[kernel] r10968 - in dists/sid/linux-2.6/debian: . patches/bugfix patches/bugfix/all/stable patches/series
Bastian Blank
waldi at alioth.debian.org
Mon Mar 24 21:19:33 UTC 2008
Author: waldi
Date: Mon Mar 24 21:19:33 2008
New Revision: 10968
Log:
Add stable release 2.6.24.4.
* debian/changelog: Update.
* debian/patches/bugfix/all/stable/2.6.24.4.patch: Add.
* debian/patches/bugfix/all/stable/2.6.24.3-fix1.patch,
debian/patches/bugfix/net-mcast-zero-addr-list.patch: Remove.
* debian/patches/series/5: Update.
Added:
dists/sid/linux-2.6/debian/patches/bugfix/all/stable/2.6.24.4.patch
Removed:
dists/sid/linux-2.6/debian/patches/bugfix/all/stable/2.6.24.3-fix1.patch
dists/sid/linux-2.6/debian/patches/bugfix/net-mcast-zero-addr-list.patch
Modified:
dists/sid/linux-2.6/debian/changelog
dists/sid/linux-2.6/debian/patches/series/5
Modified: dists/sid/linux-2.6/debian/changelog
==============================================================================
--- dists/sid/linux-2.6/debian/changelog (original)
+++ dists/sid/linux-2.6/debian/changelog Mon Mar 24 21:19:33 2008
@@ -45,9 +45,84 @@
- NFS: Fix a potential file corruption issue when writing
- NETFILTER: nf_conntrack_tcp: conntrack reopening fix
- SPARC/SPARC64: Fix usage of .section .sched.text in assembler code.
-
- [ dann frazier ]
- * Fix missing multicast addresses (closes: #466719)
+ * Add stable release 2.6.24.4:
+ - S390 futex: let futex_atomic_cmpxchg_pt survive early functional tests.
+ - slab: NUMA slab allocator migration bugfix
+ - relay: fix subbuf_splice_actor() adding too many pages
+ - BLUETOOTH: Fix bugs in previous conn add/del workqueue changes.
+ - SCSI advansys: Fix bug in AdvLoadMicrocode
+ - async_tx: avoid the async xor_zero_sum path when src_cnt > device->max_xor
+ - aio: bad AIO race in aio_complete() leads to process hang
+ - jbd: correctly unescape journal data blocks
+ - jbd2: correctly unescape journal data blocks
+ - zisofs: fix readpage() outside i_size
+ - NETFILTER: nfnetlink_log: fix computation of netlink skb size
+ - NETFILTER: nfnetlink_queue: fix computation of allocated size for netlink skb
+ - NETFILTER: xt_time: fix failure to match on Sundays
+ - sched_nr_migrate wrong mode bits
+ - nfsd: fix oops on access from high-numbered ports
+ - sched: fix race in schedule()
+ - SCSI: mpt fusion: don't oops if NumPhys==0
+ - SCSI: gdth: fix to internal commands execution
+ - SCSI: gdth: bugfix for the at-exit problems
+ - Fix default compose table initialization
+ - x86: don't use P6_NOPs if compiling with CONFIG_X86_GENERIC
+ - SCSI: fix BUG when sum(scatterlist) > bufflen
+ - USB: ehci: handle large bulk URBs correctly (again)
+ - USB: ftdi_sio - really enable EM1010PC
+ - USB: ftdi_sio: Workaround for broken Matrix Orbital serial port
+ - VT notifier fix for VT switch
+ - eCryptfs: make ecryptfs_prepare_write decrypt the page
+ - ioat: fix 'ack' handling, driver must ensure that 'ack' is zero
+ - macb: Fix speed setting
+ - x86: move out tick_nohz_stop_sched_tick() call from the loop
+ - atmel_spi: fix clock polarity
+ - b43: Backport bcm4311 fix
+ - arcmsr: fix IRQs disabled warning spew
+ - e1000e: Fix CRC stripping in hardware context bug
+ - PCI x86: always use conf1 to access config space below 256 bytes
+ - moduleparam: fix alpha, ia64 and ppc64 compile failures
+ - pata_hpt*, pata_serverworks: fix UDMA masking
+ - SCSI advansys: fix overrun_buf aligned bug
+ - NETFILTER: fix ebtable targets return
+ - NETFILTER: Fix incorrect use of skb_make_writable
+ - NETFILTER: nfnetlink_queue: fix SKB_LINEAR_ASSERT when mangling packet data
+ - spi: pxa2xx_spi clock polarity fix
+ - ufs: fix parenthesisation in ufs_set_fs_state()
+ - hugetlb: ensure we do not reference a surplus page after handing it to buddy
+ - file capabilities: simplify signal check
+ - futex: runtime enable pi and robust functionality
+ - futex: fix init order
+ - ARM pxa: fix clock lookup to find specific device clocks
+ - x86: replace LOCK_PREFIX in futex.h
+ - SCSI aic94xx: fix REQ_TASK_ABORT and REQ_DEVICE_RESET
+ - SCSI gdth: don't call pci_free_consistent under spinlock
+ - SCSI ips: fix data buffer accessors conversion bug
+ - usb-storage: don't access beyond the end of the sg buffer
+ - fuse: fix permission checking
+ - CRYPTO xts: Use proper alignment
+ - CRYPTO xcbc: Fix crash with IPsec
+ - SCSI ips: handle scsi_add_host() failure, and other err cleanups
+ - x86: adjust enable_NMI_through_LVT0()
+ - drivers: fix dma_get_required_mask
+ - iov_iter_advance() fix
+ - x86: Clear DF before calling signal handler
+ - ub: fix up the conversion to sg_init_table()
+ - MIPS: Mark all but i8259 interrupts as no-probe.
+ - IRQ_NOPROBE helper functions
+ - IPCOMP: Disable BH on output when using shared tfm
+ - IPCONFIG: The kernel gets no IP from some DHCP servers
+ - IPV4: Remove IP_TOS setting privilege checks.
+ - IPV6: dst_entry leak in ip4ip6_err.
+ - IPV6: Fix IPsec datagram fragmentation
+ - NET: Fix race in dev_close(). (Bug 9750)
+ - NET: Messed multicast lists after dev_mc_sync/unsync (closes: #466719)
+ - NIU: Bump driver version and release date.
+ - NIU: Fix BMAC alternate MAC address indexing.
+ - NIU: More BMAC alt MAC address fixes.
+ - TCP: Improve ipv4 established hash function.
+ - SPARC: Fix link errors with gcc-4.3
+ - SPARC64: Loosen checks in exception table handling.
[ Martin Michlmayr ]
* [mips/r4k-ip22] Enable BLK_DEV_LOOP and BLK_DEV_CRYPTOLOOP.
