbe_ring));
- 		for (i = 0; i < adapter->num_tx_queues; i++) {
--			temp_ring[i].count = new_tx_count;
--			err = ixgbe_setup_tx_resources(adapter, &temp_ring[i]);
-+			temp_tx_ring[i].count = new_tx_count;
-+			err = ixgbe_setup_tx_resources(adapter,
-+			                               &temp_tx_ring[i]);
- 			if (err) {
- 				while (i) {
- 					i--;
- 					ixgbe_free_tx_resources(adapter,
--					                        &temp_ring[i]);
-+					                        &temp_tx_ring[i]);
- 				}
- 				goto err_setup;
- 			}
--			temp_ring[i].v_idx = adapter->tx_ring[i].v_idx;
-+			temp_tx_ring[i].v_idx = adapter->tx_ring[i].v_idx;
- 		}
--		if (netif_running(netdev))
--			netdev->netdev_ops->ndo_stop(netdev);
--		ixgbe_reset_interrupt_capability(adapter);
--		ixgbe_napi_del_all(adapter);
--		INIT_LIST_HEAD(&netdev->napi_list);
--		kfree(adapter->tx_ring);
--		adapter->tx_ring = temp_ring;
--		temp_ring = NULL;
--		adapter->tx_ring_count = new_tx_count;
-+		need_update = true;
- 	}
- 
--	temp_ring = kcalloc(adapter->num_rx_queues,
--	                    sizeof(struct ixgbe_ring), GFP_KERNEL);
--	if (!temp_ring) {
--		if (netif_running(netdev))
--			netdev->netdev_ops->ndo_open(netdev);
--		return -ENOMEM;
-+	temp_rx_ring = kcalloc(adapter->num_rx_queues,
-+	                       sizeof(struct ixgbe_ring), GFP_KERNEL);
-+	if ((!temp_rx_ring) && (need_update)) {
-+		for (i = 0; i < adapter->num_tx_queues; i++)
-+			ixgbe_free_tx_resources(adapter, &temp_tx_ring[i]);
-+		kfree(temp_tx_ring);
-+		err = -ENOMEM;
-+		goto err_setup;
- 	}
- 
--	if (new_rx_count != adapter->rx_ring->count) {
-+	if (new_rx_count != adapter->rx_ring_count) {
-+		memcpy(temp_rx_ring, adapter->rx_ring,
-+		       adapter->num_rx_queues * sizeof(struct ixgbe_ring));
- 		for (i = 0; i < adapter->num_rx_queues; i++) {
--			temp_ring[i].count = new_rx_count;
--			err = ixgbe_setup_rx_resources(adapter, &temp_ring[i]);
-+			temp_rx_ring[i].count = new_rx_count;
-+			err = ixgbe_setup_rx_resources(adapter,
-+			                               &temp_rx_ring[i]);
- 			if (err) {
- 				while (i) {
- 					i--;
- 					ixgbe_free_rx_resources(adapter,
--					                        &temp_ring[i]);
-+					                      &temp_rx_ring[i]);
- 				}
- 				goto err_setup;
- 			}
--			temp_ring[i].v_idx = adapter->rx_ring[i].v_idx;
-+			temp_rx_ring[i].v_idx = adapter->rx_ring[i].v_idx;
- 		}
-+		need_update = true;
-+	}
-+
-+	/* if rings need to be updated, here's the place to do it in one shot */
-+	if (need_update) {
- 		if (netif_running(netdev))
--			netdev->netdev_ops->ndo_stop(netdev);
--		ixgbe_reset_interrupt_capability(adapter);
--		ixgbe_napi_del_all(adapter);
--		INIT_LIST_HEAD(&netdev->napi_list);
--		kfree(adapter->rx_ring);
--		adapter->rx_ring = temp_ring;
--		temp_ring = NULL;
--
--		adapter->rx_ring_count = new_rx_count;
-+			ixgbe_down(adapter);
-+
-+		/* tx */
-+		if (new_tx_count != adapter->tx_ring_count) {
-+			kfree(adapter->tx_ring);
-+			adapter->tx_ring = temp_tx_ring;
-+			temp_tx_ring = NULL;
-+			adapter->tx_ring_count = new_tx_count;
-+		}
-+
-+		/* rx */
-+		if (new_rx_count != adapter->rx_ring_count) {
-+			kfree(adapter->rx_ring);
-+			adapter->rx_ring = temp_rx_ring;
-+			temp_rx_ring = NULL;
-+			adapter->rx_ring_count = new_rx_count;
-+		}
- 	}
- 
- 	/* success! */
- 	err = 0;
--err_setup:
--	ixgbe_init_interrupt_scheme(adapter);
- 	if (netif_running(netdev))
--		netdev->netdev_ops->ndo_open(netdev);
-+		ixgbe_up(adapter);
- 
-+err_setup:
- 	clear_bit(__IXGBE_RESETTING, &adapter->state);
- 	return err;
- }
-diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
-index 43fedb9..9201e5a 100644
---- a/drivers/net/r8169.c
-+++ b/drivers/net/r8169.c
-@@ -2075,8 +2075,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
- 	if (!tp->pcie_cap && netif_msg_probe(tp))
- 		dev_info(&pdev->dev, "no PCI Express capability\n");
- 
--	/* Unneeded ? Don't mess with Mrs. Murphy. */
--	rtl8169_irq_mask_and_ack(ioaddr);
-+	RTL_W16(IntrMask, 0x0000);
- 
- 	/* Soft reset the chip. */
- 	RTL_W8(ChipCmd, CmdReset);
-@@ -2088,6 +2087,8 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
- 		msleep_interruptible(1);
- 	}
- 
-+	RTL_W16(IntrStatus, 0xffff);
-+
- 	/* Identify chip attached to board */
- 	rtl8169_get_mac_version(tp, ioaddr);
- 
-diff --git a/drivers/net/sfc/efx.c b/drivers/net/sfc/efx.c
-index ab0e09b..655e9b2 100644
---- a/drivers/net/sfc/efx.c
-+++ b/drivers/net/sfc/efx.c
-@@ -424,10 +424,6 @@ static void efx_start_channel(struct efx_channel *channel)
- 
- 	EFX_LOG(channel->efx, "starting chan %d\n", channel->channel);
- 
--	if (!(channel->efx->net_dev->flags & IFF_UP))
--		netif_napi_add(channel->napi_dev, &channel->napi_str,
--			       efx_poll, napi_weight);
--
- 	/* The interrupt handler for this channel may set work_pending
- 	 * as soon as we enable it.  Make sure it's cleared before
- 	 * then.  Similarly, make sure it sees the enabled flag set. */
-@@ -1273,6 +1269,8 @@ static int efx_init_napi(struct efx_nic *efx)
- 
- 	efx_for_each_channel(channel, efx) {
- 		channel->napi_dev = efx->net_dev;
-+		netif_napi_add(channel->napi_dev, &channel->napi_str,
-+			       efx_poll, napi_weight);
- 		rc = efx_lro_init(&channel->lro_mgr, efx);
- 		if (rc)
- 			goto err;
-@@ -1289,6 +1287,8 @@ static void efx_fini_napi(struct efx_nic *efx)
- 
- 	efx_for_each_channel(channel, efx) {
- 		efx_lro_fini(&channel->lro_mgr);
-+		if (channel->napi_dev)
-+			netif_napi_del(&channel->napi_str);
- 		channel->napi_dev = NULL;
- 	}
- }
-diff --git a/drivers/net/skge.c b/drivers/net/skge.c
-index c9dbb06..2bbb44b 100644
---- a/drivers/net/skge.c
-+++ b/drivers/net/skge.c
-@@ -2674,7 +2674,7 @@ static int skge_down(struct net_device *dev)
- 	if (netif_msg_ifdown(skge))
- 		printk(KERN_INFO PFX "%s: disabling interface\n", dev->name);
- 
--	netif_stop_queue(dev);
-+	netif_tx_disable(dev);
- 
- 	if (hw->chip_id == CHIP_ID_GENESIS && hw->phy_type == SK_PHY_XMAC)
- 		del_timer_sync(&skge->link_timer);
-@@ -2881,7 +2881,6 @@ static void skge_tx_clean(struct net_device *dev)
- 	}
- 
- 	skge->tx_ring.to_clean = e;
--	netif_wake_queue(dev);
- }
- 
- static void skge_tx_timeout(struct net_device *dev)
-@@ -2893,6 +2892,7 @@ static void skge_tx_timeout(struct net_device *dev)
- 
- 	skge_write8(skge->hw, Q_ADDR(txqaddr[skge->port], Q_CSR), CSR_STOP);
- 	skge_tx_clean(dev);
-+	netif_wake_queue(dev);
- }
- 
- static int skge_change_mtu(struct net_device *dev, int new_mtu)
-diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
-index 39ecf3b..820fdb2 100644
---- a/drivers/net/wireless/rt2x00/rt2x00.h
-+++ b/drivers/net/wireless/rt2x00/rt2x00.h
-@@ -687,8 +687,7 @@ struct rt2x00_dev {
- 	 */
- #ifdef CONFIG_RT2X00_LIB_RFKILL
- 	unsigned long rfkill_state;
--#define RFKILL_STATE_ALLOCATED		1
--#define RFKILL_STATE_REGISTERED		2
-+#define RFKILL_STATE_REGISTERED		1
- 	struct rfkill *rfkill;
- 	struct delayed_work rfkill_work;
- #endif /* CONFIG_RT2X00_LIB_RFKILL */
-diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
-index 87c0f2c..e694bb7 100644
---- a/drivers/net/wireless/rt2x00/rt2x00dev.c
-+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
-@@ -1105,7 +1105,6 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
- 	 * Register extra components.
- 	 */
- 	rt2x00leds_register(rt2x00dev);
--	rt2x00rfkill_allocate(rt2x00dev);
- 	rt2x00debug_register(rt2x00dev);
- 
- 	set_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
-@@ -1137,7 +1136,6 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
- 	 * Free extra components
- 	 */
- 	rt2x00debug_deregister(rt2x00dev);
--	rt2x00rfkill_free(rt2x00dev);
- 	rt2x00leds_unregister(rt2x00dev);
- 
- 	/*
-diff --git a/drivers/net/wireless/rt2x00/rt2x00lib.h b/drivers/net/wireless/rt2x00/rt2x00lib.h
-index 86cd26f..49309d4 100644
---- a/drivers/net/wireless/rt2x00/rt2x00lib.h
-+++ b/drivers/net/wireless/rt2x00/rt2x00lib.h
-@@ -260,8 +260,6 @@ static inline void rt2x00crypto_rx_insert_iv(struct sk_buff *skb,
- #ifdef CONFIG_RT2X00_LIB_RFKILL
- void rt2x00rfkill_register(struct rt2x00_dev *rt2x00dev);
- void rt2x00rfkill_unregister(struct rt2x00_dev *rt2x00dev);
--void rt2x00rfkill_allocate(struct rt2x00_dev *rt2x00dev);
--void rt2x00rfkill_free(struct rt2x00_dev *rt2x00dev);
- #else
- static inline void rt2x00rfkill_register(struct rt2x00_dev *rt2x00dev)
- {
-@@ -270,14 +268,6 @@ static inline void rt2x00rfkill_register(struct rt2x00_dev *rt2x00dev)
- static inline void rt2x00rfkill_unregister(struct rt2x00_dev *rt2x00dev)
- {
- }
--
--static inline void rt2x00rfkill_allocate(struct rt2x00_dev *rt2x00dev)
--{
--}
--
--static inline void rt2x00rfkill_free(struct rt2x00_dev *rt2x00dev)
--{
--}
- #endif /* CONFIG_RT2X00_LIB_RFKILL */
- 
- /*
-diff --git a/drivers/net/wireless/rt2x00/rt2x00rfkill.c b/drivers/net/wireless/rt2x00/rt2x00rfkill.c
-index 3298cae..08ffc6d 100644
---- a/drivers/net/wireless/rt2x00/rt2x00rfkill.c
-+++ b/drivers/net/wireless/rt2x00/rt2x00rfkill.c
-@@ -94,14 +94,50 @@ static void rt2x00rfkill_poll(struct work_struct *work)
- 			   &rt2x00dev->rfkill_work, RFKILL_POLL_INTERVAL);
- }
- 
-+static int rt2x00rfkill_allocate(struct rt2x00_dev *rt2x00dev)
-+{
-+	struct device *dev = wiphy_dev(rt2x00dev->hw->wiphy);
-+
-+	rt2x00dev->rfkill = rfkill_allocate(dev, RFKILL_TYPE_WLAN);
-+	if (!rt2x00dev->rfkill)
-+		return -ENOMEM;
-+
-+	rt2x00dev->rfkill->name = rt2x00dev->ops->name;
-+	rt2x00dev->rfkill->data = rt2x00dev;
-+	rt2x00dev->rfkill->toggle_radio = rt2x00rfkill_toggle_radio;
-+	if (test_bit(CONFIG_SUPPORT_HW_BUTTON, &rt2x00dev->flags)) {
-+		rt2x00dev->rfkill->get_state = rt2x00rfkill_get_state;
-+		rt2x00dev->rfkill->state =
-+			rt2x00dev->ops->lib->rfkill_poll(rt2x00dev) ?
-+			    RFKILL_STATE_SOFT_BLOCKED : RFKILL_STATE_UNBLOCKED;
-+	} else {
-+		rt2x00dev->rfkill->state = RFKILL_STATE_UNBLOCKED;
-+	}
-+
-+	INIT_DELAYED_WORK(&rt2x00dev->rfkill_work, rt2x00rfkill_poll);
-+
-+	return 0;
-+}
-+
-+static void rt2x00rfkill_free(struct rt2x00_dev *rt2x00dev)
-+{
-+	rfkill_free(rt2x00dev->rfkill);
-+	rt2x00dev->rfkill = NULL;
-+}
-+
- void rt2x00rfkill_register(struct rt2x00_dev *rt2x00dev)
- {
--	if (!test_bit(RFKILL_STATE_ALLOCATED, &rt2x00dev->rfkill_state) ||
--	    test_bit(RFKILL_STATE_REGISTERED, &rt2x00dev->rfkill_state))
-+	if (test_bit(RFKILL_STATE_REGISTERED, &rt2x00dev->rfkill_state))
-+		return;
-+
-+	if (rt2x00rfkill_allocate(rt2x00dev)) {
-+		ERROR(rt2x00dev, "Failed to allocate rfkill handler.\n");
- 		return;
-+	}
- 
- 	if (rfkill_register(rt2x00dev->rfkill)) {
- 		ERROR(rt2x00dev, "Failed to register rfkill handler.\n");
-+		rt2x00rfkill_free(rt2x00dev);
- 		return;
- 	}
- 
-@@ -117,8 +153,7 @@ void rt2x00rfkill_register(struct rt2x00_dev *rt2x00dev)
- 
- void rt2x00rfkill_unregister(struct rt2x00_dev *rt2x00dev)
- {
--	if (!test_bit(RFKILL_STATE_ALLOCATED, &rt2x00dev->rfkill_state) ||
--	    !test_bit(RFKILL_STATE_REGISTERED, &rt2x00dev->rfkill_state))
-+	if (!test_bit(RFKILL_STATE_REGISTERED, &rt2x00dev->rfkill_state))
- 		return;
- 
- 	cancel_delayed_work_sync(&rt2x00dev->rfkill_work);
-@@ -127,46 +162,3 @@ void rt2x00rfkill_unregister(struct rt2x00_dev *rt2x00dev)
- 
- 	__clear_bit(RFKILL_STATE_REGISTERED, &rt2x00dev->rfkill_state);
- }
--
--void rt2x00rfkill_allocate(struct rt2x00_dev *rt2x00dev)
--{
--	struct device *dev = wiphy_dev(rt2x00dev->hw->wiphy);
--
--	if (test_bit(RFKILL_STATE_ALLOCATED, &rt2x00dev->rfkill_state))
--		return;
--
--	rt2x00dev->rfkill = rfkill_allocate(dev, RFKILL_TYPE_WLAN);
--	if (!rt2x00dev->rfkill) {
--		ERROR(rt2x00dev, "Failed to allocate rfkill handler.\n");
--		return;
--	}
--
--	__set_bit(RFKILL_STATE_ALLOCATED, &rt2x00dev->rfkill_state);
--
--	rt2x00dev->rfkill->name = rt2x00dev->ops->name;
--	rt2x00dev->rfkill->data = rt2x00dev;
--	rt2x00dev->rfkill->toggle_radio = rt2x00rfkill_toggle_radio;
--	if (test_bit(CONFIG_SUPPORT_HW_BUTTON, &rt2x00dev->flags)) {
--		rt2x00dev->rfkill->get_state = rt2x00rfkill_get_state;
--		rt2x00dev->rfkill->state =
--			rt2x00dev->ops->lib->rfkill_poll(rt2x00dev) ?
--			    RFKILL_STATE_SOFT_BLOCKED : RFKILL_STATE_UNBLOCKED;
--	} else {
--		rt2x00dev->rfkill->state = RFKILL_STATE_UNBLOCKED;
--	}
--
--	INIT_DELAYED_WORK(&rt2x00dev->rfkill_work, rt2x00rfkill_poll);
--
--	return;
--}
--
--void rt2x00rfkill_free(struct rt2x00_dev *rt2x00dev)
--{
--	if (!test_bit(RFKILL_STATE_ALLOCATED, &rt2x00dev->rfkill_state))
--		return;
--
--	cancel_delayed_work_sync(&rt2x00dev->rfkill_work);
--
--	rfkill_free(rt2x00dev->rfkill);
--	rt2x00dev->rfkill = NULL;
--}
-diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
-index 55ec44a..31cfd86 100644
---- a/drivers/pci/probe.c
-+++ b/drivers/pci/probe.c
-@@ -847,6 +847,11 @@ int pci_cfg_space_size(struct pci_dev *dev)
- {
- 	int pos;
- 	u32 status;
-+	u16 class;
-+
-+	class = dev->class >> 8;
-+	if (class == PCI_CLASS_BRIDGE_HOST)
-+		return pci_cfg_space_size_ext(dev);
- 
- 	pos = pci_find_capability(dev, PCI_CAP_ID_EXP);
- 	if (!pos) {
-@@ -936,7 +941,6 @@ static struct pci_dev *pci_scan_device(struct pci_bus *bus, int devfn)
- 	dev->multifunction = !!(hdr_type & 0x80);
- 	dev->vendor = l & 0xffff;
- 	dev->device = (l >> 16) & 0xffff;
--	dev->cfg_size = pci_cfg_space_size(dev);
- 	dev->error_state = pci_channel_io_normal;
- 	set_pcie_port_type(dev);
- 
-@@ -952,6 +956,9 @@ static struct pci_dev *pci_scan_device(struct pci_bus *bus, int devfn)
- 		return NULL;
- 	}
- 
-+	/* need to have dev->class ready */
-+	dev->cfg_size = pci_cfg_space_size(dev);
-+
- 	return dev;
- }
- 
-diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
-index a6a42e8..60fbef2 100644
---- a/drivers/platform/x86/acer-wmi.c
-+++ b/drivers/platform/x86/acer-wmi.c
-@@ -225,6 +225,25 @@ static struct quirk_entry quirk_fujitsu_amilo_li_1718 = {
- 	.wireless = 2,
- };
- 
-+/* The Aspire One has a dummy ACPI-WMI interface - disable it */
-+static struct dmi_system_id __devinitdata acer_blacklist[] = {
-+	{
-+		.ident = "Acer Aspire One (SSD)",
-+		.matches = {
-+			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
-+			DMI_MATCH(DMI_PRODUCT_NAME, "AOA110"),
-+		},
-+	},
-+	{
-+		.ident = "Acer Aspire One (HDD)",
-+		.matches = {
-+			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
-+			DMI_MATCH(DMI_PRODUCT_NAME, "AOA150"),
-+		},
-+	},
-+	{}
-+};
-+
- static struct dmi_system_id acer_quirks[] = {
- 	{
- 		.callback = dmi_matched,
-@@ -1254,6 +1273,12 @@ static int __init acer_wmi_init(void)
- 
- 	printk(ACER_INFO "Acer Laptop ACPI-WMI Extras\n");
- 
-+	if (dmi_check_system(acer_blacklist)) {
-+		printk(ACER_INFO "Blacklisted hardware detected - "
-+				"not loading\n");
-+		return -ENODEV;
-+	}
-+
- 	find_quirks();
- 
- 	/*
-diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
-index 809d32d..ca4467c 100644
---- a/drivers/scsi/libiscsi.c
-+++ b/drivers/scsi/libiscsi.c
-@@ -1944,12 +1944,14 @@ iscsi_pool_init(struct iscsi_pool *q, int max, void ***items, int item_size)
- 		num_arrays++;
- 	q->pool = kzalloc(num_arrays * max * sizeof(void*), GFP_KERNEL);
- 	if (q->pool == NULL)
--		goto enomem;
-+		return -ENOMEM;
- 
- 	q->queue = kfifo_init((void*)q->pool, max * sizeof(void*),
- 			      GFP_KERNEL, NULL);
--	if (q->queue == ERR_PTR(-ENOMEM))
-+	if (IS_ERR(q->queue)) {
-+		q->queue = NULL;
- 		goto enomem;
-+	}
- 
- 	for (i = 0; i < max; i++) {
- 		q->pool[i] = kzalloc(item_size, GFP_KERNEL);
-@@ -1979,8 +1981,7 @@ void iscsi_pool_free(struct iscsi_pool *q)
- 
- 	for (i = 0; i < q->max; i++)
- 		kfree(q->pool[i]);
--	if (q->pool)
--		kfree(q->pool);
-+	kfree(q->pool);
- 	kfree(q->queue);
- }
- EXPORT_SYMBOL_GPL(iscsi_pool_free);
-diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
-index 516925d..5e390d2 100644
---- a/drivers/scsi/sg.c
-+++ b/drivers/scsi/sg.c
-@@ -101,6 +101,7 @@ static int scatter_elem_sz_prev = SG_SCATTER_SZ;
- #define SG_SECTOR_MSK (SG_SECTOR_SZ - 1)
- 
- static int sg_add(struct device *, struct class_interface *);
-+static void sg_device_destroy(struct kref *kref);
- static void sg_remove(struct device *, struct class_interface *);
- 
- static DEFINE_IDR(sg_index_idr);
-@@ -137,6 +138,7 @@ typedef struct sg_request {	/* SG_MAX_QUEUE requests outstanding per file */
- 	volatile char done;	/* 0->before bh, 1->before read, 2->read */
- 	struct request *rq;
- 	struct bio *bio;
-+	struct execute_work ew;
- } Sg_request;
- 
- typedef struct sg_fd {		/* holds the state of a file descriptor */
-@@ -158,6 +160,8 @@ typedef struct sg_fd {		/* holds the state of a file descriptor */
- 	char next_cmd_len;	/* 0 -> automatic (def), >0 -> use on next write() */
- 	char keep_orphan;	/* 0 -> drop orphan (def), 1 -> keep for read() */
- 	char mmap_called;	/* 0 -> mmap() never called on this fd */
-+	struct kref f_ref;
-+	struct execute_work ew;
- } Sg_fd;
- 
- typedef struct sg_device { /* holds the state of each scsi generic device */
-@@ -171,6 +175,7 @@ typedef struct sg_device { /* holds the state of each scsi generic device */
- 	char sgdebug;		/* 0->off, 1->sense, 9->dump dev, 10-> all devs */
- 	struct gendisk *disk;
- 	struct cdev * cdev;	/* char_dev [sysfs: /sys/cdev/major/sg<n>] */
-+	struct kref d_ref;
- } Sg_device;
- 
- static int sg_fasync(int fd, struct file *filp, int mode);
-@@ -185,7 +190,7 @@ static ssize_t sg_new_read(Sg_fd * sfp, char __user *buf, size_t count,
- 			   Sg_request * srp);
- static ssize_t sg_new_write(Sg_fd *sfp, struct file *file,
- 			const char __user *buf, size_t count, int blocking,
--			int read_only, Sg_request **o_srp);
-+			int read_only, int sg_io_owned, Sg_request **o_srp);
- static int sg_common_write(Sg_fd * sfp, Sg_request * srp,
- 			   unsigned char *cmnd, int timeout, int blocking);
- static int sg_read_oxfer(Sg_request * srp, char __user *outp, int num_read_xfer);
-@@ -194,13 +199,14 @@ static void sg_build_reserve(Sg_fd * sfp, int req_size);
- static void sg_link_reserve(Sg_fd * sfp, Sg_request * srp, int size);
- static void sg_unlink_reserve(Sg_fd * sfp, Sg_request * srp);
- static Sg_fd *sg_add_sfp(Sg_device * sdp, int dev);
--static int sg_remove_sfp(Sg_device * sdp, Sg_fd * sfp);
--static void __sg_remove_sfp(Sg_device * sdp, Sg_fd * sfp);
-+static void sg_remove_sfp(struct kref *);
- static Sg_request *sg_get_rq_mark(Sg_fd * sfp, int pack_id);
- static Sg_request *sg_add_request(Sg_fd * sfp);
- static int sg_remove_request(Sg_fd * sfp, Sg_request * srp);
- static int sg_res_in_use(Sg_fd * sfp);
-+static Sg_device *sg_lookup_dev(int dev);
- static Sg_device *sg_get_dev(int dev);
-+static void sg_put_dev(Sg_device *sdp);
- #ifdef CONFIG_SCSI_PROC_FS
- static int sg_last_dev(void);
- #endif
-@@ -237,22 +243,17 @@ sg_open(struct inode *inode, struct file *filp)
- 	nonseekable_open(inode, filp);
- 	SCSI_LOG_TIMEOUT(3, printk("sg_open: dev=%d, flags=0x%x\n", dev, flags));
- 	sdp = sg_get_dev(dev);
--	if ((!sdp) || (!sdp->device)) {
--		unlock_kernel();
--		return -ENXIO;
--	}
--	if (sdp->detached) {
--		unlock_kernel();
--		return -ENODEV;
-+	if (IS_ERR(sdp)) {
-+		retval = PTR_ERR(sdp);
-+		sdp = NULL;
-+		goto sg_put;
- 	}
- 
- 	/* This driver's module count bumped by fops_get in <linux/fs.h> */
- 	/* Prevent the device driver from vanishing while we sleep */
- 	retval = scsi_device_get(sdp->device);
--	if (retval) {
--		unlock_kernel();
--		return retval;
--	}
-+	if (retval)
-+		goto sg_put;
- 
- 	if (!((flags & O_NONBLOCK) ||
- 	      scsi_block_when_processing_errors(sdp->device))) {
-@@ -303,16 +304,20 @@ sg_open(struct inode *inode, struct file *filp)
- 	if ((sfp = sg_add_sfp(sdp, dev)))
- 		filp->private_data = sfp;
- 	else {
--		if (flags & O_EXCL)
-+		if (flags & O_EXCL) {
- 			sdp->exclude = 0;	/* undo if error */
-+			wake_up_interruptible(&sdp->o_excl_wait);
-+		}
- 		retval = -ENOMEM;
- 		goto error_out;
- 	}
--	unlock_kernel();
--	return 0;
--
--      error_out:
--	scsi_device_put(sdp->device);
-+	retval = 0;
-+error_out:
-+	if (retval)
-+		scsi_device_put(sdp->device);
-+sg_put:
-+	if (sdp)
-+		sg_put_dev(sdp);
- 	unlock_kernel();
- 	return retval;
- }
-@@ -327,13 +332,13 @@ sg_release(struct inode *inode, struct file *filp)
- 	if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
- 		return -ENXIO;
- 	SCSI_LOG_TIMEOUT(3, printk("sg_release: %s\n", sdp->disk->disk_name));
--	if (0 == sg_remove_sfp(sdp, sfp)) {	/* Returns 1 when sdp gone */
--		if (!sdp->detached) {
--			scsi_device_put(sdp->device);
--		}
--		sdp->exclude = 0;
--		wake_up_interruptible(&sdp->o_excl_wait);
--	}
-+
-+	sfp->closed = 1;
-+
-+	sdp->exclude = 0;
-+	wake_up_interruptible(&sdp->o_excl_wait);
-+
-+	kref_put(&sfp->f_ref, sg_remove_sfp);
- 	return 0;
- }
- 
-@@ -557,7 +562,8 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos)
- 		return -EFAULT;
- 	blocking = !(filp->f_flags & O_NONBLOCK);
- 	if (old_hdr.reply_len < 0)
--		return sg_new_write(sfp, filp, buf, count, blocking, 0, NULL);
-+		return sg_new_write(sfp, filp, buf, count,
-+				    blocking, 0, 0, NULL);
- 	if (count < (SZ_SG_HEADER + 6))
- 		return -EIO;	/* The minimum scsi command length is 6 bytes. */
- 
-@@ -638,7 +644,7 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos)
- 
- static ssize_t
- sg_new_write(Sg_fd *sfp, struct file *file, const char __user *buf,
--		 size_t count, int blocking, int read_only,
-+		 size_t count, int blocking, int read_only, int sg_io_owned,
- 		 Sg_request **o_srp)
- {
- 	int k;
-@@ -658,6 +664,7 @@ sg_new_write(Sg_fd *sfp, struct file *file, const char __user *buf,
- 		SCSI_LOG_TIMEOUT(1, printk("sg_new_write: queue full\n"));
- 		return -EDOM;
- 	}
-+	srp->sg_io_owned = sg_io_owned;
- 	hp = &srp->header;
- 	if (__copy_from_user(hp, buf, SZ_SG_IO_HDR)) {
- 		sg_remove_request(sfp, srp);
-@@ -755,24 +762,13 @@ sg_common_write(Sg_fd * sfp, Sg_request * srp,
- 	hp->duration = jiffies_to_msecs(jiffies);
- 
- 	srp->rq->timeout = timeout;
-+	kref_get(&sfp->f_ref); /* sg_rq_end_io() does kref_put(). */
- 	blk_execute_rq_nowait(sdp->device->request_queue, sdp->disk,
- 			      srp->rq, 1, sg_rq_end_io);
- 	return 0;
- }
- 
- static int
--sg_srp_done(Sg_request *srp, Sg_fd *sfp)
--{
--	unsigned long iflags;
--	int done;
--
--	read_lock_irqsave(&sfp->rq_list_lock, iflags);
--	done = srp->done;
--	read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
--	return done;
--}
--
--static int
- sg_ioctl(struct inode *inode, struct file *filp,
- 	 unsigned int cmd_in, unsigned long arg)
- {
-@@ -804,27 +800,26 @@ sg_ioctl(struct inode *inode, struct file *filp,
- 				return -EFAULT;
- 			result =
- 			    sg_new_write(sfp, filp, p, SZ_SG_IO_HDR,
--					 blocking, read_only, &srp);
-+					 blocking, read_only, 1, &srp);
- 			if (result < 0)
- 				return result;
--			srp->sg_io_owned = 1;
- 			while (1) {
- 				result = 0;	/* following macro to beat race condition */
- 				__wait_event_interruptible(sfp->read_wait,
--					(sdp->detached || sfp->closed || sg_srp_done(srp, sfp)),
--							   result);
-+					(srp->done || sdp->detached),
-+					result);
- 				if (sdp->detached)
- 					return -ENODEV;
--				if (sfp->closed)
--					return 0;	/* request packet dropped already */
--				if (0 == result)
-+				write_lock_irq(&sfp->rq_list_lock);
-+				if (srp->done) {
-+					srp->done = 2;
-+					write_unlock_irq(&sfp->rq_list_lock);
- 					break;
-+				}
- 				srp->orphan = 1;
-+				write_unlock_irq(&sfp->rq_list_lock);
- 				return result;	/* -ERESTARTSYS because signal hit process */
- 			}
--			write_lock_irqsave(&sfp->rq_list_lock, iflags);
--			srp->done = 2;
--			write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
- 			result = sg_new_read(sfp, p, SZ_SG_IO_HDR, srp);
- 			return (result < 0) ? result : 0;
- 		}
-@@ -1240,6 +1235,15 @@ sg_mmap(struct file *filp, struct vm_area_struct *vma)
- 	return 0;
- }
- 
-+static void sg_rq_end_io_usercontext(struct work_struct *work)
-+{
-+	struct sg_request *srp = container_of(work, struct sg_request, ew.work);
-+	struct sg_fd *sfp = srp->parentfp;
-+
-+	sg_finish_rem_req(srp);
-+	kref_put(&sfp->f_ref, sg_remove_sfp);
-+}
-+
- /*
-  * This function is a "bottom half" handler that is called by the mid
-  * level when a command is completed (or has failed).
-@@ -1247,24 +1251,23 @@ sg_mmap(struct file *filp, struct vm_area_struct *vma)
- static void sg_rq_end_io(struct request *rq, int uptodate)
- {
- 	struct sg_request *srp = rq->end_io_data;
--	Sg_device *sdp = NULL;
-+	Sg_device *sdp;
- 	Sg_fd *sfp;
- 	unsigned long iflags;
- 	unsigned int ms;
- 	char *sense;
--	int result, resid;
-+	int result, resid, done = 1;
- 
--	if (NULL == srp) {
--		printk(KERN_ERR "sg_cmd_done: NULL request\n");
-+	if (WARN_ON(srp->done != 0))
- 		return;
--	}
-+
- 	sfp = srp->parentfp;
--	if (sfp)
--		sdp = sfp->parentdp;
--	if ((NULL == sdp) || sdp->detached) {
--		printk(KERN_INFO "sg_cmd_done: device detached\n");
-+	if (WARN_ON(sfp == NULL))
- 		return;
--	}
-+
-+	sdp = sfp->parentdp;
-+	if (unlikely(sdp->detached))
-+		printk(KERN_INFO "sg_rq_end_io: device detached\n");
- 
- 	sense = rq->sense;
- 	result = rq->errors;
-@@ -1303,32 +1306,26 @@ static void sg_rq_end_io(struct request *rq, int uptodate)
- 	}
- 	/* Rely on write phase to clean out srp status values, so no "else" */
- 
--	if (sfp->closed) {	/* whoops this fd already released, cleanup */
--		SCSI_LOG_TIMEOUT(1, printk("sg_cmd_done: already closed, freeing ...\n"));
--		sg_finish_rem_req(srp);
--		srp = NULL;
--		if (NULL == sfp->headrp) {
--			SCSI_LOG_TIMEOUT(1, printk("sg_cmd_done: already closed, final cleanup\n"));
--			if (0 == sg_remove_sfp(sdp, sfp)) {	/* device still present */
--				scsi_device_put(sdp->device);
--			}
--			sfp = NULL;
--		}
--	} else if (srp && srp->orphan) {
-+	write_lock_irqsave(&sfp->rq_list_lock, iflags);
-+	if (unlikely(srp->orphan)) {
- 		if (sfp->keep_orphan)
- 			srp->sg_io_owned = 0;
--		else {
--			sg_finish_rem_req(srp);
--			srp = NULL;
--		}
-+		else
-+			done = 0;
- 	}
--	if (sfp && srp) {
--		/* Now wake up any sg_read() that is waiting for this packet. */
--		kill_fasync(&sfp->async_qp, SIGPOLL, POLL_IN);
--		write_lock_irqsave(&sfp->rq_list_lock, iflags);
--		srp->done = 1;
-+	srp->done = done;
-+	write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
-+
-+	if (likely(done)) {
-+		/* Now wake up any sg_read() that is waiting for this
-+		 * packet.
-+		 */
- 		wake_up_interruptible(&sfp->read_wait);
--		write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
-+		kill_fasync(&sfp->async_qp, SIGPOLL, POLL_IN);
-+		kref_put(&sfp->f_ref, sg_remove_sfp);
-+	} else {
-+		INIT_WORK(&srp->ew.work, sg_rq_end_io_usercontext);
-+		schedule_work(&srp->ew.work);
- 	}
- }
- 
-@@ -1364,17 +1361,18 @@ static Sg_device *sg_alloc(struct gendisk *disk, struct scsi_device *scsidp)
- 		printk(KERN_WARNING "kmalloc Sg_device failure\n");
- 		return ERR_PTR(-ENOMEM);
- 	}
--	error = -ENOMEM;
-+
- 	if (!idr_pre_get(&sg_index_idr, GFP_KERNEL)) {
- 		printk(KERN_WARNING "idr expansion Sg_device failure\n");
-+		error = -ENOMEM;
- 		goto out;
- 	}
- 
- 	write_lock_irqsave(&sg_index_lock, iflags);
--	error = idr_get_new(&sg_index_idr, sdp, &k);
--	write_unlock_irqrestore(&sg_index_lock, iflags);
- 
-+	error = idr_get_new(&sg_index_idr, sdp, &k);
- 	if (error) {
-+		write_unlock_irqrestore(&sg_index_lock, iflags);
- 		printk(KERN_WARNING "idr allocation Sg_device failure: %d\n",
- 		       error);
- 		goto out;
-@@ -1391,6 +1389,9 @@ static Sg_device *sg_alloc(struct gendisk *disk, struct scsi_device *scsidp)
- 	init_waitqueue_head(&sdp->o_excl_wait);
- 	sdp->sg_tablesize = min(q->max_hw_segments, q->max_phys_segments);
- 	sdp->index = k;
-+	kref_init(&sdp->d_ref);
-+
-+	write_unlock_irqrestore(&sg_index_lock, iflags);
- 
- 	error = 0;
-  out:
-@@ -1401,6 +1402,8 @@ static Sg_device *sg_alloc(struct gendisk *disk, struct scsi_device *scsidp)
- 	return sdp;
- 
-  overflow:
-+	idr_remove(&sg_index_idr, k);
-+	write_unlock_irqrestore(&sg_index_lock, iflags);
- 	sdev_printk(KERN_WARNING, scsidp,
- 		    "Unable to attach sg device type=%d, minor "
- 		    "number exceeds %d\n", scsidp->type, SG_MAX_DEVS - 1);
-@@ -1488,49 +1491,46 @@ out:
- 	return error;
- }
- 
--static void
--sg_remove(struct device *cl_dev, struct class_interface *cl_intf)
-+static void sg_device_destroy(struct kref *kref)
-+{
-+	struct sg_device *sdp = container_of(kref, struct sg_device, d_ref);
-+	unsigned long flags;
-+
-+	/* CAUTION!  Note that the device can still be found via idr_find()
-+	 * even though the refcount is 0.  Therefore, do idr_remove() BEFORE
-+	 * any other cleanup.
-+	 */
-+
-+	write_lock_irqsave(&sg_index_lock, flags);
-+	idr_remove(&sg_index_idr, sdp->index);
-+	write_unlock_irqrestore(&sg_index_lock, flags);
-+
-+	SCSI_LOG_TIMEOUT(3,
-+		printk("sg_device_destroy: %s\n",
-+			sdp->disk->disk_name));
-+
-+	put_disk(sdp->disk);
-+	kfree(sdp);
-+}
-+
-+static void sg_remove(struct device *cl_dev, struct class_interface *cl_intf)
- {
- 	struct scsi_device *scsidp = to_scsi_device(cl_dev->parent);
- 	Sg_device *sdp = dev_get_drvdata(cl_dev);
- 	unsigned long iflags;
- 	Sg_fd *sfp;
--	Sg_fd *tsfp;
--	Sg_request *srp;
--	Sg_request *tsrp;
--	int delay;
- 
--	if (!sdp)
-+	if (!sdp || sdp->detached)
- 		return;
- 
--	delay = 0;
-+	SCSI_LOG_TIMEOUT(3, printk("sg_remove: %s\n", sdp->disk->disk_name));
-+
-+	/* Need a write lock to set sdp->detached. */
- 	write_lock_irqsave(&sg_index_lock, iflags);
--	if (sdp->headfp) {
--		sdp->detached = 1;
--		for (sfp = sdp->headfp; sfp; sfp = tsfp) {
--			tsfp = sfp->nextfp;
--			for (srp = sfp->headrp; srp; srp = tsrp) {
--				tsrp = srp->nextrp;
--				if (sfp->closed || (0 == sg_srp_done(srp, sfp)))
--					sg_finish_rem_req(srp);
--			}
--			if (sfp->closed) {
--				scsi_device_put(sdp->device);
--				__sg_remove_sfp(sdp, sfp);
--			} else {
--				delay = 1;
--				wake_up_interruptible(&sfp->read_wait);
--				kill_fasync(&sfp->async_qp, SIGPOLL,
--					    POLL_HUP);
--			}
--		}
--		SCSI_LOG_TIMEOUT(3, printk("sg_remove: dev=%d, dirty\n", sdp->index));
--		if (NULL == sdp->headfp) {
--			idr_remove(&sg_index_idr, sdp->index);
--		}
--	} else {	/* nothing active, simple case */
--		SCSI_LOG_TIMEOUT(3, printk("sg_remove: dev=%d\n", sdp->index));
--		idr_remove(&sg_index_idr, sdp->index);
-+	sdp->detached = 1;
-+	for (sfp = sdp->headfp; sfp; sfp = sfp->nextfp) {
-+		wake_up_interruptible(&sfp->read_wait);
-+		kill_fasync(&sfp->async_qp, SIGPOLL, POLL_HUP);
- 	}
- 	write_unlock_irqrestore(&sg_index_lock, iflags);
- 
-@@ -1538,13 +1538,8 @@ sg_remove(struct device *cl_dev, struct class_interface *cl_intf)
- 	device_destroy(sg_sysfs_class, MKDEV(SCSI_GENERIC_MAJOR, sdp->index));
- 	cdev_del(sdp->cdev);
- 	sdp->cdev = NULL;
--	put_disk(sdp->disk);
--	sdp->disk = NULL;
--	if (NULL == sdp->headfp)
--		kfree(sdp);
- 
--	if (delay)
--		msleep(10);	/* dirty detach so delay device destruction */
-+	sg_put_dev(sdp);
- }
- 
- module_param_named(scatter_elem_sz, scatter_elem_sz, int, S_IRUGO | S_IWUSR);
-@@ -1673,10 +1668,30 @@ static int sg_start_req(Sg_request *srp, unsigned char *cmd)
- 		md->null_mapped = hp->dxferp ? 0 : 1;
- 	}
- 
--	if (iov_count)
--		res = blk_rq_map_user_iov(q, rq, md, hp->dxferp, iov_count,
--					  hp->dxfer_len, GFP_ATOMIC);
--	else
-+	if (iov_count) {
-+		int len, size = sizeof(struct sg_iovec) * iov_count;
-+		struct iovec *iov;
-+
-+		iov = kmalloc(size, GFP_ATOMIC);
-+		if (!iov)
-+			return -ENOMEM;
-+
-+		if (copy_from_user(iov, hp->dxferp, size)) {
-+			kfree(iov);
-+			return -EFAULT;
-+		}
-+
-+		len = iov_length(iov, iov_count);
-+		if (hp->dxfer_len < len) {
-+			iov_count = iov_shorten(iov, iov_count, hp->dxfer_len);
-+			len = hp->dxfer_len;
-+		}
-+
-+		res = blk_rq_map_user_iov(q, rq, md, (struct sg_iovec *)iov,
-+					  iov_count,
-+					  len, GFP_ATOMIC);
-+		kfree(iov);
-+	} else
- 		res = blk_rq_map_user(q, rq, md, hp->dxferp,
- 				      hp->dxfer_len, GFP_ATOMIC);
- 
-@@ -1941,22 +1956,6 @@ sg_get_rq_mark(Sg_fd * sfp, int pack_id)
- 	return resp;
- }
- 
--#ifdef CONFIG_SCSI_PROC_FS
--static Sg_request *
--sg_get_nth_request(Sg_fd * sfp, int nth)
--{
--	Sg_request *resp;
--	unsigned long iflags;
--	int k;
--
--	read_lock_irqsave(&sfp->rq_list_lock, iflags);
--	for (k = 0, resp = sfp->headrp; resp && (k < nth);
--	     ++k, resp = resp->nextrp) ;
--	read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
--	return resp;
--}
--#endif
--
- /* always adds to end of list */
- static Sg_request *
- sg_add_request(Sg_fd * sfp)
-@@ -2032,22 +2031,6 @@ sg_remove_request(Sg_fd * sfp, Sg_request * srp)
- 	return res;
- }
- 
--#ifdef CONFIG_SCSI_PROC_FS
--static Sg_fd *
--sg_get_nth_sfp(Sg_device * sdp, int nth)
--{
--	Sg_fd *resp;
--	unsigned long iflags;
--	int k;
--
--	read_lock_irqsave(&sg_index_lock, iflags);
--	for (k = 0, resp = sdp->headfp; resp && (k < nth);
--	     ++k, resp = resp->nextfp) ;
--	read_unlock_irqrestore(&sg_index_lock, iflags);
--	return resp;
--}
--#endif
--
- static Sg_fd *
- sg_add_sfp(Sg_device * sdp, int dev)
- {
-@@ -2062,6 +2045,7 @@ sg_add_sfp(Sg_device * sdp, int dev)
- 	init_waitqueue_head(&sfp->read_wait);
- 	rwlock_init(&sfp->rq_list_lock);
- 
-+	kref_init(&sfp->f_ref);
- 	sfp->timeout = SG_DEFAULT_TIMEOUT;
- 	sfp->timeout_user = SG_DEFAULT_TIMEOUT_USER;
- 	sfp->force_packid = SG_DEF_FORCE_PACK_ID;
-@@ -2089,15 +2073,54 @@ sg_add_sfp(Sg_device * sdp, int dev)
- 	sg_build_reserve(sfp, bufflen);
- 	SCSI_LOG_TIMEOUT(3, printk("sg_add_sfp:   bufflen=%d, k_use_sg=%d\n",
- 			   sfp->reserve.bufflen, sfp->reserve.k_use_sg));
-+
-+	kref_get(&sdp->d_ref);
-+	__module_get(THIS_MODULE);
- 	return sfp;
- }
- 
--static void
--__sg_remove_sfp(Sg_device * sdp, Sg_fd * sfp)
-+static void sg_remove_sfp_usercontext(struct work_struct *work)
-+{
-+	struct sg_fd *sfp = container_of(work, struct sg_fd, ew.work);
-+	struct sg_device *sdp = sfp->parentdp;
-+
-+	/* Cleanup any responses which were never read(). */
-+	while (sfp->headrp)
-+		sg_finish_rem_req(sfp->headrp);
-+
-+	if (sfp->reserve.bufflen > 0) {
-+		SCSI_LOG_TIMEOUT(6,
-+			printk("sg_remove_sfp:    bufflen=%d, k_use_sg=%d\n",
-+				(int) sfp->reserve.bufflen,
-+				(int) sfp->reserve.k_use_sg));
-+		sg_remove_scat(&sfp->reserve);
-+	}
-+
-+	SCSI_LOG_TIMEOUT(6,
-+		printk("sg_remove_sfp: %s, sfp=0x%p\n",
-+			sdp->disk->disk_name,
-+			sfp));
-+	kfree(sfp);
-+
-+	scsi_device_put(sdp->device);
-+	sg_put_dev(sdp);
-+	module_put(THIS_MODULE);
-+}
-+
-+static void sg_remove_sfp(struct kref *kref)
- {
-+	struct sg_fd *sfp = container_of(kref, struct sg_fd, f_ref);
-+	struct sg_device *sdp = sfp->parentdp;
- 	Sg_fd *fp;
- 	Sg_fd *prev_fp;
-+	unsigned long iflags;
- 
-+	/* CAUTION!  Note that sfp can still be found by walking sdp->headfp
-+	 * even though the refcount is now 0.  Therefore, unlink sfp from
-+	 * sdp->headfp BEFORE doing any other cleanup.
-+	 */
-+
-+	write_lock_irqsave(&sg_index_lock, iflags);
- 	prev_fp = sdp->headfp;
- 	if (sfp == prev_fp)
- 		sdp->headfp = prev_fp->nextfp;
-@@ -2110,54 +2133,11 @@ __sg_remove_sfp(Sg_device * sdp, Sg_fd * sfp)
- 			prev_fp = fp;
- 		}
- 	}
--	if (sfp->reserve.bufflen > 0) {
--		SCSI_LOG_TIMEOUT(6, 
--			printk("__sg_remove_sfp:    bufflen=%d, k_use_sg=%d\n",
--			(int) sfp->reserve.bufflen, (int) sfp->reserve.k_use_sg));
--		sg_remove_scat(&sfp->reserve);
--	}
--	sfp->parentdp = NULL;
--	SCSI_LOG_TIMEOUT(6, printk("__sg_remove_sfp:    sfp=0x%p\n", sfp));
--	kfree(sfp);
--}
--
--/* Returns 0 in normal case, 1 when detached and sdp object removed */
--static int
--sg_remove_sfp(Sg_device * sdp, Sg_fd * sfp)
--{
--	Sg_request *srp;
--	Sg_request *tsrp;
--	int dirty = 0;
--	int res = 0;
--
--	for (srp = sfp->headrp; srp; srp = tsrp) {
--		tsrp = srp->nextrp;
--		if (sg_srp_done(srp, sfp))
--			sg_finish_rem_req(srp);
--		else
--			++dirty;
--	}
--	if (0 == dirty) {
--		unsigned long iflags;
-+	write_unlock_irqrestore(&sg_index_lock, iflags);
-+	wake_up_interruptible(&sdp->o_excl_wait);
- 
--		write_lock_irqsave(&sg_index_lock, iflags);
--		__sg_remove_sfp(sdp, sfp);
--		if (sdp->detached && (NULL == sdp->headfp)) {
--			idr_remove(&sg_index_idr, sdp->index);
--			kfree(sdp);
--			res = 1;
--		}
--		write_unlock_irqrestore(&sg_index_lock, iflags);
--	} else {
--		/* MOD_INC's to inhibit unloading sg and associated adapter driver */
--		/* only bump the access_count if we actually succeeded in
--		 * throwing another counter on the host module */
--		scsi_device_get(sdp->device);	/* XXX: retval ignored? */	
--		sfp->closed = 1;	/* flag dirty state on this fd */
--		SCSI_LOG_TIMEOUT(1, printk("sg_remove_sfp: worrisome, %d writes pending\n",
--				  dirty));
--	}
--	return res;
-+	INIT_WORK(&sfp->ew.work, sg_remove_sfp_usercontext);
-+	schedule_work(&sfp->ew.work);
- }
- 
- static int
-@@ -2199,19 +2179,38 @@ sg_last_dev(void)
- }
- #endif
- 
--static Sg_device *
--sg_get_dev(int dev)
-+/* must be called with sg_index_lock held */
-+static Sg_device *sg_lookup_dev(int dev)
- {
--	Sg_device *sdp;
--	unsigned long iflags;
-+	return idr_find(&sg_index_idr, dev);
-+}
- 
--	read_lock_irqsave(&sg_index_lock, iflags);
--	sdp = idr_find(&sg_index_idr, dev);
--	read_unlock_irqrestore(&sg_index_lock, iflags);
-+static Sg_device *sg_get_dev(int dev)
-+{
-+	struct sg_device *sdp;
-+	unsigned long flags;
-+
-+	read_lock_irqsave(&sg_index_lock, flags);
-+	sdp = sg_lookup_dev(dev);
-+	if (!sdp)
-+		sdp = ERR_PTR(-ENXIO);
-+	else if (sdp->detached) {
-+		/* If sdp->detached, then the refcount may already be 0, in
-+		 * which case it would be a bug to do kref_get().