Added: dists/sid/linux-2.6/debian/patches/bugfix/all/stable/2.6.24.4.patch
==============================================================================
--- (empty file)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/stable/2.6.24.4.patch Mon Mar 24 21:19:33 2008
@@ -0,0 +1,3645 @@
+diff --git a/Makefile b/Makefile
+index bac9dd0..254de79 100644
+diff --git a/arch/arm/mach-pxa/clock.c b/arch/arm/mach-pxa/clock.c
+index 83ef5ec..df5ae27 100644
+--- a/arch/arm/mach-pxa/clock.c
++++ b/arch/arm/mach-pxa/clock.c
+@@ -23,18 +23,27 @@ static LIST_HEAD(clocks);
+ static DEFINE_MUTEX(clocks_mutex);
+ static DEFINE_SPINLOCK(clocks_lock);
+
++static struct clk *clk_lookup(struct device *dev, const char *id)
++{
++ struct clk *p;
++
++ list_for_each_entry(p, &clocks, node)
++ if (strcmp(id, p->name) == 0 && p->dev == dev)
++ return p;
++
++ return NULL;
++}
++
+ struct clk *clk_get(struct device *dev, const char *id)
+ {
+ struct clk *p, *clk = ERR_PTR(-ENOENT);
+
+ mutex_lock(&clocks_mutex);
+- list_for_each_entry(p, &clocks, node) {
+- if (strcmp(id, p->name) == 0 &&
+- (p->dev == NULL || p->dev == dev)) {
+- clk = p;
+- break;
+- }
+- }
++ p = clk_lookup(dev, id);
++ if (!p)
++ p = clk_lookup(NULL, id);
++ if (p)
++ clk = p;
+ mutex_unlock(&clocks_mutex);
+
+ return clk;
+diff --git a/arch/mips/kernel/i8259.c b/arch/mips/kernel/i8259.c
+index 4710135..9158dd8 100644
+--- a/arch/mips/kernel/i8259.c
++++ b/arch/mips/kernel/i8259.c
+@@ -338,8 +338,10 @@ void __init init_i8259_irqs(void)
+
+ init_8259A(0);
+
+- for (i = I8259A_IRQ_BASE; i < I8259A_IRQ_BASE + 16; i++)
++ for (i = I8259A_IRQ_BASE; i < I8259A_IRQ_BASE + 16; i++) {
+ set_irq_chip_and_handler(i, &i8259A_chip, handle_level_irq);
++ set_irq_probe(i);
++ }
+
+ setup_irq(I8259A_IRQ_BASE + PIC_CASCADE_IR, &irq2);
+ }
+diff --git a/arch/mips/kernel/irq.c b/arch/mips/kernel/irq.c
+index d06e9c9..e3309ff 100644
+--- a/arch/mips/kernel/irq.c
++++ b/arch/mips/kernel/irq.c
+@@ -145,6 +145,11 @@ __setup("nokgdb", nokgdb);
+
+ void __init init_IRQ(void)
+ {
++ int i;
++
++ for (i = 0; i < NR_IRQS; i++)
++ set_irq_noprobe(i);
++
+ arch_init_irq();
+
+ #ifdef CONFIG_KGDB
+diff --git a/arch/s390/lib/uaccess_pt.c b/arch/s390/lib/uaccess_pt.c
+index 7e8efaa..5efdfe9 100644
+--- a/arch/s390/lib/uaccess_pt.c
++++ b/arch/s390/lib/uaccess_pt.c
+@@ -406,6 +406,8 @@ int futex_atomic_cmpxchg_pt(int __user *uaddr, int oldval, int newval)
+ {
+ int ret;
+
++ if (!current->mm)
++ return -EFAULT;
+ spin_lock(¤t->mm->page_table_lock);
+ uaddr = (int __user *) __dat_user_addr((unsigned long) uaddr);
+ if (!uaddr) {
+diff --git a/arch/sparc/kernel/Makefile b/arch/sparc/kernel/Makefile
+index e795f28..bf1b15d 100644
+--- a/arch/sparc/kernel/Makefile
++++ b/arch/sparc/kernel/Makefile
+@@ -1,4 +1,4 @@
+-# $Id: Makefile,v 1.62 2000/12/15 00:41:17 davem Exp $
++#
+ # Makefile for the linux kernel.
+ #
+
+@@ -12,7 +12,8 @@ obj-y := entry.o wof.o wuf.o etrap.o rtrap.o traps.o $(IRQ_OBJS) \
+ sys_sparc.o sunos_asm.o systbls.o \
+ time.o windows.o cpu.o devices.o sclow.o \
+ tadpole.o tick14.o ptrace.o sys_solaris.o \
+- unaligned.o muldiv.o semaphore.o prom.o of_device.o devres.o
++ unaligned.o una_asm.o muldiv.o semaphore.o \
++ prom.o of_device.o devres.o
+
+ devres-y = ../../../kernel/irq/devres.o
+
+diff --git a/arch/sparc/kernel/una_asm.S b/arch/sparc/kernel/una_asm.S
+new file mode 100644
+index 0000000..8cc0345
+--- /dev/null
++++ b/arch/sparc/kernel/una_asm.S
+@@ -0,0 +1,153 @@
++/* una_asm.S: Kernel unaligned trap assembler helpers.
++ *
++ * Copyright (C) 1996,2005,2008 David S. Miller (davem at davemloft.net)
++ * Copyright (C) 1996,1997 Jakub Jelinek (jj at sunsite.mff.cuni.cz)
++ */
++
++#include <linux/errno.h>
++
++ .text
++
++retl_efault:
++ retl
++ mov -EFAULT, %o0
++
++ /* int __do_int_store(unsigned long *dst_addr, int size,
++ * unsigned long *src_val)
++ *
++ * %o0 = dest_addr
++ * %o1 = size
++ * %o2 = src_val
++ *
++ * Return '0' on success, -EFAULT on failure.