-+		 */
-+		sdp = ERR_PTR(-ENODEV);
-+	} else
-+		kref_get(&sdp->d_ref);
-+	read_unlock_irqrestore(&sg_index_lock, flags);
- 
- 	return sdp;
- }
- 
-+static void sg_put_dev(struct sg_device *sdp)
-+{
-+	kref_put(&sdp->d_ref, sg_device_destroy);
-+}
-+
- #ifdef CONFIG_SCSI_PROC_FS
- 
- static struct proc_dir_entry *sg_proc_sgp = NULL;
-@@ -2468,8 +2467,10 @@ static int sg_proc_seq_show_dev(struct seq_file *s, void *v)
- 	struct sg_proc_deviter * it = (struct sg_proc_deviter *) v;
- 	Sg_device *sdp;
- 	struct scsi_device *scsidp;
-+	unsigned long iflags;
- 
--	sdp = it ? sg_get_dev(it->index) : NULL;
-+	read_lock_irqsave(&sg_index_lock, iflags);
-+	sdp = it ? sg_lookup_dev(it->index) : NULL;
- 	if (sdp && (scsidp = sdp->device) && (!sdp->detached))
- 		seq_printf(s, "%d\t%d\t%d\t%d\t%d\t%d\t%d\t%d\t%d\n",
- 			      scsidp->host->host_no, scsidp->channel,
-@@ -2480,6 +2481,7 @@ static int sg_proc_seq_show_dev(struct seq_file *s, void *v)
- 			      (int) scsi_device_online(scsidp));
- 	else
- 		seq_printf(s, "-1\t-1\t-1\t-1\t-1\t-1\t-1\t-1\t-1\n");
-+	read_unlock_irqrestore(&sg_index_lock, iflags);
- 	return 0;
- }
- 
-@@ -2493,16 +2495,20 @@ static int sg_proc_seq_show_devstrs(struct seq_file *s, void *v)
- 	struct sg_proc_deviter * it = (struct sg_proc_deviter *) v;
- 	Sg_device *sdp;
- 	struct scsi_device *scsidp;
-+	unsigned long iflags;
- 
--	sdp = it ? sg_get_dev(it->index) : NULL;
-+	read_lock_irqsave(&sg_index_lock, iflags);
-+	sdp = it ? sg_lookup_dev(it->index) : NULL;
- 	if (sdp && (scsidp = sdp->device) && (!sdp->detached))
- 		seq_printf(s, "%8.8s\t%16.16s\t%4.4s\n",
- 			   scsidp->vendor, scsidp->model, scsidp->rev);
- 	else
- 		seq_printf(s, "<no active device>\n");
-+	read_unlock_irqrestore(&sg_index_lock, iflags);
- 	return 0;
- }
- 
-+/* must be called while holding sg_index_lock */
- static void sg_proc_debug_helper(struct seq_file *s, Sg_device * sdp)
- {
- 	int k, m, new_interface, blen, usg;
-@@ -2512,7 +2518,8 @@ static void sg_proc_debug_helper(struct seq_file *s, Sg_device * sdp)
- 	const char * cp;
- 	unsigned int ms;
- 
--	for (k = 0; (fp = sg_get_nth_sfp(sdp, k)); ++k) {
-+	for (k = 0, fp = sdp->headfp; fp != NULL; ++k, fp = fp->nextfp) {
-+		read_lock(&fp->rq_list_lock); /* irqs already disabled */
- 		seq_printf(s, "   FD(%d): timeout=%dms bufflen=%d "
- 			   "(res)sgat=%d low_dma=%d\n", k + 1,
- 			   jiffies_to_msecs(fp->timeout),
-@@ -2522,7 +2529,9 @@ static void sg_proc_debug_helper(struct seq_file *s, Sg_device * sdp)
- 		seq_printf(s, "   cmd_q=%d f_packid=%d k_orphan=%d closed=%d\n",
- 			   (int) fp->cmd_q, (int) fp->force_packid,
- 			   (int) fp->keep_orphan, (int) fp->closed);
--		for (m = 0; (srp = sg_get_nth_request(fp, m)); ++m) {
-+		for (m = 0, srp = fp->headrp;
-+				srp != NULL;
-+				++m, srp = srp->nextrp) {
- 			hp = &srp->header;
- 			new_interface = (hp->interface_id == '\0') ? 0 : 1;
- 			if (srp->res_used) {
-@@ -2559,6 +2568,7 @@ static void sg_proc_debug_helper(struct seq_file *s, Sg_device * sdp)
- 		}
- 		if (0 == m)
- 			seq_printf(s, "     No requests active\n");
-+		read_unlock(&fp->rq_list_lock);
- 	}
- }
- 
-@@ -2571,39 +2581,34 @@ static int sg_proc_seq_show_debug(struct seq_file *s, void *v)
- {
- 	struct sg_proc_deviter * it = (struct sg_proc_deviter *) v;
- 	Sg_device *sdp;
-+	unsigned long iflags;
- 
- 	if (it && (0 == it->index)) {
- 		seq_printf(s, "max_active_device=%d(origin 1)\n",
- 			   (int)it->max);
- 		seq_printf(s, " def_reserved_size=%d\n", sg_big_buff);
- 	}
--	sdp = it ? sg_get_dev(it->index) : NULL;
--	if (sdp) {
--		struct scsi_device *scsidp = sdp->device;
- 
--		if (NULL == scsidp) {
--			seq_printf(s, "device %d detached ??\n", 
--				   (int)it->index);
--			return 0;
--		}
-+	read_lock_irqsave(&sg_index_lock, iflags);
-+	sdp = it ? sg_lookup_dev(it->index) : NULL;
-+	if (sdp && sdp->headfp) {
-+		struct scsi_device *scsidp = sdp->device;
- 
--		if (sg_get_nth_sfp(sdp, 0)) {
--			seq_printf(s, " >>> device=%s ",
--				sdp->disk->disk_name);
--			if (sdp->detached)
--				seq_printf(s, "detached pending close ");
--			else
--				seq_printf
--				    (s, "scsi%d chan=%d id=%d lun=%d   em=%d",
--				     scsidp->host->host_no,
--				     scsidp->channel, scsidp->id,
--				     scsidp->lun,
--				     scsidp->host->hostt->emulated);
--			seq_printf(s, " sg_tablesize=%d excl=%d\n",
--				   sdp->sg_tablesize, sdp->exclude);
--		}
-+		seq_printf(s, " >>> device=%s ", sdp->disk->disk_name);
-+		if (sdp->detached)
-+			seq_printf(s, "detached pending close ");
-+		else
-+			seq_printf
-+			    (s, "scsi%d chan=%d id=%d lun=%d   em=%d",
-+			     scsidp->host->host_no,
-+			     scsidp->channel, scsidp->id,
-+			     scsidp->lun,
-+			     scsidp->host->hostt->emulated);
-+		seq_printf(s, " sg_tablesize=%d excl=%d\n",
-+			   sdp->sg_tablesize, sdp->exclude);
- 		sg_proc_debug_helper(s, sdp);
- 	}
-+	read_unlock_irqrestore(&sg_index_lock, iflags);
- 	return 0;
- }
- 
-diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
-index 643908b..8eba98c 100644
---- a/drivers/spi/spi.c
-+++ b/drivers/spi/spi.c
-@@ -658,7 +658,7 @@ int spi_write_then_read(struct spi_device *spi,
- 
- 	int			status;
- 	struct spi_message	message;
--	struct spi_transfer	x;
-+	struct spi_transfer	x[2];
- 	u8			*local_buf;
- 
- 	/* Use preallocated DMA-safe buffer.  We can't avoid copying here,
-@@ -669,9 +669,15 @@ int spi_write_then_read(struct spi_device *spi,
- 		return -EINVAL;
- 
- 	spi_message_init(&message);
--	memset(&x, 0, sizeof x);
--	x.len = n_tx + n_rx;
--	spi_message_add_tail(&x, &message);
-+	memset(x, 0, sizeof x);
-+	if (n_tx) {
-+		x[0].len = n_tx;
-+		spi_message_add_tail(&x[0], &message);
-+	}
-+	if (n_rx) {
-+		x[1].len = n_rx;
-+		spi_message_add_tail(&x[1], &message);
-+	}
- 
- 	/* ... unless someone else is using the pre-allocated buffer */
- 	if (!mutex_trylock(&lock)) {
-@@ -682,15 +688,15 @@ int spi_write_then_read(struct spi_device *spi,
- 		local_buf = buf;
- 
- 	memcpy(local_buf, txbuf, n_tx);
--	x.tx_buf = local_buf;
--	x.rx_buf = local_buf;
-+	x[0].tx_buf = local_buf;
-+	x[1].rx_buf = local_buf + n_tx;
- 
- 	/* do the i/o */
- 	status = spi_sync(spi, &message);
- 	if (status == 0)
--		memcpy(rxbuf, x.rx_buf + n_tx, n_rx);
-+		memcpy(rxbuf, x[1].rx_buf, n_rx);
- 
--	if (x.tx_buf == buf)
-+	if (x[0].tx_buf == buf)
- 		mutex_unlock(&lock);
- 	else
- 		kfree(local_buf);
-diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
-index 3771d6e..34e6108 100644
---- a/drivers/usb/class/cdc-wdm.c
-+++ b/drivers/usb/class/cdc-wdm.c
-@@ -652,7 +652,7 @@ next_desc:
- 
- 	iface = &intf->altsetting[0];
- 	ep = &iface->endpoint[0].desc;
--	if (!usb_endpoint_is_int_in(ep)) {
-+	if (!ep || !usb_endpoint_is_int_in(ep)) {
- 		rv = -EINVAL;
- 		goto err;
- 	}
-diff --git a/drivers/usb/gadget/u_ether.c b/drivers/usb/gadget/u_ether.c
-index 96d65ca..4007770 100644
---- a/drivers/usb/gadget/u_ether.c
-+++ b/drivers/usb/gadget/u_ether.c
-@@ -175,12 +175,6 @@ static void eth_get_drvinfo(struct net_device *net, struct ethtool_drvinfo *p)
- 	strlcpy(p->bus_info, dev_name(&dev->gadget->dev), sizeof p->bus_info);
- }
- 
--static u32 eth_get_link(struct net_device *net)
--{
--	struct eth_dev	*dev = netdev_priv(net);
--	return dev->gadget->speed != USB_SPEED_UNKNOWN;
--}
--
- /* REVISIT can also support:
-  *   - WOL (by tracking suspends and issuing remote wakeup)
-  *   - msglevel (implies updated messaging)
-@@ -189,7 +183,7 @@ static u32 eth_get_link(struct net_device *net)
- 
- static struct ethtool_ops ops = {
- 	.get_drvinfo = eth_get_drvinfo,
--	.get_link = eth_get_link
-+	.get_link = ethtool_op_get_link,
- };
- 
- static void defer_kevent(struct eth_dev *dev, int flag)
-diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
-index ae84c32..bb3143e 100644
---- a/drivers/usb/serial/ftdi_sio.c
-+++ b/drivers/usb/serial/ftdi_sio.c
-@@ -668,6 +668,7 @@ static struct usb_device_id id_table_combined [] = {
- 	{ USB_DEVICE(DE_VID, WHT_PID) },
- 	{ USB_DEVICE(ADI_VID, ADI_GNICE_PID),
- 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-+	{ USB_DEVICE(JETI_VID, JETI_SPC1201_PID) },
- 	{ },					/* Optional parameter entry */
- 	{ }					/* Terminating entry */
- };
-diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
-index daaf63d..c09f658 100644
---- a/drivers/usb/serial/ftdi_sio.h
-+++ b/drivers/usb/serial/ftdi_sio.h
-@@ -913,6 +913,13 @@
- #define ADI_GNICE_PID 		0xF000
- 
- /*
-+ * JETI SPECTROMETER SPECBOS 1201
-+ * http://www.jeti.com/products/sys/scb/scb1201.php
-+ */
-+#define JETI_VID		0x0c6c
-+#define JETI_SPC1201_PID	0x04b2
-+
-+/*
-  *   BmRequestType:  1100 0000b
-  *   bRequest:       FTDI_E2_READ
-  *   wValue:         0
-diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
-index 2620bf6..9c4c700 100644
---- a/drivers/usb/serial/ti_usb_3410_5052.c
-+++ b/drivers/usb/serial/ti_usb_3410_5052.c
-@@ -1215,20 +1215,22 @@ static void ti_bulk_in_callback(struct urb *urb)
- 	}
- 
- 	tty = tty_port_tty_get(&port->port);
--	if (tty && urb->actual_length) {
--		usb_serial_debug_data(debug, dev, __func__,
--			urb->actual_length, urb->transfer_buffer);
--
--		if (!tport->tp_is_open)
--			dbg("%s - port closed, dropping data", __func__);
--		else
--			ti_recv(&urb->dev->dev, tty,
-+	if (tty) {
-+		if (urb->actual_length) {
-+			usb_serial_debug_data(debug, dev, __func__,
-+				urb->actual_length, urb->transfer_buffer);
-+
-+			if (!tport->tp_is_open)
-+				dbg("%s - port closed, dropping data",
-+					__func__);
-+			else
-+				ti_recv(&urb->dev->dev, tty,
- 						urb->transfer_buffer,
- 						urb->actual_length);
--
--		spin_lock(&tport->tp_lock);
--		tport->tp_icount.rx += urb->actual_length;
--		spin_unlock(&tport->tp_lock);
-+			spin_lock(&tport->tp_lock);
-+			tport->tp_icount.rx += urb->actual_length;
-+			spin_unlock(&tport->tp_lock);
-+		}
- 		tty_kref_put(tty);
- 	}
- 
-diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
-index cfde74a..0f54399 100644
---- a/drivers/usb/storage/unusual_devs.h
-+++ b/drivers/usb/storage/unusual_devs.h
-@@ -1218,12 +1218,14 @@ UNUSUAL_DEV(  0x07c4, 0xa400, 0x0000, 0xffff,
- 		US_SC_DEVICE, US_PR_DEVICE, NULL,
- 		US_FL_FIX_INQUIRY | US_FL_FIX_CAPACITY ),
- 
--/* Reported by Rauch Wolke <rauchwolke@×××.net> */
-+/* Reported by Rauch Wolke <rauchwolke@×××.net>
-+ * and augmented by binbin <binbinsh@×××××.com> (Bugzilla #12882)
-+ */
- UNUSUAL_DEV(  0x07c4, 0xa4a5, 0x0000, 0xffff,
- 		"Simple Tech/Datafab",
- 		"CF+SM Reader",
- 		US_SC_DEVICE, US_PR_DEVICE, NULL,
--		US_FL_IGNORE_RESIDUE ),
-+		US_FL_IGNORE_RESIDUE | US_FL_MAX_SECTORS_64 ),
- 
- /* Casio QV 2x00/3x00/4000/8000 digital still cameras are not conformant
-  * to the USB storage specification in two ways:
-diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
-index 1657b96..471a9a6 100644
---- a/drivers/video/console/fbcon.c
-+++ b/drivers/video/console/fbcon.c
-@@ -2263,9 +2263,12 @@ static void fbcon_generic_blank(struct vc_data *vc, struct fb_info *info,
- 	}
- 
- 
-+	if (!lock_fb_info(info))
-+		return;
- 	event.info = info;
- 	event.data = &blank;
- 	fb_notifier_call_chain(FB_EVENT_CONBLANK, &event);
-+	unlock_fb_info(info);
- }
- 
- static int fbcon_blank(struct vc_data *vc, int blank, int mode_switch)
-@@ -2954,8 +2957,9 @@ static int fbcon_fb_unbind(int idx)
- 
- static int fbcon_fb_unregistered(struct fb_info *info)
- {
--	int i, idx = info->node;
-+	int i, idx;
- 
-+	idx = info->node;
- 	for (i = first_fb_vc; i <= last_fb_vc; i++) {
- 		if (con2fb_map[i] == idx)
- 			con2fb_map[i] = -1;
-@@ -2979,13 +2983,12 @@ static int fbcon_fb_unregistered(struct fb_info *info)
- 		}
- 	}
- 
--	if (!num_registered_fb)
--		unregister_con_driver(&fb_con);
--
--
- 	if (primary_device == idx)
- 		primary_device = -1;
- 
-+	if (!num_registered_fb)
-+		unregister_con_driver(&fb_con);
-+
- 	return 0;
- }
- 
-@@ -3021,8 +3024,9 @@ static inline void fbcon_select_primary(struct fb_info *info)
- 
- static int fbcon_fb_registered(struct fb_info *info)
- {
--	int ret = 0, i, idx = info->node;
-+	int ret = 0, i, idx;
- 
-+	idx = info->node;
- 	fbcon_select_primary(info);
- 
- 	if (info_idx == -1) {
-@@ -3124,7 +3128,7 @@ static void fbcon_get_requirement(struct fb_info *info,
- 	}
- }
- 
--static int fbcon_event_notify(struct notifier_block *self, 
-+static int fbcon_event_notify(struct notifier_block *self,
- 			      unsigned long action, void *data)
- {
- 	struct fb_event *event = data;
-@@ -3132,7 +3136,7 @@ static int fbcon_event_notify(struct notifier_block *self,
- 	struct fb_videomode *mode;
- 	struct fb_con2fbmap *con2fb;
- 	struct fb_blit_caps *caps;
--	int ret = 0;
-+	int idx, ret = 0;
- 
- 	/*
- 	 * ignore all events except driver registration and deregistration
-@@ -3160,7 +3164,8 @@ static int fbcon_event_notify(struct notifier_block *self,
- 		ret = fbcon_mode_deleted(info, mode);
- 		break;
- 	case FB_EVENT_FB_UNBIND:
--		ret = fbcon_fb_unbind(info->node);
-+		idx = info->node;
-+		ret = fbcon_fb_unbind(idx);
- 		break;
- 	case FB_EVENT_FB_REGISTERED:
- 		ret = fbcon_fb_registered(info);
-@@ -3188,7 +3193,6 @@ static int fbcon_event_notify(struct notifier_block *self,
- 		fbcon_get_requirement(info, caps);
- 		break;
- 	}
--
- done:
- 	return ret;
- }
-diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
-index cfd9dce..1d6fb41 100644
---- a/drivers/video/fbmem.c
-+++ b/drivers/video/fbmem.c
-@@ -1086,13 +1086,11 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
- 			return -EINVAL;
- 		con2fb.framebuffer = -1;
- 		event.data = &con2fb;
--
- 		if (!lock_fb_info(info))
- 			return -ENODEV;
- 		event.info = info;
- 		fb_notifier_call_chain(FB_EVENT_GET_CONSOLE_MAP, &event);
- 		unlock_fb_info(info);
--
- 		ret = copy_to_user(argp, &con2fb, sizeof(con2fb)) ? -EFAULT : 0;
- 		break;
- 	case FBIOPUT_CON2FBMAP:
-@@ -1112,8 +1110,7 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
- 		if (!lock_fb_info(info))
- 			return -ENODEV;
- 		event.info = info;
--		ret = fb_notifier_call_chain(FB_EVENT_SET_CONSOLE_MAP,
--					      &event);
-+		ret = fb_notifier_call_chain(FB_EVENT_SET_CONSOLE_MAP, &event);
- 		unlock_fb_info(info);
- 		break;
- 	case FBIOBLANK:
-@@ -1519,7 +1516,10 @@ register_framebuffer(struct fb_info *fb_info)
- 	registered_fb[i] = fb_info;
- 
- 	event.info = fb_info;
-+	if (!lock_fb_info(fb_info))
-+		return -ENODEV;
- 	fb_notifier_call_chain(FB_EVENT_FB_REGISTERED, &event);
-+	unlock_fb_info(fb_info);
- 	return 0;
- }
- 
-@@ -1553,8 +1553,12 @@ unregister_framebuffer(struct fb_info *fb_info)
- 		goto done;
- 	}
- 
-+
-+	if (!lock_fb_info(fb_info))
-+		return -ENODEV;
- 	event.info = fb_info;
- 	ret = fb_notifier_call_chain(FB_EVENT_FB_UNBIND, &event);
-+	unlock_fb_info(fb_info);
- 
- 	if (ret) {
- 		ret = -EINVAL;
-@@ -1588,6 +1592,8 @@ void fb_set_suspend(struct fb_info *info, int state)
- {
- 	struct fb_event event;
- 
-+	if (!lock_fb_info(info))
-+		return;
- 	event.info = info;
- 	if (state) {
- 		fb_notifier_call_chain(FB_EVENT_SUSPEND, &event);
-@@ -1596,6 +1602,7 @@ void fb_set_suspend(struct fb_info *info, int state)
- 		info->state = FBINFO_STATE_RUNNING;
- 		fb_notifier_call_chain(FB_EVENT_RESUME, &event);
- 	}
-+	unlock_fb_info(info);
- }
- 
- /**
-@@ -1665,8 +1672,11 @@ int fb_new_modelist(struct fb_info *info)
- 	err = 1;
- 
- 	if (!list_empty(&info->modelist)) {
-+		if (!lock_fb_info(info))
-+			return -ENODEV;
- 		event.info = info;
- 		err = fb_notifier_call_chain(FB_EVENT_NEW_MODELIST, &event);
-+		unlock_fb_info(info);
- 	}
- 
- 	return err;
-diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
-index 5926826..9c76a06 100644
---- a/drivers/virtio/virtio_balloon.c
-+++ b/drivers/virtio/virtio_balloon.c
-@@ -190,7 +190,8 @@ static int balloon(void *_vballoon)
- 		try_to_freeze();
- 		wait_event_interruptible(vb->config_change,
- 					 (diff = towards_target(vb)) != 0
--					 || kthread_should_stop());
-+					 || kthread_should_stop()
-+					 || freezing(current));
- 		if (diff > 0)
- 			fill_balloon(vb, diff);
- 		else if (diff < 0)
-diff --git a/fs/dquot.c b/fs/dquot.c
-index bca3cac..5a0059d 100644
---- a/fs/dquot.c
-+++ b/fs/dquot.c
-@@ -793,7 +793,7 @@ static void add_dquot_ref(struct super_block *sb, int type)
- 			continue;
- 		if (!dqinit_needed(inode, type))
- 			continue;
--		if (inode->i_state & (I_FREEING|I_WILL_FREE))
-+		if (inode->i_state & (I_FREEING|I_CLEAR|I_WILL_FREE))
- 			continue;
- 
- 		__iget(inode);
-diff --git a/fs/drop_caches.c b/fs/drop_caches.c
-index 3e5637f..f7e66c0 100644
---- a/fs/drop_caches.c
-+++ b/fs/drop_caches.c
-@@ -18,7 +18,7 @@ static void drop_pagecache_sb(struct super_block *sb)
- 
- 	spin_lock(&inode_lock);
- 	list_for_each_entry(inode, &sb->s_inodes, i_sb_list) {
--		if (inode->i_state & (I_FREEING|I_WILL_FREE))
-+		if (inode->i_state & (I_FREEING|I_CLEAR|I_WILL_FREE))
- 			continue;
- 		if (inode->i_mapping->nrpages == 0)
- 			continue;
-diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
-index 9f61e62..27b3741 100644
---- a/fs/ext4/mballoc.c
-+++ b/fs/ext4/mballoc.c
-@@ -2693,7 +2693,7 @@ int ext4_mb_init(struct super_block *sb, int needs_recovery)
- 	i = (sb->s_blocksize_bits + 2) * sizeof(unsigned int);
- 	sbi->s_mb_maxs = kmalloc(i, GFP_KERNEL);
- 	if (sbi->s_mb_maxs == NULL) {
--		kfree(sbi->s_mb_maxs);
-+		kfree(sbi->s_mb_offsets);
- 		return -ENOMEM;
- 	}
- 
-@@ -4439,7 +4439,7 @@ static void ext4_mb_add_n_trim(struct ext4_allocation_context *ac)
- 						pa_inode_list) {
- 		spin_lock(&tmp_pa->pa_lock);
- 		if (tmp_pa->pa_deleted) {
--			spin_unlock(&pa->pa_lock);
-+			spin_unlock(&tmp_pa->pa_lock);
- 			continue;
- 		}
- 		if (!added && pa->pa_free < tmp_pa->pa_free) {
-diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
-index e3fe991..f81f9e7 100644
---- a/fs/fs-writeback.c
-+++ b/fs/fs-writeback.c
-@@ -538,7 +538,8 @@ void generic_sync_sb_inodes(struct super_block *sb,
- 		list_for_each_entry(inode, &sb->s_inodes, i_sb_list) {
- 			struct address_space *mapping;
- 
--			if (inode->i_state & (I_FREEING|I_WILL_FREE|I_NEW))
-+			if (inode->i_state &
-+					(I_FREEING|I_CLEAR|I_WILL_FREE|I_NEW))
- 				continue;
- 			mapping = inode->i_mapping;
- 			if (mapping->nrpages == 0)
-diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
-index 9b800d9..c91a818 100644
---- a/fs/hugetlbfs/inode.c
-+++ b/fs/hugetlbfs/inode.c
-@@ -26,7 +26,6 @@
- #include <linux/pagevec.h>
- #include <linux/parser.h>
- #include <linux/mman.h>
--#include <linux/quotaops.h>
- #include <linux/slab.h>
- #include <linux/dnotify.h>
- #include <linux/statfs.h>
-@@ -842,7 +841,7 @@ hugetlbfs_parse_options(char *options, struct hugetlbfs_config *pconfig)
- bad_val:
-  	printk(KERN_ERR "hugetlbfs: Bad value '%s' for mount option '%s'\n",
- 	       args[0].from, p);
-- 	return 1;
-+ 	return -EINVAL;
- }
- 
- static int
-diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c
-index 6cdeacf..4bd49c1 100644
---- a/fs/nfs/nfs3xdr.c
-+++ b/fs/nfs/nfs3xdr.c
-@@ -716,7 +716,8 @@ nfs3_xdr_setaclargs(struct rpc_rqst *req, __be32 *p,
- 	if (args->npages != 0)
- 		xdr_encode_pages(buf, args->pages, 0, args->len);
- 	else
--		req->rq_slen += args->len;
-+		req->rq_slen = xdr_adjust_iovec(req->rq_svec,
-+				p + XDR_QUADLEN(args->len));
- 
- 	err = nfsacl_encode(buf, base, args->inode,
- 			    (args->mask & NFS_ACL) ?
-diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
-index a5887df..8672b95 100644
---- a/fs/ocfs2/file.c
-+++ b/fs/ocfs2/file.c
-@@ -1926,7 +1926,7 @@ static ssize_t ocfs2_file_splice_write(struct pipe_inode_info *pipe,
- 		   out->f_path.dentry->d_name.len,
- 		   out->f_path.dentry->d_name.name);
- 
--	inode_double_lock(inode, pipe->inode);
-+	mutex_lock_nested(&inode->i_mutex, I_MUTEX_PARENT);
- 
- 	ret = ocfs2_rw_lock(inode, 1);
- 	if (ret < 0) {
-@@ -1941,12 +1941,16 @@ static ssize_t ocfs2_file_splice_write(struct pipe_inode_info *pipe,
- 		goto out_unlock;
- 	}
- 
-+	if (pipe->inode)
-+		mutex_lock_nested(&pipe->inode->i_mutex, I_MUTEX_CHILD);
- 	ret = generic_file_splice_write_nolock(pipe, out, ppos, len, flags);
-+	if (pipe->inode)
-+		mutex_unlock(&pipe->inode->i_mutex);
- 
- out_unlock:
- 	ocfs2_rw_unlock(inode, 1);
- out:
--	inode_double_unlock(inode, pipe->inode);
-+	mutex_unlock(&inode->i_mutex);
- 
- 	mlog_exit(ret);
- 	return ret;
-diff --git a/fs/splice.c b/fs/splice.c
-index 4ed0ba4..4c1029a 100644
---- a/fs/splice.c
-+++ b/fs/splice.c
-@@ -736,10 +736,19 @@ ssize_t splice_from_pipe(struct pipe_inode_info *pipe, struct file *out,
- 	 * ->write_end. Most of the time, these expect i_mutex to
- 	 * be held. Since this may result in an ABBA deadlock with
- 	 * pipe->inode, we have to order lock acquiry here.
-+	 *
-+	 * Outer lock must be inode->i_mutex, as pipe_wait() will
-+	 * release and reacquire pipe->inode->i_mutex, AND inode must
-+	 * never be a pipe.
- 	 */
--	inode_double_lock(inode, pipe->inode);
-+	WARN_ON(S_ISFIFO(inode->i_mode));
-+	mutex_lock_nested(&inode->i_mutex, I_MUTEX_PARENT);
-+	if (pipe->inode)
-+		mutex_lock_nested(&pipe->inode->i_mutex, I_MUTEX_CHILD);
- 	ret = __splice_from_pipe(pipe, &sd, actor);
--	inode_double_unlock(inode, pipe->inode);
-+	if (pipe->inode)
-+		mutex_unlock(&pipe->inode->i_mutex);
-+	mutex_unlock(&inode->i_mutex);
- 
- 	return ret;
- }
-@@ -830,11 +839,17 @@ generic_file_splice_write(struct pipe_inode_info *pipe, struct file *out,
- 	};
- 	ssize_t ret;
- 
--	inode_double_lock(inode, pipe->inode);
-+	WARN_ON(S_ISFIFO(inode->i_mode));
-+	mutex_lock_nested(&inode->i_mutex, I_MUTEX_PARENT);
- 	ret = file_remove_suid(out);
--	if (likely(!ret))
-+	if (likely(!ret)) {
-+		if (pipe->inode)
-+			mutex_lock_nested(&pipe->inode->i_mutex, I_MUTEX_CHILD);
- 		ret = __splice_from_pipe(pipe, &sd, pipe_to_file);
--	inode_double_unlock(inode, pipe->inode);
-+		if (pipe->inode)
-+			mutex_unlock(&pipe->inode->i_mutex);
-+	}
-+	mutex_unlock(&inode->i_mutex);
- 	if (ret > 0) {
- 		unsigned long nr_pages;
- 
-diff --git a/include/linux/capability.h b/include/linux/capability.h
-index 4864a43..c302110 100644
---- a/include/linux/capability.h
-+++ b/include/linux/capability.h
-@@ -377,7 +377,21 @@ struct cpu_vfs_cap_data {
- #define CAP_FOR_EACH_U32(__capi)  \
- 	for (__capi = 0; __capi < _KERNEL_CAPABILITY_U32S; ++__capi)
- 
-+/*
-+ * CAP_FS_MASK and CAP_NFSD_MASKS:
-+ *
-+ * The fs mask is all the privileges that fsuid==0 historically meant.
-+ * At one time in the past, that included CAP_MKNOD and CAP_LINUX_IMMUTABLE.
-+ *
-+ * It has never meant setting security.* and trusted.* xattrs.
-+ *
-+ * We could also define fsmask as follows:
-+ *   1. CAP_FS_MASK is the privilege to bypass all fs-related DAC permissions
-+ *   2. The security.* and trusted.* xattrs are fs-related MAC permissions
-+ */
-+
- # define CAP_FS_MASK_B0     (CAP_TO_MASK(CAP_CHOWN)		\
-+			    | CAP_TO_MASK(CAP_MKNOD)		\
- 			    | CAP_TO_MASK(CAP_DAC_OVERRIDE)	\
- 			    | CAP_TO_MASK(CAP_DAC_READ_SEARCH)	\
- 			    | CAP_TO_MASK(CAP_FOWNER)		\
-@@ -392,11 +406,12 @@ struct cpu_vfs_cap_data {
- # define CAP_EMPTY_SET    ((kernel_cap_t){{ 0, 0 }})
- # define CAP_FULL_SET     ((kernel_cap_t){{ ~0, ~0 }})
- # define CAP_INIT_EFF_SET ((kernel_cap_t){{ ~CAP_TO_MASK(CAP_SETPCAP), ~0 }})
--# define CAP_FS_SET       ((kernel_cap_t){{ CAP_FS_MASK_B0, CAP_FS_MASK_B1 } })
-+# define CAP_FS_SET       ((kernel_cap_t){{ CAP_FS_MASK_B0 \
-+				    | CAP_TO_MASK(CAP_LINUX_IMMUTABLE), \
-+				    CAP_FS_MASK_B1 } })
- # define CAP_NFSD_SET     ((kernel_cap_t){{ CAP_FS_MASK_B0 \
--					    | CAP_TO_MASK(CAP_SYS_RESOURCE) \
--					    | CAP_TO_MASK(CAP_MKNOD), \
--					    CAP_FS_MASK_B1 } })
-+				    | CAP_TO_MASK(CAP_SYS_RESOURCE), \
-+				    CAP_FS_MASK_B1 } })
- 
- #endif /* _KERNEL_CAPABILITY_U32S != 2 */
- 
-diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h
-index bd37078..0d2f7c8 100644
---- a/include/linux/hrtimer.h
-+++ b/include/linux/hrtimer.h
-@@ -336,6 +336,11 @@ extern int hrtimer_start(struct hrtimer *timer, ktime_t tim,
- 			 const enum hrtimer_mode mode);
- extern int hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim,
- 			unsigned long range_ns, const enum hrtimer_mode mode);
-+extern int
-+__hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim,
-+			 unsigned long delta_ns,
-+			 const enum hrtimer_mode mode, int wakeup);
-+
- extern int hrtimer_cancel(struct hrtimer *timer);
- extern int hrtimer_try_to_cancel(struct hrtimer *timer);
- 
-diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
-index 9127f6b..564d1c0 100644
---- a/include/linux/interrupt.h
-+++ b/include/linux/interrupt.h
-@@ -274,6 +274,7 @@ extern void softirq_init(void);
- #define __raise_softirq_irqoff(nr) do { or_softirq_pending(1UL << (nr)); } while (0)
- extern void raise_softirq_irqoff(unsigned int nr);
- extern void raise_softirq(unsigned int nr);
-+extern void wakeup_softirqd(void);
- 
- /* This is the worklist that queues up per-cpu softirq work.
-  *
-diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
-index bf6f703..552ef4f 100644
---- a/include/linux/kvm_host.h
-+++ b/include/linux/kvm_host.h
-@@ -127,6 +127,10 @@ struct kvm {
- 	struct kvm_coalesced_mmio_ring *coalesced_mmio_ring;
- #endif
- 
-+#ifdef CONFIG_HAVE_KVM_IRQCHIP
-+	struct hlist_head mask_notifier_list;
-+#endif
-+
- #ifdef KVM_ARCH_WANT_MMU_NOTIFIER
- 	struct mmu_notifier mmu_notifier;
- 	unsigned long mmu_notifier_seq;
-@@ -321,6 +325,19 @@ struct kvm_assigned_dev_kernel {
- 	struct pci_dev *dev;
- 	struct kvm *kvm;
- };
-+
-+struct kvm_irq_mask_notifier {
-+	void (*func)(struct kvm_irq_mask_notifier *kimn, bool masked);
-+	int irq;
-+	struct hlist_node link;
-+};
-+
-+void kvm_register_irq_mask_notifier(struct kvm *kvm, int irq,
-+				    struct kvm_irq_mask_notifier *kimn);
-+void kvm_unregister_irq_mask_notifier(struct kvm *kvm, int irq,
-+				      struct kvm_irq_mask_notifier *kimn);
-+void kvm_fire_mask_notifiers(struct kvm *kvm, int irq, bool mask);
-+
- void kvm_set_irq(struct kvm *kvm, int irq_source_id, int irq, int level);
- void kvm_notify_acked_irq(struct kvm *kvm, unsigned gsi);
- void kvm_register_irq_ack_notifier(struct kvm *kvm,
-diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h
-index 01ca085..076a7dc 100644
---- a/include/linux/pagemap.h
-+++ b/include/linux/pagemap.h
-@@ -18,9 +18,14 @@
-  * Bits in mapping->flags.  The lower __GFP_BITS_SHIFT bits are the page
-  * allocation mode flags.
-  */
--#define	AS_EIO		(__GFP_BITS_SHIFT + 0)	/* IO error on async write */
--#define AS_ENOSPC	(__GFP_BITS_SHIFT + 1)	/* ENOSPC on async write */
--#define AS_MM_ALL_LOCKS	(__GFP_BITS_SHIFT + 2)	/* under mm_take_all_locks() */
-+enum mapping_flags {
-+	AS_EIO		= __GFP_BITS_SHIFT + 0,	/* IO error on async write */
-+	AS_ENOSPC	= __GFP_BITS_SHIFT + 1,	/* ENOSPC on async write */
-+	AS_MM_ALL_LOCKS	= __GFP_BITS_SHIFT + 2,	/* under mm_take_all_locks() */
-+#ifdef CONFIG_UNEVICTABLE_LRU
-+	AS_UNEVICTABLE	= __GFP_BITS_SHIFT + 3,	/* e.g., ramdisk, SHM_LOCK */
-+#endif
-+};
- 
- static inline void mapping_set_error(struct address_space *mapping, int error)
- {
-@@ -33,7 +38,6 @@ static inline void mapping_set_error(struct address_space *mapping, int error)
- }
- 
- #ifdef CONFIG_UNEVICTABLE_LRU
--#define AS_UNEVICTABLE	(__GFP_BITS_SHIFT + 2)	/* e.g., ramdisk, SHM_LOCK */
- 
- static inline void mapping_set_unevictable(struct address_space *mapping)
- {
-diff --git a/include/linux/sched.h b/include/linux/sched.h
-index 011db2f..f8af167 100644
---- a/include/linux/sched.h
-+++ b/include/linux/sched.h
-@@ -202,7 +202,8 @@ extern unsigned long long time_sync_thresh;
- #define task_is_stopped_or_traced(task)	\
- 			((task->state & (__TASK_STOPPED | __TASK_TRACED)) != 0)
- #define task_contributes_to_load(task)	\
--				((task->state & TASK_UNINTERRUPTIBLE) != 0)
-+				((task->state & TASK_UNINTERRUPTIBLE) != 0 && \
-+				 (task->flags & PF_FROZEN) == 0)
- 
- #define __set_task_state(tsk, state_value)		\
- 	do { (tsk)->state = (state_value); } while (0)
-diff --git a/kernel/fork.c b/kernel/fork.c
-index 4854c2c..9b51a1b 100644
---- a/kernel/fork.c
-+++ b/kernel/fork.c
-@@ -808,6 +808,12 @@ static void posix_cpu_timers_init_group(struct signal_struct *sig)
- 	sig->cputime_expires.virt_exp = cputime_zero;
- 	sig->cputime_expires.sched_exp = 0;
- 
-+	if (sig->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
-+		sig->cputime_expires.prof_exp =
-+			secs_to_cputime(sig->rlim[RLIMIT_CPU].rlim_cur);
-+		sig->cputimer.running = 1;
-+	}
-+
- 	/* The timer lists. */
- 	INIT_LIST_HEAD(&sig->cpu_timers[0]);
- 	INIT_LIST_HEAD(&sig->cpu_timers[1]);
-@@ -823,11 +829,8 @@ static int copy_signal(unsigned long clone_flags, struct task_struct *tsk)
- 		atomic_inc(&current->signal->live);
- 		return 0;
- 	}
--	sig = kmem_cache_alloc(signal_cachep, GFP_KERNEL);
--
--	if (sig)
--		posix_cpu_timers_init_group(sig);
- 
-+	sig = kmem_cache_alloc(signal_cachep, GFP_KERNEL);
- 	tsk->signal = sig;
- 	if (!sig)
- 		return -ENOMEM;
-@@ -865,6 +868,8 @@ static int copy_signal(unsigned long clone_flags, struct task_struct *tsk)
- 	memcpy(sig->rlim, current->signal->rlim, sizeof sig->rlim);
- 	task_unlock(current->group_leader);
- 
-+	posix_cpu_timers_init_group(sig);
-+
- 	acct_init_pacct(&sig->pacct);
- 
- 	tty_audit_fork(sig);
-diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
-index f394d2a..cb8a15c 100644
---- a/kernel/hrtimer.c
-+++ b/kernel/hrtimer.c
-@@ -651,14 +651,20 @@ static inline void hrtimer_init_timer_hres(struct hrtimer *timer)
-  * and expiry check is done in the hrtimer_interrupt or in the softirq.
-  */
- static inline int hrtimer_enqueue_reprogram(struct hrtimer *timer,
--					    struct hrtimer_clock_base *base)
-+					    struct hrtimer_clock_base *base,
-+					    int wakeup)
- {
- 	if (base->cpu_base->hres_active && hrtimer_reprogram(timer, base)) {
--		spin_unlock(&base->cpu_base->lock);
--		raise_softirq_irqoff(HRTIMER_SOFTIRQ);
--		spin_lock(&base->cpu_base->lock);
-+		if (wakeup) {
-+			spin_unlock(&base->cpu_base->lock);
-+			raise_softirq_irqoff(HRTIMER_SOFTIRQ);
-+			spin_lock(&base->cpu_base->lock);
-+		} else
-+			__raise_softirq_irqoff(HRTIMER_SOFTIRQ);
-+
- 		return 1;
- 	}
-+
- 	return 0;
- }
- 
-@@ -703,7 +709,8 @@ static inline int hrtimer_is_hres_enabled(void) { return 0; }
- static inline int hrtimer_switch_to_hres(void) { return 0; }
- static inline void hrtimer_force_reprogram(struct hrtimer_cpu_base *base) { }
- static inline int hrtimer_enqueue_reprogram(struct hrtimer *timer,
--					    struct hrtimer_clock_base *base)
-+					    struct hrtimer_clock_base *base,
-+					    int wakeup)
- {
- 	return 0;
- }
-@@ -886,20 +893,9 @@ remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base)
- 	return 0;
- }
- 
--/**
-- * hrtimer_start_range_ns - (re)start an hrtimer on the current CPU
-- * @timer:	the timer to be added
-- * @tim:	expiry time
-- * @delta_ns:	"slack" range for the timer
-- * @mode:	expiry mode: absolute (HRTIMER_ABS) or relative (HRTIMER_REL)
-- *
-- * Returns:
-- *  0 on success
-- *  1 when the timer was active
-- */
--int
--hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim, unsigned long delta_ns,
--			const enum hrtimer_mode mode)
-+int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim,
-+		unsigned long delta_ns, const enum hrtimer_mode mode,
-+		int wakeup)
- {
- 	struct hrtimer_clock_base *base, *new_base;
- 	unsigned long flags;
-@@ -940,12 +936,29 @@ hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim, unsigned long delta_n
- 	 * XXX send_remote_softirq() ?
- 	 */
- 	if (leftmost && new_base->cpu_base == &__get_cpu_var(hrtimer_bases))
--		hrtimer_enqueue_reprogram(timer, new_base);
-+		hrtimer_enqueue_reprogram(timer, new_base, wakeup);
- 
- 	unlock_hrtimer_base(timer, &flags);
- 
- 	return ret;
- }
-+
-+/**
-+ * hrtimer_start_range_ns - (re)start an hrtimer on the current CPU
-+ * @timer:	the timer to be added
-+ * @tim:	expiry time
-+ * @delta_ns:	"slack" range for the timer
-+ * @mode:	expiry mode: absolute (HRTIMER_ABS) or relative (HRTIMER_REL)
-+ *
-+ * Returns:
-+ *  0 on success
-+ *  1 when the timer was active
-+ */
-+int hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim,
-+		unsigned long delta_ns, const enum hrtimer_mode mode)
-+{
-+	return __hrtimer_start_range_ns(timer, tim, delta_ns, mode, 1);
-+}
- EXPORT_SYMBOL_GPL(hrtimer_start_range_ns);
- 
- /**
-@@ -961,7 +974,7 @@ EXPORT_SYMBOL_GPL(hrtimer_start_range_ns);
- int
- hrtimer_start(struct hrtimer *timer, ktime_t tim, const enum hrtimer_mode mode)
- {
--	return hrtimer_start_range_ns(timer, tim, 0, mode);
-+	return __hrtimer_start_range_ns(timer, tim, 0, mode, 1);
- }
- EXPORT_SYMBOL_GPL(hrtimer_start);
- 
-diff --git a/kernel/kprobes.c b/kernel/kprobes.c
-index 7ba8cd9..6589776 100644
---- a/kernel/kprobes.c
-+++ b/kernel/kprobes.c
-@@ -912,10 +912,8 @@ static int __kprobes pre_handler_kretprobe(struct kprobe *p,
- 		ri->rp = rp;
- 		ri->task = current;
- 
--		if (rp->entry_handler && rp->entry_handler(ri, regs)) {
--			spin_unlock_irqrestore(&rp->lock, flags);
-+		if (rp->entry_handler && rp->entry_handler(ri, regs))
- 			return 0;
--		}
- 
- 		arch_prepare_kretprobe(ri, regs);
- 
-diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c
-index e976e50..68647c1 100644
---- a/kernel/posix-cpu-timers.c
-+++ b/kernel/posix-cpu-timers.c
-@@ -18,7 +18,7 @@ void update_rlimit_cpu(unsigned long rlim_new)
- 
- 	cputime = secs_to_cputime(rlim_new);
- 	if (cputime_eq(current->signal->it_prof_expires, cputime_zero) ||
--	    cputime_lt(current->signal->it_prof_expires, cputime)) {
-+	    cputime_gt(current->signal->it_prof_expires, cputime)) {
- 		spin_lock_irq(&current->sighand->siglock);
- 		set_process_cpu_timer(current, CPUCLOCK_PROF, &cputime, NULL);
- 		spin_unlock_irq(&current->sighand->siglock);
-@@ -224,7 +224,7 @@ static int cpu_clock_sample(const clockid_t which_clock, struct task_struct *p,
- 		cpu->cpu = virt_ticks(p);
- 		break;
- 	case CPUCLOCK_SCHED:
--		cpu->sched = p->se.sum_exec_runtime + task_delta_exec(p);
-+		cpu->sched = task_sched_runtime(p);
- 		break;
- 	}
- 	return 0;
-@@ -305,18 +305,19 @@ static int cpu_clock_sample_group(const clockid_t which_clock,
- {
- 	struct task_cputime cputime;
- 
--	thread_group_cputime(p, &cputime);
- 	switch (CPUCLOCK_WHICH(which_clock)) {
- 	default:
- 		return -EINVAL;
- 	case CPUCLOCK_PROF:
-+		thread_group_cputime(p, &cputime);
- 		cpu->cpu = cputime_add(cputime.utime, cputime.stime);
- 		break;
- 	case CPUCLOCK_VIRT:
-+		thread_group_cputime(p, &cputime);
- 		cpu->cpu = cputime.utime;
- 		break;
- 	case CPUCLOCK_SCHED:
--		cpu->sched = cputime.sum_exec_runtime + task_delta_exec(p);
-+		cpu->sched = thread_group_sched_runtime(p);
- 		break;
- 	}
- 	return 0;
-diff --git a/kernel/sched.c b/kernel/sched.c
-index 8e2558c..5e80629 100644
---- a/kernel/sched.c
-+++ b/kernel/sched.c
-@@ -231,13 +231,20 @@ static void start_rt_bandwidth(struct rt_bandwidth *rt_b)
- 
- 	spin_lock(&rt_b->rt_runtime_lock);
- 	for (;;) {
-+		unsigned long delta;
-+		ktime_t soft, hard;
-+
- 		if (hrtimer_active(&rt_b->rt_period_timer))
- 			break;
- 
- 		now = hrtimer_cb_get_time(&rt_b->rt_period_timer);
- 		hrtimer_forward(&rt_b->rt_period_timer, now, rt_b->rt_period);
--		hrtimer_start_expires(&rt_b->rt_period_timer,
--				HRTIMER_MODE_ABS);
-+
-+		soft = hrtimer_get_softexpires(&rt_b->rt_period_timer);
-+		hard = hrtimer_get_expires(&rt_b->rt_period_timer);
-+		delta = ktime_to_ns(ktime_sub(hard, soft));
-+		__hrtimer_start_range_ns(&rt_b->rt_period_timer, soft, delta,
-+				HRTIMER_MODE_ABS, 0);
- 	}
- 	spin_unlock(&rt_b->rt_runtime_lock);
- }
-@@ -1129,7 +1136,8 @@ static __init void init_hrtick(void)
-  */
- static void hrtick_start(struct rq *rq, u64 delay)
- {
--	hrtimer_start(&rq->hrtick_timer, ns_to_ktime(delay), HRTIMER_MODE_REL);
-+	__hrtimer_start_range_ns(&rq->hrtick_timer, ns_to_ktime(delay), 0,
-+			HRTIMER_MODE_REL, 0);
- }
- 
- static inline void init_hrtick(void)
-@@ -4134,9 +4142,25 @@ DEFINE_PER_CPU(struct kernel_stat, kstat);
- EXPORT_PER_CPU_SYMBOL(kstat);
- 
- /*
-- * Return any ns on the sched_clock that have not yet been banked in
-+ * Return any ns on the sched_clock that have not yet been accounted in
-  * @p in case that task is currently running.
-+ *
-+ * Called with task_rq_lock() held on @rq.
-  */
-+static u64 do_task_delta_exec(struct task_struct *p, struct rq *rq)
-+{
-+	u64 ns = 0;
-+
-+	if (task_current(rq, p)) {
-+		update_rq_clock(rq);
-+		ns = rq->clock - p->se.exec_start;
-+		if ((s64)ns < 0)
-+			ns = 0;
-+	}
-+
-+	return ns;
-+}
-+
- unsigned long long task_delta_exec(struct task_struct *p)
- {
- 	unsigned long flags;
-@@ -4144,16 +4168,49 @@ unsigned long long task_delta_exec(struct task_struct *p)
- 	u64 ns = 0;
- 
- 	rq = task_rq_lock(p, &flags);
-+	ns = do_task_delta_exec(p, rq);
-+	task_rq_unlock(rq, &flags);
- 
--	if (task_current(rq, p)) {
--		u64 delta_exec;
-+	return ns;
-+}
- 
--		update_rq_clock(rq);
--		delta_exec = rq->clock - p->se.exec_start;
--		if ((s64)delta_exec > 0)
--			ns = delta_exec;
--	}
-+/*
-+ * Return accounted runtime for the task.
-+ * In case the task is currently running, return the runtime plus current's
-+ * pending runtime that have not been accounted yet.
-+ */
-+unsigned long long task_sched_runtime(struct task_struct *p)
-+{
-+	unsigned long flags;
-+	struct rq *rq;
-+	u64 ns = 0;
- 
-+	rq = task_rq_lock(p, &flags);
-+	ns = p->se.sum_exec_runtime + do_task_delta_exec(p, rq);
-+	task_rq_unlock(rq, &flags);
-+
-+	return ns;
-+}
-+
-+/*
-+ * Return sum_exec_runtime for the thread group.
-+ * In case the task is currently running, return the sum plus current's
-+ * pending runtime that have not been accounted yet.
-+ *
-+ * Note that the thread group might have other running tasks as well,
-+ * so the return value not includes other pending runtime that other
-+ * running tasks might have.
-+ */
-+unsigned long long thread_group_sched_runtime(struct task_struct *p)
-+{
-+	struct task_cputime totals;
-+	unsigned long flags;
-+	struct rq *rq;
-+	u64 ns;
-+
-+	rq = task_rq_lock(p, &flags);
-+	thread_group_cputime(p, &totals);
-+	ns = totals.sum_exec_runtime + do_task_delta_exec(p, rq);
- 	task_rq_unlock(rq, &flags);
- 
- 	return ns;
-diff --git a/kernel/softirq.c b/kernel/softirq.c
-index 9041ea7..d2b183e 100644
---- a/kernel/softirq.c
-+++ b/kernel/softirq.c
-@@ -58,7 +58,7 @@ static DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
-  * to the pending events, so lets the scheduler to balance
-  * the softirq load for us.
-  */
--static inline void wakeup_softirqd(void)
-+void wakeup_softirqd(void)
- {
- 	/* Interrupts are disabled: no need to stop preemption */
- 	struct task_struct *tsk = __get_cpu_var(ksoftirqd);
-diff --git a/kernel/sysctl.c b/kernel/sysctl.c
-index c5ef44f..7755ae7 100644
---- a/kernel/sysctl.c
-+++ b/kernel/sysctl.c
-@@ -95,12 +95,9 @@ static int sixty = 60;
- static int neg_one = -1;
- #endif
- 
--#if defined(CONFIG_MMU) && defined(CONFIG_FILE_LOCKING)
--static int two = 2;
--#endif
--
- static int zero;
- static int one = 1;
-+static int two = 2;
- static unsigned long one_ul = 1;
- static int one_hundred = 100;
- 
-@@ -1373,10 +1370,7 @@ static struct ctl_table fs_table[] = {
- 		.data		= &lease_break_time,
- 		.maxlen		= sizeof(int),
- 		.mode		= 0644,
--		.proc_handler	= &proc_dointvec_minmax,
--		.strategy	= &sysctl_intvec,
--		.extra1		= &zero,
--		.extra2		= &two,
-+		.proc_handler	= &proc_dointvec,
- 	},
- #endif
- #ifdef CONFIG_AIO
-@@ -1417,7 +1411,10 @@ static struct ctl_table fs_table[] = {
- 		.data		= &suid_dumpable,
- 		.maxlen		= sizeof(int),
- 		.mode		= 0644,
--		.proc_handler	= &proc_dointvec,
-+		.proc_handler	= &proc_dointvec_minmax,
-+		.strategy	= &sysctl_intvec,
-+		.extra1		= &zero,
-+		.extra2		= &two,
- 	},
- #if defined(CONFIG_BINFMT_MISC) || defined(CONFIG_BINFMT_MISC_MODULE)
- 	{
-diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
-index 17bb88d..b2387c0 100644
---- a/kernel/trace/trace.c
-+++ b/kernel/trace/trace.c
-@@ -3886,7 +3886,8 @@ __init static int tracer_alloc_buffers(void)
- 				       &trace_panic_notifier);
- 
- 	register_die_notifier(&trace_die_notifier);
--	ret = 0;
-+
-+	return 0;
- 
- out_free_cpumask:
- 	free_cpumask_var(tracing_cpumask);
-diff --git a/lib/cpumask.c b/lib/cpumask.c
-index 3389e24..1f71b97 100644
---- a/lib/cpumask.c
-+++ b/lib/cpumask.c
-@@ -109,10 +109,10 @@ bool alloc_cpumask_var_node(cpumask_var_t *mask, gfp_t flags, int node)
- #endif
- 	/* FIXME: Bandaid to save us from old primitives which go to NR_CPUS. */
- 	if (*mask) {
-+		unsigned char *ptr = (unsigned char *)cpumask_bits(*mask);
- 		unsigned int tail;
- 		tail = BITS_TO_LONGS(NR_CPUS - nr_cpumask_bits) * sizeof(long);
--		memset(cpumask_bits(*mask) + cpumask_size() - tail,
--		       0, tail);
-+		memset(ptr + cpumask_size() - tail, 0, tail);
- 	}
- 
- 	return *mask != NULL;
-diff --git a/mm/filemap_xip.c b/mm/filemap_xip.c
-index 0c04615..427dfe3 100644
---- a/mm/filemap_xip.c
-+++ b/mm/filemap_xip.c
-@@ -89,8 +89,8 @@ do_xip_mapping_read(struct address_space *mapping,
- 			}
- 		}
- 		nr = nr - offset;
--		if (nr > len)
--			nr = len;
-+		if (nr > len - copied)
-+			nr = len - copied;
- 
- 		error = mapping->a_ops->get_xip_mem(mapping, index, 0,
- 							&xip_mem, &xip_pfn);
-diff --git a/mm/mmap.c b/mm/mmap.c
-index 00ced3e..f1aa6f9 100644
---- a/mm/mmap.c
-+++ b/mm/mmap.c
-@@ -1571,7 +1571,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
- 	 * Overcommit..  This must be the final test, as it will
- 	 * update security statistics.
- 	 */
--	if (security_vm_enough_memory(grow))
-+	if (security_vm_enough_memory_mm(mm, grow))
- 		return -ENOMEM;
- 
- 	/* Ok, everything looks good - let it rip */
-diff --git a/net/core/skbuff.c b/net/core/skbuff.c
-index c6a6b16..eae6954 100644
---- a/net/core/skbuff.c
-+++ b/net/core/skbuff.c
-@@ -2496,7 +2496,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, int features)
- 					  skb_network_header_len(skb));
- 		skb_copy_from_linear_data(skb, nskb->data, doffset);
- 
--		if (pos >= offset + len)
-+		if (fskb != skb_shinfo(skb)->frag_list)
- 			continue;
- 
- 		if (!sg) {
-diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
-index 7ea88b6..39879ae 100644
---- a/net/ipv4/netfilter/arp_tables.c
-+++ b/net/ipv4/netfilter/arp_tables.c
-@@ -374,7 +374,9 @@ static int mark_source_chains(struct xt_table_info *newinfo,
- 			    && unconditional(&e->arp)) || visited) {
- 				unsigned int oldpos, size;
- 
--				if (t->verdict < -NF_MAX_VERDICT - 1) {
-+				if ((strcmp(t->target.u.user.name,
-+					    ARPT_STANDARD_TARGET) == 0) &&
-+				    t->verdict < -NF_MAX_VERDICT - 1) {
- 					duprintf("mark_source_chains: bad "
- 						"negative verdict (%i)\n",
- 								t->verdict);
-diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
-index ef8b6ca..ec362a3 100644
---- a/net/ipv4/netfilter/ip_tables.c
-+++ b/net/ipv4/netfilter/ip_tables.c
-@@ -496,7 +496,9 @@ mark_source_chains(struct xt_table_info *newinfo,
- 			    && unconditional(&e->ip)) || visited) {
- 				unsigned int oldpos, size;
- 
--				if (t->verdict < -NF_MAX_VERDICT - 1) {
-+				if ((strcmp(t->target.u.user.name,
-+			    		    IPT_STANDARD_TARGET) == 0) &&
-+				    t->verdict < -NF_MAX_VERDICT - 1) {
- 					duprintf("mark_source_chains: bad "
- 						"negative verdict (%i)\n",
- 								t->verdict);
-diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
-index a33485d..def375b 100644
---- a/net/ipv6/netfilter/ip6_tables.c
-+++ b/net/ipv6/netfilter/ip6_tables.c
-@@ -525,7 +525,9 @@ mark_source_chains(struct xt_table_info *newinfo,
- 			    && unconditional(&e->ipv6)) || visited) {
- 				unsigned int oldpos, size;
- 
--				if (t->verdict < -NF_MAX_VERDICT - 1) {
-+				if ((strcmp(t->target.u.user.name,
-+					    IP6T_STANDARD_TARGET) == 0) &&
-+				    t->verdict < -NF_MAX_VERDICT - 1) {
- 					duprintf("mark_source_chains: bad "
- 						"negative verdict (%i)\n",
- 								t->verdict);
-diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
-index e9c05b8..dcce778 100644
---- a/net/netrom/af_netrom.c
-+++ b/net/netrom/af_netrom.c
-@@ -1082,7 +1082,13 @@ static int nr_sendmsg(struct kiocb *iocb, struct socket *sock,
- 
- 	SOCK_DEBUG(sk, "NET/ROM: sendto: Addresses built.\n");
- 
--	/* Build a packet */
-+	/* Build a packet - the conventional user limit is 236 bytes. We can
-+	   do ludicrously large NetROM frames but must not overflow */
-+	if (len > 65536) {
-+		err = -EMSGSIZE;
-+		goto out;
-+	}
-+
- 	SOCK_DEBUG(sk, "NET/ROM: sendto: building packet.\n");
- 	size = len + NR_NETWORK_LEN + NR_TRANSPORT_LEN;
- 
-diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
-index 0139264..5e75bbf 100644
---- a/net/rose/af_rose.c
-+++ b/net/rose/af_rose.c
-@@ -1124,6 +1124,10 @@ static int rose_sendmsg(struct kiocb *iocb, struct socket *sock,
- 
- 	/* Build a packet */
- 	SOCK_DEBUG(sk, "ROSE: sendto: building packet.\n");
-+	/* Sanity check the packet size */
-+	if (len > 65535)
-+		return -EMSGSIZE;
-+
- 	size = len + AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + ROSE_MIN_LEN;
- 
- 	if ((skb = sock_alloc_send_skb(sk, size, msg->msg_flags & MSG_DONTWAIT, &err)) == NULL)
-diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
-index 9fc5b02..88d80f5 100644
---- a/net/x25/af_x25.c
-+++ b/net/x25/af_x25.c
-@@ -1037,6 +1037,12 @@ static int x25_sendmsg(struct kiocb *iocb, struct socket *sock,
- 		sx25.sx25_addr   = x25->dest_addr;
- 	}
- 
-+	/* Sanity check the packet size */
-+	if (len > 65535) {
-+		rc = -EMSGSIZE;
-+		goto out;
-+	}
-+
- 	SOCK_DEBUG(sk, "x25_sendmsg: sendto: Addresses built.\n");
- 
- 	/* Build a packet */
-diff --git a/security/commoncap.c b/security/commoncap.c
-index 7cd61a5..beac025 100644
---- a/security/commoncap.c
-+++ b/security/commoncap.c
-@@ -916,7 +916,6 @@ changed:
- 	return commit_creds(new);
- 
- no_change:
--	error = 0;
- error:
- 	abort_creds(new);
- 	return error;
-diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
-index e7ded13..c1c5f36 100644
---- a/security/smack/smack_lsm.c
-+++ b/security/smack/smack_lsm.c
-@@ -607,6 +607,8 @@ static int smack_inode_setxattr(struct dentry *dentry, const char *name,
- 	    strcmp(name, XATTR_NAME_SMACKIPOUT) == 0) {
- 		if (!capable(CAP_MAC_ADMIN))
- 			rc = -EPERM;
-+		if (size == 0)
-+			rc = -EINVAL;
- 	} else
- 		rc = cap_inode_setxattr(dentry, name, value, size, flags);
- 
-@@ -1430,7 +1432,7 @@ static int smack_inode_setsecurity(struct inode *inode, const char *name,
- 	struct socket *sock;
- 	int rc = 0;
- 
--	if (value == NULL || size > SMK_LABELLEN)
-+	if (value == NULL || size > SMK_LABELLEN || size == 0)
- 		return -EACCES;
- 
- 	sp = smk_import(value, size);
-diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
-index d03f992..cef1ce0 100644
---- a/sound/pci/hda/hda_codec.c
-+++ b/sound/pci/hda/hda_codec.c
-@@ -2003,7 +2003,11 @@ int snd_hda_codec_write_cache(struct hda_codec *codec, hda_nid_t nid,
- 	err = bus->ops.command(bus, res);
- 	if (!err) {
- 		struct hda_cache_head *c;
--		u32 key = build_cmd_cache_key(nid, verb);
-+		u32 key;
-+		/* parm may contain the verb stuff for get/set amp */
-+		verb = verb | (parm >> 8);
-+		parm &= 0xff;
-+		key = build_cmd_cache_key(nid, verb);
- 		c = get_alloc_hash(&codec->cmd_cache, key);
- 		if (c)
- 			c->val = parm;
-diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c
-index e486123..5a6d6d8 100644
---- a/sound/pci/hda/patch_analog.c
-+++ b/sound/pci/hda/patch_analog.c
-@@ -3239,7 +3239,7 @@ static const char *ad1884_slave_vols[] = {
- 	"Mic Playback Volume",
- 	"CD Playback Volume",
- 	"Internal Mic Playback Volume",
--	"Docking Mic Playback Volume"
-+	"Docking Mic Playback Volume",
- 	"Beep Playback Volume",
- 	"IEC958 Playback Volume",
- 	NULL
-diff --git a/virt/kvm/ioapic.c b/virt/kvm/ioapic.c
-index 23b81cf..e85a2bc 100644
---- a/virt/kvm/ioapic.c
-+++ b/virt/kvm/ioapic.c
-@@ -101,6 +101,7 @@ static void ioapic_service(struct kvm_ioapic *ioapic, unsigned int idx)
- static void ioapic_write_indirect(struct kvm_ioapic *ioapic, u32 val)
- {
- 	unsigned index;
-+	bool mask_before, mask_after;
- 
- 	switch (ioapic->ioregsel) {
- 	case IOAPIC_REG_VERSION:
-@@ -120,6 +121,7 @@ static void ioapic_write_indirect(struct kvm_ioapic *ioapic, u32 val)
- 		ioapic_debug("change redir index %x val %x\n", index, val);
- 		if (index >= IOAPIC_NUM_PINS)
- 			return;
-+		mask_before = ioapic->redirtbl[index].fields.mask;
- 		if (ioapic->ioregsel & 1) {
- 			ioapic->redirtbl[index].bits &= 0xffffffff;
- 			ioapic->redirtbl[index].bits |= (u64) val << 32;
-@@ -128,6 +130,9 @@ static void ioapic_write_indirect(struct kvm_ioapic *ioapic, u32 val)
- 			ioapic->redirtbl[index].bits |= (u32) val;
- 			ioapic->redirtbl[index].fields.remote_irr = 0;
- 		}
-+		mask_after = ioapic->redirtbl[index].fields.mask;
-+		if (mask_before != mask_after)
-+			kvm_fire_mask_notifiers(ioapic->kvm, index, mask_after);
- 		if (ioapic->irr & (1 << index))
- 			ioapic_service(ioapic, index);
- 		break;
-@@ -426,3 +431,4 @@ int kvm_ioapic_init(struct kvm *kvm)
- 	kvm_io_bus_register_dev(&kvm->mmio_bus, &ioapic->dev);
- 	return 0;
- }
-+
-diff --git a/virt/kvm/irq_comm.c b/virt/kvm/irq_comm.c
-index aa5d1e5..5162a41 100644
---- a/virt/kvm/irq_comm.c
-+++ b/virt/kvm/irq_comm.c
-@@ -99,3 +99,27 @@ void kvm_free_irq_source_id(struct kvm *kvm, int irq_source_id)
- 		clear_bit(irq_source_id, &kvm->arch.irq_states[i]);
- 	clear_bit(irq_source_id, &kvm->arch.irq_sources_bitmap);
- }
-+
-+void kvm_register_irq_mask_notifier(struct kvm *kvm, int irq,
-+				    struct kvm_irq_mask_notifier *kimn)
-+{
-+	kimn->irq = irq;
-+	hlist_add_head(&kimn->link, &kvm->mask_notifier_list);
-+}
-+
-+void kvm_unregister_irq_mask_notifier(struct kvm *kvm, int irq,
-+				      struct kvm_irq_mask_notifier *kimn)
-+{
-+	hlist_del(&kimn->link);
-+}
-+
-+void kvm_fire_mask_notifiers(struct kvm *kvm, int irq, bool mask)
-+{
-+	struct kvm_irq_mask_notifier *kimn;
-+	struct hlist_node *n;
-+
-+	hlist_for_each_entry(kimn, n, &kvm->mask_notifier_list, link)
-+		if (kimn->irq == irq)
-+			kimn->func(kimn, mask);
-+}
-+
-diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
-index 29a667c..6723411 100644
---- a/virt/kvm/kvm_main.c
-+++ b/virt/kvm/kvm_main.c
-@@ -563,7 +563,7 @@ static int kvm_vm_ioctl_deassign_device(struct kvm *kvm,
- 		goto out;
- 	}
- 
--	if (assigned_dev->flags & KVM_DEV_ASSIGN_ENABLE_IOMMU)
-+	if (match->flags & KVM_DEV_ASSIGN_ENABLE_IOMMU)
- 		kvm_deassign_device(kvm, match);
- 
- 	kvm_free_assigned_device(kvm, match);
-@@ -581,8 +581,10 @@ static inline int valid_vcpu(int n)
- 
- inline int kvm_is_mmio_pfn(pfn_t pfn)
- {
--	if (pfn_valid(pfn))
--		return PageReserved(pfn_to_page(pfn));
-+	if (pfn_valid(pfn)) {
-+		struct page *page = compound_head(pfn_to_page(pfn));
-+		return PageReserved(page);
-+	}
- 
- 	return true;
- }
-@@ -828,6 +830,9 @@ static struct kvm *kvm_create_vm(void)
- 
- 	if (IS_ERR(kvm))
- 		goto out;
-+#ifdef CONFIG_HAVE_KVM_IRQCHIP
-+	INIT_HLIST_HEAD(&kvm->mask_notifier_list);
-+#endif
- 
- #ifdef KVM_COALESCED_MMIO_PAGE_OFFSET
- 	page = alloc_page(GFP_KERNEL | __GFP_ZERO);

Deleted: genpatches-2.6/trunk/2.6.30/1002_linux-2.6.29.3.patch
===================================================================
--- genpatches-2.6/trunk/2.6.30/1002_linux-2.6.29.3.patch	2009-06-05 16:26:11 UTC (rev 1572)
+++ genpatches-2.6/trunk/2.6.30/1002_linux-2.6.29.3.patch	2009-06-05 16:28:49 UTC (rev 1573)
@@ -1,2934 +0,0 @@
-diff --git a/arch/powerpc/include/asm/processor.h b/arch/powerpc/include/asm/processor.h
-index d346649..9eed29e 100644
---- a/arch/powerpc/include/asm/processor.h
-+++ b/arch/powerpc/include/asm/processor.h
-@@ -313,6 +313,25 @@ static inline void prefetchw(const void *x)
- #define HAVE_ARCH_PICK_MMAP_LAYOUT
- #endif
- 
-+#ifdef CONFIG_PPC64
-+static inline unsigned long get_clean_sp(struct pt_regs *regs, int is_32)
-+{
-+	unsigned long sp;
-+
-+	if (is_32)
-+		sp = regs->gpr[1] & 0x0ffffffffUL;
-+	else
-+		sp = regs->gpr[1];
-+
-+	return sp;
-+}
-+#else
-+static inline unsigned long get_clean_sp(struct pt_regs *regs, int is_32)
-+{
-+	return regs->gpr[1];
-+}
-+#endif
-+
- #endif /* __KERNEL__ */
- #endif /* __ASSEMBLY__ */
- #endif /* _ASM_POWERPC_PROCESSOR_H */
-diff --git a/arch/powerpc/kernel/signal.c b/arch/powerpc/kernel/signal.c
-index a54405e..00b5078 100644
---- a/arch/powerpc/kernel/signal.c
-+++ b/arch/powerpc/kernel/signal.c
-@@ -26,12 +26,12 @@ int show_unhandled_signals = 0;
-  * Allocate space for the signal frame
-  */
- void __user * get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
--			   size_t frame_size)
-+			   size_t frame_size, int is_32)
- {
-         unsigned long oldsp, newsp;
- 
-         /* Default to using normal stack */
--        oldsp = regs->gpr[1];
-+        oldsp = get_clean_sp(regs, is_32);
- 
- 	/* Check for alt stack */
- 	if ((ka->sa.sa_flags & SA_ONSTACK) &&
-diff --git a/arch/powerpc/kernel/signal.h b/arch/powerpc/kernel/signal.h
-index b427bf8..95e1b14 100644
---- a/arch/powerpc/kernel/signal.h
-+++ b/arch/powerpc/kernel/signal.h
-@@ -15,7 +15,7 @@
- extern void do_signal(struct pt_regs *regs, unsigned long thread_info_flags);
- 
- extern void __user * get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
--				  size_t frame_size);
-+				  size_t frame_size, int is_32);
- extern void restore_sigmask(sigset_t *set);
- 
- extern int handle_signal32(unsigned long sig, struct k_sigaction *ka,
-diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
-index b13abf3..d670429 100644
---- a/arch/powerpc/kernel/signal_32.c
-+++ b/arch/powerpc/kernel/signal_32.c
-@@ -836,7 +836,7 @@ int handle_rt_signal32(unsigned long sig, struct k_sigaction *ka,
- 
- 	/* Set up Signal Frame */
- 	/* Put a Real Time Context onto stack */
--	rt_sf = get_sigframe(ka, regs, sizeof(*rt_sf));
-+	rt_sf = get_sigframe(ka, regs, sizeof(*rt_sf), 1);
- 	addr = rt_sf;
- 	if (unlikely(rt_sf == NULL))
- 		goto badframe;
-@@ -1182,7 +1182,7 @@ int handle_signal32(unsigned long sig, struct k_sigaction *ka,
- 	unsigned long newsp = 0;
- 
- 	/* Set up Signal Frame */
--	frame = get_sigframe(ka, regs, sizeof(*frame));
-+	frame = get_sigframe(ka, regs, sizeof(*frame), 1);
- 	if (unlikely(frame == NULL))
- 		goto badframe;
- 	sc = (struct sigcontext __user *) &frame->sctx;
-diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
-index e132891..2fe6fc6 100644
---- a/arch/powerpc/kernel/signal_64.c
-+++ b/arch/powerpc/kernel/signal_64.c
-@@ -402,7 +402,7 @@ int handle_rt_signal64(int signr, struct k_sigaction *ka, siginfo_t *info,
- 	unsigned long newsp = 0;
- 	long err = 0;
- 
--	frame = get_sigframe(ka, regs, sizeof(*frame));
-+	frame = get_sigframe(ka, regs, sizeof(*frame), 0);
- 	if (unlikely(frame == NULL))
- 		goto badframe;
- 
-diff --git a/arch/x86/kernel/xsave.c b/arch/x86/kernel/xsave.c
-index 2b54fe0..aa8bc45 100644
---- a/arch/x86/kernel/xsave.c
-+++ b/arch/x86/kernel/xsave.c
-@@ -89,7 +89,7 @@ int save_i387_xstate(void __user *buf)
- 
- 	if (!used_math())
- 		return 0;
--	clear_used_math(); /* trigger finit */
-+
- 	if (task_thread_info(tsk)->status & TS_USEDFPU) {
- 		/*
- 	 	 * Start with clearing the user buffer. This will present a
-@@ -114,6 +114,8 @@ int save_i387_xstate(void __user *buf)
- 			return -1;
- 	}
- 
-+	clear_used_math(); /* trigger finit */
-+
- 	if (task_thread_info(tsk)->status & TS_XSAVE) {
- 		struct _fpstate __user *fx = buf;
- 		struct _xstate __user *x = buf;
-diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
-index 2d4477c..8005da2 100644
---- a/arch/x86/kvm/mmu.c
-+++ b/arch/x86/kvm/mmu.c
-@@ -797,7 +797,7 @@ static struct kvm_mmu_page *kvm_mmu_alloc_page(struct kvm_vcpu *vcpu,
- 	ASSERT(is_empty_shadow_page(sp->spt));
- 	bitmap_zero(sp->slot_bitmap, KVM_MEMORY_SLOTS + KVM_PRIVATE_MEM_SLOTS);
- 	sp->multimapped = 0;
--	sp->global = 1;
-+	sp->global = 0;
- 	sp->parent_pte = parent_pte;
- 	--vcpu->kvm->arch.n_free_mmu_pages;
- 	return sp;
-diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index 758b7a1..425423e 100644
---- a/arch/x86/kvm/x86.c
-+++ b/arch/x86/kvm/x86.c
-@@ -3962,6 +3962,11 @@ EXPORT_SYMBOL_GPL(kvm_put_guest_fpu);
- 
- void kvm_arch_vcpu_free(struct kvm_vcpu *vcpu)
- {
-+	if (vcpu->arch.time_page) {
-+		kvm_release_page_dirty(vcpu->arch.time_page);
-+		vcpu->arch.time_page = NULL;
-+	}
-+
- 	kvm_x86_ops->vcpu_free(vcpu);
- }
- 
-diff --git a/arch/x86/mm/kmmio.c b/arch/x86/mm/kmmio.c
-index 6a518dd..4a68571 100644
---- a/arch/x86/mm/kmmio.c
-+++ b/arch/x86/mm/kmmio.c
-@@ -87,7 +87,7 @@ static struct kmmio_probe *get_kmmio_probe(unsigned long addr)
- {
- 	struct kmmio_probe *p;
- 	list_for_each_entry_rcu(p, &kmmio_probes, list) {
--		if (addr >= p->addr && addr <= (p->addr + p->len))
-+		if (addr >= p->addr && addr < (p->addr + p->len))
- 			return p;
- 	}
- 	return NULL;
-diff --git a/arch/x86/pci/mmconfig-shared.c b/arch/x86/pci/mmconfig-shared.c
-index 89bf924..9136946 100644
---- a/arch/x86/pci/mmconfig-shared.c
-+++ b/arch/x86/pci/mmconfig-shared.c
-@@ -254,7 +254,7 @@ static acpi_status __init check_mcfg_resource(struct acpi_resource *res,
- 		if (!fixmem32)
- 			return AE_OK;
- 		if ((mcfg_res->start >= fixmem32->address) &&
--		    (mcfg_res->end < (fixmem32->address +
-+		    (mcfg_res->end <= (fixmem32->address +
- 				      fixmem32->address_length))) {
- 			mcfg_res->flags = 1;
- 			return AE_CTRL_TERMINATE;
-@@ -271,7 +271,7 @@ static acpi_status __init check_mcfg_resource(struct acpi_resource *res,
- 		return AE_OK;
- 
- 	if ((mcfg_res->start >= address.minimum) &&
--	    (mcfg_res->end < (address.minimum + address.address_length))) {
-+	    (mcfg_res->end <= (address.minimum + address.address_length))) {
- 		mcfg_res->flags = 1;
- 		return AE_CTRL_TERMINATE;
- 	}
-@@ -318,7 +318,7 @@ static int __init is_mmconf_reserved(check_reserved_t is_reserved,
- 	u64 old_size = size;
- 	int valid = 0;
- 
--	while (!is_reserved(addr, addr + size - 1, E820_RESERVED)) {
-+	while (!is_reserved(addr, addr + size, E820_RESERVED)) {
- 		size >>= 1;
- 		if (size < (16UL<<20))
- 			break;
-diff --git a/block/genhd.c b/block/genhd.c
-index a9ec910..1a4916e 100644
---- a/block/genhd.c
-+++ b/block/genhd.c
-@@ -98,7 +98,7 @@ void disk_part_iter_init(struct disk_part_iter *piter, struct gendisk *disk,
- 
- 	if (flags & DISK_PITER_REVERSE)
- 		piter->idx = ptbl->len - 1;
--	else if (flags & DISK_PITER_INCL_PART0)
-+	else if (flags & (DISK_PITER_INCL_PART0 | DISK_PITER_INCL_EMPTY_PART0))
- 		piter->idx = 0;
- 	else
- 		piter->idx = 1;
-@@ -134,7 +134,8 @@ struct hd_struct *disk_part_iter_next(struct disk_part_iter *piter)
- 	/* determine iteration parameters */
- 	if (piter->flags & DISK_PITER_REVERSE) {
- 		inc = -1;
--		if (piter->flags & DISK_PITER_INCL_PART0)
-+		if (piter->flags & (DISK_PITER_INCL_PART0 |
-+				    DISK_PITER_INCL_EMPTY_PART0))
- 			end = -1;
- 		else
- 			end = 0;
-@@ -150,7 +151,10 @@ struct hd_struct *disk_part_iter_next(struct disk_part_iter *piter)
- 		part = rcu_dereference(ptbl->part[piter->idx]);
- 		if (!part)
- 			continue;
--		if (!(piter->flags & DISK_PITER_INCL_EMPTY) && !part->nr_sects)
-+		if (!part->nr_sects &&
-+		    !(piter->flags & DISK_PITER_INCL_EMPTY) &&
-+		    !(piter->flags & DISK_PITER_INCL_EMPTY_PART0 &&
-+		      piter->idx == 0))
- 			continue;
- 
- 		get_device(part_to_dev(part));
-@@ -1011,7 +1015,7 @@ static int diskstats_show(struct seq_file *seqf, void *v)
- 				"\n\n");
- 	*/
-  
--	disk_part_iter_init(&piter, gp, DISK_PITER_INCL_PART0);
-+	disk_part_iter_init(&piter, gp, DISK_PITER_INCL_EMPTY_PART0);
- 	while ((hd = disk_part_iter_next(&piter))) {
- 		cpu = part_stat_lock();
- 		part_round_stats(cpu, hd);
-diff --git a/drivers/acpi/acpica/rscreate.c b/drivers/acpi/acpica/rscreate.c
-index 61566b1..2b60413 100644
---- a/drivers/acpi/acpica/rscreate.c
-+++ b/drivers/acpi/acpica/rscreate.c
-@@ -191,8 +191,6 @@ acpi_rs_create_pci_routing_table(union acpi_operand_object *package_object,
- 	user_prt = ACPI_CAST_PTR(struct acpi_pci_routing_table, buffer);
- 
- 	for (index = 0; index < number_of_elements; index++) {
--		int source_name_index = 2;
--		int source_index_index = 3;
- 
- 		/*
- 		 * Point user_prt past this current structure
-@@ -261,27 +259,6 @@ acpi_rs_create_pci_routing_table(union acpi_operand_object *package_object,
- 			return_ACPI_STATUS(AE_BAD_DATA);
- 		}
- 
--		/*
--		 * If BIOS erroneously reversed the _PRT source_name and source_index,
--		 * then reverse them back.
--		 */
--		if (ACPI_GET_OBJECT_TYPE(sub_object_list[3]) !=
--		    ACPI_TYPE_INTEGER) {
--			if (acpi_gbl_enable_interpreter_slack) {
--				source_name_index = 3;
--				source_index_index = 2;
--				printk(KERN_WARNING
--				       "ACPI: Handling Garbled _PRT entry\n");
--			} else {
--				ACPI_ERROR((AE_INFO,
--					    "(PRT[%X].source_index) Need Integer, found %s",
--					    index,
--					    acpi_ut_get_object_type_name
--					    (sub_object_list[3])));
--				return_ACPI_STATUS(AE_BAD_DATA);
--			}
--		}
--
- 		user_prt->pin = (u32) obj_desc->integer.value;
- 
- 		/*
-@@ -305,7 +282,7 @@ acpi_rs_create_pci_routing_table(union acpi_operand_object *package_object,
- 		 * 3) Third subobject: Dereference the PRT.source_name
- 		 * The name may be unresolved (slack mode), so allow a null object
- 		 */
--		obj_desc = sub_object_list[source_name_index];
-+		obj_desc = sub_object_list[2];
- 		if (obj_desc) {
- 			switch (ACPI_GET_OBJECT_TYPE(obj_desc)) {
- 			case ACPI_TYPE_LOCAL_REFERENCE:
-@@ -379,7 +356,7 @@ acpi_rs_create_pci_routing_table(union acpi_operand_object *package_object,
- 
- 		/* 4) Fourth subobject: Dereference the PRT.source_index */
- 
--		obj_desc = sub_object_list[source_index_index];
-+		obj_desc = sub_object_list[3];
- 		if (ACPI_GET_OBJECT_TYPE(obj_desc) != ACPI_TYPE_INTEGER) {
- 			ACPI_ERROR((AE_INFO,
- 				    "(PRT[%X].SourceIndex) Need Integer, found %s",
-diff --git a/drivers/char/hw_random/virtio-rng.c b/drivers/char/hw_random/virtio-rng.c
-index d0e563e..86e83f8 100644
---- a/drivers/char/hw_random/virtio-rng.c
-+++ b/drivers/char/hw_random/virtio-rng.c
-@@ -37,9 +37,9 @@ static void random_recv_done(struct virtqueue *vq)
- {
- 	int len;
- 
--	/* We never get spurious callbacks. */
-+	/* We can get spurious callbacks, e.g. shared IRQs + virtio_pci. */
- 	if (!vq->vq_ops->get_buf(vq, &len))
--		BUG();
-+		return;
- 
- 	data_left = len / sizeof(random_data[0]);
- 	complete(&have_data);
-diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c
-index d9e751b..af9761c 100644
---- a/drivers/crypto/ixp4xx_crypto.c
-+++ b/drivers/crypto/ixp4xx_crypto.c
-@@ -101,6 +101,7 @@ struct buffer_desc {
- 	u32 phys_addr;
- 	u32 __reserved[4];
- 	struct buffer_desc *next;
-+	enum dma_data_direction dir;
- };
- 
- struct crypt_ctl {
-@@ -132,14 +133,10 @@ struct crypt_ctl {
- struct ablk_ctx {
- 	struct buffer_desc *src;
- 	struct buffer_desc *dst;
--	unsigned src_nents;
--	unsigned dst_nents;
- };
- 
- struct aead_ctx {
- 	struct buffer_desc *buffer;
--	unsigned short assoc_nents;
--	unsigned short src_nents;
- 	struct scatterlist ivlist;
- 	/* used when the hmac is not on one sg entry */
- 	u8 *hmac_virt;
-@@ -312,7 +309,7 @@ static struct crypt_ctl *get_crypt_desc_emerg(void)
- 	}
- }
- 
--static void free_buf_chain(struct buffer_desc *buf, u32 phys)
-+static void free_buf_chain(struct device *dev, struct buffer_desc *buf,u32 phys)
- {
- 	while (buf) {
- 		struct buffer_desc *buf1;
-@@ -320,6 +317,7 @@ static void free_buf_chain(struct buffer_desc *buf, u32 phys)
- 
- 		buf1 = buf->next;
- 		phys1 = buf->phys_next;
-+		dma_unmap_single(dev, buf->phys_next, buf->buf_len, buf->dir);
- 		dma_pool_free(buffer_pool, buf, phys);
- 		buf = buf1;
- 		phys = phys1;
-@@ -348,7 +346,6 @@ static void one_packet(dma_addr_t phys)
- 	struct crypt_ctl *crypt;
- 	struct ixp_ctx *ctx;
- 	int failed;
--	enum dma_data_direction src_direction = DMA_BIDIRECTIONAL;
- 
- 	failed = phys & 0x1 ? -EBADMSG : 0;
- 	phys &= ~0x3;
-@@ -358,13 +355,8 @@ static void one_packet(dma_addr_t phys)
- 	case CTL_FLAG_PERFORM_AEAD: {
- 		struct aead_request *req = crypt->data.aead_req;
- 		struct aead_ctx *req_ctx = aead_request_ctx(req);
--		dma_unmap_sg(dev, req->assoc, req_ctx->assoc_nents,
--				DMA_TO_DEVICE);
--		dma_unmap_sg(dev, &req_ctx->ivlist, 1, DMA_BIDIRECTIONAL);
--		dma_unmap_sg(dev, req->src, req_ctx->src_nents,
--				DMA_BIDIRECTIONAL);
- 
--		free_buf_chain(req_ctx->buffer, crypt->src_buf);
-+		free_buf_chain(dev, req_ctx->buffer, crypt->src_buf);
- 		if (req_ctx->hmac_virt) {
- 			finish_scattered_hmac(crypt);
- 		}
-@@ -374,16 +366,11 @@ static void one_packet(dma_addr_t phys)
- 	case CTL_FLAG_PERFORM_ABLK: {
- 		struct ablkcipher_request *req = crypt->data.ablk_req;
- 		struct ablk_ctx *req_ctx = ablkcipher_request_ctx(req);
--		int nents;
-+
- 		if (req_ctx->dst) {
--			nents = req_ctx->dst_nents;
--			dma_unmap_sg(dev, req->dst, nents, DMA_FROM_DEVICE);
--			free_buf_chain(req_ctx->dst, crypt->dst_buf);
--			src_direction = DMA_TO_DEVICE;
-+			free_buf_chain(dev, req_ctx->dst, crypt->dst_buf);
- 		}
--		nents = req_ctx->src_nents;
--		dma_unmap_sg(dev, req->src, nents, src_direction);
--		free_buf_chain(req_ctx->src, crypt->src_buf);
-+		free_buf_chain(dev, req_ctx->src, crypt->src_buf);
- 		req->base.complete(&req->base, failed);
- 		break;
- 	}
-@@ -750,56 +737,35 @@ static int setup_cipher(struct crypto_tfm *tfm, int encrypt,
- 	return 0;
- }
- 
--static int count_sg(struct scatterlist *sg, int nbytes)
-+static struct buffer_desc *chainup_buffers(struct device *dev,
-+		struct scatterlist *sg,	unsigned nbytes,
-+		struct buffer_desc *buf, gfp_t flags,
-+		enum dma_data_direction dir)
- {
--	int i;
--	for (i = 0; nbytes > 0; i++, sg = sg_next(sg))
--		nbytes -= sg->length;
--	return i;
--}
--
--static struct buffer_desc *chainup_buffers(struct scatterlist *sg,
--			unsigned nbytes, struct buffer_desc *buf, gfp_t flags)
--{
--	int nents = 0;
--
--	while (nbytes > 0) {
-+	for (;nbytes > 0; sg = scatterwalk_sg_next(sg)) {
-+		unsigned len = min(nbytes, sg->length);
- 		struct buffer_desc *next_buf;
- 		u32 next_buf_phys;
--		unsigned len = min(nbytes, sg_dma_len(sg));
-+		void *ptr;
- 
--		nents++;
- 		nbytes -= len;
--		if (!buf->phys_addr) {
--			buf->phys_addr = sg_dma_address(sg);
--			buf->buf_len = len;
--			buf->next = NULL;
--			buf->phys_next = 0;
--			goto next;
--		}
--		/* Two consecutive chunks on one page may be handled by the old
--		 * buffer descriptor, increased by the length of the new one
--		 */
--		if (sg_dma_address(sg) == buf->phys_addr + buf->buf_len) {
--			buf->buf_len += len;
--			goto next;
--		}
-+		ptr = page_address(sg_page(sg)) + sg->offset;
- 		next_buf = dma_pool_alloc(buffer_pool, flags, &next_buf_phys);
--		if (!next_buf)
--			return NULL;
-+		if (!next_buf) {
-+			buf = NULL;
-+			break;
-+		}
-+		sg_dma_address(sg) = dma_map_single(dev, ptr, len, dir);
- 		buf->next = next_buf;
- 		buf->phys_next = next_buf_phys;
--
- 		buf = next_buf;
--		buf->next = NULL;
--		buf->phys_next = 0;
-+
- 		buf->phys_addr = sg_dma_address(sg);
- 		buf->buf_len = len;
--next:
--		if (nbytes > 0) {
--			sg = sg_next(sg);
--		}
-+		buf->dir = dir;
- 	}
-+	buf->next = NULL;
-+	buf->phys_next = 0;
- 	return buf;
- }
- 
-@@ -860,12 +826,12 @@ static int ablk_perform(struct ablkcipher_request *req, int encrypt)
- 	struct crypto_ablkcipher *tfm = crypto_ablkcipher_reqtfm(req);
- 	struct ixp_ctx *ctx = crypto_ablkcipher_ctx(tfm);
- 	unsigned ivsize = crypto_ablkcipher_ivsize(tfm);
--	int ret = -ENOMEM;
- 	struct ix_sa_dir *dir;
- 	struct crypt_ctl *crypt;
--	unsigned int nbytes = req->nbytes, nents;
-+	unsigned int nbytes = req->nbytes;
- 	enum dma_data_direction src_direction = DMA_BIDIRECTIONAL;
- 	struct ablk_ctx *req_ctx = ablkcipher_request_ctx(req);
-+	struct buffer_desc src_hook;
- 	gfp_t flags = req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP ?
- 				GFP_KERNEL : GFP_ATOMIC;
- 
-@@ -878,7 +844,7 @@ static int ablk_perform(struct ablkcipher_request *req, int encrypt)
- 
- 	crypt = get_crypt_desc();
- 	if (!crypt)
--		return ret;
-+		return -ENOMEM;
- 
- 	crypt->data.ablk_req = req;
- 	crypt->crypto_ctx = dir->npe_ctx_phys;
-@@ -891,53 +857,41 @@ static int ablk_perform(struct ablkcipher_request *req, int encrypt)
- 	BUG_ON(ivsize && !req->info);
- 	memcpy(crypt->iv, req->info, ivsize);
- 	if (req->src != req->dst) {
-+		struct buffer_desc dst_hook;
- 		crypt->mode |= NPE_OP_NOT_IN_PLACE;
--		nents = count_sg(req->dst, nbytes);
- 		/* This was never tested by Intel
- 		 * for more than one dst buffer, I think. */
--		BUG_ON(nents != 1);
--		req_ctx->dst_nents = nents;
--		dma_map_sg(dev, req->dst, nents, DMA_FROM_DEVICE);
--		req_ctx->dst = dma_pool_alloc(buffer_pool, flags,&crypt->dst_buf);
--		if (!req_ctx->dst)
--			goto unmap_sg_dest;
--		req_ctx->dst->phys_addr = 0;
--		if (!chainup_buffers(req->dst, nbytes, req_ctx->dst, flags))
-+		BUG_ON(req->dst->length < nbytes);
-+		req_ctx->dst = NULL;
-+		if (!chainup_buffers(dev, req->dst, nbytes, &dst_hook,
-+					flags, DMA_FROM_DEVICE))
- 			goto free_buf_dest;
- 		src_direction = DMA_TO_DEVICE;
-+		req_ctx->dst = dst_hook.next;
-+		crypt->dst_buf = dst_hook.phys_next;
- 	} else {
- 		req_ctx->dst = NULL;
--		req_ctx->dst_nents = 0;
- 	}
--	nents = count_sg(req->src, nbytes);
--	req_ctx->src_nents = nents;
--	dma_map_sg(dev, req->src, nents, src_direction);
--
--	req_ctx->src = dma_pool_alloc(buffer_pool, flags, &crypt->src_buf);
--	if (!req_ctx->src)
--		goto unmap_sg_src;
--	req_ctx->src->phys_addr = 0;
--	if (!chainup_buffers(req->src, nbytes, req_ctx->src, flags))
-+	req_ctx->src = NULL;
-+	if (!chainup_buffers(dev, req->src, nbytes, &src_hook,
-+				flags, src_direction))
- 		goto free_buf_src;
- 
-+	req_ctx->src = src_hook.next;
-+	crypt->src_buf = src_hook.phys_next;
- 	crypt->ctl_flags |= CTL_FLAG_PERFORM_ABLK;
- 	qmgr_put_entry(SEND_QID, crypt_virt2phys(crypt));
- 	BUG_ON(qmgr_stat_overflow(SEND_QID));
- 	return -EINPROGRESS;
- 
- free_buf_src:
--	free_buf_chain(req_ctx->src, crypt->src_buf);
--unmap_sg_src:
--	dma_unmap_sg(dev, req->src, req_ctx->src_nents, src_direction);
-+	free_buf_chain(dev, req_ctx->src, crypt->src_buf);
- free_buf_dest:
- 	if (req->src != req->dst) {
--		free_buf_chain(req_ctx->dst, crypt->dst_buf);
--unmap_sg_dest:
--		dma_unmap_sg(dev, req->src, req_ctx->dst_nents,
--			DMA_FROM_DEVICE);
-+		free_buf_chain(dev, req_ctx->dst, crypt->dst_buf);
- 	}
- 	crypt->ctl_flags = CTL_FLAG_UNUSED;
--	return ret;
-+	return -ENOMEM;
- }
- 
- static int ablk_encrypt(struct ablkcipher_request *req)
-@@ -985,7 +939,7 @@ static int hmac_inconsistent(struct scatterlist *sg, unsigned start,
- 			break;
- 
- 		offset += sg->length;
--		sg = sg_next(sg);
-+		sg = scatterwalk_sg_next(sg);
- 	}
- 	return (start + nbytes > offset + sg->length);
- }
-@@ -997,11 +951,10 @@ static int aead_perform(struct aead_request *req, int encrypt,
- 	struct ixp_ctx *ctx = crypto_aead_ctx(tfm);
- 	unsigned ivsize = crypto_aead_ivsize(tfm);
- 	unsigned authsize = crypto_aead_authsize(tfm);
--	int ret = -ENOMEM;
- 	struct ix_sa_dir *dir;
- 	struct crypt_ctl *crypt;
--	unsigned int cryptlen, nents;
--	struct buffer_desc *buf;
-+	unsigned int cryptlen;
-+	struct buffer_desc *buf, src_hook;
- 	struct aead_ctx *req_ctx = aead_request_ctx(req);
- 	gfp_t flags = req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP ?