++ */
++ .globl __do_int_store
++__do_int_store:
++ ld [%o2], %g1
++ cmp %1, 2
++ be 2f
++ cmp %1, 4
++ be 1f
++ srl %g1, 24, %g2
++ srl %g1, 16, %g7
++4: stb %g2, [%o0]
++ srl %g1, 8, %g2
++5: stb %g7, [%o0 + 1]
++ ld [%o2 + 4], %g7
++6: stb %g2, [%o0 + 2]
++ srl %g7, 24, %g2
++7: stb %g1, [%o0 + 3]
++ srl %g7, 16, %g1
++8: stb %g2, [%o0 + 4]
++ srl %g7, 8, %g2
++9: stb %g1, [%o0 + 5]
++10: stb %g2, [%o0 + 6]
++ b 0f
++11: stb %g7, [%o0 + 7]
++1: srl %g1, 16, %g7
++12: stb %g2, [%o0]
++ srl %g1, 8, %g2
++13: stb %g7, [%o0 + 1]
++14: stb %g2, [%o0 + 2]
++ b 0f
++15: stb %g1, [%o0 + 3]
++2: srl %g1, 8, %g2
++16: stb %g2, [%o0]
++17: stb %g1, [%o0 + 1]
++0: retl
++ mov 0, %o0
++
++ .section __ex_table,#alloc
++ .word 4b, retl_efault
++ .word 5b, retl_efault
++ .word 6b, retl_efault
++ .word 7b, retl_efault
++ .word 8b, retl_efault
++ .word 9b, retl_efault
++ .word 10b, retl_efault
++ .word 11b, retl_efault
++ .word 12b, retl_efault
++ .word 13b, retl_efault
++ .word 14b, retl_efault
++ .word 15b, retl_efault
++ .word 16b, retl_efault
++ .word 17b, retl_efault
++ .previous
++
++ /* int do_int_load(unsigned long *dest_reg, int size,
++ * unsigned long *saddr, int is_signed)
++ *
++ * %o0 = dest_reg
++ * %o1 = size
++ * %o2 = saddr
++ * %o3 = is_signed
++ *
++ * Return '0' on success, -EFAULT on failure.
++ */
++ .globl do_int_load
++do_int_load:
++ cmp %o1, 8
++ be 9f
++ cmp %o1, 4
++ be 6f
++4: ldub [%o2], %g1
++5: ldub [%o2 + 1], %g2
++ sll %g1, 8, %g1
++ tst %o3
++ be 3f
++ or %g1, %g2, %g1
++ sll %g1, 16, %g1
++ sra %g1, 16, %g1
++3: b 0f
++ st %g1, [%o0]
++6: ldub [%o2 + 1], %g2
++ sll %g1, 24, %g1
++7: ldub [%o2 + 2], %g7
++ sll %g2, 16, %g2
++8: ldub [%o2 + 3], %g3
++ sll %g7, 8, %g7
++ or %g3, %g2, %g3
++ or %g7, %g3, %g7
++ or %g1, %g7, %g1
++ b 0f
++ st %g1, [%o0]
++9: ldub [%o2], %g1
++10: ldub [%o2 + 1], %g2
++ sll %g1, 24, %g1
++11: ldub [%o2 + 2], %g7
++ sll %g2, 16, %g2
++12: ldub [%o2 + 3], %g3
++ sll %g7, 8, %g7
++ or %g1, %g2, %g1
++ or %g7, %g3, %g7
++ or %g1, %g7, %g7
++13: ldub [%o2 + 4], %g1
++ st %g7, [%o0]
++14: ldub [%o2 + 5], %g2
++ sll %g1, 24, %g1
++15: ldub [%o2 + 6], %g7
++ sll %g2, 16, %g2
++16: ldub [%o2 + 7], %g3
++ sll %g7, 8, %g7
++ or %g1, %g2, %g1
++ or %g7, %g3, %g7
++ or %g1, %g7, %g7
++ st %g7, [%o0 + 4]
++0: retl
++ mov 0, %o0
++
++ .section __ex_table,#alloc
++ .word 4b, retl_efault
++ .word 5b, retl_efault
++ .word 6b, retl_efault
++ .word 7b, retl_efault
++ .word 8b, retl_efault
++ .word 9b, retl_efault
++ .word 10b, retl_efault
++ .word 11b, retl_efault
++ .word 12b, retl_efault
++ .word 13b, retl_efault
++ .word 14b, retl_efault
++ .word 15b, retl_efault
++ .word 16b, retl_efault
++ .previous
+diff --git a/arch/sparc/kernel/unaligned.c b/arch/sparc/kernel/unaligned.c
+index a6330fb..33857be 100644
+--- a/arch/sparc/kernel/unaligned.c
++++ b/arch/sparc/kernel/unaligned.c
+@@ -175,157 +175,31 @@ static void unaligned_panic(char *str)
+ panic(str);
+ }
+
+-#define do_integer_load(dest_reg, size, saddr, is_signed, errh) ({ \
+-__asm__ __volatile__ ( \
+- "cmp %1, 8\n\t" \
+- "be 9f\n\t" \
+- " cmp %1, 4\n\t" \
+- "be 6f\n" \
+-"4:\t" " ldub [%2], %%l1\n" \
+-"5:\t" "ldub [%2 + 1], %%l2\n\t" \
+- "sll %%l1, 8, %%l1\n\t" \
+- "tst %3\n\t" \
+- "be 3f\n\t" \
+- " add %%l1, %%l2, %%l1\n\t" \
+- "sll %%l1, 16, %%l1\n\t" \
+- "sra %%l1, 16, %%l1\n" \
+-"3:\t" "b 0f\n\t" \
+- " st %%l1, [%0]\n" \
+-"6:\t" "ldub [%2 + 1], %%l2\n\t" \
+- "sll %%l1, 24, %%l1\n" \
+-"7:\t" "ldub [%2 + 2], %%g7\n\t" \
+- "sll %%l2, 16, %%l2\n" \
+-"8:\t" "ldub [%2 + 3], %%g1\n\t" \
+- "sll %%g7, 8, %%g7\n\t" \
+- "or %%l1, %%l2, %%l1\n\t" \
+- "or %%g7, %%g1, %%g7\n\t" \
+- "or %%l1, %%g7, %%l1\n\t" \
+- "b 0f\n\t" \
+- " st %%l1, [%0]\n" \
+-"9:\t" "ldub [%2], %%l1\n" \
+-"10:\t" "ldub [%2 + 1], %%l2\n\t" \
+- "sll %%l1, 24, %%l1\n" \
+-"11:\t" "ldub [%2 + 2], %%g7\n\t" \
+- "sll %%l2, 16, %%l2\n" \
+-"12:\t" "ldub [%2 + 3], %%g1\n\t" \
+- "sll %%g7, 8, %%g7\n\t" \
+- "or %%l1, %%l2, %%l1\n\t" \
+- "or %%g7, %%g1, %%g7\n\t" \
+- "or %%l1, %%g7, %%g7\n" \
+-"13:\t" "ldub [%2 + 4], %%l1\n\t" \
+- "st %%g7, [%0]\n" \
+-"14:\t" "ldub [%2 + 5], %%l2\n\t" \
+- "sll %%l1, 24, %%l1\n" \
+-"15:\t" "ldub [%2 + 6], %%g7\n\t" \
+- "sll %%l2, 16, %%l2\n" \
+-"16:\t" "ldub [%2 + 7], %%g1\n\t" \
+- "sll %%g7, 8, %%g7\n\t" \
+- "or %%l1, %%l2, %%l1\n\t" \
+- "or %%g7, %%g1, %%g7\n\t" \
+- "or %%l1, %%g7, %%g7\n\t" \
+- "st %%g7, [%0 + 4]\n" \
+-"0:\n\n\t" \
+- ".section __ex_table,#alloc\n\t" \