- 				GFP_KERNEL : GFP_ATOMIC;
-@@ -1022,7 +975,7 @@ static int aead_perform(struct aead_request *req, int encrypt,
- 	}
- 	crypt = get_crypt_desc();
- 	if (!crypt)
--		return ret;
-+		return -ENOMEM;
- 
- 	crypt->data.aead_req = req;
- 	crypt->crypto_ctx = dir->npe_ctx_phys;
-@@ -1041,31 +994,27 @@ static int aead_perform(struct aead_request *req, int encrypt,
- 		BUG(); /* -ENOTSUP because of my lazyness */
- 	}
- 
--	req_ctx->buffer = dma_pool_alloc(buffer_pool, flags, &crypt->src_buf);
--	if (!req_ctx->buffer)
--		goto out;
--	req_ctx->buffer->phys_addr = 0;
- 	/* ASSOC data */
--	nents = count_sg(req->assoc, req->assoclen);
--	req_ctx->assoc_nents = nents;
--	dma_map_sg(dev, req->assoc, nents, DMA_TO_DEVICE);
--	buf = chainup_buffers(req->assoc, req->assoclen, req_ctx->buffer,flags);
-+	buf = chainup_buffers(dev, req->assoc, req->assoclen, &src_hook,
-+		flags, DMA_TO_DEVICE);
-+	req_ctx->buffer = src_hook.next;
-+	crypt->src_buf = src_hook.phys_next;
- 	if (!buf)
--		goto unmap_sg_assoc;
-+		goto out;
- 	/* IV */
- 	sg_init_table(&req_ctx->ivlist, 1);
- 	sg_set_buf(&req_ctx->ivlist, iv, ivsize);
--	dma_map_sg(dev, &req_ctx->ivlist, 1, DMA_BIDIRECTIONAL);
--	buf = chainup_buffers(&req_ctx->ivlist, ivsize, buf, flags);
-+	buf = chainup_buffers(dev, &req_ctx->ivlist, ivsize, buf, flags,
-+			DMA_BIDIRECTIONAL);
- 	if (!buf)
--		goto unmap_sg_iv;
-+		goto free_chain;
- 	if (unlikely(hmac_inconsistent(req->src, cryptlen, authsize))) {
- 		/* The 12 hmac bytes are scattered,
- 		 * we need to copy them into a safe buffer */
- 		req_ctx->hmac_virt = dma_pool_alloc(buffer_pool, flags,
- 				&crypt->icv_rev_aes);
- 		if (unlikely(!req_ctx->hmac_virt))
--			goto unmap_sg_iv;
-+			goto free_chain;
- 		if (!encrypt) {
- 			scatterwalk_map_and_copy(req_ctx->hmac_virt,
- 				req->src, cryptlen, authsize, 0);
-@@ -1075,33 +1024,28 @@ static int aead_perform(struct aead_request *req, int encrypt,
- 		req_ctx->hmac_virt = NULL;
- 	}
- 	/* Crypt */
--	nents = count_sg(req->src, cryptlen + authsize);
--	req_ctx->src_nents = nents;
--	dma_map_sg(dev, req->src, nents, DMA_BIDIRECTIONAL);
--	buf = chainup_buffers(req->src, cryptlen + authsize, buf, flags);
-+	buf = chainup_buffers(dev, req->src, cryptlen + authsize, buf, flags,
-+			DMA_BIDIRECTIONAL);
- 	if (!buf)
--		goto unmap_sg_src;
-+		goto free_hmac_virt;
- 	if (!req_ctx->hmac_virt) {
- 		crypt->icv_rev_aes = buf->phys_addr + buf->buf_len - authsize;
- 	}
-+
- 	crypt->ctl_flags |= CTL_FLAG_PERFORM_AEAD;
- 	qmgr_put_entry(SEND_QID, crypt_virt2phys(crypt));
- 	BUG_ON(qmgr_stat_overflow(SEND_QID));
- 	return -EINPROGRESS;
--unmap_sg_src:
--	dma_unmap_sg(dev, req->src, req_ctx->src_nents, DMA_BIDIRECTIONAL);
-+free_hmac_virt:
- 	if (req_ctx->hmac_virt) {
- 		dma_pool_free(buffer_pool, req_ctx->hmac_virt,
- 				crypt->icv_rev_aes);
- 	}
--unmap_sg_iv:
--	dma_unmap_sg(dev, &req_ctx->ivlist, 1, DMA_BIDIRECTIONAL);
--unmap_sg_assoc:
--	dma_unmap_sg(dev, req->assoc, req_ctx->assoc_nents, DMA_TO_DEVICE);
--	free_buf_chain(req_ctx->buffer, crypt->src_buf);
-+free_chain:
-+	free_buf_chain(dev, req_ctx->buffer, crypt->src_buf);
- out:
- 	crypt->ctl_flags = CTL_FLAG_UNUSED;
--	return ret;
-+	return -ENOMEM;
- }
- 
- static int aead_setup(struct crypto_aead *tfm, unsigned int authsize)
-diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
-index d6cc986..9239747 100644
---- a/drivers/gpu/drm/i915/i915_drv.h
-+++ b/drivers/gpu/drm/i915/i915_drv.h
-@@ -773,7 +773,8 @@ extern int i915_wait_ring(struct drm_device * dev, int n, const char *caller);
- 		       (dev)->pci_device == 0x2A42 || \
- 		       (dev)->pci_device == 0x2E02 || \
- 		       (dev)->pci_device == 0x2E12 || \
--		       (dev)->pci_device == 0x2E22)
-+		       (dev)->pci_device == 0x2E22 || \
-+		       (dev)->pci_device == 0x2E32)
- 
- #define IS_I965GM(dev) ((dev)->pci_device == 0x2A02)
- 
-@@ -782,6 +783,7 @@ extern int i915_wait_ring(struct drm_device * dev, int n, const char *caller);
- #define IS_G4X(dev) ((dev)->pci_device == 0x2E02 || \
- 		     (dev)->pci_device == 0x2E12 || \
- 		     (dev)->pci_device == 0x2E22 || \
-+		     (dev)->pci_device == 0x2E32 || \
- 		     IS_GM45(dev))
- 
- #define IS_G33(dev)    ((dev)->pci_device == 0x29C2 ||	\
-diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
-index cc2938d..a787fb8 100644
---- a/drivers/gpu/drm/i915/i915_reg.h
-+++ b/drivers/gpu/drm/i915/i915_reg.h
-@@ -1431,6 +1431,7 @@
- #define   DISPPLANE_NO_LINE_DOUBLE		0
- #define   DISPPLANE_STEREO_POLARITY_FIRST	0
- #define   DISPPLANE_STEREO_POLARITY_SECOND	(1<<18)
-+#define   DISPPLANE_TILED			(1<<10)
- #define DSPAADDR		0x70184
- #define DSPASTRIDE		0x70188
- #define DSPAPOS			0x7018C /* reserved */
-diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index 601a76f..254c5ca 100644
---- a/drivers/gpu/drm/i915/intel_display.c
-+++ b/drivers/gpu/drm/i915/intel_display.c
-@@ -338,6 +338,7 @@ intel_pipe_set_base(struct drm_crtc *crtc, int x, int y,
- 	int dspbase = (pipe == 0 ? DSPAADDR : DSPBADDR);
- 	int dspsurf = (pipe == 0 ? DSPASURF : DSPBSURF);
- 	int dspstride = (pipe == 0) ? DSPASTRIDE : DSPBSTRIDE;
-+	int dsptileoff = (pipe == 0 ? DSPATILEOFF : DSPBTILEOFF);
- 	int dspcntr_reg = (pipe == 0) ? DSPACNTR : DSPBCNTR;
- 	u32 dspcntr, alignment;
- 	int ret;
-@@ -414,6 +415,13 @@ intel_pipe_set_base(struct drm_crtc *crtc, int x, int y,
- 		mutex_unlock(&dev->struct_mutex);
- 		return -EINVAL;
- 	}
-+	if (IS_I965G(dev)) {
-+		if (obj_priv->tiling_mode != I915_TILING_NONE)
-+			dspcntr |= DISPPLANE_TILED;
-+		else
-+			dspcntr &= ~DISPPLANE_TILED;
-+	}
-+
- 	I915_WRITE(dspcntr_reg, dspcntr);
- 
- 	Start = obj_priv->gtt_offset;
-@@ -426,6 +434,7 @@ intel_pipe_set_base(struct drm_crtc *crtc, int x, int y,
- 		I915_READ(dspbase);
- 		I915_WRITE(dspsurf, Start);
- 		I915_READ(dspsurf);
-+		I915_WRITE(dsptileoff, (y << 16) | x);
- 	} else {
- 		I915_WRITE(dspbase, Start + Offset);
- 		I915_READ(dspbase);
-diff --git a/drivers/ide/cs5536.c b/drivers/ide/cs5536.c
-index 7a62db7..dc89bc2 100644
---- a/drivers/ide/cs5536.c
-+++ b/drivers/ide/cs5536.c
-@@ -237,6 +237,7 @@ static const struct ide_dma_ops cs5536_dma_ops = {
- 	.dma_test_irq		= ide_dma_test_irq,
- 	.dma_lost_irq		= ide_dma_lost_irq,
- 	.dma_timeout		= ide_dma_timeout,
-+	.dma_sff_read_status	= ide_dma_sff_read_status,
- };
- 
- static const struct ide_port_info cs5536_info = {
-diff --git a/drivers/net/b44.c b/drivers/net/b44.c
-index dc5f051..c2ffa8c 100644
---- a/drivers/net/b44.c
-+++ b/drivers/net/b44.c
-@@ -750,7 +750,7 @@ static void b44_recycle_rx(struct b44 *bp, int src_idx, u32 dest_idx_unmasked)
- 					     dest_idx * sizeof(dest_desc),
- 					     DMA_BIDIRECTIONAL);
- 
--	ssb_dma_sync_single_for_device(bp->sdev, le32_to_cpu(src_desc->addr),
-+	ssb_dma_sync_single_for_device(bp->sdev, dest_map->mapping,
- 				       RX_PKT_BUF_SZ,
- 				       DMA_FROM_DEVICE);
- }
-diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
-index b8251e8..df0794e 100644
---- a/drivers/net/forcedeth.c
-+++ b/drivers/net/forcedeth.c
-@@ -5995,6 +5995,9 @@ static int nv_resume(struct pci_dev *pdev)
- 	for (i = 0;i <= np->register_size/sizeof(u32); i++)
- 		writel(np->saved_config_space[i], base+i*sizeof(u32));
- 
-+	/* restore phy state, including autoneg */
-+	phy_init(dev);
-+
- 	netif_device_attach(dev);
- 	if (netif_running(dev)) {
- 		rc = nv_open(dev);
-diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
-index b0bc3bc..67bb769 100644
---- a/drivers/net/mv643xx_eth.c
-+++ b/drivers/net/mv643xx_eth.c
-@@ -372,12 +372,12 @@ struct mv643xx_eth_private {
- 	struct work_struct tx_timeout_task;
- 
- 	struct napi_struct napi;
-+	u8 oom;
- 	u8 work_link;
- 	u8 work_tx;
- 	u8 work_tx_end;
- 	u8 work_rx;
- 	u8 work_rx_refill;
--	u8 work_rx_oom;
- 
- 	int skb_size;
- 	struct sk_buff_head rx_recycle;
-@@ -603,7 +603,7 @@ static int rxq_refill(struct rx_queue *rxq, int budget)
- 					    dma_get_cache_alignment() - 1);
- 
- 		if (skb == NULL) {
--			mp->work_rx_oom |= 1 << rxq->index;
-+			mp->oom = 1;
- 			goto oom;
- 		}
- 
-@@ -1177,7 +1177,6 @@ static void mib_counters_update(struct mv643xx_eth_private *mp)
- 
- 	spin_lock_bh(&mp->mib_counters_lock);
- 	p->good_octets_received += mib_read(mp, 0x00);
--	p->good_octets_received += (u64)mib_read(mp, 0x04) << 32;
- 	p->bad_octets_received += mib_read(mp, 0x08);
- 	p->internal_mac_transmit_err += mib_read(mp, 0x0c);
- 	p->good_frames_received += mib_read(mp, 0x10);
-@@ -1191,7 +1190,6 @@ static void mib_counters_update(struct mv643xx_eth_private *mp)
- 	p->frames_512_to_1023_octets += mib_read(mp, 0x30);
- 	p->frames_1024_to_max_octets += mib_read(mp, 0x34);
- 	p->good_octets_sent += mib_read(mp, 0x38);
--	p->good_octets_sent += (u64)mib_read(mp, 0x3c) << 32;
- 	p->good_frames_sent += mib_read(mp, 0x40);
- 	p->excessive_collision += mib_read(mp, 0x44);
- 	p->multicast_frames_sent += mib_read(mp, 0x48);
-@@ -1908,8 +1906,10 @@ static int mv643xx_eth_poll(struct napi_struct *napi, int budget)
- 
- 	mp = container_of(napi, struct mv643xx_eth_private, napi);
- 
--	mp->work_rx_refill |= mp->work_rx_oom;
--	mp->work_rx_oom = 0;
-+	if (unlikely(mp->oom)) {
-+		mp->oom = 0;
-+		del_timer(&mp->rx_oom);
-+	}
- 
- 	work_done = 0;
- 	while (work_done < budget) {
-@@ -1923,8 +1923,10 @@ static int mv643xx_eth_poll(struct napi_struct *napi, int budget)
- 			continue;
- 		}
- 
--		queue_mask = mp->work_tx | mp->work_tx_end |
--				mp->work_rx | mp->work_rx_refill;
-+		queue_mask = mp->work_tx | mp->work_tx_end | mp->work_rx;
-+		if (likely(!mp->oom))
-+			queue_mask |= mp->work_rx_refill;
-+
- 		if (!queue_mask) {
- 			if (mv643xx_eth_collect_events(mp))
- 				continue;
-@@ -1945,7 +1947,7 @@ static int mv643xx_eth_poll(struct napi_struct *napi, int budget)
- 			txq_maybe_wake(mp->txq + queue);
- 		} else if (mp->work_rx & queue_mask) {
- 			work_done += rxq_process(mp->rxq + queue, work_tbd);
--		} else if (mp->work_rx_refill & queue_mask) {
-+		} else if (!mp->oom && (mp->work_rx_refill & queue_mask)) {
- 			work_done += rxq_refill(mp->rxq + queue, work_tbd);
- 		} else {
- 			BUG();
-@@ -1953,7 +1955,7 @@ static int mv643xx_eth_poll(struct napi_struct *napi, int budget)
- 	}
- 
- 	if (work_done < budget) {
--		if (mp->work_rx_oom)
-+		if (mp->oom)
- 			mod_timer(&mp->rx_oom, jiffies + (HZ / 10));
- 		napi_complete(napi);
- 		wrlp(mp, INT_MASK, INT_TX_END | INT_RX | INT_EXT);
-@@ -2145,7 +2147,7 @@ static int mv643xx_eth_open(struct net_device *dev)
- 		rxq_refill(mp->rxq + i, INT_MAX);
- 	}
- 
--	if (mp->work_rx_oom) {
-+	if (mp->oom) {
- 		mp->rx_oom.expires = jiffies + (HZ / 10);
- 		add_timer(&mp->rx_oom);
- 	}
-diff --git a/drivers/net/wireless/ath5k/debug.c b/drivers/net/wireless/ath5k/debug.c
-index ccaeb5c..9347a3c 100644
---- a/drivers/net/wireless/ath5k/debug.c
-+++ b/drivers/net/wireless/ath5k/debug.c
-@@ -465,7 +465,7 @@ ath5k_debug_dump_bands(struct ath5k_softc *sc)
- 
- 	for (b = 0; b < IEEE80211_NUM_BANDS; b++) {
- 		struct ieee80211_supported_band *band = &sc->sbands[b];
--		char bname[5];
-+		char bname[6];
- 		switch (band->band) {
- 		case IEEE80211_BAND_2GHZ:
- 			strcpy(bname, "2 GHz");
-diff --git a/drivers/net/wireless/ath9k/main.c b/drivers/net/wireless/ath9k/main.c
-index 3c04044..1cc826b 100644
---- a/drivers/net/wireless/ath9k/main.c
-+++ b/drivers/net/wireless/ath9k/main.c
-@@ -2300,11 +2300,6 @@ static void ath9k_configure_filter(struct ieee80211_hw *hw,
- 	rfilt = ath_calcrxfilter(sc);
- 	ath9k_hw_setrxfilter(sc->sc_ah, rfilt);
- 
--	if (changed_flags & FIF_BCN_PRBRESP_PROMISC) {
--		if (*total_flags & FIF_BCN_PRBRESP_PROMISC)
--			ath9k_hw_write_associd(sc->sc_ah, ath_bcast_mac, 0);
--	}
--
- 	DPRINTF(sc, ATH_DBG_CONFIG, "Set HW RX filter: 0x%x\n", sc->rx.rxfilter);
- }
- 
-diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
-index 6d65a02..dbae617 100644
---- a/drivers/net/wireless/b43/dma.c
-+++ b/drivers/net/wireless/b43/dma.c
-@@ -551,11 +551,32 @@ address_error:
- 	return 1;
- }
- 
-+static bool b43_rx_buffer_is_poisoned(struct b43_dmaring *ring, struct sk_buff *skb)
-+{
-+	unsigned char *f = skb->data + ring->frameoffset;
-+
-+	return ((f[0] & f[1] & f[2] & f[3] & f[4] & f[5] & f[6] & f[7]) == 0xFF);
-+}
-+
-+static void b43_poison_rx_buffer(struct b43_dmaring *ring, struct sk_buff *skb)
-+{
-+	struct b43_rxhdr_fw4 *rxhdr;
-+	unsigned char *frame;
-+
-+	/* This poisons the RX buffer to detect DMA failures. */
-+
-+	rxhdr = (struct b43_rxhdr_fw4 *)(skb->data);
-+	rxhdr->frame_len = 0;
-+
-+	B43_WARN_ON(ring->rx_buffersize < ring->frameoffset + sizeof(struct b43_plcp_hdr6) + 2);
-+	frame = skb->data + ring->frameoffset;
-+	memset(frame, 0xFF, sizeof(struct b43_plcp_hdr6) + 2 /* padding */);
-+}
-+
- static int setup_rx_descbuffer(struct b43_dmaring *ring,
- 			       struct b43_dmadesc_generic *desc,
- 			       struct b43_dmadesc_meta *meta, gfp_t gfp_flags)
- {
--	struct b43_rxhdr_fw4 *rxhdr;
- 	dma_addr_t dmaaddr;
- 	struct sk_buff *skb;
- 
-@@ -564,6 +585,7 @@ static int setup_rx_descbuffer(struct b43_dmaring *ring,
- 	skb = __dev_alloc_skb(ring->rx_buffersize, gfp_flags);
- 	if (unlikely(!skb))
- 		return -ENOMEM;
-+	b43_poison_rx_buffer(ring, skb);
- 	dmaaddr = map_descbuffer(ring, skb->data, ring->rx_buffersize, 0);
- 	if (b43_dma_mapping_error(ring, dmaaddr, ring->rx_buffersize, 0)) {
- 		/* ugh. try to realloc in zone_dma */
-@@ -574,6 +596,7 @@ static int setup_rx_descbuffer(struct b43_dmaring *ring,
- 		skb = __dev_alloc_skb(ring->rx_buffersize, gfp_flags);
- 		if (unlikely(!skb))
- 			return -ENOMEM;
-+		b43_poison_rx_buffer(ring, skb);
- 		dmaaddr = map_descbuffer(ring, skb->data,
- 					 ring->rx_buffersize, 0);
- 	}
-@@ -589,9 +612,6 @@ static int setup_rx_descbuffer(struct b43_dmaring *ring,
- 	ring->ops->fill_descriptor(ring, desc, dmaaddr,
- 				   ring->rx_buffersize, 0, 0, 0);
- 
--	rxhdr = (struct b43_rxhdr_fw4 *)(skb->data);
--	rxhdr->frame_len = 0;
--
- 	return 0;
- }
- 
-@@ -1476,12 +1496,17 @@ static void dma_rx(struct b43_dmaring *ring, int *slot)
- 			len = le16_to_cpu(rxhdr->frame_len);
- 		} while (len == 0 && i++ < 5);
- 		if (unlikely(len == 0)) {
--			/* recycle the descriptor buffer. */
--			sync_descbuffer_for_device(ring, meta->dmaaddr,
--						   ring->rx_buffersize);
--			goto drop;
-+			dmaaddr = meta->dmaaddr;
-+			goto drop_recycle_buffer;
- 		}
- 	}
-+	if (unlikely(b43_rx_buffer_is_poisoned(ring, skb))) {
-+		/* Something went wrong with the DMA.
-+		 * The device did not touch the buffer and did not overwrite the poison. */
-+		b43dbg(ring->dev->wl, "DMA RX: Dropping poisoned buffer.\n");
-+		dmaaddr = meta->dmaaddr;
-+		goto drop_recycle_buffer;
-+	}
- 	if (unlikely(len > ring->rx_buffersize)) {
- 		/* The data did not fit into one descriptor buffer
- 		 * and is split over multiple buffers.
-@@ -1494,6 +1519,7 @@ static void dma_rx(struct b43_dmaring *ring, int *slot)
- 		while (1) {
- 			desc = ops->idx2desc(ring, *slot, &meta);
- 			/* recycle the descriptor buffer. */
-+			b43_poison_rx_buffer(ring, meta->skb);
- 			sync_descbuffer_for_device(ring, meta->dmaaddr,
- 						   ring->rx_buffersize);
- 			*slot = next_slot(ring, *slot);
-@@ -1512,8 +1538,7 @@ static void dma_rx(struct b43_dmaring *ring, int *slot)
- 	err = setup_rx_descbuffer(ring, desc, meta, GFP_ATOMIC);
- 	if (unlikely(err)) {
- 		b43dbg(ring->dev->wl, "DMA RX: setup_rx_descbuffer() failed\n");
--		sync_descbuffer_for_device(ring, dmaaddr, ring->rx_buffersize);
--		goto drop;
-+		goto drop_recycle_buffer;
- 	}
- 
- 	unmap_descbuffer(ring, dmaaddr, ring->rx_buffersize, 0);
-@@ -1523,6 +1548,11 @@ static void dma_rx(struct b43_dmaring *ring, int *slot)
- 	b43_rx(ring->dev, skb, rxhdr);
- drop:
- 	return;
-+
-+drop_recycle_buffer:
-+	/* Poison and recycle the RX buffer. */
-+	b43_poison_rx_buffer(ring, skb);
-+	sync_descbuffer_for_device(ring, dmaaddr, ring->rx_buffersize);
- }
- 
- void b43_dma_rx(struct b43_dmaring *ring)
-diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
-index ed93ac4..f6a9388 100644
---- a/drivers/net/wireless/rndis_wlan.c
-+++ b/drivers/net/wireless/rndis_wlan.c
-@@ -2550,6 +2550,11 @@ static int rndis_wext_bind(struct usbnet *usbdev, struct usb_interface *intf)
- 	mutex_init(&priv->command_lock);
- 	spin_lock_init(&priv->stats_lock);
- 
-+	/* because rndis_command() sleeps we need to use workqueue */
-+	priv->workqueue = create_singlethread_workqueue("rndis_wlan");
-+	INIT_WORK(&priv->work, rndis_wext_worker);
-+	INIT_DELAYED_WORK(&priv->stats_work, rndis_update_wireless_stats);
-+
- 	/* try bind rndis_host */
- 	retval = generic_rndis_bind(usbdev, intf, FLAG_RNDIS_PHYM_WIRELESS);
- 	if (retval < 0)
-@@ -2594,16 +2599,17 @@ static int rndis_wext_bind(struct usbnet *usbdev, struct usb_interface *intf)
- 	disassociate(usbdev, 1);
- 	netif_carrier_off(usbdev->net);
- 
--	/* because rndis_command() sleeps we need to use workqueue */
--	priv->workqueue = create_singlethread_workqueue("rndis_wlan");
--	INIT_DELAYED_WORK(&priv->stats_work, rndis_update_wireless_stats);
- 	queue_delayed_work(priv->workqueue, &priv->stats_work,
- 		round_jiffies_relative(STATS_UPDATE_JIFFIES));
--	INIT_WORK(&priv->work, rndis_wext_worker);
- 
- 	return 0;
- 
- fail:
-+	cancel_delayed_work_sync(&priv->stats_work);
-+	cancel_work_sync(&priv->work);
-+	flush_workqueue(priv->workqueue);
-+	destroy_workqueue(priv->workqueue);
-+
- 	kfree(priv);
- 	return retval;
- }
-diff --git a/drivers/pci/dmar.c b/drivers/pci/dmar.c
-index 26c536b..8a01120 100644
---- a/drivers/pci/dmar.c
-+++ b/drivers/pci/dmar.c
-@@ -170,12 +170,21 @@ dmar_parse_one_drhd(struct acpi_dmar_header *header)
- 	struct dmar_drhd_unit *dmaru;
- 	int ret = 0;
- 
-+	drhd = (struct acpi_dmar_hardware_unit *)header;
-+	if (!drhd->address) {
-+		/* Promote an attitude of violence to a BIOS engineer today */
-+		WARN(1, "Your BIOS is broken; DMAR reported at address zero!\n"
-+		     "BIOS vendor: %s; Ver: %s; Product Version: %s\n",
-+		     dmi_get_system_info(DMI_BIOS_VENDOR),
-+		     dmi_get_system_info(DMI_BIOS_VERSION),
-+		     dmi_get_system_info(DMI_PRODUCT_VERSION));
-+		return -ENODEV;
-+	}
- 	dmaru = kzalloc(sizeof(*dmaru), GFP_KERNEL);
- 	if (!dmaru)
- 		return -ENOMEM;
- 
- 	dmaru->hdr = header;
--	drhd = (struct acpi_dmar_hardware_unit *)header;
- 	dmaru->reg_base_addr = drhd->address;
- 	dmaru->include_all = drhd->flags & 0x1; /* BIT0: INCLUDE_ALL */
- 
-diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
-index f3f6865..7e4f9e6 100644
---- a/drivers/pci/intel-iommu.c
-+++ b/drivers/pci/intel-iommu.c
-@@ -447,11 +447,17 @@ static struct intel_iommu *device_to_iommu(u8 bus, u8 devfn)
- 		if (drhd->ignored)
- 			continue;
- 
--		for (i = 0; i < drhd->devices_cnt; i++)
-+		for (i = 0; i < drhd->devices_cnt; i++) {
- 			if (drhd->devices[i] &&
- 			    drhd->devices[i]->bus->number == bus &&
- 			    drhd->devices[i]->devfn == devfn)
- 				return drhd->iommu;
-+			if (drhd->devices[i] &&
-+			    drhd->devices[i]->subordinate &&
-+			    drhd->devices[i]->subordinate->number <= bus &&
-+			    drhd->devices[i]->subordinate->subordinate >= bus)
-+				return drhd->iommu;
-+		}
- 
- 		if (drhd->include_all)
- 			return drhd->iommu;
-diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
-index 92b9efe..c65c2f4 100644
---- a/drivers/pci/quirks.c
-+++ b/drivers/pci/quirks.c
-@@ -1960,6 +1960,7 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RS400_200, quirk_di
- DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RS480, quirk_disable_all_msi);
- DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_VT3336, quirk_disable_all_msi);
- DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_VT3351, quirk_disable_all_msi);
-+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_VT3364, quirk_disable_all_msi);
- 
- /* Disable MSI on chipsets that are known to not support it */
- static void __devinit quirk_disable_msi(struct pci_dev *dev)
-diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
-index d243320..99d32f7 100644
---- a/drivers/platform/x86/thinkpad_acpi.c
-+++ b/drivers/platform/x86/thinkpad_acpi.c
-@@ -306,11 +306,17 @@ static u32 dbg_level;
- 
- static struct workqueue_struct *tpacpi_wq;
- 
-+enum led_status_t {
-+	TPACPI_LED_OFF = 0,
-+	TPACPI_LED_ON,
-+	TPACPI_LED_BLINK,
-+};
-+
- /* Special LED class that can defer work */
- struct tpacpi_led_classdev {
- 	struct led_classdev led_classdev;
- 	struct work_struct work;
--	enum led_brightness new_brightness;
-+	enum led_status_t new_state;
- 	unsigned int led;
- };
- 
-@@ -4057,7 +4063,7 @@ static void light_set_status_worker(struct work_struct *work)
- 			container_of(work, struct tpacpi_led_classdev, work);
- 
- 	if (likely(tpacpi_lifecycle == TPACPI_LIFE_RUNNING))
--		light_set_status((data->new_brightness != LED_OFF));
-+		light_set_status((data->new_state != TPACPI_LED_OFF));
- }
- 
- static void light_sysfs_set(struct led_classdev *led_cdev,
-@@ -4067,7 +4073,8 @@ static void light_sysfs_set(struct led_classdev *led_cdev,
- 		container_of(led_cdev,
- 			     struct tpacpi_led_classdev,
- 			     led_classdev);
--	data->new_brightness = brightness;
-+	data->new_state = (brightness != LED_OFF) ?
-+				TPACPI_LED_ON : TPACPI_LED_OFF;
- 	queue_work(tpacpi_wq, &data->work);
- }
- 
-@@ -4574,12 +4581,6 @@ enum {	/* For TPACPI_LED_OLD */
- 	TPACPI_LED_EC_HLMS = 0x0e,	/* EC reg to select led to command */
- };
- 
--enum led_status_t {
--	TPACPI_LED_OFF = 0,
--	TPACPI_LED_ON,
--	TPACPI_LED_BLINK,
--};
--
- static enum led_access_mode led_supported;
- 
- TPACPI_HANDLE(led, ec, "SLED",	/* 570 */
-@@ -4673,23 +4674,13 @@ static int led_set_status(const unsigned int led,
- 	return rc;
- }
- 
--static void led_sysfs_set_status(unsigned int led,
--				 enum led_brightness brightness)
--{
--	led_set_status(led,
--			(brightness == LED_OFF) ?
--			TPACPI_LED_OFF :
--			(tpacpi_led_state_cache[led] == TPACPI_LED_BLINK) ?
--				TPACPI_LED_BLINK : TPACPI_LED_ON);
--}
--
- static void led_set_status_worker(struct work_struct *work)
- {
- 	struct tpacpi_led_classdev *data =
- 		container_of(work, struct tpacpi_led_classdev, work);
- 
- 	if (likely(tpacpi_lifecycle == TPACPI_LIFE_RUNNING))
--		led_sysfs_set_status(data->led, data->new_brightness);
-+		led_set_status(data->led, data->new_state);
- }
- 
- static void led_sysfs_set(struct led_classdev *led_cdev,
-@@ -4698,7 +4689,13 @@ static void led_sysfs_set(struct led_classdev *led_cdev,
- 	struct tpacpi_led_classdev *data = container_of(led_cdev,
- 			     struct tpacpi_led_classdev, led_classdev);
- 
--	data->new_brightness = brightness;
-+	if (brightness == LED_OFF)
-+		data->new_state = TPACPI_LED_OFF;
-+	else if (tpacpi_led_state_cache[data->led] != TPACPI_LED_BLINK)
-+		data->new_state = TPACPI_LED_ON;
-+	else
-+		data->new_state = TPACPI_LED_BLINK;
-+
- 	queue_work(tpacpi_wq, &data->work);
- }
- 
-@@ -4716,7 +4713,7 @@ static int led_sysfs_blink_set(struct led_classdev *led_cdev,
- 	} else if ((*delay_on != 500) || (*delay_off != 500))
- 		return -EINVAL;
- 
--	data->new_brightness = TPACPI_LED_BLINK;
-+	data->new_state = TPACPI_LED_BLINK;
- 	queue_work(tpacpi_wq, &data->work);
- 
- 	return 0;
-diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
-index cfcfd5a..4b36d88 100644
---- a/drivers/usb/serial/usb-serial.c
-+++ b/drivers/usb/serial/usb-serial.c
-@@ -136,22 +136,10 @@ static void destroy_serial(struct kref *kref)
- 
- 	dbg("%s - %s", __func__, serial->type->description);
- 
--	serial->type->shutdown(serial);
--
- 	/* return the minor range that this device had */
- 	if (serial->minor != SERIAL_TTY_NO_MINOR)
- 		return_serial(serial);
- 
--	for (i = 0; i < serial->num_ports; ++i)
--		serial->port[i]->port.count = 0;
--
--	/* the ports are cleaned up and released in port_release() */
--	for (i = 0; i < serial->num_ports; ++i)
--		if (serial->port[i]->dev.parent != NULL) {
--			device_unregister(&serial->port[i]->dev);
--			serial->port[i] = NULL;
--		}
--
- 	/* If this is a "fake" port, we have to clean it up here, as it will
- 	 * not get cleaned up in port_release() as it was never registered with
- 	 * the driver core */
-@@ -186,7 +174,7 @@ static int serial_open (struct tty_struct *tty, struct file *filp)
- 	struct usb_serial *serial;
- 	struct usb_serial_port *port;
- 	unsigned int portNumber;
--	int retval;
-+	int retval = 0;
- 
- 	dbg("%s", __func__);
- 
-@@ -197,16 +185,24 @@ static int serial_open (struct tty_struct *tty, struct file *filp)
- 		return -ENODEV;
- 	}
- 
-+	mutex_lock(&serial->disc_mutex);
- 	portNumber = tty->index - serial->minor;
- 	port = serial->port[portNumber];
--	if (!port) {
-+	if (!port || serial->disconnected)
- 		retval = -ENODEV;
--		goto bailout_kref_put;
--	}
-+	else
-+		get_device(&port->dev);
-+	/*
-+	 * Note: Our locking order requirement does not allow port->mutex
-+	 * to be acquired while serial->disc_mutex is held.
-+	 */
-+	mutex_unlock(&serial->disc_mutex);
-+	if (retval)
-+		goto bailout_serial_put;
- 
- 	if (mutex_lock_interruptible(&port->mutex)) {
- 		retval = -ERESTARTSYS;
--		goto bailout_kref_put;
-+		goto bailout_port_put;
- 	}
- 
- 	++port->port.count;
-@@ -226,14 +222,20 @@ static int serial_open (struct tty_struct *tty, struct file *filp)
- 			goto bailout_mutex_unlock;
- 		}
- 
--		retval = usb_autopm_get_interface(serial->interface);
-+		mutex_lock(&serial->disc_mutex);
-+		if (serial->disconnected)
-+			retval = -ENODEV;
-+		else
-+			retval = usb_autopm_get_interface(serial->interface);
- 		if (retval)
- 			goto bailout_module_put;
-+
- 		/* only call the device specific open if this
- 		 * is the first time the port is opened */
- 		retval = serial->type->open(tty, port, filp);
- 		if (retval)
- 			goto bailout_interface_put;
-+		mutex_unlock(&serial->disc_mutex);
- 	}
- 
- 	mutex_unlock(&port->mutex);
-@@ -242,13 +244,16 @@ static int serial_open (struct tty_struct *tty, struct file *filp)
- bailout_interface_put:
- 	usb_autopm_put_interface(serial->interface);
- bailout_module_put:
-+	mutex_unlock(&serial->disc_mutex);
- 	module_put(serial->type->driver.owner);
- bailout_mutex_unlock:
- 	port->port.count = 0;
- 	tty->driver_data = NULL;
- 	tty_port_tty_set(&port->port, NULL);
- 	mutex_unlock(&port->mutex);
--bailout_kref_put:
-+bailout_port_put:
-+	put_device(&port->dev);
-+bailout_serial_put:
- 	usb_serial_put(serial);
- 	return retval;
- }
-@@ -256,6 +261,9 @@ bailout_kref_put:
- static void serial_close(struct tty_struct *tty, struct file *filp)
- {
- 	struct usb_serial_port *port = tty->driver_data;
-+	struct usb_serial *serial;
-+	struct module *owner;
-+	int count;
- 
- 	if (!port)
- 		return;
-@@ -263,6 +271,8 @@ static void serial_close(struct tty_struct *tty, struct file *filp)
- 	dbg("%s - port %d", __func__, port->number);
- 
- 	mutex_lock(&port->mutex);
-+	serial = port->serial;
-+	owner = serial->type->driver.owner;
- 
- 	if (port->port.count == 0) {
- 		mutex_unlock(&port->mutex);
-@@ -275,7 +285,7 @@ static void serial_close(struct tty_struct *tty, struct file *filp)
- 		 * this before we drop the port count. The call is protected
- 		 * by the port mutex
- 		 */
--		port->serial->type->close(tty, port, filp);
-+		serial->type->close(tty, port, filp);
- 
- 	if (port->port.count == (port->console ? 2 : 1)) {
- 		struct tty_struct *tty = tty_port_tty_get(&port->port);
-@@ -289,17 +299,23 @@ static void serial_close(struct tty_struct *tty, struct file *filp)
- 		}
- 	}
- 
--	if (port->port.count == 1) {
--		mutex_lock(&port->serial->disc_mutex);
--		if (!port->serial->disconnected)
--			usb_autopm_put_interface(port->serial->interface);
--		mutex_unlock(&port->serial->disc_mutex);
--		module_put(port->serial->type->driver.owner);
--	}
- 	--port->port.count;
--
-+	count = port->port.count;
- 	mutex_unlock(&port->mutex);
--	usb_serial_put(port->serial);
-+	put_device(&port->dev);
-+
-+	/* Mustn't dereference port any more */
-+	if (count == 0) {
-+		mutex_lock(&serial->disc_mutex);
-+		if (!serial->disconnected)
-+			usb_autopm_put_interface(serial->interface);
-+		mutex_unlock(&serial->disc_mutex);
-+	}
-+	usb_serial_put(serial);
-+
-+	/* Mustn't dereference serial any more */
-+	if (count == 0)
-+		module_put(owner);
- }
- 
- static int serial_write(struct tty_struct *tty, const unsigned char *buf,
-@@ -548,7 +564,13 @@ static void kill_traffic(struct usb_serial_port *port)
- 
- static void port_free(struct usb_serial_port *port)
- {
-+	/*
-+	 * Stop all the traffic before cancelling the work, so that
-+	 * nobody will restart it by calling usb_serial_port_softint.
-+	 */
- 	kill_traffic(port);
-+	cancel_work_sync(&port->work);
-+
- 	usb_free_urb(port->read_urb);
- 	usb_free_urb(port->write_urb);
- 	usb_free_urb(port->interrupt_in_urb);
-@@ -557,7 +579,6 @@ static void port_free(struct usb_serial_port *port)
- 	kfree(port->bulk_out_buffer);
- 	kfree(port->interrupt_in_buffer);
- 	kfree(port->interrupt_out_buffer);
--	flush_scheduled_work();		/* port->work */
- 	kfree(port);
- }
- 
-@@ -1042,6 +1063,12 @@ void usb_serial_disconnect(struct usb_interface *interface)
- 	usb_set_intfdata(interface, NULL);
- 	/* must set a flag, to signal subdrivers */
- 	serial->disconnected = 1;
-+	mutex_unlock(&serial->disc_mutex);
-+
-+	/* Unfortunately, many of the sub-drivers expect the port structures
-+	 * to exist when their shutdown method is called, so we have to go
-+	 * through this awkward two-step unregistration procedure.
-+	 */
- 	for (i = 0; i < serial->num_ports; ++i) {
- 		port = serial->port[i];
- 		if (port) {
-@@ -1051,11 +1078,21 @@ void usb_serial_disconnect(struct usb_interface *interface)
- 				tty_kref_put(tty);
- 			}
- 			kill_traffic(port);
-+			cancel_work_sync(&port->work);
-+			device_del(&port->dev);
-+		}
-+	}
-+	serial->type->shutdown(serial);
-+	for (i = 0; i < serial->num_ports; ++i) {
-+		port = serial->port[i];
-+		if (port) {
-+			put_device(&port->dev);
-+			serial->port[i] = NULL;
- 		}
- 	}
-+
- 	/* let the last holder of this object
- 	 * cause it to be cleaned up */
--	mutex_unlock(&serial->disc_mutex);
- 	usb_serial_put(serial);
- 	dev_info(dev, "device disconnected\n");
- }
-diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
-index 0f54399..af39dec 100644
---- a/drivers/usb/storage/unusual_devs.h
-+++ b/drivers/usb/storage/unusual_devs.h
-@@ -2134,6 +2134,12 @@ UNUSUAL_DEV(  0xed06, 0x4500, 0x0001, 0x0001,
- 		US_SC_DEVICE, US_PR_DEVICE, NULL,
- 		US_FL_CAPACITY_HEURISTICS),
- 
-+/* Reported by Alessio Treglia <quadrispro@××××××.com> */
-+UNUSUAL_DEV( 0xed10, 0x7636, 0x0001, 0x0001,
-+		"TGE",
-+		"Digital MP3 Audio Player",
-+		US_SC_DEVICE, US_PR_DEVICE, NULL, US_FL_NOT_LOCKABLE ),
-+
- /* Control/Bulk transport for all SubClass values */
- USUAL_DEV(US_SC_RBC, US_PR_CB, USB_US_TYPE_STOR),
- USUAL_DEV(US_SC_8020, US_PR_CB, USB_US_TYPE_STOR),
-diff --git a/fs/Makefile b/fs/Makefile
-index dc20db3..0cd7097 100644
---- a/fs/Makefile
-+++ b/fs/Makefile
-@@ -11,7 +11,7 @@ obj-y :=	open.o read_write.o file_table.o super.o \
- 		attr.o bad_inode.o file.o filesystems.o namespace.o \
- 		seq_file.o xattr.o libfs.o fs-writeback.o \
- 		pnode.o drop_caches.o splice.o sync.o utimes.o \
--		stack.o
-+		stack.o fs_struct.o
- 
- ifeq ($(CONFIG_BLOCK),y)
- obj-y +=	buffer.o bio.o block_dev.o direct-io.o mpage.o ioprio.o
-diff --git a/fs/bio.c b/fs/bio.c
-index d4f0632..bfdfe57 100644
---- a/fs/bio.c
-+++ b/fs/bio.c
-@@ -806,6 +806,9 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
- 		len += iov[i].iov_len;
- 	}
- 
-+	if (offset)
-+		nr_pages++;
-+
- 	bmd = bio_alloc_map_data(nr_pages, iov_count, gfp_mask);
- 	if (!bmd)
- 		return ERR_PTR(-ENOMEM);
-diff --git a/fs/compat.c b/fs/compat.c
-index d0145ca..1df8926 100644
---- a/fs/compat.c
-+++ b/fs/compat.c
-@@ -51,6 +51,7 @@
- #include <linux/poll.h>
- #include <linux/mm.h>
- #include <linux/eventpoll.h>
-+#include <linux/fs_struct.h>
- 
- #include <asm/uaccess.h>
- #include <asm/mmu_context.h>
-@@ -1392,12 +1393,18 @@ int compat_do_execve(char * filename,
- {
- 	struct linux_binprm *bprm;
- 	struct file *file;
-+	struct files_struct *displaced;
-+	bool clear_in_exec;
- 	int retval;
- 
-+	retval = unshare_files(&displaced);
-+	if (retval)
-+		goto out_ret;
-+
- 	retval = -ENOMEM;
- 	bprm = kzalloc(sizeof(*bprm), GFP_KERNEL);
- 	if (!bprm)
--		goto out_ret;
-+		goto out_files;
- 
- 	retval = mutex_lock_interruptible(&current->cred_exec_mutex);
- 	if (retval < 0)
-@@ -1407,12 +1414,16 @@ int compat_do_execve(char * filename,
- 	bprm->cred = prepare_exec_creds();
- 	if (!bprm->cred)
- 		goto out_unlock;
--	check_unsafe_exec(bprm, current->files);
-+
-+	retval = check_unsafe_exec(bprm);
-+	if (retval < 0)
-+		goto out_unlock;
-+	clear_in_exec = retval;
- 
- 	file = open_exec(filename);
- 	retval = PTR_ERR(file);
- 	if (IS_ERR(file))
--		goto out_unlock;
-+		goto out_unmark;
- 
- 	sched_exec();
- 
-@@ -1454,9 +1465,12 @@ int compat_do_execve(char * filename,
- 		goto out;
- 
- 	/* execve succeeded */
-+	current->fs->in_exec = 0;
- 	mutex_unlock(&current->cred_exec_mutex);
- 	acct_update_integrals(current);
- 	free_bprm(bprm);
-+	if (displaced)
-+		put_files_struct(displaced);
- 	return retval;
- 
- out:
-@@ -1469,12 +1483,19 @@ out_file:
- 		fput(bprm->file);
- 	}
- 
-+out_unmark:
-+	if (clear_in_exec)
-+		current->fs->in_exec = 0;
-+
- out_unlock:
- 	mutex_unlock(&current->cred_exec_mutex);
- 
- out_free:
- 	free_bprm(bprm);
- 
-+out_files:
-+	if (displaced)
-+		reset_files_struct(displaced);
- out_ret:
- 	return retval;
- }
-diff --git a/fs/exec.c b/fs/exec.c
-index 929b580..3b36c69 100644
---- a/fs/exec.c
-+++ b/fs/exec.c
-@@ -1049,32 +1049,35 @@ EXPORT_SYMBOL(install_exec_creds);
-  * - the caller must hold current->cred_exec_mutex to protect against
-  *   PTRACE_ATTACH
-  */
--void check_unsafe_exec(struct linux_binprm *bprm, struct files_struct *files)
-+int check_unsafe_exec(struct linux_binprm *bprm)
- {
- 	struct task_struct *p = current, *t;
--	unsigned long flags;
--	unsigned n_fs, n_files, n_sighand;
-+	unsigned n_fs;
-+	int res = 0;
- 
- 	bprm->unsafe = tracehook_unsafe_exec(p);
- 
- 	n_fs = 1;
--	n_files = 1;
--	n_sighand = 1;
--	lock_task_sighand(p, &flags);
-+	write_lock(&p->fs->lock);
-+	rcu_read_lock();
- 	for (t = next_thread(p); t != p; t = next_thread(t)) {
- 		if (t->fs == p->fs)
- 			n_fs++;
--		if (t->files == files)
--			n_files++;
--		n_sighand++;
- 	}
-+	rcu_read_unlock();
- 
--	if (atomic_read(&p->fs->count) > n_fs ||
--	    atomic_read(&p->files->count) > n_files ||
--	    atomic_read(&p->sighand->count) > n_sighand)
-+	if (p->fs->users > n_fs) {
- 		bprm->unsafe |= LSM_UNSAFE_SHARE;
-+	} else {
-+		res = -EAGAIN;
-+		if (!p->fs->in_exec) {
-+			p->fs->in_exec = 1;
-+			res = 1;
-+		}
-+	}
-+	write_unlock(&p->fs->lock);
- 
--	unlock_task_sighand(p, &flags);
-+	return res;
- }
- 
- /* 
-@@ -1270,6 +1273,7 @@ int do_execve(char * filename,
- 	struct linux_binprm *bprm;
- 	struct file *file;
- 	struct files_struct *displaced;
-+	bool clear_in_exec;
- 	int retval;
- 
- 	retval = unshare_files(&displaced);
-@@ -1289,12 +1293,16 @@ int do_execve(char * filename,
- 	bprm->cred = prepare_exec_creds();
- 	if (!bprm->cred)
- 		goto out_unlock;
--	check_unsafe_exec(bprm, displaced);
-+
-+	retval = check_unsafe_exec(bprm);
-+	if (retval < 0)
-+		goto out_unlock;
-+	clear_in_exec = retval;
- 
- 	file = open_exec(filename);
- 	retval = PTR_ERR(file);
- 	if (IS_ERR(file))
--		goto out_unlock;
-+		goto out_unmark;
- 
- 	sched_exec();
- 
-@@ -1337,6 +1345,7 @@ int do_execve(char * filename,
- 		goto out;
- 
- 	/* execve succeeded */
-+	current->fs->in_exec = 0;
- 	mutex_unlock(&current->cred_exec_mutex);
- 	acct_update_integrals(current);
- 	free_bprm(bprm);
-@@ -1354,6 +1363,10 @@ out_file:
- 		fput(bprm->file);
- 	}
- 
-+out_unmark:
-+	if (clear_in_exec)
-+		current->fs->in_exec = 0;
-+
- out_unlock:
- 	mutex_unlock(&current->cred_exec_mutex);
- 
-diff --git a/fs/fs_struct.c b/fs/fs_struct.c
-new file mode 100644
-index 0000000..41cff72
---- /dev/null
-+++ b/fs/fs_struct.c
-@@ -0,0 +1,170 @@
-+#include <linux/module.h>
-+#include <linux/sched.h>
-+#include <linux/fs.h>
-+#include <linux/path.h>
-+#include <linux/slab.h>
-+
-+/*
-+ * Replace the fs->{rootmnt,root} with {mnt,dentry}. Put the old values.
-+ * It can block.
-+ */
-+void set_fs_root(struct fs_struct *fs, struct path *path)
-+{
-+	struct path old_root;
-+
-+	write_lock(&fs->lock);
-+	old_root = fs->root;
-+	fs->root = *path;
-+	path_get(path);
-+	write_unlock(&fs->lock);
-+	if (old_root.dentry)
-+		path_put(&old_root);
-+}
-+
-+/*
-+ * Replace the fs->{pwdmnt,pwd} with {mnt,dentry}. Put the old values.
-+ * It can block.
-+ */
-+void set_fs_pwd(struct fs_struct *fs, struct path *path)
-+{
-+	struct path old_pwd;
-+
-+	write_lock(&fs->lock);
-+	old_pwd = fs->pwd;
-+	fs->pwd = *path;
-+	path_get(path);
-+	write_unlock(&fs->lock);
-+
-+	if (old_pwd.dentry)
-+		path_put(&old_pwd);
-+}
-+
-+void chroot_fs_refs(struct path *old_root, struct path *new_root)
-+{
-+	struct task_struct *g, *p;
-+	struct fs_struct *fs;
-+	int count = 0;
-+
-+	read_lock(&tasklist_lock);
-+	do_each_thread(g, p) {
-+		task_lock(p);
-+		fs = p->fs;
-+		if (fs) {
-+			write_lock(&fs->lock);
-+			if (fs->root.dentry == old_root->dentry
-+			    && fs->root.mnt == old_root->mnt) {
-+				path_get(new_root);
-+				fs->root = *new_root;
-+				count++;
-+			}
-+			if (fs->pwd.dentry == old_root->dentry
-+			    && fs->pwd.mnt == old_root->mnt) {
-+				path_get(new_root);
-+				fs->pwd = *new_root;
-+				count++;
-+			}
-+			write_unlock(&fs->lock);
-+		}
-+		task_unlock(p);
-+	} while_each_thread(g, p);
-+	read_unlock(&tasklist_lock);
-+	while (count--)
-+		path_put(old_root);
-+}
-+
-+void free_fs_struct(struct fs_struct *fs)
-+{
-+	path_put(&fs->root);
-+	path_put(&fs->pwd);
-+	kmem_cache_free(fs_cachep, fs);
-+}
-+
-+void exit_fs(struct task_struct *tsk)
-+{
-+	struct fs_struct *fs = tsk->fs;
-+
-+	if (fs) {
-+		int kill;
-+		task_lock(tsk);
-+		write_lock(&fs->lock);
-+		tsk->fs = NULL;
-+		kill = !--fs->users;
-+		write_unlock(&fs->lock);
-+		task_unlock(tsk);
-+		if (kill)
-+			free_fs_struct(fs);
-+	}
-+}
-+
-+struct fs_struct *copy_fs_struct(struct fs_struct *old)
-+{
-+	struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL);
-+	/* We don't need to lock fs - think why ;-) */
-+	if (fs) {
-+		fs->users = 1;
-+		fs->in_exec = 0;
-+		rwlock_init(&fs->lock);
-+		fs->umask = old->umask;
-+		read_lock(&old->lock);
-+		fs->root = old->root;
-+		path_get(&old->root);
-+		fs->pwd = old->pwd;
-+		path_get(&old->pwd);
-+		read_unlock(&old->lock);
-+	}
-+	return fs;
-+}
-+
-+int unshare_fs_struct(void)
-+{
-+	struct fs_struct *fs = current->fs;
-+	struct fs_struct *new_fs = copy_fs_struct(fs);
-+	int kill;
-+
-+	if (!new_fs)
-+		return -ENOMEM;
-+
-+	task_lock(current);
-+	write_lock(&fs->lock);
-+	kill = !--fs->users;
-+	current->fs = new_fs;
-+	write_unlock(&fs->lock);
-+	task_unlock(current);
-+
-+	if (kill)
-+		free_fs_struct(fs);
-+
-+	return 0;
-+}
-+EXPORT_SYMBOL_GPL(unshare_fs_struct);
-+
-+/* to be mentioned only in INIT_TASK */
-+struct fs_struct init_fs = {
-+	.users		= 1,
-+	.lock		= __RW_LOCK_UNLOCKED(init_fs.lock),
-+	.umask		= 0022,
-+};
-+
-+void daemonize_fs_struct(void)
-+{
-+	struct fs_struct *fs = current->fs;
-+
-+	if (fs) {
-+		int kill;
-+
-+		task_lock(current);
-+
-+		write_lock(&init_fs.lock);
-+		init_fs.users++;
-+		write_unlock(&init_fs.lock);
-+
-+		write_lock(&fs->lock);
-+		current->fs = &init_fs;
-+		kill = !--fs->users;
-+		write_unlock(&fs->lock);
-+
-+		task_unlock(current);
-+		if (kill)
-+			free_fs_struct(fs);
-+	}
-+}
-diff --git a/fs/internal.h b/fs/internal.h
-index 0d8ac49..b4dac4f 100644
---- a/fs/internal.h
-+++ b/fs/internal.h
-@@ -11,6 +11,7 @@
- 
- struct super_block;
- struct linux_binprm;
-+struct path;
- 
- /*
-  * block_dev.c
-@@ -43,7 +44,7 @@ extern void __init chrdev_init(void);
- /*
-  * exec.c
-  */
--extern void check_unsafe_exec(struct linux_binprm *, struct files_struct *);
-+extern int check_unsafe_exec(struct linux_binprm *);
- 
- /*
-  * namespace.c
-@@ -60,3 +61,8 @@ extern void umount_tree(struct vfsmount *, int, struct list_head *);
- extern struct vfsmount *copy_tree(struct vfsmount *, struct dentry *, int);
- 
- extern void __init mnt_init(void);
-+
-+/*
-+ * fs_struct.c
-+ */
-+extern void chroot_fs_refs(struct path *, struct path *);
-diff --git a/fs/namei.c b/fs/namei.c
-index bbc15c2..2389dda 100644
---- a/fs/namei.c
-+++ b/fs/namei.c
-@@ -2891,10 +2891,3 @@ EXPORT_SYMBOL(vfs_symlink);
- EXPORT_SYMBOL(vfs_unlink);
- EXPORT_SYMBOL(dentry_unhash);
- EXPORT_SYMBOL(generic_readlink);
--
--/* to be mentioned only in INIT_TASK */
--struct fs_struct init_fs = {
--	.count		= ATOMIC_INIT(1),
--	.lock		= __RW_LOCK_UNLOCKED(init_fs.lock),
--	.umask		= 0022,
--};
-diff --git a/fs/namespace.c b/fs/namespace.c
-index 06f8e63..685e354 100644
---- a/fs/namespace.c
-+++ b/fs/namespace.c
-@@ -2089,66 +2089,6 @@ out1:
- }
- 
- /*
-- * Replace the fs->{rootmnt,root} with {mnt,dentry}. Put the old values.
-- * It can block. Requires the big lock held.
-- */
--void set_fs_root(struct fs_struct *fs, struct path *path)
--{
--	struct path old_root;
--
--	write_lock(&fs->lock);
--	old_root = fs->root;
--	fs->root = *path;
--	path_get(path);
--	write_unlock(&fs->lock);
--	if (old_root.dentry)
--		path_put(&old_root);
--}
--
--/*
-- * Replace the fs->{pwdmnt,pwd} with {mnt,dentry}. Put the old values.
-- * It can block. Requires the big lock held.