+- ".word 4b, " #errh "\n\t" \
+- ".word 5b, " #errh "\n\t" \
+- ".word 6b, " #errh "\n\t" \
+- ".word 7b, " #errh "\n\t" \
+- ".word 8b, " #errh "\n\t" \
+- ".word 9b, " #errh "\n\t" \
+- ".word 10b, " #errh "\n\t" \
+- ".word 11b, " #errh "\n\t" \
+- ".word 12b, " #errh "\n\t" \
+- ".word 13b, " #errh "\n\t" \
+- ".word 14b, " #errh "\n\t" \
+- ".word 15b, " #errh "\n\t" \
+- ".word 16b, " #errh "\n\n\t" \
+- ".previous\n\t" \
+- : : "r" (dest_reg), "r" (size), "r" (saddr), "r" (is_signed) \
+- : "l1", "l2", "g7", "g1", "cc"); \
+-})
+-
+-#define store_common(dst_addr, size, src_val, errh) ({ \
+-__asm__ __volatile__ ( \
+- "ld [%2], %%l1\n" \
+- "cmp %1, 2\n\t" \
+- "be 2f\n\t" \
+- " cmp %1, 4\n\t" \
+- "be 1f\n\t" \
+- " srl %%l1, 24, %%l2\n\t" \
+- "srl %%l1, 16, %%g7\n" \
+-"4:\t" "stb %%l2, [%0]\n\t" \
+- "srl %%l1, 8, %%l2\n" \
+-"5:\t" "stb %%g7, [%0 + 1]\n\t" \
+- "ld [%2 + 4], %%g7\n" \
+-"6:\t" "stb %%l2, [%0 + 2]\n\t" \
+- "srl %%g7, 24, %%l2\n" \
+-"7:\t" "stb %%l1, [%0 + 3]\n\t" \
+- "srl %%g7, 16, %%l1\n" \
+-"8:\t" "stb %%l2, [%0 + 4]\n\t" \
+- "srl %%g7, 8, %%l2\n" \
+-"9:\t" "stb %%l1, [%0 + 5]\n" \
+-"10:\t" "stb %%l2, [%0 + 6]\n\t" \
+- "b 0f\n" \
+-"11:\t" " stb %%g7, [%0 + 7]\n" \
+-"1:\t" "srl %%l1, 16, %%g7\n" \
+-"12:\t" "stb %%l2, [%0]\n\t" \
+- "srl %%l1, 8, %%l2\n" \
+-"13:\t" "stb %%g7, [%0 + 1]\n" \
+-"14:\t" "stb %%l2, [%0 + 2]\n\t" \
+- "b 0f\n" \
+-"15:\t" " stb %%l1, [%0 + 3]\n" \
+-"2:\t" "srl %%l1, 8, %%l2\n" \
+-"16:\t" "stb %%l2, [%0]\n" \
+-"17:\t" "stb %%l1, [%0 + 1]\n" \
+-"0:\n\n\t" \
+- ".section __ex_table,#alloc\n\t" \
+- ".word 4b, " #errh "\n\t" \
+- ".word 5b, " #errh "\n\t" \
+- ".word 6b, " #errh "\n\t" \
+- ".word 7b, " #errh "\n\t" \
+- ".word 8b, " #errh "\n\t" \
+- ".word 9b, " #errh "\n\t" \
+- ".word 10b, " #errh "\n\t" \
+- ".word 11b, " #errh "\n\t" \
+- ".word 12b, " #errh "\n\t" \
+- ".word 13b, " #errh "\n\t" \
+- ".word 14b, " #errh "\n\t" \
+- ".word 15b, " #errh "\n\t" \
+- ".word 16b, " #errh "\n\t" \
+- ".word 17b, " #errh "\n\n\t" \
+- ".previous\n\t" \
+- : : "r" (dst_addr), "r" (size), "r" (src_val) \
+- : "l1", "l2", "g7", "g1", "cc"); \
+-})
+-
+-#define do_integer_store(reg_num, size, dst_addr, regs, errh) ({ \
+- unsigned long *src_val; \
+- static unsigned long zero[2] = { 0, }; \
+- \
+- if (reg_num) src_val = fetch_reg_addr(reg_num, regs); \
+- else { \
+- src_val = &zero[0]; \
+- if (size == 8) \
+- zero[1] = fetch_reg(1, regs); \
+- } \
+- store_common(dst_addr, size, src_val, errh); \
+-})
++/* una_asm.S */
++extern int do_int_load(unsigned long *dest_reg, int size,
++ unsigned long *saddr, int is_signed);
++extern int __do_int_store(unsigned long *dst_addr, int size,
++ unsigned long *src_val);
++
++static int do_int_store(int reg_num, int size, unsigned long *dst_addr,
++ struct pt_regs *regs)
++{
++ unsigned long zero[2] = { 0, 0 };
++ unsigned long *src_val;
++
++ if (reg_num)
++ src_val = fetch_reg_addr(reg_num, regs);
++ else {
++ src_val = &zero[0];
++ if (size == 8)
++ zero[1] = fetch_reg(1, regs);
++ }
++ return __do_int_store(dst_addr, size, src_val);
++}
+
+ extern void smp_capture(void);
+ extern void smp_release(void);
+
+-#define do_atomic(srcdest_reg, mem, errh) ({ \
+- unsigned long flags, tmp; \
+- \
+- smp_capture(); \
+- local_irq_save(flags); \
+- tmp = *srcdest_reg; \
+- do_integer_load(srcdest_reg, 4, mem, 0, errh); \
+- store_common(mem, 4, &tmp, errh); \
+- local_irq_restore(flags); \
+- smp_release(); \
+-})
+-
+ static inline void advance(struct pt_regs *regs)
+ {
+ regs->pc = regs->npc;
+@@ -342,9 +216,7 @@ static inline int ok_for_kernel(unsigned int insn)
+ return !floating_point_load_or_store_p(insn);
+ }
+
+-void kernel_mna_trap_fault(struct pt_regs *regs, unsigned int insn) __asm__ ("kernel_mna_trap_fault");
+-
+-void kernel_mna_trap_fault(struct pt_regs *regs, unsigned int insn)
++static void kernel_mna_trap_fault(struct pt_regs *regs, unsigned int insn)
+ {
+ unsigned long g2 = regs->u_regs [UREG_G2];
+ unsigned long fixup = search_extables_range(regs->pc, &g2);
+@@ -379,48 +251,34 @@ asmlinkage void kernel_unaligned_trap(struct pt_regs *regs, unsigned int insn)
+ printk("Unsupported unaligned load/store trap for kernel at <%08lx>.\n",
+ regs->pc);
+ unaligned_panic("Wheee. Kernel does fpu/atomic unaligned load/store.");
+-
+- __asm__ __volatile__ ("\n"
+-"kernel_unaligned_trap_fault:\n\t"
+- "mov %0, %%o0\n\t"
+- "call kernel_mna_trap_fault\n\t"
+- " mov %1, %%o1\n\t"
+- :
+- : "r" (regs), "r" (insn)
+- : "o0", "o1", "o2", "o3", "o4", "o5", "o7",
+- "g1", "g2", "g3", "g4", "g5", "g7", "cc");
+ } else {
+ unsigned long addr = compute_effective_address(regs, insn);
++ int err;
+
+ #ifdef DEBUG_MNA
+ printk("KMNA: pc=%08lx [dir=%s addr=%08lx size=%d] retpc[%08lx]\n",
+ regs->pc, dirstrings[dir], addr, size, regs->u_regs[UREG_RETPC]);
+ #endif
+- switch(dir) {
++ switch (dir) {
+ case load:
+- do_integer_load(fetch_reg_addr(((insn>>25)&0x1f), regs),
+- size, (unsigned long *) addr,
+- decode_signedness(insn),
+- kernel_unaligned_trap_fault);
++ err = do_int_load(fetch_reg_addr(((insn>>25)&0x1f),
++ regs),
++ size, (unsigned long *) addr,
++ decode_signedness(insn));
+ break;
+
+ case store:
+- do_integer_store(((insn>>25)&0x1f), size,
+- (unsigned long *) addr, regs,
+- kernel_unaligned_trap_fault);
++ err = do_int_store(((insn>>25)&0x1f), size,
++ (unsigned long *) addr, regs);
+ break;
+-#if 0 /* unsupported */
+- case both:
+- do_atomic(fetch_reg_addr(((insn>>25)&0x1f), regs),
+- (unsigned long *) addr,
+- kernel_unaligned_trap_fault);
+- break;
+-#endif
+ default:
+ panic("Impossible kernel unaligned trap.");
+ /* Not reached... */
+ }
+- advance(regs);
++ if (err)
++ kernel_mna_trap_fault(regs, insn);
++ else
++ advance(regs);
+ }
+ }
+
+@@ -459,9 +317,7 @@ static inline int ok_for_user(struct pt_regs *regs, unsigned int insn,
+ return 0;
+ }
+
+-void user_mna_trap_fault(struct pt_regs *regs, unsigned int insn) __asm__ ("user_mna_trap_fault");
+-
+-void user_mna_trap_fault(struct pt_regs *regs, unsigned int insn)
++static void user_mna_trap_fault(struct pt_regs *regs, unsigned int insn)
+ {
+ siginfo_t info;
+
+@@ -485,7 +341,7 @@ asmlinkage void user_unaligned_trap(struct pt_regs *regs, unsigned int insn)
+ if(!ok_for_user(regs, insn, dir)) {
+ goto kill_user;
+ } else {
+- int size = decode_access_size(insn);
++ int err, size = decode_access_size(insn);
+ unsigned long addr;
+
+ if(floating_point_load_or_store_p(insn)) {
+@@ -496,48 +352,34 @@ asmlinkage void user_unaligned_trap(struct pt_regs *regs, unsigned int insn)
+ addr = compute_effective_address(regs, insn);
+ switch(dir) {
+ case load:
+- do_integer_load(fetch_reg_addr(((insn>>25)&0x1f), regs),
+- size, (unsigned long *) addr,
+- decode_signedness(insn),
+- user_unaligned_trap_fault);
++ err = do_int_load(fetch_reg_addr(((insn>>25)&0x1f),
++ regs),
++ size, (unsigned long *) addr,
++ decode_signedness(insn));
+ break;
+
+ case store:
+- do_integer_store(((insn>>25)&0x1f), size,
+- (unsigned long *) addr, regs,
+- user_unaligned_trap_fault);
++ err = do_int_store(((insn>>25)&0x1f), size,
++ (unsigned long *) addr, regs);
+ break;
+
+ case both:
+-#if 0 /* unsupported */
+- do_atomic(fetch_reg_addr(((insn>>25)&0x1f), regs),
+- (unsigned long *) addr,
+- user_unaligned_trap_fault);
+-#else
+ /*
+ * This was supported in 2.4. However, we question
+ * the value of SWAP instruction across word boundaries.
+ */
+ printk("Unaligned SWAP unsupported.\n");
+- goto kill_user;
+-#endif
++ err = -EFAULT;
+ break;
+
+ default:
+ unaligned_panic("Impossible user unaligned trap.");
+-
+- __asm__ __volatile__ ("\n"
+-"user_unaligned_trap_fault:\n\t"
+- "mov %0, %%o0\n\t"
+- "call user_mna_trap_fault\n\t"
+- " mov %1, %%o1\n\t"
+- :
+- : "r" (regs), "r" (insn)
+- : "o0", "o1", "o2", "o3", "o4", "o5", "o7",
+- "g1", "g2", "g3", "g4", "g5", "g7", "cc");
+ goto out;
+ }
+- advance(regs);
++ if (err)
++ goto kill_user;
++ else
++ advance(regs);
+ goto out;
+ }
+
+diff --git a/arch/sparc64/mm/fault.c b/arch/sparc64/mm/fault.c
+index e2027f2..2650d0d 100644
+--- a/arch/sparc64/mm/fault.c
++++ b/arch/sparc64/mm/fault.c
+@@ -244,16 +244,8 @@ static void do_kernel_fault(struct pt_regs *regs, int si_code, int fault_code,
+ if (regs->tstate & TSTATE_PRIV) {
+ const struct exception_table_entry *entry;
+
+- if (asi == ASI_P && (insn & 0xc0800000) == 0xc0800000) {
+- if (insn & 0x2000)
+- asi = (regs->tstate >> 24);
+- else
+- asi = (insn >> 5);
+- }
+-
+- /* Look in asi.h: All _S asis have LS bit set */
+- if ((asi & 0x1) &&
+- (entry = search_exception_tables(regs->tpc))) {
++ entry = search_exception_tables(regs->tpc);
++ if (entry) {
+ regs->tpc = entry->fixup;
+ regs->tnpc = regs->tpc + 4;
+ return;
+@@ -294,7 +286,7 @@ asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
+ unsigned long tpc = regs->tpc;
+
+ /* Sanity check the PC. */
+- if ((tpc >= KERNBASE && tpc < (unsigned long) _etext) ||