-- */
--void set_fs_pwd(struct fs_struct *fs, struct path *path)
--{
--	struct path old_pwd;
--
--	write_lock(&fs->lock);
--	old_pwd = fs->pwd;
--	fs->pwd = *path;
--	path_get(path);
--	write_unlock(&fs->lock);
--
--	if (old_pwd.dentry)
--		path_put(&old_pwd);
--}
--
--static void chroot_fs_refs(struct path *old_root, struct path *new_root)
--{
--	struct task_struct *g, *p;
--	struct fs_struct *fs;
--
--	read_lock(&tasklist_lock);
--	do_each_thread(g, p) {
--		task_lock(p);
--		fs = p->fs;
--		if (fs) {
--			atomic_inc(&fs->count);
--			task_unlock(p);
--			if (fs->root.dentry == old_root->dentry
--			    && fs->root.mnt == old_root->mnt)
--				set_fs_root(fs, new_root);
--			if (fs->pwd.dentry == old_root->dentry
--			    && fs->pwd.mnt == old_root->mnt)
--				set_fs_pwd(fs, new_root);
--			put_fs_struct(fs);
--		} else
--			task_unlock(p);
--	} while_each_thread(g, p);
--	read_unlock(&tasklist_lock);
--}
--
--/*
-  * pivot_root Semantics:
-  * Moves the root file system of the current process to the directory put_old,
-  * makes new_root as the new root file system of the current process, and sets
-diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c
-index 07e4f5d..144d699 100644
---- a/fs/nfsd/nfssvc.c
-+++ b/fs/nfsd/nfssvc.c
-@@ -404,7 +404,6 @@ static int
- nfsd(void *vrqstp)
- {
- 	struct svc_rqst *rqstp = (struct svc_rqst *) vrqstp;
--	struct fs_struct *fsp;
- 	int err, preverr = 0;
- 
- 	/* Lock module and set up kernel thread */
-@@ -413,13 +412,11 @@ nfsd(void *vrqstp)
- 	/* At this point, the thread shares current->fs
- 	 * with the init process. We need to create files with a
- 	 * umask of 0 instead of init's umask. */
--	fsp = copy_fs_struct(current->fs);
--	if (!fsp) {
-+	if (unshare_fs_struct() < 0) {
- 		printk("Unable to start nfsd thread: out of memory\n");
- 		goto out;
- 	}
--	exit_fs(current);
--	current->fs = fsp;
-+
- 	current->fs->umask = 0;
- 
- 	/*
-diff --git a/fs/proc/array.c b/fs/proc/array.c
-index 7e4877d..725a650 100644
---- a/fs/proc/array.c
-+++ b/fs/proc/array.c
-@@ -80,6 +80,7 @@
- #include <linux/delayacct.h>
- #include <linux/seq_file.h>
- #include <linux/pid_namespace.h>
-+#include <linux/ptrace.h>
- #include <linux/tracehook.h>
- 
- #include <asm/pgtable.h>
-@@ -352,6 +353,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
- 	char state;
- 	pid_t ppid = 0, pgid = -1, sid = -1;
- 	int num_threads = 0;
-+	int permitted;
- 	struct mm_struct *mm;
- 	unsigned long long start_time;
- 	unsigned long cmin_flt = 0, cmaj_flt = 0;
-@@ -364,11 +366,14 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
- 
- 	state = *get_task_state(task);
- 	vsize = eip = esp = 0;
-+	permitted = ptrace_may_access(task, PTRACE_MODE_READ);
- 	mm = get_task_mm(task);
- 	if (mm) {
- 		vsize = task_vsize(mm);
--		eip = KSTK_EIP(task);
--		esp = KSTK_ESP(task);
-+		if (permitted) {
-+			eip = KSTK_EIP(task);
-+			esp = KSTK_ESP(task);
-+		}
- 	}
- 
- 	get_task_comm(tcomm, task);
-@@ -424,7 +429,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
- 		unlock_task_sighand(task, &flags);
- 	}
- 
--	if (!whole || num_threads < 2)
-+	if (permitted && (!whole || num_threads < 2))
- 		wchan = get_wchan(task);
- 	if (!whole) {
- 		min_flt = task->min_flt;
-@@ -476,7 +481,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
- 		rsslim,
- 		mm ? mm->start_code : 0,
- 		mm ? mm->end_code : 0,
--		mm ? mm->start_stack : 0,
-+		(permitted && mm) ? mm->start_stack : 0,
- 		esp,
- 		eip,
- 		/* The signal information here is obsolete.
-diff --git a/fs/proc/base.c b/fs/proc/base.c
-index beaa0ce..74e83e7 100644
---- a/fs/proc/base.c
-+++ b/fs/proc/base.c
-@@ -146,15 +146,22 @@ static unsigned int pid_entry_count_dirs(const struct pid_entry *entries,
- 	return count;
- }
- 
--static struct fs_struct *get_fs_struct(struct task_struct *task)
-+static int get_fs_path(struct task_struct *task, struct path *path, bool root)
- {
- 	struct fs_struct *fs;
-+	int result = -ENOENT;
-+
- 	task_lock(task);
- 	fs = task->fs;
--	if(fs)
--		atomic_inc(&fs->count);
-+	if (fs) {
-+		read_lock(&fs->lock);
-+		*path = root ? fs->root : fs->pwd;
-+		path_get(path);
-+		read_unlock(&fs->lock);
-+		result = 0;
-+	}
- 	task_unlock(task);
--	return fs;
-+	return result;
- }
- 
- static int get_nr_threads(struct task_struct *tsk)
-@@ -172,42 +179,24 @@ static int get_nr_threads(struct task_struct *tsk)
- static int proc_cwd_link(struct inode *inode, struct path *path)
- {
- 	struct task_struct *task = get_proc_task(inode);
--	struct fs_struct *fs = NULL;
- 	int result = -ENOENT;
- 
- 	if (task) {
--		fs = get_fs_struct(task);
-+		result = get_fs_path(task, path, 0);
- 		put_task_struct(task);
- 	}
--	if (fs) {
--		read_lock(&fs->lock);
--		*path = fs->pwd;
--		path_get(&fs->pwd);
--		read_unlock(&fs->lock);
--		result = 0;
--		put_fs_struct(fs);
--	}
- 	return result;
- }
- 
- static int proc_root_link(struct inode *inode, struct path *path)
- {
- 	struct task_struct *task = get_proc_task(inode);
--	struct fs_struct *fs = NULL;
- 	int result = -ENOENT;
- 
- 	if (task) {
--		fs = get_fs_struct(task);
-+		result = get_fs_path(task, path, 1);
- 		put_task_struct(task);
- 	}
--	if (fs) {
--		read_lock(&fs->lock);
--		*path = fs->root;
--		path_get(&fs->root);
--		read_unlock(&fs->lock);
--		result = 0;
--		put_fs_struct(fs);
--	}
- 	return result;
- }
- 
-@@ -332,7 +321,10 @@ static int proc_pid_wchan(struct task_struct *task, char *buffer)
- 	wchan = get_wchan(task);
- 
- 	if (lookup_symbol_name(wchan, symname) < 0)
--		return sprintf(buffer, "%lu", wchan);
-+		if (!ptrace_may_access(task, PTRACE_MODE_READ))
-+			return 0;
-+		else
-+			return sprintf(buffer, "%lu", wchan);
- 	else
- 		return sprintf(buffer, "%s", symname);
- }
-@@ -596,7 +588,6 @@ static int mounts_open_common(struct inode *inode, struct file *file,
- 	struct task_struct *task = get_proc_task(inode);
- 	struct nsproxy *nsp;
- 	struct mnt_namespace *ns = NULL;
--	struct fs_struct *fs = NULL;
- 	struct path root;
- 	struct proc_mounts *p;
- 	int ret = -EINVAL;
-@@ -610,22 +601,16 @@ static int mounts_open_common(struct inode *inode, struct file *file,
- 				get_mnt_ns(ns);
- 		}
- 		rcu_read_unlock();
--		if (ns)
--			fs = get_fs_struct(task);
-+		if (ns && get_fs_path(task, &root, 1) == 0)
-+			ret = 0;
- 		put_task_struct(task);
- 	}
- 
- 	if (!ns)
- 		goto err;
--	if (!fs)
-+	if (ret)
- 		goto err_put_ns;
- 
--	read_lock(&fs->lock);
--	root = fs->root;
--	path_get(&root);
--	read_unlock(&fs->lock);
--	put_fs_struct(fs);
--
- 	ret = -ENOMEM;
- 	p = kmalloc(sizeof(struct proc_mounts), GFP_KERNEL);
- 	if (!p)
-diff --git a/fs/proc/meminfo.c b/fs/proc/meminfo.c
-index 43d2394..52981cd 100644
---- a/fs/proc/meminfo.c
-+++ b/fs/proc/meminfo.c
-@@ -35,7 +35,7 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
- #define K(x) ((x) << (PAGE_SHIFT - 10))
- 	si_meminfo(&i);
- 	si_swapinfo(&i);
--	committed = atomic_long_read(&vm_committed_space);
-+	committed = percpu_counter_read_positive(&vm_committed_as);
- 	allowed = ((totalram_pages - hugetlb_total_pages())
- 		* sysctl_overcommit_ratio / 100) + total_swap_pages;
- 
-diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
-index 9406384..c93ed2d 100644
---- a/fs/proc/task_mmu.c
-+++ b/fs/proc/task_mmu.c
-@@ -663,6 +663,10 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
- 		goto out_task;
- 
- 	ret = 0;
-+
-+	if (!count)
-+		goto out_task;
-+
- 	mm = get_task_mm(task);
- 	if (!mm)
- 		goto out_task;
-diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c
-index 343ea12..6ca0105 100644
---- a/fs/proc/task_nommu.c
-+++ b/fs/proc/task_nommu.c
-@@ -49,7 +49,7 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
- 	else
- 		bytes += kobjsize(mm);
- 	
--	if (current->fs && atomic_read(&current->fs->count) > 1)
-+	if (current->fs && current->fs->users > 1)
- 		sbytes += kobjsize(current->fs);
- 	else
- 		bytes += kobjsize(current->fs);
-diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
-index 5165f24..671fab3 100644
---- a/include/drm/drm_pciids.h
-+++ b/include/drm/drm_pciids.h
-@@ -418,4 +418,5 @@
- 	{0x8086, 0x2e02, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
- 	{0x8086, 0x2e12, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
- 	{0x8086, 0x2e22, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
-+	{0x8086, 0x2e32, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
- 	{0, 0, 0}
-diff --git a/include/linux/fs_struct.h b/include/linux/fs_struct.h
-index a97c053..78a05bf 100644
---- a/include/linux/fs_struct.h
-+++ b/include/linux/fs_struct.h
-@@ -4,9 +4,10 @@
- #include <linux/path.h>
- 
- struct fs_struct {
--	atomic_t count;
-+	int users;
- 	rwlock_t lock;
- 	int umask;
-+	int in_exec;
- 	struct path root, pwd;
- };
- 
-@@ -16,6 +17,8 @@ extern void exit_fs(struct task_struct *);
- extern void set_fs_root(struct fs_struct *, struct path *);
- extern void set_fs_pwd(struct fs_struct *, struct path *);
- extern struct fs_struct *copy_fs_struct(struct fs_struct *);
--extern void put_fs_struct(struct fs_struct *);
-+extern void free_fs_struct(struct fs_struct *);
-+extern void daemonize_fs_struct(void);
-+extern int unshare_fs_struct(void);
- 
- #endif /* _LINUX_FS_STRUCT_H */
-diff --git a/include/linux/genhd.h b/include/linux/genhd.h
-index 16948ea..102d9e9 100644
---- a/include/linux/genhd.h
-+++ b/include/linux/genhd.h
-@@ -214,6 +214,7 @@ static inline void disk_put_part(struct hd_struct *part)
- #define DISK_PITER_REVERSE	(1 << 0) /* iterate in the reverse direction */
- #define DISK_PITER_INCL_EMPTY	(1 << 1) /* include 0-sized parts */
- #define DISK_PITER_INCL_PART0	(1 << 2) /* include partition 0 */
-+#define DISK_PITER_INCL_EMPTY_PART0 (1 << 3) /* include empty partition 0 */
- 
- struct disk_part_iter {
- 	struct gendisk		*disk;
-diff --git a/include/linux/kvm.h b/include/linux/kvm.h
-index 0424326..c344599 100644
---- a/include/linux/kvm.h
-+++ b/include/linux/kvm.h
-@@ -396,6 +396,8 @@ struct kvm_trace_rec {
- #ifdef __KVM_HAVE_USER_NMI
- #define KVM_CAP_USER_NMI 22
- #endif
-+/* Another bug in KVM_SET_USER_MEMORY_REGION fixed: */
-+#define KVM_CAP_JOIN_MEMORY_REGIONS_WORKS 30
- 
- /*
-  * ioctls for VM fds
-diff --git a/include/linux/mman.h b/include/linux/mman.h
-index 30d1073..9872d6c 100644
---- a/include/linux/mman.h
-+++ b/include/linux/mman.h
-@@ -12,21 +12,18 @@
- 
- #ifdef __KERNEL__
- #include <linux/mm.h>
-+#include <linux/percpu_counter.h>
- 
- #include <asm/atomic.h>
- 
- extern int sysctl_overcommit_memory;
- extern int sysctl_overcommit_ratio;
--extern atomic_long_t vm_committed_space;
-+extern struct percpu_counter vm_committed_as;
- 
--#ifdef CONFIG_SMP
--extern void vm_acct_memory(long pages);
--#else
- static inline void vm_acct_memory(long pages)
- {
--	atomic_long_add(pages, &vm_committed_space);
-+	percpu_counter_add(&vm_committed_as, pages);
- }
--#endif
- 
- static inline void vm_unacct_memory(long pages)
- {
-diff --git a/include/linux/pci_regs.h b/include/linux/pci_regs.h
-index 027815b..b647a4d 100644
---- a/include/linux/pci_regs.h
-+++ b/include/linux/pci_regs.h
-@@ -235,7 +235,7 @@
- #define  PCI_PM_CAP_PME_SHIFT	11	/* Start of the PME Mask in PMC */
- #define PCI_PM_CTRL		4	/* PM control and status register */
- #define  PCI_PM_CTRL_STATE_MASK	0x0003	/* Current power state (D0 to D3) */
--#define  PCI_PM_CTRL_NO_SOFT_RESET	0x0004	/* No reset for D3hot->D0 */
-+#define  PCI_PM_CTRL_NO_SOFT_RESET	0x0008	/* No reset for D3hot->D0 */
- #define  PCI_PM_CTRL_PME_ENABLE	0x0100	/* PME pin enable */
- #define  PCI_PM_CTRL_DATA_SEL_MASK	0x1e00	/* Data select (??) */
- #define  PCI_PM_CTRL_DATA_SCALE_MASK	0x6000	/* Data scale (??) */
-diff --git a/kernel/exec_domain.c b/kernel/exec_domain.c
-index 667c841..cb8e962 100644
---- a/kernel/exec_domain.c
-+++ b/kernel/exec_domain.c
-@@ -145,28 +145,6 @@ __set_personality(u_long personality)
- 		return 0;
- 	}
- 
--	if (atomic_read(&current->fs->count) != 1) {
--		struct fs_struct *fsp, *ofsp;
--
--		fsp = copy_fs_struct(current->fs);
--		if (fsp == NULL) {
--			module_put(ep->module);
--			return -ENOMEM;
--		}
--
--		task_lock(current);
--		ofsp = current->fs;
--		current->fs = fsp;
--		task_unlock(current);
--
--		put_fs_struct(ofsp);
--	}
--
--	/*
--	 * At that point we are guaranteed to be the sole owner of
--	 * current->fs.
--	 */
--
- 	current->personality = personality;
- 	oep = current_thread_info()->exec_domain;
- 	current_thread_info()->exec_domain = ep;
-diff --git a/kernel/exit.c b/kernel/exit.c
-index efd30cc..467ffcd 100644
---- a/kernel/exit.c
-+++ b/kernel/exit.c
-@@ -429,7 +429,6 @@ EXPORT_SYMBOL(disallow_signal);
- void daemonize(const char *name, ...)
- {
- 	va_list args;
--	struct fs_struct *fs;
- 	sigset_t blocked;
- 
- 	va_start(args, name);
-@@ -462,11 +461,7 @@ void daemonize(const char *name, ...)
- 
- 	/* Become as one with the init task */
- 
--	exit_fs(current);	/* current->fs->count--; */
--	fs = init_task.fs;
--	current->fs = fs;
--	atomic_inc(&fs->count);
--
-+	daemonize_fs_struct();
- 	exit_files(current);
- 	current->files = init_task.files;
- 	atomic_inc(&current->files->count);
-@@ -565,30 +560,6 @@ void exit_files(struct task_struct *tsk)
- 	}
- }
- 
--void put_fs_struct(struct fs_struct *fs)
--{
--	/* No need to hold fs->lock if we are killing it */
--	if (atomic_dec_and_test(&fs->count)) {
--		path_put(&fs->root);
--		path_put(&fs->pwd);
--		kmem_cache_free(fs_cachep, fs);
--	}
--}
--
--void exit_fs(struct task_struct *tsk)
--{
--	struct fs_struct * fs = tsk->fs;
--
--	if (fs) {
--		task_lock(tsk);
--		tsk->fs = NULL;
--		task_unlock(tsk);
--		put_fs_struct(fs);
--	}
--}
--
--EXPORT_SYMBOL_GPL(exit_fs);
--
- #ifdef CONFIG_MM_OWNER
- /*
-  * Task p is exiting and it owned mm, lets find a new owner for it
-@@ -950,8 +921,7 @@ static void exit_notify(struct task_struct *tsk, int group_dead)
- 	 */
- 	if (tsk->exit_signal != SIGCHLD && !task_detached(tsk) &&
- 	    (tsk->parent_exec_id != tsk->real_parent->self_exec_id ||
--	     tsk->self_exec_id != tsk->parent_exec_id) &&
--	    !capable(CAP_KILL))
-+	     tsk->self_exec_id != tsk->parent_exec_id))
- 		tsk->exit_signal = SIGCHLD;
- 
- 	signal = tracehook_notify_death(tsk, &cookie, group_dead);
-diff --git a/kernel/fork.c b/kernel/fork.c
-index 9b51a1b..8727a5a 100644
---- a/kernel/fork.c
-+++ b/kernel/fork.c
-@@ -676,38 +676,21 @@ fail_nomem:
- 	return retval;
- }
- 
--static struct fs_struct *__copy_fs_struct(struct fs_struct *old)
--{
--	struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL);
--	/* We don't need to lock fs - think why ;-) */
--	if (fs) {
--		atomic_set(&fs->count, 1);
--		rwlock_init(&fs->lock);
--		fs->umask = old->umask;
--		read_lock(&old->lock);
--		fs->root = old->root;
--		path_get(&old->root);
--		fs->pwd = old->pwd;
--		path_get(&old->pwd);
--		read_unlock(&old->lock);
--	}
--	return fs;
--}
--
--struct fs_struct *copy_fs_struct(struct fs_struct *old)
--{
--	return __copy_fs_struct(old);
--}
--
--EXPORT_SYMBOL_GPL(copy_fs_struct);
--
- static int copy_fs(unsigned long clone_flags, struct task_struct *tsk)
- {
-+	struct fs_struct *fs = current->fs;
- 	if (clone_flags & CLONE_FS) {
--		atomic_inc(&current->fs->count);
-+		/* tsk->fs is already what we want */
-+		write_lock(&fs->lock);
-+		if (fs->in_exec) {
-+			write_unlock(&fs->lock);
-+			return -EAGAIN;
-+		}
-+		fs->users++;
-+		write_unlock(&fs->lock);
- 		return 0;
- 	}
--	tsk->fs = __copy_fs_struct(current->fs);
-+	tsk->fs = copy_fs_struct(fs);
- 	if (!tsk->fs)
- 		return -ENOMEM;
- 	return 0;
-@@ -1543,12 +1526,16 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
- {
- 	struct fs_struct *fs = current->fs;
- 
--	if ((unshare_flags & CLONE_FS) &&
--	    (fs && atomic_read(&fs->count) > 1)) {
--		*new_fsp = __copy_fs_struct(current->fs);
--		if (!*new_fsp)
--			return -ENOMEM;
--	}
-+	if (!(unshare_flags & CLONE_FS) || !fs)
-+		return 0;
-+
-+	/* don't need lock here; in the worst case we'll do useless copy */
-+	if (fs->users == 1)
-+		return 0;
-+
-+	*new_fsp = copy_fs_struct(fs);
-+	if (!*new_fsp)
-+		return -ENOMEM;
- 
- 	return 0;
- }
-@@ -1664,8 +1651,13 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
- 
- 		if (new_fs) {
- 			fs = current->fs;
-+			write_lock(&fs->lock);
- 			current->fs = new_fs;
--			new_fs = fs;
-+			if (--fs->users)
-+				new_fs = NULL;
-+			else
-+				new_fs = fs;
-+			write_unlock(&fs->lock);
- 		}
- 
- 		if (new_mm) {
-@@ -1704,7 +1696,7 @@ bad_unshare_cleanup_sigh:
- 
- bad_unshare_cleanup_fs:
- 	if (new_fs)
--		put_fs_struct(new_fs);
-+		free_fs_struct(new_fs);
- 
- bad_unshare_cleanup_thread:
- bad_unshare_out:
-diff --git a/kernel/ptrace.c b/kernel/ptrace.c
-index c9cf48b..dc3b98e 100644
---- a/kernel/ptrace.c
-+++ b/kernel/ptrace.c
-@@ -186,7 +186,7 @@ int ptrace_attach(struct task_struct *task)
- 	/* Protect exec's credential calculations against our interference;
- 	 * SUID, SGID and LSM creds get determined differently under ptrace.
- 	 */
--	retval = mutex_lock_interruptible(&current->cred_exec_mutex);
-+	retval = mutex_lock_interruptible(&task->cred_exec_mutex);
- 	if (retval  < 0)
- 		goto out;
- 
-@@ -230,7 +230,7 @@ repeat:
- bad:
- 	write_unlock_irqrestore(&tasklist_lock, flags);
- 	task_unlock(task);
--	mutex_unlock(&current->cred_exec_mutex);
-+	mutex_unlock(&task->cred_exec_mutex);
- out:
- 	return retval;
- }
-diff --git a/kernel/sched.c b/kernel/sched.c
-index 5e80629..7d13deb 100644
---- a/kernel/sched.c
-+++ b/kernel/sched.c
-@@ -4347,7 +4347,7 @@ void account_process_tick(struct task_struct *p, int user_tick)
- 
- 	if (user_tick)
- 		account_user_time(p, one_jiffy, one_jiffy_scaled);
--	else if (p != rq->idle)
-+	else if ((p != rq->idle) || (irq_count() != HARDIRQ_OFFSET))
- 		account_system_time(p, HARDIRQ_OFFSET, one_jiffy,
- 				    one_jiffy_scaled);
- 	else
-diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
-index 21a5ca8..83c4417 100644
---- a/kernel/time/tick-common.c
-+++ b/kernel/time/tick-common.c
-@@ -93,7 +93,17 @@ void tick_handle_periodic(struct clock_event_device *dev)
- 	for (;;) {
- 		if (!clockevents_program_event(dev, next, ktime_get()))
- 			return;
--		tick_periodic(cpu);
-+		/*
-+		 * Have to be careful here. If we're in oneshot mode,
-+		 * before we call tick_periodic() in a loop, we need
-+		 * to be sure we're using a real hardware clocksource.
-+		 * Otherwise we could get trapped in an infinite
-+		 * loop, as the tick_periodic() increments jiffies,
-+		 * when then will increment time, posibly causing
-+		 * the loop to trigger again and again.
-+		 */
-+		if (timekeeping_valid_for_hres())
-+			tick_periodic(cpu);
- 		next = ktime_add(next, tick_period);
- 	}
- }
-diff --git a/mm/madvise.c b/mm/madvise.c
-index b9ce574..36d6ea2 100644
---- a/mm/madvise.c
-+++ b/mm/madvise.c
-@@ -112,6 +112,14 @@ static long madvise_willneed(struct vm_area_struct * vma,
- 	if (!file)
- 		return -EBADF;
- 
-+	/*
-+	 * Page cache readahead assumes page cache pages are order-0 which
-+	 * is not the case for hugetlbfs. Do not give a bad return value
-+	 * but ignore the advice.
-+	 */
-+	if (vma->vm_flags & VM_HUGETLB)
-+		return 0;
-+
- 	if (file->f_mapping->a_ops->get_xip_mem) {
- 		/* no bad return value, but ignore advice */
- 		return 0;
-diff --git a/mm/mmap.c b/mm/mmap.c
-index f1aa6f9..efff81b 100644
---- a/mm/mmap.c
-+++ b/mm/mmap.c
-@@ -84,7 +84,7 @@ EXPORT_SYMBOL(vm_get_page_prot);
- int sysctl_overcommit_memory = OVERCOMMIT_GUESS;  /* heuristic overcommit */
- int sysctl_overcommit_ratio = 50;	/* default is 50% */
- int sysctl_max_map_count __read_mostly = DEFAULT_MAX_MAP_COUNT;
--atomic_long_t vm_committed_space = ATOMIC_LONG_INIT(0);
-+struct percpu_counter vm_committed_as;
- 
- /*
-  * Check that a process has enough memory to allocate a new virtual
-@@ -178,11 +178,7 @@ int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin)
- 	if (mm)
- 		allowed -= mm->total_vm / 32;
- 
--	/*
--	 * cast `allowed' as a signed long because vm_committed_space
--	 * sometimes has a negative value
--	 */
--	if (atomic_long_read(&vm_committed_space) < (long)allowed)
-+	if (percpu_counter_read_positive(&vm_committed_as) < allowed)
- 		return 0;
- error:
- 	vm_unacct_memory(pages);
-@@ -2477,6 +2473,10 @@ void mm_drop_all_locks(struct mm_struct *mm)
-  */
- void __init mmap_init(void)
- {
-+	int ret;
-+
-+	ret = percpu_counter_init(&vm_committed_as, 0);
-+	VM_BUG_ON(ret);
- 	vm_area_cachep = kmem_cache_create("vm_area_struct",
- 			sizeof(struct vm_area_struct), 0,
- 			SLAB_PANIC, NULL);
-diff --git a/mm/nommu.c b/mm/nommu.c
-index 2fcf47d..ee955bc 100644
---- a/mm/nommu.c
-+++ b/mm/nommu.c
-@@ -62,7 +62,7 @@ void *high_memory;
- struct page *mem_map;
- unsigned long max_mapnr;
- unsigned long num_physpages;
--atomic_long_t vm_committed_space = ATOMIC_LONG_INIT(0);
-+struct percpu_counter vm_committed_as;
- int sysctl_overcommit_memory = OVERCOMMIT_GUESS; /* heuristic overcommit */
- int sysctl_overcommit_ratio = 50; /* default is 50% */
- int sysctl_max_map_count = DEFAULT_MAX_MAP_COUNT;
-@@ -463,6 +463,10 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
-  */
- void __init mmap_init(void)
- {
-+	int ret;
-+
-+	ret = percpu_counter_init(&vm_committed_as, 0);
-+	VM_BUG_ON(ret);
- 	vm_region_jar = kmem_cache_create("vm_region_jar",
- 					  sizeof(struct vm_region), 0,
- 					  SLAB_PANIC, NULL);
-@@ -1849,12 +1853,9 @@ int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin)
- 	if (mm)
- 		allowed -= mm->total_vm / 32;
- 
--	/*
--	 * cast `allowed' as a signed long because vm_committed_space
--	 * sometimes has a negative value
--	 */
--	if (atomic_long_read(&vm_committed_space) < (long)allowed)
-+	if (percpu_counter_read_positive(&vm_committed_as) < allowed)
- 		return 0;
-+
- error:
- 	vm_unacct_memory(pages);
- 
-diff --git a/mm/swap.c b/mm/swap.c
-index 8adb9fe..2460f7d 100644
---- a/mm/swap.c
-+++ b/mm/swap.c
-@@ -514,49 +514,6 @@ unsigned pagevec_lookup_tag(struct pagevec *pvec, struct address_space *mapping,
- 
- EXPORT_SYMBOL(pagevec_lookup_tag);
- 
--#ifdef CONFIG_SMP
--/*
-- * We tolerate a little inaccuracy to avoid ping-ponging the counter between
-- * CPUs
-- */
--#define ACCT_THRESHOLD	max(16, NR_CPUS * 2)
--
--static DEFINE_PER_CPU(long, committed_space);
--
--void vm_acct_memory(long pages)
--{
--	long *local;
--
--	preempt_disable();
--	local = &__get_cpu_var(committed_space);
--	*local += pages;
--	if (*local > ACCT_THRESHOLD || *local < -ACCT_THRESHOLD) {
--		atomic_long_add(*local, &vm_committed_space);
--		*local = 0;
--	}
--	preempt_enable();
--}
--
--#ifdef CONFIG_HOTPLUG_CPU
--
--/* Drop the CPU's cached committed space back into the central pool. */
--static int cpu_swap_callback(struct notifier_block *nfb,
--			     unsigned long action,
--			     void *hcpu)
--{
--	long *committed;
--
--	committed = &per_cpu(committed_space, (long)hcpu);
--	if (action == CPU_DEAD || action == CPU_DEAD_FROZEN) {
--		atomic_long_add(*committed, &vm_committed_space);
--		*committed = 0;
--		drain_cpu_pagevecs((long)hcpu);
--	}
--	return NOTIFY_OK;
--}
--#endif /* CONFIG_HOTPLUG_CPU */
--#endif /* CONFIG_SMP */
--
- /*
-  * Perform any setup for the swap system
-  */
-@@ -577,7 +534,4 @@ void __init swap_setup(void)
- 	 * Right now other parts of the system means that we
- 	 * _really_ don't want to cluster much more
- 	 */
--#ifdef CONFIG_HOTPLUG_CPU
--	hotcpu_notifier(cpu_swap_callback, 0);
--#endif
- }
-diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
-index 2b890af..4a78c17 100644
---- a/net/mac80211/mlme.c
-+++ b/net/mac80211/mlme.c
-@@ -1342,7 +1342,7 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
- 
- 	for (i = 0; i < elems.ext_supp_rates_len; i++) {
- 		int rate = (elems.ext_supp_rates[i] & 0x7f) * 5;
--		bool is_basic = !!(elems.supp_rates[i] & 0x80);
-+		bool is_basic = !!(elems.ext_supp_rates[i] & 0x80);
- 
- 		if (rate > 110)
- 			have_higher_than_11mbit = true;
-diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
-index 7175ae8..75837ca 100644
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -29,6 +29,7 @@
- static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
- 					   struct tid_ampdu_rx *tid_agg_rx,
- 					   struct sk_buff *skb,
-+					   struct ieee80211_rx_status *status,
- 					   u16 mpdu_seq_num,
- 					   int bar_req);
- /*
-@@ -1538,7 +1539,7 @@ ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
- 		/* manage reordering buffer according to requested */
- 		/* sequence number */
- 		rcu_read_lock();
--		ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, NULL,
-+		ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, NULL, NULL,
- 						 start_seq_num, 1);
- 		rcu_read_unlock();
- 		return RX_DROP_UNUSABLE;
-@@ -2034,6 +2035,7 @@ static inline u16 seq_sub(u16 sq1, u16 sq2)
- static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
- 					   struct tid_ampdu_rx *tid_agg_rx,
- 					   struct sk_buff *skb,
-+					   struct ieee80211_rx_status *rxstatus,
- 					   u16 mpdu_seq_num,
- 					   int bar_req)
- {
-@@ -2115,6 +2117,8 @@ static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
- 
- 	/* put the frame in the reordering buffer */
- 	tid_agg_rx->reorder_buf[index] = skb;
-+	memcpy(tid_agg_rx->reorder_buf[index]->cb, rxstatus,
-+	       sizeof(*rxstatus));
- 	tid_agg_rx->stored_mpdu_num++;
- 	/* release the buffer until next missing frame */
- 	index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn)
-@@ -2140,7 +2144,8 @@ static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
- }
- 
- static u8 ieee80211_rx_reorder_ampdu(struct ieee80211_local *local,
--				     struct sk_buff *skb)
-+				     struct sk_buff *skb,
-+				     struct ieee80211_rx_status *status)
- {
- 	struct ieee80211_hw *hw = &local->hw;
- 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-@@ -2191,7 +2196,7 @@ static u8 ieee80211_rx_reorder_ampdu(struct ieee80211_local *local,
- 
- 	/* according to mpdu sequence number deal with reordering buffer */
- 	mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
--	ret = ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb,
-+	ret = ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb, status,
- 						mpdu_seq_num, 0);
-  end_reorder:
- 	return ret;
-@@ -2255,7 +2260,7 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
- 		return;
- 	}
- 
--	if (!ieee80211_rx_reorder_ampdu(local, skb))
-+	if (!ieee80211_rx_reorder_ampdu(local, skb, status))
- 		__ieee80211_rx_handle_packet(hw, skb, status, rate);
- 
- 	rcu_read_unlock();
-diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
-index 8892161..723b647 100644
---- a/scripts/mod/modpost.c
-+++ b/scripts/mod/modpost.c
-@@ -2005,6 +2005,7 @@ static void read_markers(const char *fname)
- 		if (!mod->skip)
- 			add_marker(mod, marker, fmt);
- 	}
-+	release_file(file, size);
- 	return;
- fail:
- 	fatal("parse error in markers list file\n");
-diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
-index 0081597..e210b21 100644
---- a/security/selinux/hooks.c
-+++ b/security/selinux/hooks.c
-@@ -4661,6 +4661,7 @@ static int selinux_ip_postroute_iptables_compat(struct sock *sk,
- 	if (err)
- 		return err;
- 	err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
-+	if (err)
- 		return err;
- 
- 	err = sel_netnode_sid(addrp, family, &node_sid);
-diff --git a/sound/soc/codecs/wm8580.c b/sound/soc/codecs/wm8580.c
-index d004e58..f3d15d5 100644
---- a/sound/soc/codecs/wm8580.c
-+++ b/sound/soc/codecs/wm8580.c
-@@ -533,7 +533,7 @@ static int wm8580_set_dai_pll(struct snd_soc_dai *codec_dai,
- 	reg = wm8580_read(codec, WM8580_PLLA4 + offset);
- 	reg &= ~0x3f;
- 	reg |= pll_div.prescale | pll_div.postscale << 1 |
--		pll_div.freqmode << 4;
-+		pll_div.freqmode << 3;
- 
- 	wm8580_write(codec, WM8580_PLLA4 + offset, reg);
- 
-diff --git a/sound/usb/usx2y/us122l.c b/sound/usb/usx2y/us122l.c
-index 73e59f4..9ce1c59 100644
---- a/sound/usb/usx2y/us122l.c
-+++ b/sound/usb/usx2y/us122l.c
-@@ -478,6 +478,14 @@ static bool us122l_create_card(struct snd_card *card)
- 	return true;
- }
- 
-+static void snd_us122l_free(struct snd_card *card)
-+{
-+	struct us122l	*us122l = US122L(card);
-+	int		index = us122l->chip.index;
-+	if (index >= 0  &&  index < SNDRV_CARDS)
-+		snd_us122l_card_used[index] = 0;
-+}
-+
- static struct snd_card *usx2y_create_card(struct usb_device *device)
- {
- 	int		dev;
-@@ -492,7 +500,7 @@ static struct snd_card *usx2y_create_card(struct usb_device *device)
- 	if (!card)
- 		return NULL;
- 	snd_us122l_card_used[US122L(card)->chip.index = dev] = 1;
--
-+	card->private_free = snd_us122l_free;
- 	US122L(card)->chip.dev = device;
- 	US122L(card)->chip.card = card;
- 	mutex_init(&US122L(card)->mutex);
-@@ -575,7 +583,7 @@ static void snd_us122l_disconnect(struct usb_interface *intf)
- 	}
- 
- 	usb_put_intf(intf);
--	usb_put_dev(US122L(card)->chip.dev);
-+	usb_put_dev(us122l->chip.dev);
- 
- 	while (atomic_read(&us122l->mmap_count))
- 		msleep(500);
-diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
-index 6723411..d85642e 100644
---- a/virt/kvm/kvm_main.c
-+++ b/virt/kvm/kvm_main.c
-@@ -964,6 +964,7 @@ int __kvm_set_memory_region(struct kvm *kvm,
- 	int r;
- 	gfn_t base_gfn;
- 	unsigned long npages;
-+	int largepages;
- 	unsigned long i;
- 	struct kvm_memory_slot *memslot;
- 	struct kvm_memory_slot old, new;
-@@ -1004,7 +1005,7 @@ int __kvm_set_memory_region(struct kvm *kvm,
- 	for (i = 0; i < KVM_MEMORY_SLOTS; ++i) {
- 		struct kvm_memory_slot *s = &kvm->memslots[i];
- 
--		if (s == memslot)
-+		if (s == memslot || !s->npages)
- 			continue;
- 		if (!((base_gfn + npages <= s->base_gfn) ||
- 		      (base_gfn >= s->base_gfn + s->npages)))
-@@ -1039,11 +1040,8 @@ int __kvm_set_memory_region(struct kvm *kvm,
- 			new.userspace_addr = 0;
- 	}
- 	if (npages && !new.lpage_info) {
--		int largepages = npages / KVM_PAGES_PER_HPAGE;
--		if (npages % KVM_PAGES_PER_HPAGE)
--			largepages++;
--		if (base_gfn % KVM_PAGES_PER_HPAGE)
--			largepages++;
-+		largepages = 1 + (base_gfn + npages - 1) / KVM_PAGES_PER_HPAGE;
-+		largepages -= base_gfn / KVM_PAGES_PER_HPAGE;
- 
- 		new.lpage_info = vmalloc(largepages * sizeof(*new.lpage_info));
- 
-@@ -1999,6 +1997,7 @@ static long kvm_dev_ioctl_check_extension_generic(long arg)
- 	switch (arg) {
- 	case KVM_CAP_USER_MEMORY:
- 	case KVM_CAP_DESTROY_MEMORY_REGION_WORKS:
-+	case KVM_CAP_JOIN_MEMORY_REGIONS_WORKS:
- 		return 1;
- 	default:
- 		break;

Deleted: genpatches-2.6/trunk/2.6.30/1003_linux-2.6.29.4.patch
===================================================================
--- genpatches-2.6/trunk/2.6.30/1003_linux-2.6.29.4.patch	2009-06-05 16:26:11 UTC (rev 1572)
+++ genpatches-2.6/trunk/2.6.30/1003_linux-2.6.29.4.patch	2009-06-05 16:28:49 UTC (rev 1573)
@@ -1,3211 +0,0 @@
-diff --git a/Documentation/filesystems/Locking b/Documentation/filesystems/Locking
-index ec6a939..eea7102 100644
---- a/Documentation/filesystems/Locking
-+++ b/Documentation/filesystems/Locking
-@@ -502,23 +502,31 @@ prototypes:
- 	void (*open)(struct vm_area_struct*);
- 	void (*close)(struct vm_area_struct*);
- 	int (*fault)(struct vm_area_struct*, struct vm_fault *);
--	int (*page_mkwrite)(struct vm_area_struct *, struct page *);
-+	int (*page_mkwrite)(struct vm_area_struct *, struct vm_fault *);
- 	int (*access)(struct vm_area_struct *, unsigned long, void*, int, int);
- 
- locking rules:
- 		BKL	mmap_sem	PageLocked(page)
- open:		no	yes
- close:		no	yes
--fault:		no	yes
--page_mkwrite:	no	yes		no
-+fault:		no	yes		can return with page locked
-+page_mkwrite:	no	yes		can return with page locked
- access:		no	yes
- 
--	->page_mkwrite() is called when a previously read-only page is
--about to become writeable. The file system is responsible for
--protecting against truncate races. Once appropriate action has been
--taking to lock out truncate, the page range should be verified to be
--within i_size. The page mapping should also be checked that it is not
--NULL.
-+	->fault() is called when a previously not present pte is about
-+to be faulted in. The filesystem must find and return the page associated
-+with the passed in "pgoff" in the vm_fault structure. If it is possible that
-+the page may be truncated and/or invalidated, then the filesystem must lock
-+the page, then ensure it is not already truncated (the page lock will block
-+subsequent truncate), and then return with VM_FAULT_LOCKED, and the page
-+locked. The VM will unlock the page.
-+
-+	->page_mkwrite() is called when a previously read-only pte is
-+about to become writeable. The filesystem again must ensure that there are
-+no truncate/invalidate races, and then return with the page locked. If
-+the page has been truncated, the filesystem should not look up a new page
-+like the ->fault() handler, but simply return with VM_FAULT_NOPAGE, which
-+will cause the VM to retry the fault.
- 
- 	->access() is called when get_user_pages() fails in
- acces_process_vm(), typically used to debug a process through
-diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
-index da56821..dd8eeea 100644
---- a/arch/x86/kvm/svm.c
-+++ b/arch/x86/kvm/svm.c
-@@ -411,7 +411,6 @@ static __init int svm_hardware_setup(void)
- 
- 	iopm_va = page_address(iopm_pages);
- 	memset(iopm_va, 0xff, PAGE_SIZE * (1 << IOPM_ALLOC_ORDER));
--	clear_bit(0x80, iopm_va); /* allow direct access to PC debug port */
- 	iopm_base = page_to_pfn(iopm_pages) << PAGE_SHIFT;
- 
- 	if (boot_cpu_has(X86_FEATURE_NX))
-diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index 425423e..92f0457 100644
---- a/arch/x86/kvm/x86.c
-+++ b/arch/x86/kvm/x86.c
-@@ -1075,9 +1075,9 @@ void kvm_arch_vcpu_put(struct kvm_vcpu *vcpu)
- 
- static int is_efer_nx(void)
- {
--	u64 efer;
-+	unsigned long long efer = 0;
- 
--	rdmsrl(MSR_EFER, efer);
-+	rdmsrl_safe(MSR_EFER, &efer);
- 	return efer & EFER_NX;
- }
- 
-diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c
-index e190d8b..7ffc5ac 100644
---- a/drivers/dma/dmatest.c
-+++ b/drivers/dma/dmatest.c
-@@ -410,9 +410,7 @@ static int __init dmatest_init(void)
- 		chan = dma_request_channel(mask, filter, NULL);
- 		if (chan) {
- 			err = dmatest_add_channel(chan);
--			if (err == 0)
--				continue;
--			else {
-+			if (err) {
- 				dma_release_channel(chan);
- 				break; /* add_channel failed, punt */
- 			}
-diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
-index 8851197..700ebec 100644
---- a/drivers/hid/hid-ids.h
-+++ b/drivers/hid/hid-ids.h
-@@ -110,6 +110,11 @@
- #define USB_VENDOR_ID_BERKSHIRE		0x0c98
- #define USB_DEVICE_ID_BERKSHIRE_PCWD	0x1140
- 
-+#define USB_VENDOR_ID_CH		0x068e
-+#define USB_DEVICE_ID_CH_PRO_PEDALS	0x00f2
-+#define USB_DEVICE_ID_CH_COMBATSTICK	0x00f4
-+#define USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE	0x00ff
-+
- #define USB_VENDOR_ID_CHERRY		0x046a
- #define USB_DEVICE_ID_CHERRY_CYMOTION	0x0023
- 
-diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
-index 4391717..d8f7423 100644
---- a/drivers/hid/usbhid/hid-quirks.c
-+++ b/drivers/hid/usbhid/hid-quirks.c
-@@ -50,6 +50,9 @@ static const struct hid_blacklist {
- 	{ USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_2PORTKVM, HID_QUIRK_NOGET },
- 	{ USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVM, HID_QUIRK_NOGET },
- 	{ USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVMC, HID_QUIRK_NOGET },
-+	{ USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_COMBATSTICK, HID_QUIRK_NOGET },
-+	{ USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE, HID_QUIRK_NOGET },
-+	{ USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_PEDALS, HID_QUIRK_NOGET },
- 	{ USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
- 	{ USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
- 	{ USB_VENDOR_ID_SUN, USB_DEVICE_ID_RARITAN_KVM_DONGLE, HID_QUIRK_NOGET },
-diff --git a/drivers/hwmon/w83781d.c b/drivers/hwmon/w83781d.c
-index dbfb30c..0bdab95 100644
---- a/drivers/hwmon/w83781d.c
-+++ b/drivers/hwmon/w83781d.c
-@@ -1462,7 +1462,8 @@ static struct w83781d_data *w83781d_update_device(struct device *dev)
- 				data->pwm[i] =
- 				    w83781d_read_value(data,
- 						       W83781D_REG_PWM[i]);
--				if ((data->type != w83782d || !client->driver)
-+				/* Only W83782D on SMBus has PWM3 and PWM4 */
-+				if ((data->type != w83782d || !client)
- 				    && i == 1)
- 					break;
- 			}
-diff --git a/drivers/i2c/algos/i2c-algo-bit.c b/drivers/i2c/algos/i2c-algo-bit.c
-index eb8f72c..0e034a4 100644
---- a/drivers/i2c/algos/i2c-algo-bit.c
-+++ b/drivers/i2c/algos/i2c-algo-bit.c
-@@ -104,7 +104,7 @@ static int sclhi(struct i2c_algo_bit_data *adap)
- 		 * chips may hold it low ("clock stretching") while they
- 		 * are processing data internally.
- 		 */
--		if (time_after_eq(jiffies, start + adap->timeout))
-+		if (time_after(jiffies, start + adap->timeout))
- 			return -ETIMEDOUT;
- 		cond_resched();
- 	}
-diff --git a/drivers/i2c/algos/i2c-algo-pca.c b/drivers/i2c/algos/i2c-algo-pca.c
-index d50b329..2346a89 100644
---- a/drivers/i2c/algos/i2c-algo-pca.c
-+++ b/drivers/i2c/algos/i2c-algo-pca.c
-@@ -270,10 +270,21 @@ static int pca_xfer(struct i2c_adapter *i2c_adap,
- 
- 		case 0x30: /* Data byte in I2CDAT has been transmitted; NOT ACK has been received */
- 			DEB2("NOT ACK received after data byte\n");
-+			pca_stop(adap);
- 			goto out;
- 
- 		case 0x38: /* Arbitration lost during SLA+W, SLA+R or data bytes */
- 			DEB2("Arbitration lost\n");
-+			/*
-+			 * The PCA9564 data sheet (2006-09-01) says "A
-+			 * START condition will be transmitted when the
-+			 * bus becomes free (STOP or SCL and SDA high)"
-+			 * when the STA bit is set (p. 11).
-+			 *
-+			 * In case this won't work, try pca_reset()
-+			 * instead.