++ if ((tpc >= KERNBASE && tpc < (unsigned long) __init_end) ||
+ (tpc >= MODULES_VADDR && tpc < MODULES_END)) {
+ /* Valid, no problems... */
+ } else {
+diff --git a/arch/x86/ia32/ia32_signal.c b/arch/x86/ia32/ia32_signal.c
+index 6ea19c2..4eaaf78 100644
+--- a/arch/x86/ia32/ia32_signal.c
++++ b/arch/x86/ia32/ia32_signal.c
+@@ -494,7 +494,7 @@ int ia32_setup_frame(int sig, struct k_sigaction *ka,
+ regs->ss = __USER32_DS;
+
+ set_fs(USER_DS);
+- regs->eflags &= ~TF_MASK;
++ regs->eflags &= ~(TF_MASK | X86_EFLAGS_DF);
+ if (test_thread_flag(TIF_SINGLESTEP))
+ ptrace_notify(SIGTRAP);
+
+@@ -600,7 +600,7 @@ int ia32_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
+ regs->ss = __USER32_DS;
+
+ set_fs(USER_DS);
+- regs->eflags &= ~TF_MASK;
++ regs->eflags &= ~(TF_MASK | X86_EFLAGS_DF);
+ if (test_thread_flag(TIF_SINGLESTEP))
+ ptrace_notify(SIGTRAP);
+
+diff --git a/arch/x86/kernel/apic_32.c b/arch/x86/kernel/apic_32.c
+index edb5108..c48fbb1 100644
+--- a/arch/x86/kernel/apic_32.c
++++ b/arch/x86/kernel/apic_32.c
+@@ -154,7 +154,7 @@ unsigned long safe_apic_wait_icr_idle(void)
+ /**
+ * enable_NMI_through_LVT0 - enable NMI through local vector table 0
+ */
+-void enable_NMI_through_LVT0 (void * dummy)
++void __cpuinit enable_NMI_through_LVT0(void)
+ {
+ unsigned int v = APIC_DM_NMI;
+
+diff --git a/arch/x86/kernel/apic_64.c b/arch/x86/kernel/apic_64.c
+index f28ccb5..0173007 100644
+--- a/arch/x86/kernel/apic_64.c
++++ b/arch/x86/kernel/apic_64.c
+@@ -151,7 +151,7 @@ unsigned int safe_apic_wait_icr_idle(void)
+ return send_status;
+ }
+
+-void enable_NMI_through_LVT0 (void * dummy)
++void enable_NMI_through_LVT0(void)
+ {
+ unsigned int v;
+
+diff --git a/arch/x86/kernel/io_apic_32.c b/arch/x86/kernel/io_apic_32.c
+index a6b1490..232fdeb 100644
+--- a/arch/x86/kernel/io_apic_32.c
++++ b/arch/x86/kernel/io_apic_32.c
+@@ -2080,7 +2080,7 @@ static struct irq_chip lapic_chip __read_mostly = {
+ .eoi = ack_apic,
+ };
+
+-static void setup_nmi (void)
++static void __init setup_nmi(void)
+ {
+ /*
+ * Dirty trick to enable the NMI watchdog ...
+@@ -2093,7 +2093,7 @@ static void setup_nmi (void)
+ */
+ apic_printk(APIC_VERBOSE, KERN_INFO "activating NMI Watchdog ...");
+
+- on_each_cpu(enable_NMI_through_LVT0, NULL, 1, 1);
++ enable_NMI_through_LVT0();
+
+ apic_printk(APIC_VERBOSE, " done.\n");
+ }
+diff --git a/arch/x86/kernel/io_apic_64.c b/arch/x86/kernel/io_apic_64.c
+index cbac167..7119cb7 100644
+--- a/arch/x86/kernel/io_apic_64.c
++++ b/arch/x86/kernel/io_apic_64.c
+@@ -1565,7 +1565,7 @@ static struct hw_interrupt_type lapic_irq_type __read_mostly = {
+ .end = end_lapic_irq,
+ };
+
+-static void setup_nmi (void)
++static void __init setup_nmi(void)
+ {
+ /*
+ * Dirty trick to enable the NMI watchdog ...
+@@ -1578,7 +1578,7 @@ static void setup_nmi (void)
+ */
+ printk(KERN_INFO "activating NMI Watchdog ...");
+
+- enable_NMI_through_LVT0(NULL);
++ enable_NMI_through_LVT0();
+
+ printk(" done.\n");
+ }
+@@ -1654,7 +1654,7 @@ static inline void unlock_ExtINT_logic(void)
+ *
+ * FIXME: really need to revamp this for modern platforms only.
+ */
+-static inline void check_timer(void)
++static inline void __init check_timer(void)
+ {
+ struct irq_cfg *cfg = irq_cfg + 0;
+ int apic1, pin1, apic2, pin2;
+diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
+index ab79e1d..d7f7132 100644
+--- a/arch/x86/kernel/process_64.c
++++ b/arch/x86/kernel/process_64.c
+@@ -212,14 +212,13 @@ void cpu_idle (void)
+ current_thread_info()->status |= TS_POLLING;
+ /* endless idle loop with no priority at all */
+ while (1) {
++ tick_nohz_stop_sched_tick();
+ while (!need_resched()) {
+ void (*idle)(void);
+
+ if (__get_cpu_var(cpu_idle_state))
+ __get_cpu_var(cpu_idle_state) = 0;
+
+- tick_nohz_stop_sched_tick();
+-
+ rmb();
+ idle = pm_idle;
+ if (!idle)
+diff --git a/arch/x86/kernel/signal_32.c b/arch/x86/kernel/signal_32.c
+index 9bdd830..20056db 100644
+--- a/arch/x86/kernel/signal_32.c
++++ b/arch/x86/kernel/signal_32.c
+@@ -396,7 +396,7 @@ static int setup_frame(int sig, struct k_sigaction *ka,
+ * The tracer may want to single-step inside the
+ * handler too.
+ */
+- regs->eflags &= ~TF_MASK;
++ regs->eflags &= ~(TF_MASK | X86_EFLAGS_DF);
+ if (test_thread_flag(TIF_SINGLESTEP))
+ ptrace_notify(SIGTRAP);
+
+@@ -489,7 +489,7 @@ static int setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
+ * The tracer may want to single-step inside the
+ * handler too.
+ */
+- regs->eflags &= ~TF_MASK;
++ regs->eflags &= ~(TF_MASK | X86_EFLAGS_DF);
+ if (test_thread_flag(TIF_SINGLESTEP))
+ ptrace_notify(SIGTRAP);
+
+diff --git a/arch/x86/kernel/signal_64.c b/arch/x86/kernel/signal_64.c
+index ab086b0..62964c5 100644
+--- a/arch/x86/kernel/signal_64.c
++++ b/arch/x86/kernel/signal_64.c
+@@ -295,7 +295,7 @@ static int setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
+ see include/asm-x86_64/uaccess.h for details. */
+ set_fs(USER_DS);
+
+- regs->eflags &= ~TF_MASK;
++ regs->eflags &= ~(TF_MASK | X86_EFLAGS_DF);
+ if (test_thread_flag(TIF_SINGLESTEP))
+ ptrace_notify(SIGTRAP);
+ #ifdef DEBUG_SIG
+diff --git a/arch/x86/kernel/smpboot_32.c b/arch/x86/kernel/smpboot_32.c
+index 4ea80cb..fe200cf 100644
+--- a/arch/x86/kernel/smpboot_32.c
++++ b/arch/x86/kernel/smpboot_32.c
+@@ -405,7 +405,7 @@ static void __cpuinit start_secondary(void *unused)
+ setup_secondary_clock();
+ if (nmi_watchdog == NMI_IO_APIC) {
+ disable_8259A_irq(0);
+- enable_NMI_through_LVT0(NULL);
++ enable_NMI_through_LVT0();
+ enable_8259A_irq(0);
+ }
+ /*
+diff --git a/arch/x86/kernel/smpboot_64.c b/arch/x86/kernel/smpboot_64.c
+index aaf4e12..eca8026 100644
+--- a/arch/x86/kernel/smpboot_64.c
++++ b/arch/x86/kernel/smpboot_64.c
+@@ -338,7 +338,7 @@ void __cpuinit start_secondary(void)
+
+ if (nmi_watchdog == NMI_IO_APIC) {
+ disable_8259A_irq(0);
+- enable_NMI_through_LVT0(NULL);
++ enable_NMI_through_LVT0();
+ enable_8259A_irq(0);
+ }
+
+diff --git a/arch/x86/pci/mmconfig-shared.c b/arch/x86/pci/mmconfig-shared.c
+index 4df637e..6b521d3 100644
+--- a/arch/x86/pci/mmconfig-shared.c
++++ b/arch/x86/pci/mmconfig-shared.c
+@@ -22,42 +22,9 @@
+ #define MMCONFIG_APER_MIN (2 * 1024*1024)
+ #define MMCONFIG_APER_MAX (256 * 1024*1024)
+
+-DECLARE_BITMAP(pci_mmcfg_fallback_slots, 32*PCI_MMCFG_MAX_CHECK_BUS);
+-
+ /* Indicate if the mmcfg resources have been placed into the resource table. */
+ static int __initdata pci_mmcfg_resources_inserted;
+
+-/* K8 systems have some devices (typically in the builtin northbridge)
+- that are only accessible using type1
+- Normally this can be expressed in the MCFG by not listing them
+- and assigning suitable _SEGs, but this isn't implemented in some BIOS.
+- Instead try to discover all devices on bus 0 that are unreachable using MM
+- and fallback for them. */
+-static void __init unreachable_devices(void)
+-{
+- int i, bus;
+- /* Use the max bus number from ACPI here? */
+- for (bus = 0; bus < PCI_MMCFG_MAX_CHECK_BUS; bus++) {
+- for (i = 0; i < 32; i++) {
+- unsigned int devfn = PCI_DEVFN(i, 0);
+- u32 val1, val2;
+-
+- pci_conf1_read(0, bus, devfn, 0, 4, &val1);
+- if (val1 == 0xffffffff)
+- continue;
+-
+- if (pci_mmcfg_arch_reachable(0, bus, devfn)) {
+- raw_pci_ops->read(0, bus, devfn, 0, 4, &val2);
+- if (val1 == val2)
+- continue;
+- }
+- set_bit(i + 32 * bus, pci_mmcfg_fallback_slots);
+- printk(KERN_NOTICE "PCI: No mmconfig possible on device"
+- " %02x:%02x\n", bus, i);
+- }
+- }
+-}
+-
+ static const char __init *pci_mmcfg_e7520(void)
+ {
+ u32 win;
+@@ -270,8 +237,6 @@ void __init pci_mmcfg_init(int type)
+ return;
+
+ if (pci_mmcfg_arch_init()) {
+- if (type == 1)
+- unreachable_devices();
+ if (known_bridge)
+ pci_mmcfg_insert_resources(IORESOURCE_BUSY);
+ pci_probe = (pci_probe & ~PCI_PROBE_MASK) | PCI_PROBE_MMCONF;
+diff --git a/arch/x86/pci/mmconfig_32.c b/arch/x86/pci/mmconfig_32.c
+index 1bf5816..7b75e65 100644
+--- a/arch/x86/pci/mmconfig_32.c
++++ b/arch/x86/pci/mmconfig_32.c
+@@ -30,10 +30,6 @@ static u32 get_base_addr(unsigned int seg, int bus, unsigned devfn)
+ struct acpi_mcfg_allocation *cfg;
+ int cfg_num;
+
+- if (seg == 0 && bus < PCI_MMCFG_MAX_CHECK_BUS &&
+- test_bit(PCI_SLOT(devfn) + 32*bus, pci_mmcfg_fallback_slots))
+- return 0;
+-
+ for (cfg_num = 0; cfg_num < pci_mmcfg_config_num; cfg_num++) {
+ cfg = &pci_mmcfg_config[cfg_num];
+ if (cfg->pci_segment == seg &&
+@@ -68,13 +64,16 @@ static int pci_mmcfg_read(unsigned int seg, unsigned int bus,
+ u32 base;
+
+ if ((bus > 255) || (devfn > 255) || (reg > 4095)) {
+- *value = -1;
++err: *value = -1;
+ return -EINVAL;
+ }
+
++ if (reg < 256)
++ return pci_conf1_read(seg,bus,devfn,reg,len,value);
++
+ base = get_base_addr(seg, bus, devfn);
+ if (!base)
+- return pci_conf1_read(seg,bus,devfn,reg,len,value);
++ goto err;
+
+ spin_lock_irqsave(&pci_config_lock, flags);
+
+@@ -105,9 +104,12 @@ static int pci_mmcfg_write(unsigned int seg, unsigned int bus,
+ if ((bus > 255) || (devfn > 255) || (reg > 4095))
+ return -EINVAL;
+
++ if (reg < 256)
++ return pci_conf1_write(seg,bus,devfn,reg,len,value);
++
+ base = get_base_addr(seg, bus, devfn);
+ if (!base)
+- return pci_conf1_write(seg,bus,devfn,reg,len,value);
++ return -EINVAL;
+
+ spin_lock_irqsave(&pci_config_lock, flags);
+
+@@ -134,12 +136,6 @@ static struct pci_raw_ops pci_mmcfg = {
+ .write = pci_mmcfg_write,
+ };
+