-+			 */
-+			pca_start(adap);
- 			goto out;
- 
- 		case 0x58: /* Data byte has been received; NOT ACK has been returned */
-diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
-index 7199437..b411249 100644
---- a/drivers/md/bitmap.c
-+++ b/drivers/md/bitmap.c
-@@ -985,6 +985,9 @@ static int bitmap_init_from_disk(struct bitmap *bitmap, sector_t start)
- 			oldindex = index;
- 			oldpage = page;
- 
-+			bitmap->filemap[bitmap->file_pages++] = page;
-+			bitmap->last_page_size = count;
-+
- 			if (outofdate) {
- 				/*
- 				 * if bitmap is out of date, dirty the
-@@ -997,15 +1000,9 @@ static int bitmap_init_from_disk(struct bitmap *bitmap, sector_t start)
- 				write_page(bitmap, page, 1);
- 
- 				ret = -EIO;
--				if (bitmap->flags & BITMAP_WRITE_ERROR) {
--					/* release, page not in filemap yet */
--					put_page(page);
-+				if (bitmap->flags & BITMAP_WRITE_ERROR)
- 					goto err;
--				}
- 			}
--
--			bitmap->filemap[bitmap->file_pages++] = page;
--			bitmap->last_page_size = count;
- 		}
- 		paddr = kmap_atomic(page, KM_USER0);
- 		if (bitmap->flags & BITMAP_HOSTENDIAN)
-@@ -1015,9 +1012,11 @@ static int bitmap_init_from_disk(struct bitmap *bitmap, sector_t start)
- 		kunmap_atomic(paddr, KM_USER0);
- 		if (b) {
- 			/* if the disk bit is set, set the memory bit */
--			bitmap_set_memory_bits(bitmap, i << CHUNK_BLOCK_SHIFT(bitmap),
--					       ((i+1) << (CHUNK_BLOCK_SHIFT(bitmap)) >= start)
--				);
-+			int needed = ((sector_t)(i+1) << (CHUNK_BLOCK_SHIFT(bitmap))
-+				      >= start);
-+			bitmap_set_memory_bits(bitmap,
-+					       (sector_t)i << CHUNK_BLOCK_SHIFT(bitmap),
-+					       needed);
- 			bit_cnt++;
- 			set_page_attr(bitmap, page, BITMAP_PAGE_CLEAN);
- 		}
-@@ -1153,8 +1152,9 @@ void bitmap_daemon_work(struct bitmap *bitmap)
- 			spin_lock_irqsave(&bitmap->lock, flags);
- 			clear_page_attr(bitmap, page, BITMAP_PAGE_CLEAN);
- 		}
--		bmc = bitmap_get_counter(bitmap, j << CHUNK_BLOCK_SHIFT(bitmap),
--					&blocks, 0);
-+		bmc = bitmap_get_counter(bitmap,
-+					 (sector_t)j << CHUNK_BLOCK_SHIFT(bitmap),
-+					 &blocks, 0);
- 		if (bmc) {
- /*
-   if (j < 100) printk("bitmap: j=%lu, *bmc = 0x%x\n", j, *bmc);
-@@ -1168,7 +1168,8 @@ void bitmap_daemon_work(struct bitmap *bitmap)
- 			} else if (*bmc == 1) {
- 				/* we can clear the bit */
- 				*bmc = 0;
--				bitmap_count_page(bitmap, j << CHUNK_BLOCK_SHIFT(bitmap),
-+				bitmap_count_page(bitmap,
-+						  (sector_t)j << CHUNK_BLOCK_SHIFT(bitmap),
- 						  -1);
- 
- 				/* clear the bit */
-@@ -1484,7 +1485,7 @@ void bitmap_dirty_bits(struct bitmap *bitmap, unsigned long s, unsigned long e)
- 	unsigned long chunk;
- 
- 	for (chunk = s; chunk <= e; chunk++) {
--		sector_t sec = chunk << CHUNK_BLOCK_SHIFT(bitmap);
-+		sector_t sec = (sector_t)chunk << CHUNK_BLOCK_SHIFT(bitmap);
- 		bitmap_set_memory_bits(bitmap, sec, 1);
- 		bitmap_file_set_bit(bitmap, sec);
- 	}
-diff --git a/drivers/md/md.c b/drivers/md/md.c
-index a307f87..dc85211 100644
---- a/drivers/md/md.c
-+++ b/drivers/md/md.c
-@@ -2844,11 +2844,8 @@ array_state_store(mddev_t *mddev, const char *buf, size_t len)
- 			} else
- 				err = -EBUSY;
- 			spin_unlock_irq(&mddev->write_lock);
--		} else {
--			mddev->ro = 0;
--			mddev->recovery_cp = MaxSector;
--			err = do_md_run(mddev);
--		}
-+		} else
-+			err = -EINVAL;
- 		break;
- 	case active:
- 		if (mddev->pers) {
-diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
-index 7301631..d849533 100644
---- a/drivers/md/raid10.c
-+++ b/drivers/md/raid10.c
-@@ -1807,17 +1807,17 @@ static sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *skipped, i
- 				r10_bio->sector = sect;
- 
- 				raid10_find_phys(conf, r10_bio);
--				/* Need to check if this section will still be
-+
-+				/* Need to check if the array will still be
- 				 * degraded
- 				 */
--				for (j=0; j<conf->copies;j++) {
--					int d = r10_bio->devs[j].devnum;
--					if (conf->mirrors[d].rdev == NULL ||
--					    test_bit(Faulty, &conf->mirrors[d].rdev->flags)) {
-+				for (j=0; j<conf->raid_disks; j++)
-+					if (conf->mirrors[j].rdev == NULL ||
-+					    test_bit(Faulty, &conf->mirrors[j].rdev->flags)) {
- 						still_degraded = 1;
- 						break;
- 					}
--				}
-+
- 				must_sync = bitmap_start_sync(mddev->bitmap, sect,
- 							      &sync_blocks, still_degraded);
- 
-diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
-index 6bd63cc..d436e27 100644
---- a/drivers/net/e1000/e1000_main.c
-+++ b/drivers/net/e1000/e1000_main.c
-@@ -3712,7 +3712,7 @@ static irqreturn_t e1000_intr(int irq, void *data)
- 	struct e1000_hw *hw = &adapter->hw;
- 	u32 rctl, icr = er32(ICR);
- 
--	if (unlikely((!icr) || test_bit(__E1000_RESETTING, &adapter->flags)))
-+	if (unlikely((!icr) || test_bit(__E1000_DOWN, &adapter->flags)))
- 		return IRQ_NONE;  /* Not our interrupt */
- 
- 	/* IMS will not auto-mask if INT_ASSERTED is not set, and if it is
-diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
-index dfe9226..9a59414 100644
---- a/drivers/net/ehea/ehea_main.c
-+++ b/drivers/net/ehea/ehea_main.c
-@@ -529,14 +529,17 @@ static inline struct sk_buff *get_skb_by_index(struct sk_buff **skb_array,
- 	x &= (arr_len - 1);
- 
- 	pref = skb_array[x];
--	prefetchw(pref);
--	prefetchw(pref + EHEA_CACHE_LINE);
--
--	pref = (skb_array[x]->data);
--	prefetch(pref);
--	prefetch(pref + EHEA_CACHE_LINE);
--	prefetch(pref + EHEA_CACHE_LINE * 2);
--	prefetch(pref + EHEA_CACHE_LINE * 3);
-+	if (pref) {
-+		prefetchw(pref);
-+		prefetchw(pref + EHEA_CACHE_LINE);
-+
-+		pref = (skb_array[x]->data);
-+		prefetch(pref);
-+		prefetch(pref + EHEA_CACHE_LINE);
-+		prefetch(pref + EHEA_CACHE_LINE * 2);
-+		prefetch(pref + EHEA_CACHE_LINE * 3);
-+	}
-+
- 	skb = skb_array[skb_index];
- 	skb_array[skb_index] = NULL;
- 	return skb;
-@@ -553,12 +556,14 @@ static inline struct sk_buff *get_skb_by_index_ll(struct sk_buff **skb_array,
- 	x &= (arr_len - 1);
- 
- 	pref = skb_array[x];
--	prefetchw(pref);
--	prefetchw(pref + EHEA_CACHE_LINE);
-+	if (pref) {
-+		prefetchw(pref);
-+		prefetchw(pref + EHEA_CACHE_LINE);
- 
--	pref = (skb_array[x]->data);
--	prefetchw(pref);
--	prefetchw(pref + EHEA_CACHE_LINE);
-+		pref = (skb_array[x]->data);
-+		prefetchw(pref);
-+		prefetchw(pref + EHEA_CACHE_LINE);
-+	}
- 
- 	skb = skb_array[wqe_index];
- 	skb_array[wqe_index] = NULL;
-diff --git a/drivers/net/ne2k-pci.c b/drivers/net/ne2k-pci.c
-index f090d3b..453d6bb 100644
---- a/drivers/net/ne2k-pci.c
-+++ b/drivers/net/ne2k-pci.c
-@@ -373,18 +373,17 @@ static int __devinit ne2k_pci_init_one (struct pci_dev *pdev,
- 	dev->ethtool_ops = &ne2k_pci_ethtool_ops;
- 	NS8390_init(dev, 0);
- 
-+	memcpy(dev->dev_addr, SA_prom, 6);
-+	memcpy(dev->perm_addr, dev->dev_addr, dev->addr_len);
-+
- 	i = register_netdev(dev);
- 	if (i)
- 		goto err_out_free_netdev;
- 
--	for(i = 0; i < 6; i++)
--		dev->dev_addr[i] = SA_prom[i];
- 	printk("%s: %s found at %#lx, IRQ %d, %pM.\n",
- 	       dev->name, pci_clone_list[chip_idx].name, ioaddr, dev->irq,
- 	       dev->dev_addr);
- 
--	memcpy(dev->perm_addr, dev->dev_addr, dev->addr_len);
--
- 	return 0;
- 
- err_out_free_netdev:
-diff --git a/drivers/serial/mpc52xx_uart.c b/drivers/serial/mpc52xx_uart.c
-index 0c3a2ab..28d2c8d 100644
---- a/drivers/serial/mpc52xx_uart.c
-+++ b/drivers/serial/mpc52xx_uart.c
-@@ -522,7 +522,7 @@ mpc52xx_uart_startup(struct uart_port *port)
- 
- 	/* Request IRQ */
- 	ret = request_irq(port->irq, mpc52xx_uart_int,
--		IRQF_DISABLED | IRQF_SAMPLE_RANDOM | IRQF_SHARED,
-+		IRQF_DISABLED | IRQF_SAMPLE_RANDOM,
- 		"mpc52xx_psc_uart", port);
- 	if (ret)
- 		return ret;
-diff --git a/drivers/usb/gadget/usbstring.c b/drivers/usb/gadget/usbstring.c
-index 4154be3..58c4d37 100644
---- a/drivers/usb/gadget/usbstring.c
-+++ b/drivers/usb/gadget/usbstring.c
-@@ -38,7 +38,7 @@ static int utf8_to_utf16le(const char *s, __le16 *cp, unsigned len)
- 				uchar = (c & 0x1f) << 6;
- 
- 				c = (u8) *s++;
--				if ((c & 0xc0) != 0xc0)
-+				if ((c & 0xc0) != 0x80)
- 					goto fail;
- 				c &= 0x3f;
- 				uchar |= c;
-@@ -49,13 +49,13 @@ static int utf8_to_utf16le(const char *s, __le16 *cp, unsigned len)
- 				uchar = (c & 0x0f) << 12;
- 
- 				c = (u8) *s++;
--				if ((c & 0xc0) != 0xc0)
-+				if ((c & 0xc0) != 0x80)
- 					goto fail;
- 				c &= 0x3f;
- 				uchar |= c << 6;
- 
- 				c = (u8) *s++;
--				if ((c & 0xc0) != 0xc0)
-+				if ((c & 0xc0) != 0x80)
- 					goto fail;
- 				c &= 0x3f;
- 				uchar |= c;
-diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
-index bb3143e..5daa517 100644
---- a/drivers/usb/serial/ftdi_sio.c
-+++ b/drivers/usb/serial/ftdi_sio.c
-@@ -56,6 +56,7 @@ static __u16 vendor = FTDI_VID;
- static __u16 product;
- 
- struct ftdi_private {
-+	struct kref kref;
- 	ftdi_chip_type_t chip_type;
- 				/* type of device, either SIO or FT8U232AM */
- 	int baud_base;		/* baud base clock for divisor setting */
-@@ -1352,6 +1353,7 @@ static int ftdi_sio_port_probe(struct usb_serial_port *port)
- 		return -ENOMEM;
- 	}
- 
-+	kref_init(&priv->kref);
- 	spin_lock_init(&priv->rx_lock);
- 	spin_lock_init(&priv->tx_lock);
- 	init_waitqueue_head(&priv->delta_msr_wait);
-@@ -1468,6 +1470,13 @@ static void ftdi_shutdown(struct usb_serial *serial)
- 	dbg("%s", __func__);
- }
- 
-+static void ftdi_sio_priv_release(struct kref *k)
-+{
-+	struct ftdi_private *priv = container_of(k, struct ftdi_private, kref);
-+
-+	kfree(priv);
-+}
-+
- static int ftdi_sio_port_remove(struct usb_serial_port *port)
- {
- 	struct ftdi_private *priv = usb_get_serial_port_data(port);
-@@ -1482,7 +1491,7 @@ static int ftdi_sio_port_remove(struct usb_serial_port *port)
- 
- 	if (priv) {
- 		usb_set_serial_port_data(port, NULL);
--		kfree(priv);
-+		kref_put(&priv->kref, ftdi_sio_priv_release);
- 	}
- 
- 	return 0;
-@@ -1547,7 +1556,8 @@ static int ftdi_open(struct tty_struct *tty,
- 		dev_err(&port->dev,
- 			"%s - failed submitting read urb, error %d\n",
- 			__func__, result);
--
-+	else
-+		kref_get(&priv->kref);
- 
- 	return result;
- } /* ftdi_open */
-@@ -1589,11 +1599,11 @@ static void ftdi_close(struct tty_struct *tty,
- 	mutex_unlock(&port->serial->disc_mutex);
- 
- 	/* cancel any scheduled reading */
--	cancel_delayed_work(&priv->rx_work);
--	flush_scheduled_work();
-+	cancel_delayed_work_sync(&priv->rx_work);
- 
- 	/* shutdown our bulk read */
- 	usb_kill_urb(port->read_urb);
-+	kref_put(&priv->kref, ftdi_sio_priv_release);
- } /* ftdi_close */
- 
- 
-diff --git a/drivers/video/fb_defio.c b/drivers/video/fb_defio.c
-index 0820265..0a7a667 100644
---- a/drivers/video/fb_defio.c
-+++ b/drivers/video/fb_defio.c
-@@ -85,8 +85,9 @@ EXPORT_SYMBOL_GPL(fb_deferred_io_fsync);
- 
- /* vm_ops->page_mkwrite handler */
- static int fb_deferred_io_mkwrite(struct vm_area_struct *vma,
--				  struct page *page)
-+				  struct vm_fault *vmf)
- {
-+	struct page *page = vmf->page;
- 	struct fb_info *info = vma->vm_private_data;
- 	struct fb_deferred_io *fbdefio = info->fbdefio;
- 	struct page *cur;
-diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
-index 5e1d4e3..7dd1b6d 100644
---- a/fs/btrfs/ctree.h
-+++ b/fs/btrfs/ctree.h
-@@ -2060,7 +2060,7 @@ int btrfs_merge_bio_hook(struct page *page, unsigned long offset,
- unsigned long btrfs_force_ra(struct address_space *mapping,
- 			      struct file_ra_state *ra, struct file *file,
- 			      pgoff_t offset, pgoff_t last_index);
--int btrfs_page_mkwrite(struct vm_area_struct *vma, struct page *page);
-+int btrfs_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf);
- int btrfs_readpage(struct file *file, struct page *page);
- void btrfs_delete_inode(struct inode *inode);
- void btrfs_put_inode(struct inode *inode);
-diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
-index 7d4f948..17e608c 100644
---- a/fs/btrfs/inode.c
-+++ b/fs/btrfs/inode.c
-@@ -4292,8 +4292,9 @@ static void btrfs_invalidatepage(struct page *page, unsigned long offset)
-  * beyond EOF, then the page is guaranteed safe against truncation until we
-  * unlock the page.
-  */
--int btrfs_page_mkwrite(struct vm_area_struct *vma, struct page *page)
-+int btrfs_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
- {
-+	struct page *page = vmf->page;
- 	struct inode *inode = fdentry(vma->vm_file)->d_inode;
- 	struct btrfs_root *root = BTRFS_I(inode)->root;
- 	struct extent_io_tree *io_tree = &BTRFS_I(inode)->io_tree;
-@@ -4306,10 +4307,15 @@ int btrfs_page_mkwrite(struct vm_area_struct *vma, struct page *page)
- 	u64 page_end;
- 
- 	ret = btrfs_check_data_free_space(root, inode, PAGE_CACHE_SIZE);
--	if (ret)
-+	if (ret) {
-+		if (ret == -ENOMEM)
-+			ret = VM_FAULT_OOM;
-+		else /* -ENOSPC, -EIO, etc */
-+			ret = VM_FAULT_SIGBUS;
- 		goto out;
-+	}
- 
--	ret = -EINVAL;
-+	ret = VM_FAULT_NOPAGE; /* make the VM retry the fault */
- again:
- 	lock_page(page);
- 	size = i_size_read(inode);
-diff --git a/fs/buffer.c b/fs/buffer.c
-index 891e1c7..4eb8992 100644
---- a/fs/buffer.c
-+++ b/fs/buffer.c
-@@ -2465,20 +2465,22 @@ int block_commit_write(struct page *page, unsigned from, unsigned to)
-  * unlock the page.
-  */
- int
--block_page_mkwrite(struct vm_area_struct *vma, struct page *page,
-+block_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf,
- 		   get_block_t get_block)
- {
-+	struct page *page = vmf->page;
- 	struct inode *inode = vma->vm_file->f_path.dentry->d_inode;
- 	unsigned long end;
- 	loff_t size;
--	int ret = -EINVAL;
-+	int ret = VM_FAULT_NOPAGE; /* make the VM retry the fault */
- 
- 	lock_page(page);
- 	size = i_size_read(inode);
- 	if ((page->mapping != inode->i_mapping) ||
- 	    (page_offset(page) > size)) {
- 		/* page got truncated out from underneath us */
--		goto out_unlock;
-+		unlock_page(page);
-+		goto out;
- 	}
- 
- 	/* page is wholly or partially inside EOF */
-@@ -2491,8 +2493,16 @@ block_page_mkwrite(struct vm_area_struct *vma, struct page *page,
- 	if (!ret)
- 		ret = block_commit_write(page, 0, end);
- 
--out_unlock:
--	unlock_page(page);
-+	if (unlikely(ret)) {
-+		unlock_page(page);
-+		if (ret == -ENOMEM)
-+			ret = VM_FAULT_OOM;
-+		else /* -ENOSPC, -EIO, etc */
-+			ret = VM_FAULT_SIGBUS;
-+	} else
-+		ret = VM_FAULT_LOCKED;
-+
-+out:
- 	return ret;
- }
- 
-diff --git a/fs/cifs/cifs_unicode.h b/fs/cifs/cifs_unicode.h
-index 14eb9a2..604ce8a 100644
---- a/fs/cifs/cifs_unicode.h
-+++ b/fs/cifs/cifs_unicode.h
-@@ -64,6 +64,13 @@ int cifs_strtoUCS(__le16 *, const char *, int, const struct nls_table *);
- #endif
- 
- /*
-+ * To be safe - for UCS to UTF-8 with strings loaded with the rare long
-+ * characters alloc more to account for such multibyte target UTF-8
-+ * characters.
-+ */
-+#define UNICODE_NAME_MAX ((4 * NAME_MAX) + 2)
-+
-+/*
-  * UniStrcat:  Concatenate the second string to the first
-  *
-  * Returns:
-diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
-index 71ae000..4fbb6b5 100644
---- a/fs/cifs/cifssmb.c
-+++ b/fs/cifs/cifssmb.c
-@@ -91,23 +91,22 @@ static int
- cifs_strncpy_to_host(char **dst, const char *src, const int maxlen,
- 		 const bool is_unicode, const struct nls_table *nls_codepage)
- {
--	int plen;
-+	int src_len, dst_len;
- 
- 	if (is_unicode) {
--		plen = UniStrnlen((wchar_t *)src, maxlen);
--		*dst = kmalloc(plen + 2, GFP_KERNEL);
-+		src_len = UniStrnlen((wchar_t *)src, maxlen);
-+		*dst = kmalloc((4 * src_len) + 2, GFP_KERNEL);
- 		if (!*dst)
- 			goto cifs_strncpy_to_host_ErrExit;
--		cifs_strfromUCS_le(*dst, (__le16 *)src, plen, nls_codepage);
-+		dst_len = cifs_strfromUCS_le(*dst, (__le16 *)src, src_len, nls_codepage);
-+		(*dst)[dst_len + 1] = 0;
- 	} else {
--		plen = strnlen(src, maxlen);
--		*dst = kmalloc(plen + 2, GFP_KERNEL);
-+		src_len = strnlen(src, maxlen);
-+		*dst = kmalloc(src_len + 1, GFP_KERNEL);
- 		if (!*dst)
- 			goto cifs_strncpy_to_host_ErrExit;
--		strncpy(*dst, src, plen);
-+		strlcpy(*dst, src, src_len + 1);
- 	}
--	(*dst)[plen] = 0;
--	(*dst)[plen+1] = 0; /* harmless for ASCII case, needed for Unicode */
- 	return 0;
- 
- cifs_strncpy_to_host_ErrExit:
-diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
-index 4b64f39..0344b26 100644
---- a/fs/cifs/connect.c
-+++ b/fs/cifs/connect.c
-@@ -3667,16 +3667,12 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
- 			    BCC(smb_buffer_response)) {
- 				kfree(tcon->nativeFileSystem);
- 				tcon->nativeFileSystem =
--				    kzalloc(2*(length + 1), GFP_KERNEL);
-+				    kzalloc((4 * length) + 2, GFP_KERNEL);
- 				if (tcon->nativeFileSystem)
- 					cifs_strfromUCS_le(
- 						tcon->nativeFileSystem,
- 						(__le16 *) bcc_ptr,
- 						length, nls_codepage);
--				bcc_ptr += 2 * length;
--				bcc_ptr[0] = 0;	/* null terminate the string */
--				bcc_ptr[1] = 0;
--				bcc_ptr += 2;
- 			}
- 			/* else do not bother copying these information fields*/
- 		} else {
-diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
-index 4c89c57..b2990b1 100644
---- a/fs/cifs/misc.c
-+++ b/fs/cifs/misc.c
-@@ -691,14 +691,15 @@ cifs_convertUCSpath(char *target, const __le16 *source, int maxlen,
- 						NLS_MAX_CHARSET_SIZE);
- 				if (len > 0) {
- 					j += len;
--					continue;
-+					goto overrun_chk;
- 				} else {
- 					target[j] = '?';
- 				}
- 		}
- 		j++;
- 		/* make sure we do not overrun callers allocated temp buffer */
--		if (j >= (2 * NAME_MAX))
-+overrun_chk:
-+		if (j >= UNICODE_NAME_MAX)
- 			break;
- 	}
- cUCS_out:
-diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
-index c2c01ff..0bdd5a6 100644
---- a/fs/cifs/readdir.c
-+++ b/fs/cifs/readdir.c
-@@ -1072,7 +1072,7 @@ int cifs_readdir(struct file *file, void *direntry, filldir_t filldir)
- 		with the rare long characters alloc more to account for
- 		such multibyte target UTF-8 characters. cifs_unicode.c,
- 		which actually does the conversion, has the same limit */
--		tmp_buf = kmalloc((2 * NAME_MAX) + 4, GFP_KERNEL);
-+		tmp_buf = kmalloc(UNICODE_NAME_MAX, GFP_KERNEL);
- 		for (i = 0; (i < num_to_fill) && (rc == 0); i++) {
- 			if (current_entry == NULL) {
- 				/* evaluate whether this case is an error */
-diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
-index 5c68b42..23e8f99 100644
---- a/fs/cifs/sess.c
-+++ b/fs/cifs/sess.c
-@@ -111,7 +111,7 @@ static __le16 get_next_vcnum(struct cifsSesInfo *ses)
- get_vc_num_exit:
- 	write_unlock(&cifs_tcp_ses_lock);
- 
--	return le16_to_cpu(vcnum);
-+	return cpu_to_le16(vcnum);
- }
- 
- static __u32 cifs_ssetup_hdr(struct cifsSesInfo *ses, SESSION_SETUP_ANDX *pSMB)
-@@ -285,27 +285,26 @@ static int decode_unicode_ssetup(char **pbcc_area, int bleft,
- 	int words_left, len;
- 	char *data = *pbcc_area;
- 
--
--
- 	cFYI(1, ("bleft %d", bleft));
- 
--
--	/* SMB header is unaligned, so cifs servers word align start of
--	   Unicode strings */
--	data++;
--	bleft--; /* Windows servers do not always double null terminate
--		    their final Unicode string - in which case we
--		    now will not attempt to decode the byte of junk
--		    which follows it */
-+	/*
-+	 * Windows servers do not always double null terminate their final
-+	 * Unicode string. Check to see if there are an uneven number of bytes
-+	 * left. If so, then add an extra NULL pad byte to the end of the
-+	 * response.
-+	 *
-+	 * See section 2.7.2 in "Implementing CIFS" for details
-+	 */
-+	if (bleft % 2) {
-+		data[bleft] = 0;
-+		++bleft;
-+	}
- 
- 	words_left = bleft / 2;
- 
- 	/* save off server operating system */
- 	len = UniStrnlen((wchar_t *) data, words_left);
- 
--/* We look for obvious messed up bcc or strings in response so we do not go off
--   the end since (at least) WIN2K and Windows XP have a major bug in not null
--   terminating last Unicode string in response  */
- 	if (len >= words_left)
- 		return rc;
- 
-@@ -343,13 +342,10 @@ static int decode_unicode_ssetup(char **pbcc_area, int bleft,
- 		return rc;
- 
- 	kfree(ses->serverDomain);
--	ses->serverDomain = kzalloc(2 * (len + 1), GFP_KERNEL); /* BB FIXME wrong length */
--	if (ses->serverDomain != NULL) {
-+	ses->serverDomain = kzalloc((4 * len) + 2, GFP_KERNEL);
-+	if (ses->serverDomain != NULL)
- 		cifs_strfromUCS_le(ses->serverDomain, (__le16 *)data, len,
- 				   nls_cp);
--		ses->serverDomain[2*len] = 0;
--		ses->serverDomain[(2*len) + 1] = 0;
--	}
- 	data += 2 * (len + 1);
- 	words_left -= len + 1;
- 
-@@ -702,12 +698,18 @@ CIFS_SessSetup(unsigned int xid, struct cifsSesInfo *ses, int first_time,
- 	}
- 
- 	/* BB check if Unicode and decode strings */
--	if (smb_buf->Flags2 & SMBFLG2_UNICODE)
-+	if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
-+		/* unicode string area must be word-aligned */
-+		if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
-+			++bcc_ptr;
-+			--bytes_remaining;
-+		}
- 		rc = decode_unicode_ssetup(&bcc_ptr, bytes_remaining,
--						   ses, nls_cp);
--	else
-+					   ses, nls_cp);
-+	} else {
- 		rc = decode_ascii_ssetup(&bcc_ptr, bytes_remaining,
- 					 ses, nls_cp);
-+	}
- 
- ssetup_exit:
- 	if (spnego_key) {
-diff --git a/fs/eventpoll.c b/fs/eventpoll.c
-index 011b9b8..e323e47 100644
---- a/fs/eventpoll.c
-+++ b/fs/eventpoll.c
-@@ -1136,7 +1136,7 @@ error_return:
- 
- SYSCALL_DEFINE1(epoll_create, int, size)
- {
--	if (size < 0)
-+	if (size <= 0)
- 		return -EINVAL;
- 
- 	return sys_epoll_create1(0);
-diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
-index b0c87dc..90909f9 100644
---- a/fs/ext4/ext4.h
-+++ b/fs/ext4/ext4.h
-@@ -1097,7 +1097,7 @@ extern int ext4_meta_trans_blocks(struct inode *, int nrblocks, int idxblocks);
- extern int ext4_chunk_trans_blocks(struct inode *, int nrblocks);
- extern int ext4_block_truncate_page(handle_t *handle,
- 		struct address_space *mapping, loff_t from);
--extern int ext4_page_mkwrite(struct vm_area_struct *vma, struct page *page);
-+extern int ext4_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf);
- 
- /* ioctl.c */
- extern long ext4_ioctl(struct file *, unsigned int, unsigned long);
-diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
-index c7fed5b..2c0439d 100644
---- a/fs/ext4/inode.c
-+++ b/fs/ext4/inode.c
-@@ -5116,8 +5116,9 @@ static int ext4_bh_unmapped(handle_t *handle, struct buffer_head *bh)
- 	return !buffer_mapped(bh);
- }
- 
--int ext4_page_mkwrite(struct vm_area_struct *vma, struct page *page)
-+int ext4_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
- {
-+	struct page *page = vmf->page;
- 	loff_t size;
- 	unsigned long len;
- 	int ret = -EINVAL;
-@@ -5169,6 +5170,8 @@ int ext4_page_mkwrite(struct vm_area_struct *vma, struct page *page)
- 		goto out_unlock;
- 	ret = 0;
- out_unlock:
-+	if (ret)
-+		ret = VM_FAULT_SIGBUS;
- 	up_read(&inode->i_alloc_sem);
- 	return ret;
- }
-diff --git a/fs/fcntl.c b/fs/fcntl.c
-index bd215cc..fc2aaa6 100644
---- a/fs/fcntl.c
-+++ b/fs/fcntl.c
-@@ -117,11 +117,13 @@ SYSCALL_DEFINE2(dup2, unsigned int, oldfd, unsigned int, newfd)
- {
- 	if (unlikely(newfd == oldfd)) { /* corner case */
- 		struct files_struct *files = current->files;
-+		int retval = oldfd;
-+
- 		rcu_read_lock();
- 		if (!fcheck_files(files, oldfd))
--			oldfd = -EBADF;
-+			retval = -EBADF;
- 		rcu_read_unlock();
--		return oldfd;
-+		return retval;
- 	}
- 	return sys_dup3(oldfd, newfd, 0);
- }
-diff --git a/fs/fuse/file.c b/fs/fuse/file.c
-index 821d10f..4e340fe 100644
---- a/fs/fuse/file.c
-+++ b/fs/fuse/file.c
-@@ -1234,8 +1234,9 @@ static void fuse_vma_close(struct vm_area_struct *vma)
-  * - sync(2)
-  * - try_to_free_pages() with order > PAGE_ALLOC_COSTLY_ORDER
-  */
--static int fuse_page_mkwrite(struct vm_area_struct *vma, struct page *page)
-+static int fuse_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
- {
-+	struct page *page = vmf->page;
- 	/*
- 	 * Don't use page->mapping as it may become NULL from a
- 	 * concurrent truncate.
-diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
-index 459b73d..75ca5ac 100644
---- a/fs/fuse/inode.c
-+++ b/fs/fuse/inode.c
-@@ -908,6 +908,7 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
-  err_put_root:
- 	dput(root_dentry);
-  err_put_conn:
-+	bdi_destroy(&fc->bdi);
- 	fuse_conn_put(fc);
-  err_fput:
- 	fput(file);
-diff --git a/fs/gfs2/ops_file.c b/fs/gfs2/ops_file.c
-index 93fe41b..0093a33 100644
---- a/fs/gfs2/ops_file.c
-+++ b/fs/gfs2/ops_file.c
-@@ -336,8 +336,9 @@ static int gfs2_allocate_page_backing(struct page *page)
-  * blocks allocated on disk to back that page.
-  */
- 
--static int gfs2_page_mkwrite(struct vm_area_struct *vma, struct page *page)
-+static int gfs2_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
- {
-+	struct page *page = vmf->page;
- 	struct inode *inode = vma->vm_file->f_path.dentry->d_inode;
- 	struct gfs2_inode *ip = GFS2_I(inode);
- 	struct gfs2_sbd *sdp = GFS2_SB(inode);
-@@ -409,6 +410,10 @@ out_unlock:
- 	gfs2_glock_dq(&gh);
- out:
- 	gfs2_holder_uninit(&gh);
-+	if (ret == -ENOMEM)
-+		ret = VM_FAULT_OOM;
-+	else if (ret)
-+		ret = VM_FAULT_SIGBUS;
- 	return ret;
- }
- 
-diff --git a/fs/ioctl.c b/fs/ioctl.c
-index 240ec63..344d9f3 100644
---- a/fs/ioctl.c
-+++ b/fs/ioctl.c
-@@ -258,7 +258,7 @@ int __generic_block_fiemap(struct inode *inode,
- 	long long length = 0, map_len = 0;
- 	u64 logical = 0, phys = 0, size = 0;
- 	u32 flags = FIEMAP_EXTENT_MERGED;
--	int ret = 0;
-+	int ret = 0, past_eof = 0, whole_file = 0;
- 
- 	if ((ret = fiemap_check_flags(fieinfo, FIEMAP_FLAG_SYNC)))
- 		return ret;
-@@ -266,6 +266,9 @@ int __generic_block_fiemap(struct inode *inode,
- 	start_blk = logical_to_blk(inode, start);
- 
- 	length = (long long)min_t(u64, len, i_size_read(inode));
-+	if (length < len)
-+		whole_file = 1;
-+
- 	map_len = length;
- 
- 	do {
-@@ -282,11 +285,26 @@ int __generic_block_fiemap(struct inode *inode,
- 
- 		/* HOLE */
- 		if (!buffer_mapped(&tmp)) {
-+			length -= blk_to_logical(inode, 1);
-+			start_blk++;
-+
-+			/*
-+			 * we want to handle the case where there is an
-+			 * allocated block at the front of the file, and then
-+			 * nothing but holes up to the end of the file properly,
-+			 * to make sure that extent at the front gets properly
-+			 * marked with FIEMAP_EXTENT_LAST
-+			 */
-+			if (!past_eof &&
-+			    blk_to_logical(inode, start_blk) >=
-+			    blk_to_logical(inode, 0)+i_size_read(inode))
-+				past_eof = 1;
-+
- 			/*
- 			 * first hole after going past the EOF, this is our
- 			 * last extent
- 			 */
--			if (length <= 0) {
-+			if (past_eof && size) {
- 				flags = FIEMAP_EXTENT_MERGED|FIEMAP_EXTENT_LAST;
- 				ret = fiemap_fill_next_extent(fieinfo, logical,
- 							      phys, size,
-@@ -294,15 +312,37 @@ int __generic_block_fiemap(struct inode *inode,
- 				break;
- 			}
- 
--			length -= blk_to_logical(inode, 1);
--
- 			/* if we have holes up to/past EOF then we're done */
--			if (length <= 0)
-+			if (length <= 0 || past_eof)
- 				break;
--
--			start_blk++;
- 		} else {
--			if (length <= 0 && size) {
-+			/*
-+			 * we have gone over the length of what we wanted to
-+			 * map, and it wasn't the entire file, so add the extent
-+			 * we got last time and exit.
-+			 *
-+			 * This is for the case where say we want to map all the
-+			 * way up to the second to the last block in a file, but
-+			 * the last block is a hole, making the second to last
-+			 * block FIEMAP_EXTENT_LAST.  In this case we want to
-+			 * see if there is a hole after the second to last block
-+			 * so we can mark it properly.  If we found data after
-+			 * we exceeded the length we were requesting, then we
-+			 * are good to go, just add the extent to the fieinfo
-+			 * and break
-+			 */
-+			if (length <= 0 && !whole_file) {
-+				ret = fiemap_fill_next_extent(fieinfo, logical,
-+							      phys, size,
-+							      flags);
-+				break;
-+			}
-+
-+			/*
-+			 * if size != 0 then we know we already have an extent
-+			 * to add, so add it.
-+			 */
-+			if (size) {
- 				ret = fiemap_fill_next_extent(fieinfo, logical,
- 							      phys, size,
- 							      flags);
-@@ -319,19 +359,14 @@ int __generic_block_fiemap(struct inode *inode,
- 			start_blk += logical_to_blk(inode, size);
- 
- 			/*
--			 * if we are past the EOF we need to loop again to see
--			 * if there is a hole so we can mark this extent as the
--			 * last one, and if not keep mapping things until we
--			 * find a hole, or we run out of slots in the extent
--			 * array
-+			 * If we are past the EOF, then we need to make sure as
-+			 * soon as we find a hole that the last extent we found
-+			 * is marked with FIEMAP_EXTENT_LAST
- 			 */
--			if (length <= 0)
--				continue;
--
--			ret = fiemap_fill_next_extent(fieinfo, logical, phys,
--						      size, flags);
--			if (ret)
--				break;
-+			if (!past_eof &&
-+			    logical+size >=
-+			    blk_to_logical(inode, 0)+i_size_read(inode))
-+				past_eof = 1;
- 		}
- 		cond_resched();
- 	} while (1);
-diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c
-index 64f1c31..38af057 100644
---- a/fs/lockd/svc.c
-+++ b/fs/lockd/svc.c
-@@ -115,6 +115,16 @@ static void set_grace_period(void)
- 	schedule_delayed_work(&grace_period_end, grace_period);
- }
- 
-+static void restart_grace(void)
-+{
-+	if (nlmsvc_ops) {
-+		cancel_delayed_work_sync(&grace_period_end);
-+		locks_end_grace(&lockd_manager);
-+		nlmsvc_invalidate_all();
-+		set_grace_period();
-+	}
-+}
-+
- /*
-  * This is the lockd kernel thread
-  */
-@@ -160,10 +170,7 @@ lockd(void *vrqstp)
- 
- 		if (signalled()) {
- 			flush_signals(current);
--			if (nlmsvc_ops) {
--				nlmsvc_invalidate_all();
--				set_grace_period();
--			}
-+			restart_grace();
- 			continue;
- 		}
- 
-diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
-index 672368f..3b2f697 100644
---- a/fs/nfs/dir.c
-+++ b/fs/nfs/dir.c
-@@ -1624,8 +1624,7 @@ static int nfs_rename(struct inode *old_dir, struct dentry *old_dentry,
- 		} else if (atomic_read(&new_dentry->d_count) > 1)
- 			/* dentry still busy? */
- 			goto out;
--	} else
--		nfs_drop_nlink(new_inode);
-+	}
- 
- go_ahead:
- 	/*
-@@ -1638,10 +1637,8 @@ go_ahead:
- 	}
- 	nfs_inode_return_delegation(old_inode);
- 
--	if (new_inode != NULL) {
-+	if (new_inode != NULL)
- 		nfs_inode_return_delegation(new_inode);
--		d_delete(new_dentry);
--	}
- 
- 	error = NFS_PROTO(old_dir)->rename(old_dir, &old_dentry->d_name,
- 					   new_dir, &new_dentry->d_name);
-@@ -1650,6 +1647,8 @@ out:
- 	if (rehash)
- 		d_rehash(rehash);
- 	if (!error) {
-+		if (new_inode != NULL)
-+			nfs_drop_nlink(new_inode);
- 		d_move(old_dentry, new_dentry);
- 		nfs_set_verifier(new_dentry,
- 					nfs_save_change_attribute(new_dir));
-diff --git a/fs/nfs/file.c b/fs/nfs/file.c
-index 90f292b..523e7e0 100644
---- a/fs/nfs/file.c
-+++ b/fs/nfs/file.c
-@@ -451,8 +451,9 @@ const struct address_space_operations nfs_file_aops = {
- 	.launder_page = nfs_launder_page,
- };
- 
--static int nfs_vm_page_mkwrite(struct vm_area_struct *vma, struct page *page)
-+static int nfs_vm_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
- {
-+	struct page *page = vmf->page;
- 	struct file *filp = vma->vm_file;
- 	struct dentry *dentry = filp->f_path.dentry;
- 	unsigned pagelen;
-@@ -479,11 +480,11 @@ static int nfs_vm_page_mkwrite(struct vm_area_struct *vma, struct page *page)
- 		goto out_unlock;
- 
- 	ret = nfs_updatepage(filp, page, 0, pagelen);
--	if (ret == 0)
--		ret = pagelen;
- out_unlock:
-+	if (!ret)
-+		return VM_FAULT_LOCKED;
- 	unlock_page(page);
--	return ret;
-+	return VM_FAULT_SIGBUS;
- }
- 
- static struct vm_operations_struct nfs_file_vm_ops = {
-diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
-index 9250067..4c5fb99 100644
---- a/fs/nfsd/nfs4xdr.c
-+++ b/fs/nfsd/nfs4xdr.c
-@@ -1843,6 +1843,15 @@ nfsd4_encode_dirent_fattr(struct nfsd4_readdir *cd,
- 	dentry = lookup_one_len(name, cd->rd_fhp->fh_dentry, namlen);
- 	if (IS_ERR(dentry))
- 		return nfserrno(PTR_ERR(dentry));
-+	if (!dentry->d_inode) {
-+		/*
-+		 * nfsd_buffered_readdir drops the i_mutex between
-+		 * readdir and calling this callback, leaving a window
-+		 * where this directory entry could have gone away.
-+		 */
-+		dput(dentry);
-+		return nfserr_noent;
-+	}
- 
- 	exp_get(exp);
- 	/*
-@@ -1905,6 +1914,7 @@ nfsd4_encode_dirent(void *ccdv, const char *name, int namlen,
- 	struct nfsd4_readdir *cd = container_of(ccd, struct nfsd4_readdir, common);
- 	int buflen;
- 	__be32 *p = cd->buffer;
-+	__be32 *cookiep;
- 	__be32 nfserr = nfserr_toosmall;
- 
- 	/* In nfsv4, "." and ".." never make it onto the wire.. */
-@@ -1921,7 +1931,7 @@ nfsd4_encode_dirent(void *ccdv, const char *name, int namlen,
- 		goto fail;
- 
- 	*p++ = xdr_one;                             /* mark entry present */
--	cd->offset = p;                             /* remember pointer */
-+	cookiep = p;
- 	p = xdr_encode_hyper(p, NFS_OFFSET_MAX);    /* offset of next entry */
- 	p = xdr_encode_array(p, name, namlen);      /* name length & name */
- 
-@@ -1935,6 +1945,8 @@ nfsd4_encode_dirent(void *ccdv, const char *name, int namlen,
- 		goto fail;
- 	case nfserr_dropit:
- 		goto fail;
-+	case nfserr_noent:
-+		goto skip_entry;
- 	default:
- 		/*
- 		 * If the client requested the RDATTR_ERROR attribute,
-@@ -1953,6 +1965,8 @@ nfsd4_encode_dirent(void *ccdv, const char *name, int namlen,
- 	}
- 	cd->buflen -= (p - cd->buffer);
- 	cd->buffer = p;
-+	cd->offset = cookiep;
-+skip_entry:
- 	cd->common.err = nfs_ok;
- 	return 0;
- fail:
-diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
-index 8672b95..c2a87c8 100644
---- a/fs/ocfs2/file.c
-+++ b/fs/ocfs2/file.c
-@@ -1912,6 +1912,22 @@ out_sems:
- 	return written ? written : ret;
- }
- 
-+static int ocfs2_splice_to_file(struct pipe_inode_info *pipe,
-+				struct file *out,
-+				struct splice_desc *sd)
-+{
-+	int ret;
-+
-+	ret = ocfs2_prepare_inode_for_write(out->f_path.dentry,	&sd->pos,
-+					    sd->total_len, 0, NULL);
-+	if (ret < 0) {
-+		mlog_errno(ret);
-+		return ret;
-+	}
-+
-+	return splice_from_pipe_feed(pipe, sd, pipe_to_file);
-+}
-+
- static ssize_t ocfs2_file_splice_write(struct pipe_inode_info *pipe,
- 				       struct file *out,
- 				       loff_t *ppos,
-@@ -1919,38 +1935,76 @@ static ssize_t ocfs2_file_splice_write(struct pipe_inode_info *pipe,
- 				       unsigned int flags)
- {
- 	int ret;
--	struct inode *inode = out->f_path.dentry->d_inode;
-+	struct address_space *mapping = out->f_mapping;
-+	struct inode *inode = mapping->host;
-+	struct splice_desc sd = {
-+		.total_len = len,
-+		.flags = flags,
-+		.pos = *ppos,
-+		.u.file = out,
-+	};
- 
- 	mlog_entry("(0x%p, 0x%p, %u, '%.*s')\n", out, pipe,
- 		   (unsigned int)len,
- 		   out->f_path.dentry->d_name.len,
- 		   out->f_path.dentry->d_name.name);
- 
--	mutex_lock_nested(&inode->i_mutex, I_MUTEX_PARENT);
-+	if (pipe->inode)
-+		mutex_lock_nested(&pipe->inode->i_mutex, I_MUTEX_PARENT);
- 
--	ret = ocfs2_rw_lock(inode, 1);
--	if (ret < 0) {
--		mlog_errno(ret);
--		goto out;
--	}
-+	splice_from_pipe_begin(&sd);
-+	do {
-+		ret = splice_from_pipe_next(pipe, &sd);
-+		if (ret <= 0)
-+			break;
- 
--	ret = ocfs2_prepare_inode_for_write(out->f_path.dentry, ppos, len, 0,
--					    NULL);
--	if (ret < 0) {
--		mlog_errno(ret);
--		goto out_unlock;
--	}
-+		mutex_lock_nested(&inode->i_mutex, I_MUTEX_CHILD);
-+		ret = ocfs2_rw_lock(inode, 1);
-+		if (ret < 0)
-+			mlog_errno(ret);
-+		else {
-+			ret = ocfs2_splice_to_file(pipe, out, &sd);
-+			ocfs2_rw_unlock(inode, 1);
-+		}
-+		mutex_unlock(&inode->i_mutex);
-+	} while (ret > 0);
-+	splice_from_pipe_end(pipe, &sd);
- 
- 	if (pipe->inode)
--		mutex_lock_nested(&pipe->inode->i_mutex, I_MUTEX_CHILD);
--	ret = generic_file_splice_write_nolock(pipe, out, ppos, len, flags);
--	if (pipe->inode)
- 		mutex_unlock(&pipe->inode->i_mutex);
- 
--out_unlock:
--	ocfs2_rw_unlock(inode, 1);
--out:
--	mutex_unlock(&inode->i_mutex);
-+	if (sd.num_spliced)
-+		ret = sd.num_spliced;
-+
-+	if (ret > 0) {
-+		unsigned long nr_pages;
-+
-+		*ppos += ret;
-+		nr_pages = (ret + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
-+
-+		/*
-+		 * If file or inode is SYNC and we actually wrote some data,
-+		 * sync it.
-+		 */
-+		if (unlikely((out->f_flags & O_SYNC) || IS_SYNC(inode))) {
-+			int err;
-+
-+			mutex_lock(&inode->i_mutex);
-+			err = ocfs2_rw_lock(inode, 1);
-+			if (err < 0) {
-+				mlog_errno(err);
-+			} else {
-+				err = generic_osync_inode(inode, mapping,
-+						  OSYNC_METADATA|OSYNC_DATA);
-+				ocfs2_rw_unlock(inode, 1);
-+			}
-+			mutex_unlock(&inode->i_mutex);
-+
-+			if (err)
-+				ret = err;
-+		}
-+		balance_dirty_pages_ratelimited_nr(mapping, nr_pages);
-+	}
- 
- 	mlog_exit(ret);
- 	return ret;
-diff --git a/fs/ocfs2/mmap.c b/fs/ocfs2/mmap.c
-index eea1d24..b606496 100644
---- a/fs/ocfs2/mmap.c
-+++ b/fs/ocfs2/mmap.c
-@@ -154,8 +154,9 @@ out:
- 	return ret;
- }
- 
--static int ocfs2_page_mkwrite(struct vm_area_struct *vma, struct page *page)
-+static int ocfs2_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
- {
-+	struct page *page = vmf->page;
- 	struct inode *inode = vma->vm_file->f_path.dentry->d_inode;
- 	struct buffer_head *di_bh = NULL;
- 	sigset_t blocked, oldset;
-@@ -196,7 +197,8 @@ out:
- 	ret2 = ocfs2_vm_op_unblock_sigs(&oldset);
- 	if (ret2 < 0)
- 		mlog_errno(ret2);
--
-+	if (ret)
-+		ret = VM_FAULT_SIGBUS;
- 	return ret;
- }
- 
-diff --git a/fs/splice.c b/fs/splice.c
-index 4c1029a..caa79d2 100644
---- a/fs/splice.c
-+++ b/fs/splice.c
-@@ -554,8 +554,8 @@ static int pipe_to_sendpage(struct pipe_inode_info *pipe,
-  * SPLICE_F_MOVE isn't set, or we cannot move the page, we simply create
-  * a new page in the output file page cache and fill/dirty that.
-  */
--static int pipe_to_file(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
--			struct splice_desc *sd)
-+int pipe_to_file(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
-+		 struct splice_desc *sd)
- {
- 	struct file *file = sd->u.file;
- 	struct address_space *mapping = file->f_mapping;
-@@ -599,108 +599,178 @@ static int pipe_to_file(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
- out:
- 	return ret;
- }
-+EXPORT_SYMBOL(pipe_to_file);
-+
-+static void wakeup_pipe_writers(struct pipe_inode_info *pipe)
-+{
-+	smp_mb();
-+	if (waitqueue_active(&pipe->wait))
-+		wake_up_interruptible(&pipe->wait);
-+	kill_fasync(&pipe->fasync_writers, SIGIO, POLL_OUT);
-+}
- 
- /**
-- * __splice_from_pipe - splice data from a pipe to given actor
-+ * splice_from_pipe_feed - feed available data from a pipe to a file
-  * @pipe:	pipe to splice from
-  * @sd:		information to @actor
-  * @actor:	handler that splices the data
-  *
-  * Description:
-- *    This function does little more than loop over the pipe and call
-- *    @actor to do the actual moving of a single struct pipe_buffer to
-- *    the desired destination. See pipe_to_file, pipe_to_sendpage, or
-- *    pipe_to_user.
-+
-+ *    This function loops over the pipe and calls @actor to do the
-+ *    actual moving of a single struct pipe_buffer to the desired
-+ *    destination.  It returns when there's no more buffers left in
-+ *    the pipe or if the requested number of bytes (@sd->total_len)
-+ *    have been copied.  It returns a positive number (one) if the
-+ *    pipe needs to be filled with more data, zero if the required
-+ *    number of bytes have been copied and -errno on error.
-  *
-+ *    This, together with splice_from_pipe_{begin,end,next}, may be
-+ *    used to implement the functionality of __splice_from_pipe() when
-+ *    locking is required around copying the pipe buffers to the
-+ *    destination.
-  */
--ssize_t __splice_from_pipe(struct pipe_inode_info *pipe, struct splice_desc *sd,
--			   splice_actor *actor)
-+int splice_from_pipe_feed(struct pipe_inode_info *pipe, struct splice_desc *sd,
-+			  splice_actor *actor)
- {
--	int ret, do_wakeup, err;
--
--	ret = 0;
--	do_wakeup = 0;
--
--	for (;;) {
--		if (pipe->nrbufs) {
--			struct pipe_buffer *buf = pipe->bufs + pipe->curbuf;
--			const struct pipe_buf_operations *ops = buf->ops;
-+	int ret;
- 
--			sd->len = buf->len;
--			if (sd->len > sd->total_len)
--				sd->len = sd->total_len;
-+	while (pipe->nrbufs) {
-+		struct pipe_buffer *buf = pipe->bufs + pipe->curbuf;
-+		const struct pipe_buf_operations *ops = buf->ops;
- 
--			err = actor(pipe, buf, sd);
--			if (err <= 0) {
--				if (!ret && err != -ENODATA)
--					ret = err;
-+		sd->len = buf->len;
-+		if (sd->len > sd->total_len)
-+			sd->len = sd->total_len;
- 
--				break;
--			}
-+		ret = actor(pipe, buf, sd);
-+		if (ret <= 0) {
-+			if (ret == -ENODATA)
-+				ret = 0;
-+			return ret;
-+		}
-+		buf->offset += ret;
-+		buf->len -= ret;
- 
--			ret += err;
--			buf->offset += err;
--			buf->len -= err;
-+		sd->num_spliced += ret;
-+		sd->len -= ret;
-+		sd->pos += ret;
-+		sd->total_len -= ret;
- 
--			sd->len -= err;
--			sd->pos += err;
--			sd->total_len -= err;
--			if (sd->len)
--				continue;
-+		if (!buf->len) {
-+			buf->ops = NULL;
-+			ops->release(pipe, buf);
-+			pipe->curbuf = (pipe->curbuf + 1) & (PIPE_BUFFERS - 1);
-+			pipe->nrbufs--;
-+			if (pipe->inode)
-+				sd->need_wakeup = true;
-+		}
- 
--			if (!buf->len) {
--				buf->ops = NULL;
--				ops->release(pipe, buf);
--				pipe->curbuf = (pipe->curbuf + 1) & (PIPE_BUFFERS - 1);
--				pipe->nrbufs--;
--				if (pipe->inode)
--					do_wakeup = 1;
--			}
-+		if (!sd->total_len)
-+			return 0;
-+	}
- 
--			if (!sd->total_len)
--				break;
--		}
-+	return 1;
-+}
-+EXPORT_SYMBOL(splice_from_pipe_feed);
- 
--		if (pipe->nrbufs)
--			continue;
-+/**
-+ * splice_from_pipe_next - wait for some data to splice from
-+ * @pipe:	pipe to splice from
-+ * @sd:		information about the splice operation
-+ *
-+ * Description:
-+ *    This function will wait for some data and return a positive
-+ *    value (one) if pipe buffers are available.  It will return zero
-+ *    or -errno if no more data needs to be spliced.
-+ */
-+int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
-+{
-+	while (!pipe->nrbufs) {
- 		if (!pipe->writers)
--			break;
--		if (!pipe->waiting_writers) {
--			if (ret)
--				break;
--		}
-+			return 0;
- 
--		if (sd->flags & SPLICE_F_NONBLOCK) {
--			if (!ret)
--				ret = -EAGAIN;
--			break;
--		}
-+		if (!pipe->waiting_writers && sd->num_spliced)
-+			return 0;
- 
--		if (signal_pending(current)) {
--			if (!ret)
--				ret = -ERESTARTSYS;
--			break;
--		}
-+		if (sd->flags & SPLICE_F_NONBLOCK)
-+			return -EAGAIN;
- 
--		if (do_wakeup) {
--			smp_mb();
--			if (waitqueue_active(&pipe->wait))
--				wake_up_interruptible_sync(&pipe->wait);
--			kill_fasync(&pipe->fasync_writers, SIGIO, POLL_OUT);
--			do_wakeup = 0;
-+		if (signal_pending(current))
-+			return -ERESTARTSYS;
-+
-+		if (sd->need_wakeup) {
-+			wakeup_pipe_writers(pipe);
-+			sd->need_wakeup = false;
- 		}
- 
- 		pipe_wait(pipe);
- 	}
- 
--	if (do_wakeup) {
--		smp_mb();
--		if (waitqueue_active(&pipe->wait))
--			wake_up_interruptible(&pipe->wait);
--		kill_fasync(&pipe->fasync_writers, SIGIO, POLL_OUT);
--	}
-+	return 1;
-+}
-+EXPORT_SYMBOL(splice_from_pipe_next);
- 
--	return ret;
-+/**
-+ * splice_from_pipe_begin - start splicing from pipe
-+ * @pipe:	pipe to splice from
-+ *
-+ * Description:
-+ *    This function should be called before a loop containing
-+ *    splice_from_pipe_next() and splice_from_pipe_feed() to
-+ *    initialize the necessary fields of @sd.
-+ */
-+void splice_from_pipe_begin(struct splice_desc *sd)
-+{
-+	sd->num_spliced = 0;
-+	sd->need_wakeup = false;
-+}
-+EXPORT_SYMBOL(splice_from_pipe_begin);
-+
-+/**
-+ * splice_from_pipe_end - finish splicing from pipe
-+ * @pipe:	pipe to splice from
-+ * @sd:		information about the splice operation
-+ *
-+ * Description:
-+ *    This function will wake up pipe writers if necessary.  It should
-+ *    be called after a loop containing splice_from_pipe_next() and
-+ *    splice_from_pipe_feed().
-+ */
-+void splice_from_pipe_end(struct pipe_inode_info *pipe, struct splice_desc *sd)
-+{
-+	if (sd->need_wakeup)
-+		wakeup_pipe_writers(pipe);
-+}
-+EXPORT_SYMBOL(splice_from_pipe_end);
-+
-+/**
-+ * __splice_from_pipe - splice data from a pipe to given actor
-+ * @pipe:	pipe to splice from
-+ * @sd:		information to @actor
-+ * @actor:	handler that splices the data
-+ *
-+ * Description:
-+ *    This function does little more than loop over the pipe and call
-+ *    @actor to do the actual moving of a single struct pipe_buffer to
-+ *    the desired destination. See pipe_to_file, pipe_to_sendpage, or
-+ *    pipe_to_user.
-+ *
-+ */
-+ssize_t __splice_from_pipe(struct pipe_inode_info *pipe, struct splice_desc *sd,
-+			   splice_actor *actor)
-+{
-+	int ret;
-+
-+	splice_from_pipe_begin(sd);
-+	do {
-+		ret = splice_from_pipe_next(pipe, sd);
-+		if (ret > 0)
-+			ret = splice_from_pipe_feed(pipe, sd, actor);
-+	} while (ret > 0);
-+	splice_from_pipe_end(pipe, sd);
-+
-+	return sd->num_spliced ? sd->num_spliced : ret;
- }
- EXPORT_SYMBOL(__splice_from_pipe);
- 
-@@ -714,7 +784,7 @@ EXPORT_SYMBOL(__splice_from_pipe);
-  * @actor:	handler that splices the data
-  *
-  * Description:
-- *    See __splice_from_pipe. This function locks the input and output inodes,
-+ *    See __splice_from_pipe. This function locks the pipe inode,
-  *    otherwise it's identical to __splice_from_pipe().
-  *
-  */
-@@ -723,7 +793,6 @@ ssize_t splice_from_pipe(struct pipe_inode_info *pipe, struct file *out,
- 			 splice_actor *actor)
- {
- 	ssize_t ret;
--	struct inode *inode = out->f_mapping->host;
- 	struct splice_desc sd = {
- 		.total_len = len,
- 		.flags = flags,
-@@ -731,24 +800,11 @@ ssize_t splice_from_pipe(struct pipe_inode_info *pipe, struct file *out,
- 		.u.file = out,
- 	};
- 
--	/*
--	 * The actor worker might be calling ->write_begin and
--	 * ->write_end. Most of the time, these expect i_mutex to
--	 * be held. Since this may result in an ABBA deadlock with
--	 * pipe->inode, we have to order lock acquiry here.
--	 *
--	 * Outer lock must be inode->i_mutex, as pipe_wait() will
--	 * release and reacquire pipe->inode->i_mutex, AND inode must
--	 * never be a pipe.
--	 */
--	WARN_ON(S_ISFIFO(inode->i_mode));
--	mutex_lock_nested(&inode->i_mutex, I_MUTEX_PARENT);
- 	if (pipe->inode)
--		mutex_lock_nested(&pipe->inode->i_mutex, I_MUTEX_CHILD);
-+		mutex_lock(&pipe->inode->i_mutex);
- 	ret = __splice_from_pipe(pipe, &sd, actor);
- 	if (pipe->inode)
- 		mutex_unlock(&pipe->inode->i_mutex);
--	mutex_unlock(&inode->i_mutex);
- 
- 	return ret;
- }
-@@ -839,17 +895,29 @@ generic_file_splice_write(struct pipe_inode_info *pipe, struct file *out,
- 	};
- 	ssize_t ret;
- 
--	WARN_ON(S_ISFIFO(inode->i_mode));
--	mutex_lock_nested(&inode->i_mutex, I_MUTEX_PARENT);
--	ret = file_remove_suid(out);
--	if (likely(!ret)) {
--		if (pipe->inode)
--			mutex_lock_nested(&pipe->inode->i_mutex, I_MUTEX_CHILD);
--		ret = __splice_from_pipe(pipe, &sd, pipe_to_file);
--		if (pipe->inode)
--			mutex_unlock(&pipe->inode->i_mutex);
--	}
--	mutex_unlock(&inode->i_mutex);
-+	if (pipe->inode)
-+		mutex_lock_nested(&pipe->inode->i_mutex, I_MUTEX_PARENT);
-+
-+	splice_from_pipe_begin(&sd);
-+	do {
-+		ret = splice_from_pipe_next(pipe, &sd);
-+		if (ret <= 0)
-+			break;
-+
-+		mutex_lock_nested(&inode->i_mutex, I_MUTEX_CHILD);
-+		ret = file_remove_suid(out);
-+		if (!ret)
-+			ret = splice_from_pipe_feed(pipe, &sd, pipe_to_file);
-+		mutex_unlock(&inode->i_mutex);
-+	} while (ret > 0);
-+	splice_from_pipe_end(pipe, &sd);
-+
-+	if (pipe->inode)
-+		mutex_unlock(&pipe->inode->i_mutex);
-+
-+	if (sd.num_spliced)
-+		ret = sd.num_spliced;
-+
- 	if (ret > 0) {
- 		unsigned long nr_pages;
- 
-diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c
-index 93b6de5..0ff89fe 100644
---- a/fs/ubifs/file.c
-+++ b/fs/ubifs/file.c
-@@ -1434,8 +1434,9 @@ static int ubifs_releasepage(struct page *page, gfp_t unused_gfp_flags)
-  * mmap()d file has taken write protection fault and is being made
-  * writable. UBIFS must ensure page is budgeted for.
-  */
--static int ubifs_vm_page_mkwrite(struct vm_area_struct *vma, struct page *page)
-+static int ubifs_vm_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
- {
-+	struct page *page = vmf->page;
- 	struct inode *inode = vma->vm_file->f_path.dentry->d_inode;
- 	struct ubifs_info *c = inode->i_sb->s_fs_info;
- 	struct timespec now = ubifs_current_time(inode);
-@@ -1447,7 +1448,7 @@ static int ubifs_vm_page_mkwrite(struct vm_area_struct *vma, struct page *page)
- 	ubifs_assert(!(inode->i_sb->s_flags & MS_RDONLY));
- 
- 	if (unlikely(c->ro_media))
--		return -EROFS;
-+		return VM_FAULT_SIGBUS; /* -EROFS */
- 
- 	/*
- 	 * We have not locked @page so far so we may budget for changing the
-@@ -1480,7 +1481,7 @@ static int ubifs_vm_page_mkwrite(struct vm_area_struct *vma, struct page *page)
- 		if (err == -ENOSPC)
- 			ubifs_warn("out of space for mmapped file "
- 				   "(inode number %lu)", inode->i_ino);
--		return err;
-+		return VM_FAULT_SIGBUS;
- 	}
- 
- 	lock_page(page);
-@@ -1520,6 +1521,8 @@ static int ubifs_vm_page_mkwrite(struct vm_area_struct *vma, struct page *page)
- out_unlock:
- 	unlock_page(page);
- 	ubifs_release_budget(c, &req);
-+	if (err)
-+		err = VM_FAULT_SIGBUS;
- 	return err;
- }
- 
-diff --git a/fs/xfs/linux-2.6/xfs_file.c b/fs/xfs/linux-2.6/xfs_file.c
-index e14c4e3..f4e2554 100644
---- a/fs/xfs/linux-2.6/xfs_file.c
-+++ b/fs/xfs/linux-2.6/xfs_file.c
-@@ -234,9 +234,9 @@ xfs_file_mmap(
- STATIC int
- xfs_vm_page_mkwrite(
- 	struct vm_area_struct	*vma,
--	struct page		*page)
-+	struct vm_fault		*vmf)
- {
--	return block_page_mkwrite(vma, page, xfs_get_blocks);
-+	return block_page_mkwrite(vma, vmf, xfs_get_blocks);
- }
- 
- const struct file_operations xfs_file_operations = {
-diff --git a/include/linux/buffer_head.h b/include/linux/buffer_head.h
-index bd7ac79..2c2d216 100644
---- a/include/linux/buffer_head.h
-+++ b/include/linux/buffer_head.h
-@@ -223,7 +223,7 @@ int cont_write_begin(struct file *, struct address_space *, loff_t,
- 			get_block_t *, loff_t *);
- int generic_cont_expand_simple(struct inode *inode, loff_t size);
- int block_commit_write(struct page *page, unsigned from, unsigned to);
--int block_page_mkwrite(struct vm_area_struct *vma, struct page *page,
-+int block_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf,
- 				get_block_t get_block);
- void block_sync_page(struct page *);
- sector_t generic_block_bmap(struct address_space *, sector_t, get_block_t *);
-diff --git a/include/linux/compiler.h b/include/linux/compiler.h
-index d95da10..0011cd7 100644
---- a/include/linux/compiler.h
-+++ b/include/linux/compiler.h
-@@ -75,7 +75,8 @@ struct ftrace_branch_data {
-  * Note: DISABLE_BRANCH_PROFILING can be used by special lowlevel code
-  * to disable branch tracing on a per file basis.
-  */
--#if defined(CONFIG_TRACE_BRANCH_PROFILING) && !defined(DISABLE_BRANCH_PROFILING)
-+#if defined(CONFIG_TRACE_BRANCH_PROFILING) \
-+    && !defined(DISABLE_BRANCH_PROFILING) && !defined(__CHECKER__)
- void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
- 
- #define likely_notrace(x)	__builtin_expect(!!(x), 1)
-diff --git a/include/linux/mm.h b/include/linux/mm.h
-index 3daa05f..93d0a69 100644
---- a/include/linux/mm.h
-+++ b/include/linux/mm.h
-@@ -145,6 +145,7 @@ extern pgprot_t protection_map[16];
- 
- #define FAULT_FLAG_WRITE	0x01	/* Fault was a write access */
- #define FAULT_FLAG_NONLINEAR	0x02	/* Fault was via a nonlinear mapping */
-+#define FAULT_FLAG_MKWRITE	0x04	/* Fault was mkwrite of existing pte */
- 
- /*
-  * This interface is used by x86 PAT code to identify a pfn mapping that is
-@@ -197,7 +198,7 @@ struct vm_operations_struct {
- 
- 	/* notification that a previously read-only page is about to become
- 	 * writable, if an error is returned it will cause a SIGBUS */
--	int (*page_mkwrite)(struct vm_area_struct *vma, struct page *page);
-+	int (*page_mkwrite)(struct vm_area_struct *vma, struct vm_fault *vmf);
- 
- 	/* called by access_process_vm when get_user_pages() fails, typically
- 	 * for use by special VMAs that can switch between memory and hardware
-diff --git a/include/linux/splice.h b/include/linux/splice.h
-index 528dcb9..5f3faa9 100644
---- a/include/linux/splice.h
-+++ b/include/linux/splice.h
-@@ -36,6 +36,8 @@ struct splice_desc {
- 		void *data;		/* cookie */
- 	} u;
- 	loff_t pos;			/* file position */
-+	size_t num_spliced;		/* number of bytes already spliced */
-+	bool need_wakeup;		/* need to wake up writer */
- };
- 
- struct partial_page {
-@@ -66,6 +68,16 @@ extern ssize_t splice_from_pipe(struct pipe_inode_info *, struct file *,
- 				splice_actor *);
- extern ssize_t __splice_from_pipe(struct pipe_inode_info *,
- 				  struct splice_desc *, splice_actor *);
-+extern int splice_from_pipe_feed(struct pipe_inode_info *, struct splice_desc *,
-+				 splice_actor *);
-+extern int splice_from_pipe_next(struct pipe_inode_info *,
-+				 struct splice_desc *);
-+extern void splice_from_pipe_begin(struct splice_desc *);
-+extern void splice_from_pipe_end(struct pipe_inode_info *,
-+				 struct splice_desc *);
-+extern int pipe_to_file(struct pipe_inode_info *, struct pipe_buffer *,
-+			struct splice_desc *);
-+
- extern ssize_t splice_to_pipe(struct pipe_inode_info *,
- 			      struct splice_pipe_desc *);
- extern ssize_t splice_direct_to_actor(struct file *, struct splice_desc *,
-diff --git a/include/net/cipso_ipv4.h b/include/net/cipso_ipv4.h
-index bedc7f6..abd4436 100644
---- a/include/net/cipso_ipv4.h
-+++ b/include/net/cipso_ipv4.h
-@@ -40,6 +40,7 @@
- #include <linux/net.h>
- #include <linux/skbuff.h>
- #include <net/netlabel.h>
-+#include <net/request_sock.h>
- #include <asm/atomic.h>
- 
- /* known doi values */
-@@ -215,6 +216,10 @@ int cipso_v4_sock_setattr(struct sock *sk,
- 			  const struct netlbl_lsm_secattr *secattr);
- void cipso_v4_sock_delattr(struct sock *sk);
- int cipso_v4_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr);
-+int cipso_v4_req_setattr(struct request_sock *req,
-+			 const struct cipso_v4_doi *doi_def,
-+			 const struct netlbl_lsm_secattr *secattr);
-+void cipso_v4_req_delattr(struct request_sock *req);
- int cipso_v4_skbuff_setattr(struct sk_buff *skb,
- 			    const struct cipso_v4_doi *doi_def,
- 			    const struct netlbl_lsm_secattr *secattr);
-@@ -247,6 +252,18 @@ static inline int cipso_v4_sock_getattr(struct sock *sk,
- 	return -ENOSYS;
- }
- 
-+static inline int cipso_v4_req_setattr(struct request_sock *req,
-+				       const struct cipso_v4_doi *doi_def,
-+				       const struct netlbl_lsm_secattr *secattr)
-+{
-+	return -ENOSYS;
-+}
-+
-+static inline void cipso_v4_req_delattr(struct request_sock *req)
-+{
-+	return;
-+}
-+
- static inline int cipso_v4_skbuff_setattr(struct sk_buff *skb,
- 				      const struct cipso_v4_doi *doi_def,
- 				      const struct netlbl_lsm_secattr *secattr)
-diff --git a/include/net/netlabel.h b/include/net/netlabel.h
-index 749011e..bf77b5c 100644
---- a/include/net/netlabel.h
-+++ b/include/net/netlabel.h
-@@ -36,6 +36,7 @@
- #include <linux/in.h>
- #include <linux/in6.h>
- #include <net/netlink.h>
-+#include <net/request_sock.h>
- #include <asm/atomic.h>
- 
- struct cipso_v4_doi;
-@@ -413,6 +414,9 @@ int netlbl_sock_getattr(struct sock *sk,
- int netlbl_conn_setattr(struct sock *sk,
- 			struct sockaddr *addr,
- 			const struct netlbl_lsm_secattr *secattr);
-+int netlbl_req_setattr(struct request_sock *req,
-+		       const struct netlbl_lsm_secattr *secattr);
-+void netlbl_req_delattr(struct request_sock *req);
- int netlbl_skbuff_setattr(struct sk_buff *skb,
- 			  u16 family,
- 			  const struct netlbl_lsm_secattr *secattr);
-@@ -519,7 +523,7 @@ static inline int netlbl_enabled(void)
- 	return 0;
- }
- static inline int netlbl_sock_setattr(struct sock *sk,
--				     const struct netlbl_lsm_secattr *secattr)
-+				      const struct netlbl_lsm_secattr *secattr)
- {
- 	return -ENOSYS;
- }
-@@ -537,6 +541,15 @@ static inline int netlbl_conn_setattr(struct sock *sk,
- {
- 	return -ENOSYS;
- }
-+static inline int netlbl_req_setattr(struct request_sock *req,
-+				     const struct netlbl_lsm_secattr *secattr)
-+{
-+	return -ENOSYS;
-+}
-+static inline void netlbl_req_delattr(struct request_sock *req)
-+{
-+	return;
-+}
- static inline int netlbl_skbuff_setattr(struct sk_buff *skb,
- 				      u16 family,
- 				      const struct netlbl_lsm_secattr *secattr)
-diff --git a/mm/memory.c b/mm/memory.c
-index d7df5ba..c304626 100644
---- a/mm/memory.c
-+++ b/mm/memory.c
-@@ -1940,6 +1940,15 @@ static int do_wp_page(struct mm_struct *mm, struct vm_area_struct *vma,
- 		 * get_user_pages(.write=1, .force=1).
- 		 */
- 		if (vma->vm_ops && vma->vm_ops->page_mkwrite) {
-+			struct vm_fault vmf;
-+			int tmp;
-+
-+			vmf.virtual_address = (void __user *)(address &
-+								PAGE_MASK);
-+			vmf.pgoff = old_page->index;
-+			vmf.flags = FAULT_FLAG_WRITE|FAULT_FLAG_MKWRITE;
-+			vmf.page = old_page;
-+
- 			/*
- 			 * Notify the address space that the page is about to
- 			 * become writable so that it can prohibit this or wait
-@@ -1951,8 +1960,21 @@ static int do_wp_page(struct mm_struct *mm, struct vm_area_struct *vma,
- 			page_cache_get(old_page);
- 			pte_unmap_unlock(page_table, ptl);
- 
--			if (vma->vm_ops->page_mkwrite(vma, old_page) < 0)
-+			tmp = vma->vm_ops->page_mkwrite(vma, &vmf);
-+			if (unlikely(tmp &
-+					(VM_FAULT_ERROR | VM_FAULT_NOPAGE))) {
-+				ret = tmp;
- 				goto unwritable_page;
-+			}
-+			if (unlikely(!(tmp & VM_FAULT_LOCKED))) {
-+				lock_page(old_page);
-+				if (!old_page->mapping) {
-+					ret = 0; /* retry the fault */
-+					unlock_page(old_page);
-+					goto unwritable_page;
-+				}
-+			} else
-+				VM_BUG_ON(!PageLocked(old_page));
- 
- 			/*
- 			 * Since we dropped the lock we need to revalidate
-@@ -1962,9 +1984,11 @@ static int do_wp_page(struct mm_struct *mm, struct vm_area_struct *vma,
- 			 */
- 			page_table = pte_offset_map_lock(mm, pmd, address,
- 							 &ptl);
--			page_cache_release(old_page);
--			if (!pte_same(*page_table, orig_pte))
-+			if (!pte_same(*page_table, orig_pte)) {
-+				unlock_page(old_page);
-+				page_cache_release(old_page);
- 				goto unlock;
-+			}
- 
- 			page_mkwrite = 1;
- 		}
-@@ -2076,9 +2100,6 @@ gotten:
- unlock:
- 	pte_unmap_unlock(page_table, ptl);
- 	if (dirty_page) {
--		if (vma->vm_file)
--			file_update_time(vma->vm_file);
--
- 		/*
- 		 * Yes, Virginia, this is actually required to prevent a race
- 		 * with clear_page_dirty_for_io() from clearing the page dirty
-@@ -2087,21 +2108,46 @@ unlock:
- 		 *
- 		 * do_no_page is protected similarly.
- 		 */
--		wait_on_page_locked(dirty_page);
--		set_page_dirty_balance(dirty_page, page_mkwrite);
-+		if (!page_mkwrite) {
-+			wait_on_page_locked(dirty_page);
-+			set_page_dirty_balance(dirty_page, page_mkwrite);
-+		}
- 		put_page(dirty_page);
-+		if (page_mkwrite) {
-+			struct address_space *mapping = dirty_page->mapping;
-+
-+			set_page_dirty(dirty_page);
-+			unlock_page(dirty_page);
-+			page_cache_release(dirty_page);
-+			if (mapping)	{
-+				/*
-+				 * Some device drivers do not set page.mapping
-+				 * but still dirty their pages
-+				 */
-+				balance_dirty_pages_ratelimited(mapping);
-+			}
-+		}
-+
-+		/* file_update_time outside page_lock */
-+		if (vma->vm_file)
-+			file_update_time(vma->vm_file);
- 	}
- 	return ret;
- oom_free_new:
- 	page_cache_release(new_page);
- oom:
--	if (old_page)
-+	if (old_page) {
-+		if (page_mkwrite) {
-+			unlock_page(old_page);
-+			page_cache_release(old_page);
-+		}
- 		page_cache_release(old_page);
-+	}
- 	return VM_FAULT_OOM;
- 
- unwritable_page:
- 	page_cache_release(old_page);
--	return VM_FAULT_SIGBUS;
-+	return ret;
- }
- 
- /*
-@@ -2645,25 +2691,25 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
- 			 * to become writable
- 			 */
- 			if (vma->vm_ops->page_mkwrite) {
-+				int tmp;
-+
- 				unlock_page(page);
--				if (vma->vm_ops->page_mkwrite(vma, page) < 0) {
--					ret = VM_FAULT_SIGBUS;
--					anon = 1; /* no anon but release vmf.page */
--					goto out_unlocked;
--				}
--				lock_page(page);
--				/*
--				 * XXX: this is not quite right (racy vs
--				 * invalidate) to unlock and relock the page
--				 * like this, however a better fix requires
--				 * reworking page_mkwrite locking API, which
--				 * is better done later.
--				 */
--				if (!page->mapping) {
--					ret = 0;
--					anon = 1; /* no anon but release vmf.page */
--					goto out;
-+				vmf.flags = FAULT_FLAG_WRITE|FAULT_FLAG_MKWRITE;
-+				tmp = vma->vm_ops->page_mkwrite(vma, &vmf);
-+				if (unlikely(tmp &
-+					  (VM_FAULT_ERROR | VM_FAULT_NOPAGE))) {
-+					ret = tmp;
-+					goto unwritable_page;
- 				}
-+				if (unlikely(!(tmp & VM_FAULT_LOCKED))) {
-+					lock_page(page);
-+					if (!page->mapping) {
-+						ret = 0; /* retry the fault */
-+						unlock_page(page);
-+						goto unwritable_page;
-+					}
-+				} else
-+					VM_BUG_ON(!PageLocked(page));
- 				page_mkwrite = 1;
- 			}
- 		}
-@@ -2715,19 +2761,35 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
- 	pte_unmap_unlock(page_table, ptl);
- 
- out:
--	unlock_page(vmf.page);
--out_unlocked:
--	if (anon)
--		page_cache_release(vmf.page);
--	else if (dirty_page) {
--		if (vma->vm_file)
--			file_update_time(vma->vm_file);
-+	if (dirty_page) {
-+		struct address_space *mapping = page->mapping;
- 
--		set_page_dirty_balance(dirty_page, page_mkwrite);
-+		if (set_page_dirty(dirty_page))
-+			page_mkwrite = 1;
-+		unlock_page(dirty_page);
- 		put_page(dirty_page);
-+		if (page_mkwrite && mapping) {
-+			/*
-+			 * Some device drivers do not set page.mapping but still
-+			 * dirty their pages
-+			 */
-+			balance_dirty_pages_ratelimited(mapping);
-+		}
-+
-+		/* file_update_time outside page_lock */
-+		if (vma->vm_file)
-+			file_update_time(vma->vm_file);
-+	} else {
-+		unlock_page(vmf.page);
-+		if (anon)
-+			page_cache_release(vmf.page);
- 	}
- 
- 	return ret;
-+
-+unwritable_page:
-+	page_cache_release(page);
-+	return ret;
- }
- 
- static int do_linear_fault(struct mm_struct *mm, struct vm_area_struct *vma,
-diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
-index 7bc9929..4ea2c38 100644
---- a/net/ipv4/cipso_ipv4.c
-+++ b/net/ipv4/cipso_ipv4.c
-@@ -1942,6 +1942,72 @@ socket_setattr_failure:
- }
- 
- /**
-+ * cipso_v4_req_setattr - Add a CIPSO option to a connection request socket
-+ * @req: the connection request socket
-+ * @doi_def: the CIPSO DOI to use
-+ * @secattr: the specific security attributes of the socket
-+ *
-+ * Description:
-+ * Set the CIPSO option on the given socket using the DOI definition and
-+ * security attributes passed to the function.  Returns zero on success and
-+ * negative values on failure.
-+ *
-+ */
-+int cipso_v4_req_setattr(struct request_sock *req,
-+			 const struct cipso_v4_doi *doi_def,
-+			 const struct netlbl_lsm_secattr *secattr)
-+{
-+	int ret_val = -EPERM;
-+	unsigned char *buf = NULL;
-+	u32 buf_len;
-+	u32 opt_len;
-+	struct ip_options *opt = NULL;
-+	struct inet_request_sock *req_inet;
-+
-+	/* We allocate the maximum CIPSO option size here so we are probably
-+	 * being a little wasteful, but it makes our life _much_ easier later
-+	 * on and after all we are only talking about 40 bytes. */
-+	buf_len = CIPSO_V4_OPT_LEN_MAX;
-+	buf = kmalloc(buf_len, GFP_ATOMIC);
-+	if (buf == NULL) {
-+		ret_val = -ENOMEM;
-+		goto req_setattr_failure;
-+	}
-+
-+	ret_val = cipso_v4_genopt(buf, buf_len, doi_def, secattr);
-+	if (ret_val < 0)
-+		goto req_setattr_failure;
-+	buf_len = ret_val;
-+
-+	/* We can't use ip_options_get() directly because it makes a call to
-+	 * ip_options_get_alloc() which allocates memory with GFP_KERNEL and
-+	 * we won't always have CAP_NET_RAW even though we _always_ want to
-+	 * set the IPOPT_CIPSO option. */
-+	opt_len = (buf_len + 3) & ~3;
-+	opt = kzalloc(sizeof(*opt) + opt_len, GFP_ATOMIC);
-+	if (opt == NULL) {
-+		ret_val = -ENOMEM;
-+		goto req_setattr_failure;
-+	}
-+	memcpy(opt->__data, buf, buf_len);
-+	opt->optlen = opt_len;
-+	opt->cipso = sizeof(struct iphdr);
-+	kfree(buf);
-+	buf = NULL;
-+
-+	req_inet = inet_rsk(req);
-+	opt = xchg(&req_inet->opt, opt);
-+	kfree(opt);
-+
-+	return 0;
-+
-+req_setattr_failure:
-+	kfree(buf);
-+	kfree(opt);
-+	return ret_val;
-+}
-+
-+/**
-  * cipso_v4_sock_delattr - Delete the CIPSO option from a socket
-  * @sk: the socket
-  *
-@@ -2016,6 +2082,70 @@ void cipso_v4_sock_delattr(struct sock *sk)
- }
- 
- /**
-+ * cipso_v4_req_delattr - Delete the CIPSO option from a request socket
-+ * @reg: the request socket
-+ *
-+ * Description:
-+ * Removes the CIPSO option from a request socket, if present.
-+ *
-+ */
-+void cipso_v4_req_delattr(struct request_sock *req)
-+{
-+	struct ip_options *opt;
-+	struct inet_request_sock *req_inet;
-+
-+	req_inet = inet_rsk(req);
-+	opt = req_inet->opt;
-+	if (opt == NULL || opt->cipso == 0)
-+		return;
-+
-+	if (opt->srr || opt->rr || opt->ts || opt->router_alert) {
-+		u8 cipso_len;
-+		u8 cipso_off;
-+		unsigned char *cipso_ptr;
-+		int iter;
-+		int optlen_new;
-+
-+		cipso_off = opt->cipso - sizeof(struct iphdr);
-+		cipso_ptr = &opt->__data[cipso_off];
-+		cipso_len = cipso_ptr[1];
-+
-+		if (opt->srr > opt->cipso)
-+			opt->srr -= cipso_len;
-+		if (opt->rr > opt->cipso)
-+			opt->rr -= cipso_len;
-+		if (opt->ts > opt->cipso)
-+			opt->ts -= cipso_len;
-+		if (opt->router_alert > opt->cipso)
-+			opt->router_alert -= cipso_len;
-+		opt->cipso = 0;
-+
-+		memmove(cipso_ptr, cipso_ptr + cipso_len,
-+			opt->optlen - cipso_off - cipso_len);
-+
-+		/* determining the new total option length is tricky because of
-+		 * the padding necessary, the only thing i can think to do at
-+		 * this point is walk the options one-by-one, skipping the
-+		 * padding at the end to determine the actual option size and
-+		 * from there we can determine the new total option length */
-+		iter = 0;
-+		optlen_new = 0;
-+		while (iter < opt->optlen)
-+			if (opt->__data[iter] != IPOPT_NOP) {
-+				iter += opt->__data[iter + 1];
-+				optlen_new = iter;
-+			} else
-+				iter++;
-+		opt->optlen = (optlen_new + 3) & ~3;
-+	} else {
-+		/* only the cipso option was present on the socket so we can
-+		 * remove the entire option struct */
-+		req_inet->opt = NULL;
-+		kfree(opt);
-+	}
-+}
-+
-+/**
-  * cipso_v4_getattr - Helper function for the cipso_v4_*_getattr functions
-  * @cipso: the CIPSO v4 option
-  * @secattr: the security attributes
-diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
-index d346c22..b35a950 100644
---- a/net/ipv4/syncookies.c
-+++ b/net/ipv4/syncookies.c
-@@ -288,10 +288,6 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
- 	if (!req)
- 		goto out;
- 
--	if (security_inet_conn_request(sk, skb, req)) {
--		reqsk_free(req);
--		goto out;
--	}
- 	ireq = inet_rsk(req);
- 	treq = tcp_rsk(req);
- 	treq->rcv_isn		= ntohl(th->seq) - 1;
-@@ -322,6 +318,11 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
- 		}
- 	}
- 
-+	if (security_inet_conn_request(sk, skb, req)) {
-+		reqsk_free(req);
-+		goto out;
-+	}
-+
- 	req->expires	= 0UL;
- 	req->retrans	= 0;
- 
-diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
-index cf74c41..5499c28 100644
---- a/net/ipv4/tcp_ipv4.c
-+++ b/net/ipv4/tcp_ipv4.c
-@@ -1239,14 +1239,15 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
- 
- 	tcp_openreq_init(req, &tmp_opt, skb);
- 
--	if (security_inet_conn_request(sk, skb, req))
--		goto drop_and_free;
--
- 	ireq = inet_rsk(req);
- 	ireq->loc_addr = daddr;
- 	ireq->rmt_addr = saddr;
- 	ireq->no_srccheck = inet_sk(sk)->transparent;
- 	ireq->opt = tcp_v4_save_options(sk, skb);
-+
-+	if (security_inet_conn_request(sk, skb, req))
-+		goto drop_and_free;
-+
- 	if (!want_cookie)
- 		TCP_ECN_create_request(req, tcp_hdr(skb));
- 
-diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
-index fd9229d..a52ca1c 100644
---- a/net/netlabel/netlabel_kapi.c
-+++ b/net/netlabel/netlabel_kapi.c
-@@ -757,6 +757,90 @@ conn_setattr_return:
- }
- 
- /**
-+ * netlbl_req_setattr - Label a request socket using the correct protocol
-+ * @req: the request socket to label
-+ * @secattr: the security attributes
-+ *
-+ * Description:
-+ * Attach the correct label to the given socket using the security attributes
-+ * specified in @secattr.  Returns zero on success, negative values on failure.
-+ *
-+ */
-+int netlbl_req_setattr(struct request_sock *req,
-+		       const struct netlbl_lsm_secattr *secattr)
-+{
-+	int ret_val;
-+	struct netlbl_dom_map *dom_entry;
-+	struct netlbl_domaddr4_map *af4_entry;
-+	u32 proto_type;
-+	struct cipso_v4_doi *proto_cv4;
-+
-+	rcu_read_lock();
-+	dom_entry = netlbl_domhsh_getentry(secattr->domain);
-+	if (dom_entry == NULL) {
-+		ret_val = -ENOENT;
-+		goto req_setattr_return;
-+	}
-+	switch (req->rsk_ops->family) {
-+	case AF_INET:
-+		if (dom_entry->type == NETLBL_NLTYPE_ADDRSELECT) {
-+			struct inet_request_sock *req_inet = inet_rsk(req);
-+			af4_entry = netlbl_domhsh_getentry_af4(secattr->domain,
-+							    req_inet->rmt_addr);
-+			if (af4_entry == NULL) {
-+				ret_val = -ENOENT;
-+				goto req_setattr_return;
-+			}
-+			proto_type = af4_entry->type;
-+			proto_cv4 = af4_entry->type_def.cipsov4;
-+		} else {
-+			proto_type = dom_entry->type;
-+			proto_cv4 = dom_entry->type_def.cipsov4;
-+		}
-+		switch (proto_type) {
-+		case NETLBL_NLTYPE_CIPSOV4:
-+			ret_val = cipso_v4_req_setattr(req, proto_cv4, secattr);
-+			break;
-+		case NETLBL_NLTYPE_UNLABELED:
-+			/* just delete the protocols we support for right now
-+			 * but we could remove other protocols if needed */
-+			cipso_v4_req_delattr(req);
-+			ret_val = 0;
-+			break;
-+		default:
-+			ret_val = -ENOENT;
-+		}
-+		break;
-+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
-+	case AF_INET6:
-+		/* since we don't support any IPv6 labeling protocols right
-+		 * now we can optimize everything away until we do */
-+		ret_val = 0;
-+		break;
-+#endif /* IPv6 */
-+	default:
-+		ret_val = -EPROTONOSUPPORT;
-+	}
-+
-+req_setattr_return:
-+	rcu_read_unlock();
-+	return ret_val;
-+}
-+
-+/**
-+* netlbl_req_delattr - Delete all the NetLabel labels on a socket
-+* @req: the socket
-+*
-+* Description:
-+* Remove all the NetLabel labeling from @req.
-+*
-+*/
-+void netlbl_req_delattr(struct request_sock *req)
-+{
-+	cipso_v4_req_delattr(req);
-+}
-+
-+/**
-  * netlbl_skbuff_setattr - Label a packet using the correct protocol
-  * @skb: the packet
-  * @family: protocol family
-diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
-index e210b21..8d24c91 100644
---- a/security/selinux/hooks.c
-+++ b/security/selinux/hooks.c
-@@ -311,7 +311,7 @@ static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
- 	ssec->sid = SECINITSID_UNLABELED;
- 	sk->sk_security = ssec;
- 
--	selinux_netlbl_sk_security_reset(ssec, family);
-+	selinux_netlbl_sk_security_reset(ssec);
- 
- 	return 0;
- }
-@@ -2952,7 +2952,6 @@ static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
- static int selinux_revalidate_file_permission(struct file *file, int mask)
- {
- 	const struct cred *cred = current_cred();
--	int rc;
- 	struct inode *inode = file->f_path.dentry->d_inode;
- 
- 	if (!mask) {
-@@ -2964,30 +2963,16 @@ static int selinux_revalidate_file_permission(struct file *file, int mask)
- 	if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
- 		mask |= MAY_APPEND;
- 
--	rc = file_has_perm(cred, file,
--			   file_mask_to_av(inode->i_mode, mask));
--	if (rc)
--		return rc;
--
--	return selinux_netlbl_inode_permission(inode, mask);
-+	return file_has_perm(cred, file, file_mask_to_av(inode->i_mode, mask));
- }
- 
- static int selinux_file_permission(struct file *file, int mask)
- {
--	struct inode *inode = file->f_path.dentry->d_inode;
--	struct file_security_struct *fsec = file->f_security;
--	struct inode_security_struct *isec = inode->i_security;
--	u32 sid = current_sid();
--
- 	if (!mask) {
- 		/* No permission to check.  Existence test. */
- 		return 0;
- 	}
- 
--	if (sid == fsec->sid && fsec->isid == isec->sid
--	    && fsec->pseqno == avc_policy_seqno())
--		return selinux_netlbl_inode_permission(inode, mask);
--
- 	return selinux_revalidate_file_permission(file, mask);
- }
- 
-@@ -3799,7 +3784,7 @@ static int selinux_socket_post_create(struct socket *sock, int family,
- 		sksec = sock->sk->sk_security;
- 		sksec->sid = isec->sid;
- 		sksec->sclass = isec->sclass;
--		err = selinux_netlbl_socket_post_create(sock);
-+		err = selinux_netlbl_socket_post_create(sock->sk, family);
- 	}
- 
- 	return err;
-@@ -3990,13 +3975,7 @@ static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
- static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
- 				  int size)
- {
--	int rc;
--
--	rc = socket_has_perm(current, sock, SOCKET__WRITE);
--	if (rc)
--		return rc;
--
--	return selinux_netlbl_inode_permission(SOCK_INODE(sock), MAY_WRITE);
-+	return socket_has_perm(current, sock, SOCKET__WRITE);
- }
- 
- static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
-@@ -4384,7 +4363,7 @@ static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
- 	newssec->peer_sid = ssec->peer_sid;
- 	newssec->sclass = ssec->sclass;
- 
--	selinux_netlbl_sk_security_reset(newssec, newsk->sk_family);
-+	selinux_netlbl_sk_security_reset(newssec);
- }
- 
- static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
-@@ -4429,15 +4408,15 @@ static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
- 		req->secid = sksec->sid;
- 		req->peer_secid = SECSID_NULL;
- 		return 0;
-+	} else {
-+		err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
-+		if (err)
-+			return err;
-+		req->secid = newsid;
-+		req->peer_secid = peersid;
- 	}
- 
--	err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
--	if (err)
--		return err;
--
--	req->secid = newsid;
--	req->peer_secid = peersid;
--	return 0;
-+	return selinux_netlbl_inet_conn_request(req, family);
- }
- 
- static void selinux_inet_csk_clone(struct sock *newsk,
-@@ -4454,7 +4433,7 @@ static void selinux_inet_csk_clone(struct sock *newsk,
- 
- 	/* We don't need to take any sort of lock here as we are the only
- 	 * thread with access to newsksec */
--	selinux_netlbl_sk_security_reset(newsksec, req->rsk_ops->family);
-+	selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
- }
- 
- static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
-@@ -4467,8 +4446,6 @@ static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
- 		family = PF_INET;
- 
- 	selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
--
--	selinux_netlbl_inet_conn_established(sk, family);
- }
- 
- static void selinux_req_classify_flow(const struct request_sock *req,
-diff --git a/security/selinux/include/netlabel.h b/security/selinux/include/netlabel.h
-index b913c8d..a5537cd 100644
---- a/security/selinux/include/netlabel.h
-+++ b/security/selinux/include/netlabel.h
-@@ -32,6 +32,7 @@
- #include <linux/net.h>
- #include <linux/skbuff.h>
- #include <net/sock.h>
-+#include <net/request_sock.h>
- 
- #include "avc.h"
- #include "objsec.h"
-@@ -42,8 +43,7 @@ void selinux_netlbl_cache_invalidate(void);
- void selinux_netlbl_err(struct sk_buff *skb, int error, int gateway);
- 
- void selinux_netlbl_sk_security_free(struct sk_security_struct *ssec);
--void selinux_netlbl_sk_security_reset(struct sk_security_struct *ssec,
--				      int family);
-+void selinux_netlbl_sk_security_reset(struct sk_security_struct *ssec);
- 
- int selinux_netlbl_skbuff_getsid(struct sk_buff *skb,
- 				 u16 family,
-@@ -53,8 +53,9 @@ int selinux_netlbl_skbuff_setsid(struct sk_buff *skb,
- 				 u16 family,
- 				 u32 sid);
- 
--void selinux_netlbl_inet_conn_established(struct sock *sk, u16 family);
--int selinux_netlbl_socket_post_create(struct socket *sock);
-+int selinux_netlbl_inet_conn_request(struct request_sock *req, u16 family);
-+void selinux_netlbl_inet_csk_clone(struct sock *sk, u16 family);
-+int selinux_netlbl_socket_post_create(struct sock *sk, u16 family);
- int selinux_netlbl_inode_permission(struct inode *inode, int mask);
- int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
- 				struct sk_buff *skb,
-@@ -85,8 +86,7 @@ static inline void selinux_netlbl_sk_security_free(
- }
- 
- static inline void selinux_netlbl_sk_security_reset(
--					       struct sk_security_struct *ssec,
--					       int family)
-+					       struct sk_security_struct *ssec)
- {
- 	return;
- }
-@@ -113,12 +113,17 @@ static inline int selinux_netlbl_conn_setsid(struct sock *sk,
- 	return 0;
- }
- 
--static inline void selinux_netlbl_inet_conn_established(struct sock *sk,
--							u16 family)
-+static inline int selinux_netlbl_inet_conn_request(struct request_sock *req,
-+						   u16 family)
-+{
-+	return 0;
-+}
-+static inline void selinux_netlbl_inet_csk_clone(struct sock *sk, u16 family)
- {
- 	return;
- }
--static inline int selinux_netlbl_socket_post_create(struct socket *sock)
-+static inline int selinux_netlbl_socket_post_create(struct sock *sk,
-+						    u16 family)
- {
- 	return 0;
- }
-diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c
-index 350794a..5786c8c 100644
---- a/security/selinux/netlabel.c
-+++ b/security/selinux/netlabel.c
-@@ -100,41 +100,6 @@ static struct netlbl_lsm_secattr *selinux_netlbl_sock_genattr(struct sock *sk)
- }
- 
- /**
-- * selinux_netlbl_sock_setsid - Label a socket using the NetLabel mechanism
-- * @sk: the socket to label
-- *
-- * Description:
-- * Attempt to label a socket using the NetLabel mechanism.  Returns zero values
-- * on success, negative values on failure.
-- *
-- */
--static int selinux_netlbl_sock_setsid(struct sock *sk)
--{
--	int rc;
--	struct sk_security_struct *sksec = sk->sk_security;
--	struct netlbl_lsm_secattr *secattr;
--
--	if (sksec->nlbl_state != NLBL_REQUIRE)
--		return 0;
--
--	secattr = selinux_netlbl_sock_genattr(sk);
--	if (secattr == NULL)
--		return -ENOMEM;
--	rc = netlbl_sock_setattr(sk, secattr);
--	switch (rc) {
--	case 0:
--		sksec->nlbl_state = NLBL_LABELED;
--		break;
--	case -EDESTADDRREQ:
--		sksec->nlbl_state = NLBL_REQSKB;
--		rc = 0;
--		break;
--	}
--
--	return rc;
--}
--
--/**
-  * selinux_netlbl_cache_invalidate - Invalidate the NetLabel cache
-  *
-  * Description:
-@@ -188,13 +153,9 @@ void selinux_netlbl_sk_security_free(struct sk_security_struct *ssec)
-  * The caller is responsibile for all the NetLabel sk_security_struct locking.
-  *
-  */
--void selinux_netlbl_sk_security_reset(struct sk_security_struct *ssec,
--				      int family)
-+void selinux_netlbl_sk_security_reset(struct sk_security_struct *ssec)
- {
--	if (family == PF_INET)
--		ssec->nlbl_state = NLBL_REQUIRE;
--	else
--		ssec->nlbl_state = NLBL_UNSET;
-+	ssec->nlbl_state = NLBL_UNSET;
- }
- 
- /**
-@@ -281,127 +242,85 @@ skbuff_setsid_return:
- }
- 
- /**
-- * selinux_netlbl_inet_conn_established - Netlabel the newly accepted connection
-- * @sk: the new connection
-+ * selinux_netlbl_inet_conn_request - Label an incoming stream connection
-+ * @req: incoming connection request socket
-  *
-  * Description:
-- * A new connection has been established on @sk so make sure it is labeled
-- * correctly with the NetLabel susbsystem.
-+ * A new incoming connection request is represented by @req, we need to label
-+ * the new request_sock here and the stack will ensure the on-the-wire label
-+ * will get preserved when a full sock is created once the connection handshake
-+ * is complete.  Returns zero on success, negative values on failure.
-  *
-  */
--void selinux_netlbl_inet_conn_established(struct sock *sk, u16 family)
-+int selinux_netlbl_inet_conn_request(struct request_sock *req, u16 family)
- {
- 	int rc;
--	struct sk_security_struct *sksec = sk->sk_security;
--	struct netlbl_lsm_secattr *secattr;
--	struct inet_sock *sk_inet = inet_sk(sk);
--	struct sockaddr_in addr;
--
--	if (sksec->nlbl_state != NLBL_REQUIRE)
--		return;
-+	struct netlbl_lsm_secattr secattr;
- 
--	secattr = selinux_netlbl_sock_genattr(sk);
--	if (secattr == NULL)
--		return;
-+	if (family != PF_INET)
-+		return 0;
- 
--	rc = netlbl_sock_setattr(sk, secattr);
--	switch (rc) {
--	case 0:
--		sksec->nlbl_state = NLBL_LABELED;
--		break;
--	case -EDESTADDRREQ:
--		/* no PF_INET6 support yet because we don't support any IPv6
--		 * labeling protocols */
--		if (family != PF_INET) {
--			sksec->nlbl_state = NLBL_UNSET;
--			return;
--		}
--
--		addr.sin_family = family;
--		addr.sin_addr.s_addr = sk_inet->daddr;
--		if (netlbl_conn_setattr(sk, (struct sockaddr *)&addr,
--					secattr) != 0) {
--			/* we failed to label the connected socket (could be
--			 * for a variety of reasons, the actual "why" isn't
--			 * important here) so we have to go to our backup plan,
--			 * labeling the packets individually in the netfilter
--			 * local output hook.  this is okay but we need to
--			 * adjust the MSS of the connection to take into
--			 * account any labeling overhead, since we don't know
--			 * the exact overhead at this point we'll use the worst
--			 * case value which is 40 bytes for IPv4 */
--			struct inet_connection_sock *sk_conn = inet_csk(sk);
--			sk_conn->icsk_ext_hdr_len += 40 -
--				      (sk_inet->opt ? sk_inet->opt->optlen : 0);
--			sk_conn->icsk_sync_mss(sk, sk_conn->icsk_pmtu_cookie);
--
--			sksec->nlbl_state = NLBL_REQSKB;
--		} else
--			sksec->nlbl_state = NLBL_CONNLABELED;
--		break;
--	default:
--		/* note that we are failing to label the socket which could be
--		 * a bad thing since it means traffic could leave the system
--		 * without the desired labeling, however, all is not lost as
--		 * we have a check in selinux_netlbl_inode_permission() to
--		 * pick up the pieces that we might drop here because we can't
--		 * return an error code */
--		break;
--	}
-+	netlbl_secattr_init(&secattr);
-+	rc = security_netlbl_sid_to_secattr(req->secid, &secattr);
-+	if (rc != 0)
-+		goto inet_conn_request_return;
-+	rc = netlbl_req_setattr(req, &secattr);
-+inet_conn_request_return:
-+	netlbl_secattr_destroy(&secattr);
-+	return rc;
- }
- 
- /**
-- * selinux_netlbl_socket_post_create - Label a socket using NetLabel
-- * @sock: the socket to label
-+ * selinux_netlbl_inet_csk_clone - Initialize the newly created sock
-+ * @sk: the new sock
-  *
-  * Description:
-- * Attempt to label a socket using the NetLabel mechanism using the given
-- * SID.  Returns zero values on success, negative values on failure.
-+ * A new connection has been established using @sk, we've already labeled the
-+ * socket via the request_sock struct in selinux_netlbl_inet_conn_request() but
-+ * we need to set the NetLabel state here since we now have a sock structure.
-  *
-  */
--int selinux_netlbl_socket_post_create(struct socket *sock)
-+void selinux_netlbl_inet_csk_clone(struct sock *sk, u16 family)
- {
--	return selinux_netlbl_sock_setsid(sock->sk);
-+	struct sk_security_struct *sksec = sk->sk_security;
-+
-+	if (family == PF_INET)
-+		sksec->nlbl_state = NLBL_LABELED;
-+	else
-+		sksec->nlbl_state = NLBL_UNSET;
- }
- 
- /**
-- * selinux_netlbl_inode_permission - Verify the socket is NetLabel labeled
-- * @inode: the file descriptor's inode
-- * @mask: the permission mask
-+ * selinux_netlbl_socket_post_create - Label a socket using NetLabel
-+ * @sock: the socket to label
-  *
-  * Description:
-- * Looks at a file's inode and if it is marked as a socket protected by
-- * NetLabel then verify that the socket has been labeled, if not try to label
-- * the socket now with the inode's SID.  Returns zero on success, negative
-- * values on failure.
-+ * Attempt to label a socket using the NetLabel mechanism using the given
-+ * SID.  Returns zero values on success, negative values on failure.
-  *
-  */
--int selinux_netlbl_inode_permission(struct inode *inode, int mask)
-+int selinux_netlbl_socket_post_create(struct sock *sk, u16 family)
- {
- 	int rc;
--	struct sock *sk;
--	struct socket *sock;
--	struct sk_security_struct *sksec;
-+	struct sk_security_struct *sksec = sk->sk_security;
-+	struct netlbl_lsm_secattr *secattr;
- 
--	if (!S_ISSOCK(inode->i_mode) ||
--	    ((mask & (MAY_WRITE | MAY_APPEND)) == 0))
--		return 0;
--	sock = SOCKET_I(inode);
--	sk = sock->sk;
--	if (sk == NULL)
--		return 0;
--	sksec = sk->sk_security;
--	if (sksec == NULL || sksec->nlbl_state != NLBL_REQUIRE)
-+	if (family != PF_INET)
- 		return 0;
- 
--	local_bh_disable();
--	bh_lock_sock_nested(sk);
--	if (likely(sksec->nlbl_state == NLBL_REQUIRE))
--		rc = selinux_netlbl_sock_setsid(sk);
--	else
-+	secattr = selinux_netlbl_sock_genattr(sk);
-+	if (secattr == NULL)
-+		return -ENOMEM;
-+	rc = netlbl_sock_setattr(sk, secattr);
-+	switch (rc) {
-+	case 0:
-+		sksec->nlbl_state = NLBL_LABELED;
-+		break;
-+	case -EDESTADDRREQ:
-+		sksec->nlbl_state = NLBL_REQSKB;
- 		rc = 0;
--	bh_unlock_sock(sk);
--	local_bh_enable();
-+		break;
-+	}
- 
- 	return rc;
- }
-diff --git a/security/smack/smack.h b/security/smack/smack.h
-index b79582e..1983196 100644
---- a/security/smack/smack.h
-+++ b/security/smack/smack.h
-@@ -40,7 +40,6 @@ struct superblock_smack {
- struct socket_smack {
- 	char		*smk_out;			/* outbound label */
- 	char		*smk_in;			/* inbound label */
--	int		smk_labeled;			/* label scheme */
- 	char		smk_packet[SMK_LABELLEN];	/* TCP peer label */
- };
- 
-diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
-index c1c5f36..b4e811b 100644
---- a/security/smack/smack_lsm.c
-+++ b/security/smack/smack_lsm.c
-@@ -7,6 +7,8 @@
-  *	Casey Schaufler <casey@××××××××××××.com>
-  *
-  *  Copyright (C) 2007 Casey Schaufler <casey@××××××××××××.com>
-+ *  Copyright (C) 2009 Hewlett-Packard Development Company, L.P.
-+ *                Paul Moore <paul.moore@××.com>
-  *
-  *	This program is free software; you can redistribute it and/or modify
-  *	it under the terms of the GNU General Public License version 2,
-@@ -20,6 +22,7 @@
- #include <linux/ext2_fs.h>
- #include <linux/kd.h>
- #include <asm/ioctls.h>
-+#include <linux/ip.h>
- #include <linux/tcp.h>
- #include <linux/udp.h>
- #include <linux/mutex.h>
-@@ -1279,7 +1282,6 @@ static int smack_sk_alloc_security(struct sock *sk, int family, gfp_t gfp_flags)
- 
- 	ssp->smk_in = csp;
- 	ssp->smk_out = csp;
--	ssp->smk_labeled = SMACK_CIPSO_SOCKET;
- 	ssp->smk_packet[0] = '\0';
- 
- 	sk->sk_security = ssp;
-@@ -1397,16 +1399,6 @@ static int smack_netlabel(struct sock *sk, int labeled)
- 
- 	bh_unlock_sock(sk);
- 	local_bh_enable();
--	/*
--	 * Remember the label scheme used so that it is not
--	 * necessary to do the netlabel setting if it has not
--	 * changed the next time through.
--	 *
--	 * The -EDESTADDRREQ case is an indication that there's
--	 * a single level host involved.
--	 */
--	if (rc == 0)
--		ssp->smk_labeled = labeled;
- 
- 	return rc;
- }
-@@ -1551,19 +1543,14 @@ static int smack_socket_connect(struct socket *sock, struct sockaddr *sap,
- 		return -EINVAL;
- 
- 	hostsp = smack_host_label((struct sockaddr_in *)sap);
--	if (hostsp == NULL) {
--		if (ssp->smk_labeled != SMACK_CIPSO_SOCKET)
--			return smack_netlabel(sock->sk, SMACK_CIPSO_SOCKET);
--		return 0;
--	}
-+	if (hostsp == NULL)
-+		return smack_netlabel(sock->sk, SMACK_CIPSO_SOCKET);
- 
- 	rc = smk_access(ssp->smk_out, hostsp, MAY_WRITE);
- 	if (rc != 0)
- 		return rc;
- 
--	if (ssp->smk_labeled != SMACK_UNLABELED_SOCKET)
--		return smack_netlabel(sock->sk, SMACK_UNLABELED_SOCKET);
--	return 0;
-+	return smack_netlabel(sock->sk, SMACK_UNLABELED_SOCKET);
- }
- 
- /**
-@@ -2275,21 +2262,14 @@ static int smack_socket_sendmsg(struct socket *sock, struct msghdr *msg,
- 		return 0;
- 
- 	hostsp = smack_host_label(sip);
--	if (hostsp == NULL) {
--		if (ssp->smk_labeled != SMACK_CIPSO_SOCKET)
--			return smack_netlabel(sock->sk, SMACK_CIPSO_SOCKET);
--		return 0;
--	}
-+	if (hostsp == NULL)
-+		return smack_netlabel(sock->sk, SMACK_CIPSO_SOCKET);
- 
- 	rc = smk_access(ssp->smk_out, hostsp, MAY_WRITE);
- 	if (rc != 0)
- 		return rc;
- 
--	if (ssp->smk_labeled != SMACK_UNLABELED_SOCKET)
--		return smack_netlabel(sock->sk, SMACK_UNLABELED_SOCKET);
--
--	return 0;
--
-+	return smack_netlabel(sock->sk, SMACK_UNLABELED_SOCKET);
- }
- 
- 
-@@ -2504,22 +2484,14 @@ static int smack_socket_getpeersec_dgram(struct socket *sock,
- static void smack_sock_graft(struct sock *sk, struct socket *parent)
- {
- 	struct socket_smack *ssp;
--	int rc;
- 
--	if (sk == NULL)
--		return;
--
--	if (sk->sk_family != PF_INET && sk->sk_family != PF_INET6)
-+	if (sk == NULL ||
-+	    (sk->sk_family != PF_INET && sk->sk_family != PF_INET6))
- 		return;
- 
- 	ssp = sk->sk_security;
- 	ssp->smk_in = ssp->smk_out = current_security();
--	ssp->smk_packet[0] = '\0';
--
--	rc = smack_netlabel(sk, SMACK_CIPSO_SOCKET);
--	if (rc != 0)
--		printk(KERN_WARNING "Smack: \"%s\" netlbl error %d.\n",
--		       __func__, -rc);
-+	/* cssp->smk_packet is already set in smack_inet_csk_clone() */
- }
- 
- /**
-@@ -2534,35 +2506,82 @@ static void smack_sock_graft(struct sock *sk, struct socket *parent)
- static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb,
- 				   struct request_sock *req)
- {
--	struct netlbl_lsm_secattr skb_secattr;
-+	u16 family = sk->sk_family;
- 	struct socket_smack *ssp = sk->sk_security;
-+	struct netlbl_lsm_secattr secattr;
-+	struct sockaddr_in addr;
-+	struct iphdr *hdr;
- 	char smack[SMK_LABELLEN];
- 	int rc;
- 
--	if (skb == NULL)
--		return -EACCES;
-+	/* handle mapped IPv4 packets arriving via IPv6 sockets */
-+	if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
-+		family = PF_INET;
- 
--	netlbl_secattr_init(&skb_secattr);
--	rc = netlbl_skbuff_getattr(skb, sk->sk_family, &skb_secattr);
-+	netlbl_secattr_init(&secattr);
-+	rc = netlbl_skbuff_getattr(skb, family, &secattr);
- 	if (rc == 0)
--		smack_from_secattr(&skb_secattr, smack);
-+		smack_from_secattr(&secattr, smack);
- 	else
- 		strncpy(smack, smack_known_huh.smk_known, SMK_MAXLEN);
--	netlbl_secattr_destroy(&skb_secattr);
-+	netlbl_secattr_destroy(&secattr);
-+
- 	/*
--	 * Receiving a packet requires that the other end
--	 * be able to write here. Read access is not required.
--	 *
--	 * If the request is successful save the peer's label
--	 * so that SO_PEERCRED can report it.
--	 */
-+	* Receiving a packet requires that the other end be able to write
-+	* here. Read access is not required.
-+	*/
- 	rc = smk_access(smack, ssp->smk_in, MAY_WRITE);
--	if (rc == 0)
--		strncpy(ssp->smk_packet, smack, SMK_MAXLEN);
-+	if (rc != 0)
-+		return rc;
-+
-+	/*
-+	* Save the peer's label in the request_sock so we can later setup
-+	* smk_packet in the child socket so that SO_PEERCRED can report it.
-+	*/
-+	req->peer_secid = smack_to_secid(smack);
-+
-+	/*
-+	* We need to decide if we want to label the incoming connection here
-+	* if we do we only need to label the request_sock and the stack will
-+	* propogate the wire-label to the sock when it is created.
-+	*/
-+	hdr = ip_hdr(skb);
-+	addr.sin_addr.s_addr = hdr->saddr;
-+	rcu_read_lock();
-+	if (smack_host_label(&addr) == NULL) {
-+		rcu_read_unlock();
-+		netlbl_secattr_init(&secattr);
-+		smack_to_secattr(smack, &secattr);
-+		rc = netlbl_req_setattr(req, &secattr);
-+		netlbl_secattr_destroy(&secattr);
-+	} else {
-+		rcu_read_unlock();
-+		netlbl_req_delattr(req);
-+	}
- 
- 	return rc;
- }
- 
-+/**
-+* smack_inet_csk_clone - Copy the connection information to the new socket
-+* @sk: the new socket
-+* @req: the connection's request_sock
-+*
-+* Transfer the connection's peer label to the newly created socket.
-+*/
-+static void smack_inet_csk_clone(struct sock *sk,
-+			         const struct request_sock *req)
-+{
-+	struct socket_smack *ssp = sk->sk_security;
-+	char *smack;
-+
-+	if (req->peer_secid != 0) {
-+		smack = smack_from_secid(req->peer_secid);
-+		strncpy(ssp->smk_packet, smack, SMK_MAXLEN);
-+	} else
-+		ssp->smk_packet[0] = '\0';
-+}
-+
- /*
-  * Key management security hooks
-  *
-@@ -2915,6 +2934,7 @@ struct security_operations smack_ops = {
- 	.sk_free_security = 		smack_sk_free_security,
- 	.sock_graft = 			smack_sock_graft,
- 	.inet_conn_request = 		smack_inet_conn_request,
-+	.inet_csk_clone =		smack_inet_csk_clone,
- 
-  /* key management security hooks */
- #ifdef CONFIG_KEYS
-diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
-index 6094344..0547239 100644
---- a/sound/pci/hda/patch_sigmatel.c
-+++ b/sound/pci/hda/patch_sigmatel.c
-@@ -4007,7 +4007,12 @@ static int stac92xx_init(struct hda_codec *codec)
- 				pinctl = snd_hda_codec_read(codec, nid, 0,
- 					AC_VERB_GET_PIN_WIDGET_CONTROL, 0);
- 				/* if PINCTL already set then skip */
--				if (!(pinctl & AC_PINCTL_IN_EN)) {
-+				/* Also, if both INPUT and OUTPUT are set,
-+				 * it must be a BIOS bug; need to override, too
-+				 */
-+				if (!(pinctl & AC_PINCTL_IN_EN) ||
-+				    (pinctl & AC_PINCTL_OUT_EN)) {
-+					pinctl &= ~AC_PINCTL_OUT_EN;
- 					pinctl |= AC_PINCTL_IN_EN;
- 					stac92xx_auto_set_pinctl(codec, nid,
- 								 pinctl);
-diff --git a/sound/soc/codecs/wm8990.c b/sound/soc/codecs/wm8990.c
-index a5731fa..380302d 100644
---- a/sound/soc/codecs/wm8990.c
-+++ b/sound/soc/codecs/wm8990.c
-@@ -744,7 +744,7 @@ SND_SOC_DAPM_MIXER_E("INMIXL", WM8990_INTDRIVBITS, WM8990_INMIXL_PWR_BIT, 0,
- 	inmixer_event, SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD),
- 
- /* AINLMUX */
--SND_SOC_DAPM_MUX_E("AILNMUX", WM8990_INTDRIVBITS, WM8990_AINLMUX_PWR_BIT, 0,
-+SND_SOC_DAPM_MUX_E("AINLMUX", WM8990_INTDRIVBITS, WM8990_AINLMUX_PWR_BIT, 0,
- 	&wm8990_dapm_ainlmux_controls, inmixer_event,
- 	SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD),
- 
-@@ -755,7 +755,7 @@ SND_SOC_DAPM_MIXER_E("INMIXR", WM8990_INTDRIVBITS, WM8990_INMIXR_PWR_BIT, 0,
- 	inmixer_event, SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD),
- 
- /* AINRMUX */
--SND_SOC_DAPM_MUX_E("AIRNMUX", WM8990_INTDRIVBITS, WM8990_AINRMUX_PWR_BIT, 0,
-+SND_SOC_DAPM_MUX_E("AINRMUX", WM8990_INTDRIVBITS, WM8990_AINRMUX_PWR_BIT, 0,
- 	&wm8990_dapm_ainrmux_controls, inmixer_event,
- 	SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD),
- 
-@@ -863,40 +863,40 @@ static const struct snd_soc_dapm_route audio_map[] = {
- 	{"LIN12 PGA", "LIN2 Switch", "LIN2"},
- 	/* LIN34 PGA */
- 	{"LIN34 PGA", "LIN3 Switch", "LIN3"},
--	{"LIN34 PGA", "LIN4 Switch", "LIN4"},
-+	{"LIN34 PGA", "LIN4 Switch", "LIN4/RXN"},
- 	/* INMIXL */
- 	{"INMIXL", "Record Left Volume", "LOMIX"},
- 	{"INMIXL", "LIN2 Volume", "LIN2"},
- 	{"INMIXL", "LINPGA12 Switch", "LIN12 PGA"},
- 	{"INMIXL", "LINPGA34 Switch", "LIN34 PGA"},
--	/* AILNMUX */
--	{"AILNMUX", "INMIXL Mix", "INMIXL"},
--	{"AILNMUX", "DIFFINL Mix", "LIN12PGA"},
--	{"AILNMUX", "DIFFINL Mix", "LIN34PGA"},
--	{"AILNMUX", "RXVOICE Mix", "LIN4/RXN"},
--	{"AILNMUX", "RXVOICE Mix", "RIN4/RXP"},
-+	/* AINLMUX */
-+	{"AINLMUX", "INMIXL Mix", "INMIXL"},
-+	{"AINLMUX", "DIFFINL Mix", "LIN12 PGA"},
-+	{"AINLMUX", "DIFFINL Mix", "LIN34 PGA"},
-+	{"AINLMUX", "RXVOICE Mix", "LIN4/RXN"},
-+	{"AINLMUX", "RXVOICE Mix", "RIN4/RXP"},
- 	/* ADC */
--	{"Left ADC", NULL, "AILNMUX"},
-+	{"Left ADC", NULL, "AINLMUX"},
- 
- 	/* RIN12 PGA */
- 	{"RIN12 PGA", "RIN1 Switch", "RIN1"},
- 	{"RIN12 PGA", "RIN2 Switch", "RIN2"},
- 	/* RIN34 PGA */
- 	{"RIN34 PGA", "RIN3 Switch", "RIN3"},
--	{"RIN34 PGA", "RIN4 Switch", "RIN4"},
-+	{"RIN34 PGA", "RIN4 Switch", "RIN4/RXP"},
- 	/* INMIXL */
- 	{"INMIXR", "Record Right Volume", "ROMIX"},
- 	{"INMIXR", "RIN2 Volume", "RIN2"},
- 	{"INMIXR", "RINPGA12 Switch", "RIN12 PGA"},
- 	{"INMIXR", "RINPGA34 Switch", "RIN34 PGA"},
--	/* AIRNMUX */
--	{"AIRNMUX", "INMIXR Mix", "INMIXR"},
--	{"AIRNMUX", "DIFFINR Mix", "RIN12PGA"},
--	{"AIRNMUX", "DIFFINR Mix", "RIN34PGA"},
--	{"AIRNMUX", "RXVOICE Mix", "RIN4/RXN"},
--	{"AIRNMUX", "RXVOICE Mix", "RIN4/RXP"},
-+	/* AINRMUX */
-+	{"AINRMUX", "INMIXR Mix", "INMIXR"},
-+	{"AINRMUX", "DIFFINR Mix", "RIN12 PGA"},
-+	{"AINRMUX", "DIFFINR Mix", "RIN34 PGA"},
-+	{"AINRMUX", "RXVOICE Mix", "LIN4/RXN"},
-+	{"AINRMUX", "RXVOICE Mix", "RIN4/RXP"},
- 	/* ADC */
--	{"Right ADC", NULL, "AIRNMUX"},
-+	{"Right ADC", NULL, "AINRMUX"},
- 
- 	/* LOMIX */
- 	{"LOMIX", "LOMIX RIN3 Bypass Switch", "RIN3"},
-@@ -937,7 +937,7 @@ static const struct snd_soc_dapm_route audio_map[] = {
- 	{"LOPMIX", "LOPMIX Left Mixer PGA Switch", "LOPGA"},
- 
- 	/* OUT3MIX */
--	{"OUT3MIX", "OUT3MIX LIN4/RXP Bypass Switch", "LIN4/RXP"},
-+	{"OUT3MIX", "OUT3MIX LIN4/RXP Bypass Switch", "LIN4/RXN"},
- 	{"OUT3MIX", "OUT3MIX Left Out PGA Switch", "LOPGA"},
- 
- 	/* OUT4MIX */
-@@ -964,7 +964,7 @@ static const struct snd_soc_dapm_route audio_map[] = {
- 	/* Output Pins */
- 	{"LON", NULL, "LONMIX"},
- 	{"LOP", NULL, "LOPMIX"},
--	{"OUT", NULL, "OUT3MIX"},
-+	{"OUT3", NULL, "OUT3MIX"},
- 	{"LOUT", NULL, "LOUT PGA"},
- 	{"SPKN", NULL, "SPKMIX"},
- 	{"ROUT", NULL, "ROUT PGA"},

Deleted: genpatches-2.6/trunk/2.6.30/1915_ext4-automatically-allocate-delay-allocated-blocks-on-rename.patch
===================================================================
--- genpatches-2.6/trunk/2.6.30/1915_ext4-automatically-allocate-delay-allocated-blocks-on-rename.patch	2009-06-05 16:26:11 UTC (rev 1572)
+++ genpatches-2.6/trunk/2.6.30/1915_ext4-automatically-allocate-delay-allocated-blocks-on-rename.patch	2009-06-05 16:28:49 UTC (rev 1573)
@@ -1,50 +0,0 @@
-Added-By: Gordon Malm <gengor@g.o>
-
----
-From: Theodore Ts'o <tytso@×××.edu>
-Date: Tue, 24 Feb 2009 04:05:27 +0000 (-0500)
-Subject: ext4: Automatically allocate delay allocated blocks on rename
-X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftytso%2Fext4.git;a=commitdiff_plain;h=dbc85aa9f11d8c13c15527d43a3def8d7beffdc8
-
-ext4: Automatically allocate delay allocated blocks on rename
-
-When renaming a file such that a link to another inode is overwritten,
-force any delay allocated blocks that to be allocated so that if the
-filesystem is mounted with data=ordered, the data blocks will be
-pushed out to disk along with the journal commit.  Many application
-programs expect this, so we do this to avoid zero length files if the
-system crashes unexpectedly.
-
-Signed-off-by: "Theodore Ts'o" <tytso@×××.edu>
----
-
-diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
-index cb15900..a9a7581 100644
---- a/fs/ext4/namei.c
-+++ b/fs/ext4/namei.c
-@@ -2357,7 +2357,7 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
- 	struct inode *old_inode, *new_inode;
- 	struct buffer_head *old_bh, *new_bh, *dir_bh;
- 	struct ext4_dir_entry_2 *old_de, *new_de;
--	int retval;
-+	int retval, force_da_alloc = 0;
- 
- 	old_bh = new_bh = dir_bh = NULL;
- 
-@@ -2497,6 +2497,7 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
- 		ext4_mark_inode_dirty(handle, new_inode);
- 		if (!new_inode->i_nlink)
- 			ext4_orphan_add(handle, new_inode);
-+		force_da_alloc = 1;
- 	}
- 	retval = 0;
- 
-@@ -2505,6 +2506,8 @@ end_rename:
- 	brelse(old_bh);
- 	brelse(new_bh);
- 	ext4_journal_stop(handle);
-+	if (retval == 0 && force_da_alloc)
-+		ext4_alloc_da_blocks(old_inode);
- 	return retval;
- }
- 

Deleted: genpatches-2.6/trunk/2.6.30/1916_ext4-automatically-allocate-delay-allocated-blocks-on-close.patch
===================================================================
--- genpatches-2.6/trunk/2.6.30/1916_ext4-automatically-allocate-delay-allocated-blocks-on-close.patch	2009-06-05 16:26:11 UTC (rev 1572)
+++ genpatches-2.6/trunk/2.6.30/1916_ext4-automatically-allocate-delay-allocated-blocks-on-close.patch	2009-06-05 16:28:49 UTC (rev 1573)
@@ -1,61 +0,0 @@
-Added-By: Gordon Malm <gengor@g.o>
-
----
-From: Theodore Ts'o <tytso@×××.edu>
-Date: Tue, 24 Feb 2009 13:21:14 +0000 (-0500)
-Subject: ext4: Automatically allocate delay allocated blocks on close
-X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftytso%2Fext4.git;a=commitdiff_plain;h=6645f8c3bc3cdaa7de4aaa3d34d40c2e8e5f09ae
-
-ext4: Automatically allocate delay allocated blocks on close
-
-When closing a file that had been previously truncated, force any
-delay allocated blocks that to be allocated so that if the filesystem
-is mounted with data=ordered, the data blocks will be pushed out to
-disk along with the journal commit.  Many application programs expect
-this, so we do this to avoid zero length files if the system crashes
-unexpectedly.
-
-Signed-off-by: "Theodore Ts'o" <tytso@×××.edu>
----
-
-diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
-index ea51c89..234c731 100644
---- a/fs/ext4/ext4.h
-+++ b/fs/ext4/ext4.h
-@@ -269,6 +269,7 @@ static inline __u32 ext4_mask_flags(umode_t mode, __u32 flags)
- #define EXT4_STATE_NEW			0x00000002 /* inode is newly created */
- #define EXT4_STATE_XATTR		0x00000004 /* has in-inode xattrs */
- #define EXT4_STATE_NO_EXPAND		0x00000008 /* No space for expansion */
-+#define EXT4_STATE_DA_ALLOC_CLOSE	0x00000010 /* Alloc DA blks on close */
- 
- /* Used to pass group descriptor data when online resize is done */
- struct ext4_new_group_input {
-diff --git a/fs/ext4/file.c b/fs/ext4/file.c
-index f731cb5..06df827 100644
---- a/fs/ext4/file.c
-+++ b/fs/ext4/file.c
-@@ -33,6 +33,10 @@
-  */
- static int ext4_release_file(struct inode *inode, struct file *filp)
- {
-+	if (EXT4_I(inode)->i_state & EXT4_STATE_DA_ALLOC_CLOSE) {
-+		ext4_alloc_da_blocks(inode);
-+		EXT4_I(inode)->i_state &= ~EXT4_STATE_DA_ALLOC_CLOSE;
-+	}
- 	/* if we are the last writer on the inode, drop the block reservation */
- 	if ((filp->f_mode & FMODE_WRITE) &&
- 			(atomic_read(&inode->i_writecount) == 1))
-diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
-index ead57ab..666caa9 100644
---- a/fs/ext4/inode.c
-+++ b/fs/ext4/inode.c
-@@ -3871,6 +3871,9 @@ void ext4_truncate(struct inode *inode)
- 	if (!ext4_can_truncate(inode))
- 		return;
- 
-+	if (inode->i_size == 0)
-+		ei->i_state |= EXT4_STATE_DA_ALLOC_CLOSE;
-+
- 	if (EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL) {
- 		ext4_ext_truncate(inode);
- 		return;

Deleted: genpatches-2.6/trunk/2.6.30/1917_ext4-add-EXT4_IOC_ALLOC_DA_BLKS-ioctl.patch
===================================================================
--- genpatches-2.6/trunk/2.6.30/1917_ext4-add-EXT4_IOC_ALLOC_DA_BLKS-ioctl.patch	2009-06-05 16:26:11 UTC (rev 1572)
+++ genpatches-2.6/trunk/2.6.30/1917_ext4-add-EXT4_IOC_ALLOC_DA_BLKS-ioctl.patch	2009-06-05 16:28:49 UTC (rev 1573)
@@ -1,118 +0,0 @@
-Added-By: Gordon Malm <gengor@g.o>
-
----
-From: Theodore Ts'o <tytso@×××.edu>
-Date: Thu, 26 Feb 2009 06:04:07 +0000 (-0500)
-Subject: ext4: add EXT4_IOC_ALLOC_DA_BLKS ioctl
-X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftytso%2Fext4.git;a=commitdiff_plain;h=3bf3342f394d72ed2ec7e77b5b39e1b50fad8284
-
-ext4: add EXT4_IOC_ALLOC_DA_BLKS ioctl
-
-Add an ioctl which forces all of the delay allocated blocks to be
-allocated.  This also provides a function ext4_alloc_da_blocks() which
-will be used by the following commits to force files to be fully
-allocated to preserve application-expected ext3 behaviour.
-
-Signed-off-by: "Theodore Ts'o" <tytso@×××.edu>
----
-
-diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
-index 684a063..ea51c89 100644
---- a/fs/ext4/ext4.h
-+++ b/fs/ext4/ext4.h
-@@ -316,7 +316,9 @@ struct ext4_new_group_data {
- #define EXT4_IOC_GROUP_EXTEND		_IOW('f', 7, unsigned long)
- #define EXT4_IOC_GROUP_ADD		_IOW('f', 8, struct ext4_new_group_input)
- #define EXT4_IOC_MIGRATE		_IO('f', 9)
-+ /* note ioctl 10 reserved for an early version of the FIEMAP ioctl */
-  /* note ioctl 11 reserved for filesystem-independent FIEMAP ioctl */
-+#define EXT4_IOC_ALLOC_DA_BLKS		_IO('f', 12)
- 
- /*
-  * ioctl commands in 32 bit emulation
-@@ -1093,6 +1095,7 @@ extern int ext4_can_truncate(struct inode *inode);
- extern void ext4_truncate(struct inode *);
- extern void ext4_set_inode_flags(struct inode *);
- extern void ext4_get_inode_flags(struct ext4_inode_info *);
-+extern int ext4_alloc_da_blocks(struct inode *inode);
- extern void ext4_set_aops(struct inode *inode);
- extern int ext4_writepage_trans_blocks(struct inode *);
- extern int ext4_meta_trans_blocks(struct inode *, int nrblocks, int idxblocks);
-diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
-index c67f46e..ead57ab 100644
---- a/fs/ext4/inode.c
-+++ b/fs/ext4/inode.c
-@@ -2807,6 +2807,48 @@ out:
- 	return;
- }
- 
-+/*
-+ * Force all delayed allocation blocks to be allocated for a given inode.
-+ */
-+int ext4_alloc_da_blocks(struct inode *inode)
-+{
-+	if (!EXT4_I(inode)->i_reserved_data_blocks &&
-+	    !EXT4_I(inode)->i_reserved_meta_blocks)
-+		return 0;
-+
-+	/*
-+	 * We do something simple for now.  The filemap_flush() will
-+	 * also start triggering a write of the data blocks, which is
-+	 * not strictly speaking necessary (and for users of
-+	 * laptop_mode, not even desirable).  However, to do otherwise
-+	 * would require replicating code paths in:
-+	 * 
-+	 * ext4_da_writepages() ->
-+	 *    write_cache_pages() ---> (via passed in callback function)
-+	 *        __mpage_da_writepage() -->
-+	 *           mpage_add_bh_to_extent()
-+	 *           mpage_da_map_blocks()
-+	 *
-+	 * The problem is that write_cache_pages(), located in
-+	 * mm/page-writeback.c, marks pages clean in preparation for
-+	 * doing I/O, which is not desirable if we're not planning on
-+	 * doing I/O at all.
-+	 *
-+	 * We could call write_cache_pages(), and then redirty all of
-+	 * the pages by calling redirty_page_for_writeback() but that
-+	 * would be ugly in the extreme.  So instead we would need to
-+	 * replicate parts of the code in the above functions,
-+	 * simplifying them becuase we wouldn't actually intend to
-+	 * write out the pages, but rather only collect contiguous
-+	 * logical block extents, call the multi-block allocator, and
-+	 * then update the buffer heads with the block allocations.
-+	 * 
-+	 * For now, though, we'll cheat by calling filemap_flush(),
-+	 * which will map the blocks, and start the I/O, but not
-+	 * actually wait for the I/O to complete.
-+	 */
-+	return filemap_flush(inode->i_mapping);
-+}
- 
- /*
-  * bmap() is special.  It gets used by applications such as lilo and by
-diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
-index 22dd29f..91e75f7 100644
---- a/fs/ext4/ioctl.c
-+++ b/fs/ext4/ioctl.c
-@@ -262,6 +262,20 @@ setversion_out:
- 		return err;
- 	}
- 
-+	case EXT4_IOC_ALLOC_DA_BLKS:
-+	{
-+		int err;
-+		if (!is_owner_or_cap(inode))
-+			return -EACCES;
-+
-+		err = mnt_want_write(filp->f_path.mnt);
-+		if (err)
-+			return err;
-+		err = ext4_alloc_da_blocks(inode);
-+		mnt_drop_write(filp->f_path.mnt);
-+		return err;
-+	}
-+
- 	default:
- 		return -ENOTTY;
- 	}

Deleted: genpatches-2.6/trunk/2.6.30/1918_ext4-fix-discard-of-inode-prealloc-space-with-delayed-allocation.patch
===================================================================
--- genpatches-2.6/trunk/2.6.30/1918_ext4-fix-discard-of-inode-prealloc-space-with-delayed-allocation.patch	2009-06-05 16:26:11 UTC (rev 1572)
+++ genpatches-2.6/trunk/2.6.30/1918_ext4-fix-discard-of-inode-prealloc-space-with-delayed-allocation.patch	2009-06-05 16:28:49 UTC (rev 1573)
@@ -1,53 +0,0 @@
-Added-By: Gordon Malm <gengor@g.o>
-
----
-From: Aneesh Kumar K.V <aneesh.kumar@××××××××××××××.com>
-Date: Thu, 26 Feb 2009 05:54:52 +0000 (-0500)
-Subject: ext4: Fix discard of inode prealloc space with delayed allocation.
-X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftytso%2Fext4.git;a=commitdiff_plain;h=3cb5e61547e9ee5f040d7a02c48c7cdf6485eecc
-
-ext4: Fix discard of inode prealloc space with delayed allocation.
-
-With delayed allocation we should not/cannot discard inode prealloc
-space during file close. We would still have dirty pages for which we
-haven't allocated blocks yet. With this fix after each get_blocks
-request we check whether we have zero reserved blocks and if yes and
-we don't have any writers on the file we discard inode prealloc space.
-
-Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@××××××××××××××.com>
-Signed-off-by: "Theodore Ts'o" <tytso@×××.edu>
----
-
-diff --git a/fs/ext4/file.c b/fs/ext4/file.c
-index 06df827..588af8c 100644
---- a/fs/ext4/file.c
-+++ b/fs/ext4/file.c
-@@ -39,7 +39,8 @@ static int ext4_release_file(struct inode *inode, struct file *filp)
- 	}
- 	/* if we are the last writer on the inode, drop the block reservation */
- 	if ((filp->f_mode & FMODE_WRITE) &&
--			(atomic_read(&inode->i_writecount) == 1))
-+			(atomic_read(&inode->i_writecount) == 1) &&
-+		        !EXT4_I(inode)->i_reserved_data_blocks)
- 	{
- 		down_write(&EXT4_I(inode)->i_data_sem);
- 		ext4_discard_preallocations(inode);
-diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
-index 666caa9..8815b9c 100644
---- a/fs/ext4/inode.c
-+++ b/fs/ext4/inode.c
-@@ -1053,6 +1053,14 @@ static void ext4_da_update_reserve_space(struct inode *inode, int used)
- 	EXT4_I(inode)->i_reserved_data_blocks -= used;
- 
- 	spin_unlock(&EXT4_I(inode)->i_block_reservation_lock);
-+
-+	/*
-+	 * If have done all the pending block allocation and if the we
-+	 * don't have any writer on the inode, we can discard the
-+	 * inode's preallocations.
-+	 */
-+	if (!total && (atomic_read(&inode->i_writecount) == 0))
-+		ext4_discard_preallocations(inode);
- }
- 
- /*

Deleted: genpatches-2.6/trunk/2.6.30/2300_alpha-add-pci-resources.patch
===================================================================
--- genpatches-2.6/trunk/2.6.30/2300_alpha-add-pci-resources.patch	2009-06-05 16:26:11 UTC (rev 1572)
+++ genpatches-2.6/trunk/2.6.30/2300_alpha-add-pci-resources.patch	2009-06-05 16:28:49 UTC (rev 1573)
@@ -1,499 +0,0 @@
-From: Ivan Kokshaysky <ink@×××××××××××××××××.ru>
-Date: Tue, 17 Feb 2009 10:46:53 +0000 (+0300)
-Subject: PCI/alpha: pci sysfs resources
-X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Faxboe%2Flinux-2.6-block.git;a=commitdiff_plain;h=10a0ef39fbd1d484c2bbc1ffd83d57ecef209140
-
-PCI/alpha: pci sysfs resources
-
-This closes http://bugzilla.kernel.org/show_bug.cgi?id=10893
-which is a showstopper for X development on alpha.
-
-The generic HAVE_PCI_MMAP code (drivers/pci-sysfs.c) is not
-very useful since we have to deal with three different types
-of MMIO address spaces: sparse and dense mappings for old
-ev4/ev5 machines and "normal" 1:1 MMIO space (bwx) for ev56 and
-later.
-Also "write combine" mappings are meaningless on alpha - roughly
-speaking, alpha does write combining, IO reordering and other
-optimizations by default, unless user splits IO accesses
-with memory barriers.
-
-I think the cleanest way to deal with resource files on alpha
-is to convert the default no-op pci_create_resource_files() and
-pci_remove_resource_files() for !HAVE_PCI_MMAP case into __weak
-functions and override them with alpha specific ones.
-
-Another alpha hook is needed for "legacy_" resource files
-to handle sparse addressing (pci_adjust_legacy_attr).
-
-With the "standard" resourceN files on ev56/ev6 libpciaccess
-works "out of the box". Handling of resourceN_sparse/resourceN_dense
-files on older machines obviously requires some userland work.
-
-Sparse/dense stuff has been tested on sx164 (pca56/pyxis, normally
-uses bwx IO) with the kernel hacked into "cia compatible" mode.
-
-Signed-off-by: Ivan Kokshaysky <ink@×××××××××××××××××.ru>
-Signed-off-by: Jesse Barnes <jbarnes@××××××××××××.org>
----
-
-diff --git a/arch/alpha/include/asm/pci.h b/arch/alpha/include/asm/pci.h
-index 2a14302..cb04eaa 100644
---- a/arch/alpha/include/asm/pci.h
-+++ b/arch/alpha/include/asm/pci.h
-@@ -273,4 +273,18 @@ struct pci_dev *alpha_gendev_to_pci(struct device *dev);
- 
- extern struct pci_dev *isa_bridge;
- 
-+extern int pci_legacy_read(struct pci_bus *bus, loff_t port, u32 *val,
-+			   size_t count);
-+extern int pci_legacy_write(struct pci_bus *bus, loff_t port, u32 val,
-+			    size_t count);
-+extern int pci_mmap_legacy_page_range(struct pci_bus *bus,
-+				      struct vm_area_struct *vma,
-+				      enum pci_mmap_state mmap_state);
-+extern void pci_adjust_legacy_attr(struct pci_bus *bus,
-+				   enum pci_mmap_state mmap_type);
-+#define HAVE_PCI_LEGACY	1
-+
-+extern int pci_create_resource_files(struct pci_dev *dev);
-+extern void pci_remove_resource_files(struct pci_dev *dev);
-+
- #endif /* __ALPHA_PCI_H */
-diff --git a/arch/alpha/kernel/Makefile b/arch/alpha/kernel/Makefile
-index b469775..a427538 100644
---- a/arch/alpha/kernel/Makefile
-+++ b/arch/alpha/kernel/Makefile
-@@ -12,7 +12,7 @@ obj-y    := entry.o traps.o process.o init_task.o osf_sys.o irq.o \
- 
- obj-$(CONFIG_VGA_HOSE)	+= console.o
- obj-$(CONFIG_SMP)	+= smp.o
--obj-$(CONFIG_PCI)	+= pci.o pci_iommu.o
-+obj-$(CONFIG_PCI)	+= pci.o pci_iommu.o pci-sysfs.o
- obj-$(CONFIG_SRM_ENV)	+= srm_env.o
- obj-$(CONFIG_MODULES)	+= module.o
- 
-diff --git a/arch/alpha/kernel/pci-sysfs.c b/arch/alpha/kernel/pci-sysfs.c
-new file mode 100644
-index 0000000..6ea822e
---- /dev/null
-+++ b/arch/alpha/kernel/pci-sysfs.c
-@@ -0,0 +1,366 @@
-+/*
-+ * arch/alpha/kernel/pci-sysfs.c
-+ *
-+ * Copyright (C) 2009 Ivan Kokshaysky
-+ *
-+ * Alpha PCI resource files.
-+ *
-+ * Loosely based on generic HAVE_PCI_MMAP implementation in
-+ * drivers/pci/pci-sysfs.c
-+ */
-+
-+#include <linux/sched.h>
-+#include <linux/pci.h>
-+
-+static int hose_mmap_page_range(struct pci_controller *hose,
-+				struct vm_area_struct *vma,
-+				enum pci_mmap_state mmap_type, int sparse)
-+{
-+	unsigned long base;
-+
-+	if (mmap_type == pci_mmap_mem)
-+		base = sparse ? hose->sparse_mem_base : hose->dense_mem_base;
-+	else
-+		base = sparse ? hose->sparse_io_base : hose->dense_io_base;
-+
-+	vma->vm_pgoff += base >> PAGE_SHIFT;
-+	vma->vm_flags |= (VM_IO | VM_RESERVED);
-+
-+	return io_remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
-+				  vma->vm_end - vma->vm_start,
-+				  vma->vm_page_prot);
-+}
-+
-+static int __pci_mmap_fits(struct pci_dev *pdev, int num,
-+			   struct vm_area_struct *vma, int sparse)
-+{
-+	unsigned long nr, start, size;
-+	int shift = sparse ? 5 : 0;
-+
-+	nr = (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
-+	start = vma->vm_pgoff;
-+	size = ((pci_resource_len(pdev, num) - 1) >> (PAGE_SHIFT - shift)) + 1;
-+
-+	if (start < size && size - start >= nr)
-+		return 1;
-+	WARN(1, "process \"%s\" tried to map%s 0x%08lx-0x%08lx on %s BAR %d "
-+		"(size 0x%08lx)\n",
-+		current->comm, sparse ? " sparse" : "", start, start + nr,
-+		pci_name(pdev), num, size);
-+	return 0;
-+}
-+
-+/**
-+ * pci_mmap_resource - map a PCI resource into user memory space
-+ * @kobj: kobject for mapping
-+ * @attr: struct bin_attribute for the file being mapped
-+ * @vma: struct vm_area_struct passed into the mmap
-+ * @sparse: address space type
-+ *
-+ * Use the bus mapping routines to map a PCI resource into userspace.
-+ */
-+static int pci_mmap_resource(struct kobject *kobj, struct bin_attribute *attr,
-+			     struct vm_area_struct *vma, int sparse)
-+{
-+	struct pci_dev *pdev = to_pci_dev(container_of(kobj,
-+						       struct device, kobj));
-+	struct resource *res = (struct resource *)attr->private;
-+	enum pci_mmap_state mmap_type;
-+	struct pci_bus_region bar;
-+	int i;
-+
-+	for (i = 0; i < PCI_ROM_RESOURCE; i++)
-+		if (res == &pdev->resource[i])
-+			break;
-+	if (i >= PCI_ROM_RESOURCE)
-+		return -ENODEV;
-+
-+	if (!__pci_mmap_fits(pdev, i, vma, sparse))
-+		return -EINVAL;
-+
-+	if (iomem_is_exclusive(res->start))
-+		return -EINVAL;
-+
-+	pcibios_resource_to_bus(pdev, &bar, res);
-+	vma->vm_pgoff += bar.start >> (PAGE_SHIFT - (sparse ? 5 : 0));
-+	mmap_type = res->flags & IORESOURCE_MEM ? pci_mmap_mem : pci_mmap_io;
-+
-+	return hose_mmap_page_range(pdev->sysdata, vma, mmap_type, sparse);
-+}
-+
-+static int pci_mmap_resource_sparse(struct kobject *kobj,
-+				    struct bin_attribute *attr,
-+				    struct vm_area_struct *vma)
-+{
-+	return pci_mmap_resource(kobj, attr, vma, 1);
-+}
-+
-+static int pci_mmap_resource_dense(struct kobject *kobj,
-+				   struct bin_attribute *attr,
-+				   struct vm_area_struct *vma)
-+{
-+	return pci_mmap_resource(kobj, attr, vma, 0);
-+}
-+
-+/**
-+ * pci_remove_resource_files - cleanup resource files
-+ * @dev: dev to cleanup
-+ *
-+ * If we created resource files for @dev, remove them from sysfs and
-+ * free their resources.
-+ */
-+void pci_remove_resource_files(struct pci_dev *pdev)
-+{
-+	int i;
-+
-+	for (i = 0; i < PCI_ROM_RESOURCE; i++) {
-+		struct bin_attribute *res_attr;
-+
-+		res_attr = pdev->res_attr[i];
-+		if (res_attr) {
-+			sysfs_remove_bin_file(&pdev->dev.kobj, res_attr);
-+			kfree(res_attr);
-+		}
-+
-+		res_attr = pdev->res_attr_wc[i];
-+		if (res_attr) {
-+			sysfs_remove_bin_file(&pdev->dev.kobj, res_attr);
-+			kfree(res_attr);
-+		}
-+	}
-+}
-+
-+static int sparse_mem_mmap_fits(struct pci_dev *pdev, int num)
-+{
-+	struct pci_bus_region bar;
-+	struct pci_controller *hose = pdev->sysdata;
-+	long dense_offset;
-+	unsigned long sparse_size;
-+
-+	pcibios_resource_to_bus(pdev, &bar, &pdev->resource[num]);
-+
-+	/* All core logic chips have 4G sparse address space, except
-+	   CIA which has 16G (see xxx_SPARSE_MEM and xxx_DENSE_MEM
-+	   definitions in asm/core_xxx.h files). This corresponds
-+	   to 128M or 512M of the bus space. */
-+	dense_offset = (long)(hose->dense_mem_base - hose->sparse_mem_base);
-+	sparse_size = dense_offset >= 0x400000000UL ? 0x20000000 : 0x8000000;
-+
-+	return bar.end < sparse_size;
-+}
-+
-+static int pci_create_one_attr(struct pci_dev *pdev, int num, char *name,
-+			       char *suffix, struct bin_attribute *res_attr,
-+			       unsigned long sparse)
-+{
-+	size_t size = pci_resource_len(pdev, num);
-+
-+	sprintf(name, "resource%d%s", num, suffix);
-+	res_attr->mmap = sparse ? pci_mmap_resource_sparse :
-+				  pci_mmap_resource_dense;
-+	res_attr->attr.name = name;
-+	res_attr->attr.mode = S_IRUSR | S_IWUSR;
-+	res_attr->size = sparse ? size << 5 : size;
-+	res_attr->private = &pdev->resource[num];
-+	return sysfs_create_bin_file(&pdev->dev.kobj, res_attr);
-+}
-+
-+static int pci_create_attr(struct pci_dev *pdev, int num)
-+{
-+	/* allocate attribute structure, piggyback attribute name */
-+	int retval, nlen1, nlen2 = 0, res_count = 1;
-+	unsigned long sparse_base, dense_base;
-+	struct bin_attribute *attr;
-+	struct pci_controller *hose = pdev->sysdata;
-+	char *suffix, *attr_name;
-+
-+	suffix = "";	/* Assume bwx machine, normal resourceN files. */
-+	nlen1 = 10;
-+
-+	if (pdev->resource[num].flags & IORESOURCE_MEM) {
-+		sparse_base = hose->sparse_mem_base;
-+		dense_base = hose->dense_mem_base;
-+		if (sparse_base && !sparse_mem_mmap_fits(pdev, num)) {
-+			sparse_base = 0;
-+			suffix = "_dense";
-+			nlen1 = 16;	/* resourceN_dense */
-+		}
-+	} else {
-+		sparse_base = hose->sparse_io_base;
-+		dense_base = hose->dense_io_base;
-+	}
-+
-+	if (sparse_base) {
-+		suffix = "_sparse";
-+		nlen1 = 17;
-+		if (dense_base) {
-+			nlen2 = 16;	/* resourceN_dense */
-+			res_count = 2;
-+		}
-+	}
-+
-+	attr = kzalloc(sizeof(*attr) * res_count + nlen1 + nlen2, GFP_ATOMIC);
-+	if (!attr)
-+		return -ENOMEM;
-+
-+	/* Create bwx, sparse or single dense file */
-+	attr_name = (char *)(attr + res_count);
-+	pdev->res_attr[num] = attr;
-+	retval = pci_create_one_attr(pdev, num, attr_name, suffix, attr,
-+				     sparse_base);
-+	if (retval || res_count == 1)
-+		return retval;
-+
-+	/* Create dense file */
-+	attr_name += nlen1;
-+	attr++;
-+	pdev->res_attr_wc[num] = attr;
-+	return pci_create_one_attr(pdev, num, attr_name, "_dense", attr, 0);
-+}
-+
-+/**
-+ * pci_create_resource_files - create resource files in sysfs for @dev
-+ * @dev: dev in question
-+ *
-+ * Walk the resources in @dev creating files for each resource available.
-+ */
-+int pci_create_resource_files(struct pci_dev *pdev)
-+{
-+	int i;
-+	int retval;
-+
-+	/* Expose the PCI resources from this device as files */
-+	for (i = 0; i < PCI_ROM_RESOURCE; i++) {
-+
-+		/* skip empty resources */
-+		if (!pci_resource_len(pdev, i))
-+			continue;
-+
-+		retval = pci_create_attr(pdev, i);
-+		if (retval) {
-+			pci_remove_resource_files(pdev);
-+			return retval;
-+		}
-+	}
-+	return 0;
-+}
-+
-+/* Legacy I/O bus mapping stuff. */
-+
-+static int __legacy_mmap_fits(struct pci_controller *hose,
-+			      struct vm_area_struct *vma,
-+			      unsigned long res_size, int sparse)
-+{
-+	unsigned long nr, start, size;
-+
-+	nr = (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
-+	start = vma->vm_pgoff;
-+	size = ((res_size - 1) >> PAGE_SHIFT) + 1;
-+
-+	if (start < size && size - start >= nr)
-+		return 1;
-+	WARN(1, "process \"%s\" tried to map%s 0x%08lx-0x%08lx on hose %d "
-+		"(size 0x%08lx)\n",
-+		current->comm, sparse ? " sparse" : "", start, start + nr,
-+		hose->index, size);
-+	return 0;
-+}
-+
-+static inline int has_sparse(struct pci_controller *hose,
-+			     enum pci_mmap_state mmap_type)
-+{
-+	unsigned long base;
-+
-+	base = (mmap_type == pci_mmap_mem) ? hose->sparse_mem_base :
-+					     hose->sparse_io_base;
-+
-+	return base != 0;
-+}
-+
-+int pci_mmap_legacy_page_range(struct pci_bus *bus, struct vm_area_struct *vma,
-+			       enum pci_mmap_state mmap_type)
-+{
-+	struct pci_controller *hose = bus->sysdata;
-+	int sparse = has_sparse(hose, mmap_type);
-+	unsigned long res_size;
-+
-+	res_size = (mmap_type == pci_mmap_mem) ? bus->legacy_mem->size :
-+						 bus->legacy_io->size;
-+	if (!__legacy_mmap_fits(hose, vma, res_size, sparse))
-+		return -EINVAL;
-+
-+	return hose_mmap_page_range(hose, vma, mmap_type, sparse);
-+}
-+
-+/**
-+ * pci_adjust_legacy_attr - adjustment of legacy file attributes
-+ * @b: bus to create files under
-+ * @mmap_type: I/O port or memory
-+ *
-+ * Adjust file name and size for sparse mappings.
-+ */
-+void pci_adjust_legacy_attr(struct pci_bus *bus, enum pci_mmap_state mmap_type)
-+{
-+	struct pci_controller *hose = bus->sysdata;
-+
-+	if (!has_sparse(hose, mmap_type))
-+		return;
-+
-+	if (mmap_type == pci_mmap_mem) {
-+		bus->legacy_mem->attr.name = "legacy_mem_sparse";
-+		bus->legacy_mem->size <<= 5;
-+	} else {
-+		bus->legacy_io->attr.name = "legacy_io_sparse";
-+		bus->legacy_io->size <<= 5;
-+	}
-+	return;
-+}
-+
-+/* Legacy I/O bus read/write functions */
-+int pci_legacy_read(struct pci_bus *bus, loff_t port, u32 *val, size_t size)
-+{
-+	struct pci_controller *hose = bus->sysdata;
-+
-+	port += hose->io_space->start;
-+
-+	switch(size) {
-+	case 1:
-+		*((u8 *)val) = inb(port);
-+		return 1;
-+	case 2:
-+		if (port & 1)
-+			return -EINVAL;
-+		*((u16 *)val) = inw(port);
-+		return 2;
-+	case 4:
-+		if (port & 3)
-+			return -EINVAL;
-+		*((u32 *)val) = inl(port);
-+		return 4;
-+	}
-+	return -EINVAL;
-+}
-+
-+int pci_legacy_write(struct pci_bus *bus, loff_t port, u32 val, size_t size)
-+{
-+	struct pci_controller *hose = bus->sysdata;
-+
-+	port += hose->io_space->start;
-+
-+	switch(size) {
-+	case 1:
-+		outb(port, val);
-+		return 1;
-+	case 2:
-+		if (port & 1)
-+			return -EINVAL;
-+		outw(port, val);
-+		return 2;
-+	case 4:
-+		if (port & 3)
-+			return -EINVAL;
-+		outl(port, val);
-+		return 4;
-+	}
-+	return -EINVAL;
-+}
-diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
-index dfc4e0d..1c89298 100644
---- a/drivers/pci/pci-sysfs.c
-+++ b/drivers/pci/pci-sysfs.c
-@@ -493,6 +493,19 @@ pci_mmap_legacy_io(struct kobject *kobj, struct bin_attribute *attr,
- }
- 
- /**
-+ * pci_adjust_legacy_attr - adjustment of legacy file attributes
-+ * @b: bus to create files under
-+ * @mmap_type: I/O port or memory
-+ *
-+ * Stub implementation. Can be overridden by arch if necessary.
-+ */
-+void __weak
-+pci_adjust_legacy_attr(struct pci_bus *b, enum pci_mmap_state mmap_type)
-+{
-+	return;
-+}
-+
-+/**
-  * pci_create_legacy_files - create legacy I/O port and memory files
-  * @b: bus to create files under
-  *
-@@ -518,6 +531,7 @@ void pci_create_legacy_files(struct pci_bus *b)
- 	b->legacy_io->read = pci_read_legacy_io;
- 	b->legacy_io->write = pci_write_legacy_io;
- 	b->legacy_io->mmap = pci_mmap_legacy_io;
-+	pci_adjust_legacy_attr(b, pci_mmap_io);
- 	error = device_create_bin_file(&b->dev, b->legacy_io);
- 	if (error)
- 		goto legacy_io_err;
-@@ -528,6 +542,7 @@ void pci_create_legacy_files(struct pci_bus *b)
- 	b->legacy_mem->size = 1024*1024;
- 	b->legacy_mem->attr.mode = S_IRUSR | S_IWUSR;
- 	b->legacy_mem->mmap = pci_mmap_legacy_mem;
-+	pci_adjust_legacy_attr(b, pci_mmap_mem);
- 	error = device_create_bin_file(&b->dev, b->legacy_mem);
- 	if (error)
- 		goto legacy_mem_err;
-@@ -719,8 +734,8 @@ static int pci_create_resource_files(struct pci_dev *pdev)
- 	return 0;
- }
- #else /* !HAVE_PCI_MMAP */
--static inline int pci_create_resource_files(struct pci_dev *dev) { return 0; }
--static inline void pci_remove_resource_files(struct pci_dev *dev) { return; }
-+int __weak pci_create_resource_files(struct pci_dev *dev) { return 0; }
-+void __weak pci_remove_resource_files(struct pci_dev *dev) { return; }
- #endif /* HAVE_PCI_MMAP */
- 
- /**
-

Deleted: genpatches-2.6/trunk/2.6.30/2700_usblp-poll-for-status.patch
===================================================================
--- genpatches-2.6/trunk/2.6.30/2700_usblp-poll-for-status.patch	2009-06-05 16:26:11 UTC (rev 1572)
+++ genpatches-2.6/trunk/2.6.30/2700_usblp-poll-for-status.patch	2009-06-05 16:28:49 UTC (rev 1573)
@@ -1,51 +0,0 @@
-From: Pete Zaitcev <zaitcev@××××××.com>
-Date: Wed, 7 Jan 2009 00:20:42 +0000 (-0700)
-Subject: usblp: continuously poll for status
-X-Git-Tag: v2.6.30-rc1~670^2~93
-X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=dd44be6b17ac52238aa6c7f46b906d9fb76e7052
-
-usblp: continuously poll for status
-
-The usblp in 2.6.18 polled for status regardless if we actually needed it.
-At some point I dropped it, to save the batteries if nothing else.
-As it turned out, printers exist (e.g. Canon BJC-3000) that need prodding
-this way or else they stop. This patch restores the old behaviour.
-If you want to save battery, don't leave jobs in the print queue.
-
-I tested this on my printers by printing and examining usbmon traces
-to make sure status is being requested and printers continue to print.
-Tuomas Jäntti verified the fix on BJC-3000.
-
-Signed-off-by: Pete Zaitcev <zaitcev@××××××.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@××××.de>
----
-
-diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c
-index 3f3ee13..d2747a4 100644
---- a/drivers/usb/class/usblp.c
-+++ b/drivers/usb/class/usblp.c
-@@ -880,16 +880,19 @@ static int usblp_wwait(struct usblp *usblp, int nonblock)
- 		if (rc <= 0)
- 			break;
- 
--		if (usblp->flags & LP_ABORT) {
--			if (schedule_timeout(msecs_to_jiffies(5000)) == 0) {
-+		if (schedule_timeout(msecs_to_jiffies(1500)) == 0) {
-+			if (usblp->flags & LP_ABORT) {
- 				err = usblp_check_status(usblp, err);
- 				if (err == 1) {	/* Paper out */
- 					rc = -ENOSPC;
- 					break;
- 				}
-+			} else {
-+				/* Prod the printer, Gentoo#251237. */
-+				mutex_lock(&usblp->mut);
-+				usblp_read_status(usblp, usblp->statusbuf);
-+				mutex_unlock(&usblp->mut);
- 			}
--		} else {
--			schedule();
- 		}
- 	}
- 	set_current_state(TASK_RUNNING);
-