+-int __init pci_mmcfg_arch_reachable(unsigned int seg, unsigned int bus,
+- unsigned int devfn)
+-{
+- return get_base_addr(seg, bus, devfn) != 0;
+-}
+-
+ int __init pci_mmcfg_arch_init(void)
+ {
+ printk(KERN_INFO "PCI: Using MMCONFIG\n");
+diff --git a/arch/x86/pci/mmconfig_64.c b/arch/x86/pci/mmconfig_64.c
+index 4095e4d..c4cf318 100644
+--- a/arch/x86/pci/mmconfig_64.c
++++ b/arch/x86/pci/mmconfig_64.c
+@@ -40,9 +40,7 @@ static char __iomem *get_virt(unsigned int seg, unsigned bus)
+ static char __iomem *pci_dev_base(unsigned int seg, unsigned int bus, unsigned int devfn)
+ {
+ char __iomem *addr;
+- if (seg == 0 && bus < PCI_MMCFG_MAX_CHECK_BUS &&
+- test_bit(32*bus + PCI_SLOT(devfn), pci_mmcfg_fallback_slots))
+- return NULL;
++
+ addr = get_virt(seg, bus);
+ if (!addr)
+ return NULL;
+@@ -56,13 +54,16 @@ static int pci_mmcfg_read(unsigned int seg, unsigned int bus,
+
+ /* Why do we have this when nobody checks it. How about a BUG()!? -AK */
+ if (unlikely((bus > 255) || (devfn > 255) || (reg > 4095))) {
+- *value = -1;
++err: *value = -1;
+ return -EINVAL;
+ }
+
++ if (reg < 256)
++ return pci_conf1_read(seg,bus,devfn,reg,len,value);
++
+ addr = pci_dev_base(seg, bus, devfn);
+ if (!addr)
+- return pci_conf1_read(seg,bus,devfn,reg,len,value);
++ goto err;
+
+ switch (len) {
+ case 1:
+@@ -88,9 +89,12 @@ static int pci_mmcfg_write(unsigned int seg, unsigned int bus,
+ if (unlikely((bus > 255) || (devfn > 255) || (reg > 4095)))
+ return -EINVAL;
+
++ if (reg < 256)
++ return pci_conf1_write(seg,bus,devfn,reg,len,value);
++
+ addr = pci_dev_base(seg, bus, devfn);
+ if (!addr)
+- return pci_conf1_write(seg,bus,devfn,reg,len,value);
++ return -EINVAL;
+
+ switch (len) {
+ case 1:
+@@ -126,12 +130,6 @@ static void __iomem * __init mcfg_ioremap(struct acpi_mcfg_allocation *cfg)
+ return addr;
+ }
+
+-int __init pci_mmcfg_arch_reachable(unsigned int seg, unsigned int bus,
+- unsigned int devfn)
+-{
+- return pci_dev_base(seg, bus, devfn) != NULL;
+-}
+-
+ int __init pci_mmcfg_arch_init(void)
+ {
+ int i;
+diff --git a/arch/x86/pci/pci.h b/arch/x86/pci/pci.h
+index ac56d39..36cb44c 100644
+--- a/arch/x86/pci/pci.h
++++ b/arch/x86/pci/pci.h
+@@ -98,13 +98,6 @@ extern void pcibios_sort(void);
+
+ /* pci-mmconfig.c */
+
+-/* Verify the first 16 busses. We assume that systems with more busses
+- get MCFG right. */
+-#define PCI_MMCFG_MAX_CHECK_BUS 16
+-extern DECLARE_BITMAP(pci_mmcfg_fallback_slots, 32*PCI_MMCFG_MAX_CHECK_BUS);
+-
+-extern int __init pci_mmcfg_arch_reachable(unsigned int seg, unsigned int bus,
+- unsigned int devfn);
+ extern int __init pci_mmcfg_arch_init(void);
+
+ /*
+diff --git a/crypto/async_tx/async_xor.c b/crypto/async_tx/async_xor.c
+index 2575f67..5c579d2 100644
+--- a/crypto/async_tx/async_xor.c
++++ b/crypto/async_tx/async_xor.c
+@@ -264,7 +264,7 @@ async_xor_zero_sum(struct page *dest, struct page **src_list,
+
+ BUG_ON(src_cnt <= 1);
+
+- if (tx) {
++ if (tx && src_cnt <= device->max_xor) {
+ dma_addr_t dma_addr;
+ enum dma_data_direction dir;
+
+diff --git a/crypto/xcbc.c b/crypto/xcbc.c
+index ac68f3b..a957373 100644
+--- a/crypto/xcbc.c
++++ b/crypto/xcbc.c
+@@ -124,6 +124,11 @@ static int crypto_xcbc_digest_update2(struct hash_desc *pdesc,
+ unsigned int offset = sg[i].offset;
+ unsigned int slen = sg[i].length;
+
++ if (unlikely(slen > nbytes))
++ slen = nbytes;
++
++ nbytes -= slen;
++
+ while (slen > 0) {
+ unsigned int len = min(slen, ((unsigned int)(PAGE_SIZE)) - offset);
+ char *p = crypto_kmap(pg, 0) + offset;
+@@ -177,7 +182,6 @@ static int crypto_xcbc_digest_update2(struct hash_desc *pdesc,
+ offset = 0;
+ pg++;
+ }
+- nbytes-=sg[i].length;
+ i++;
+ } while (nbytes>0);
+
+diff --git a/crypto/xts.c b/crypto/xts.c
+index 8eb08bf..d87b0f3 100644
+--- a/crypto/xts.c
++++ b/crypto/xts.c
+@@ -77,16 +77,16 @@ static int setkey(struct crypto_tfm *parent, const u8 *key,
+ }
+
+ struct sinfo {
+- be128 t;
++ be128 *t;
+ struct crypto_tfm *tfm;
+ void (*fn)(struct crypto_tfm *, u8 *, const u8 *);
+ };
+
+ static inline void xts_round(struct sinfo *s, void *dst, const void *src)
+ {
+- be128_xor(dst, &s->t, src); /* PP <- T xor P */
++ be128_xor(dst, s->t, src); /* PP <- T xor P */
+ s->fn(s->tfm, dst, dst); /* CC <- E(Key1,PP) */
+- be128_xor(dst, dst, &s->t); /* C <- T xor CC */
++ be128_xor(dst, dst, s->t); /* C <- T xor CC */
+ }
+
+ static int crypt(struct blkcipher_desc *d,
+@@ -101,7 +101,6 @@ static int crypt(struct blkcipher_desc *d,
+ .tfm = crypto_cipher_tfm(ctx->child),
+ .fn = fn
+ };
+- be128 *iv;
+ u8 *wsrc;
+ u8 *wdst;
+
+@@ -109,20 +108,20 @@ static int crypt(struct blkcipher_desc *d,
+ if (!w->nbytes)
+ return err;
+
++ s.t = (be128 *)w->iv;
+ avail = w->nbytes;
+
+ wsrc = w->src.virt.addr;
+ wdst = w->dst.virt.addr;
+
+ /* calculate first value of T */
+- iv = (be128 *)w->iv;
+- tw(crypto_cipher_tfm(ctx->tweak), (void *)&s.t, w->iv);
++ tw(crypto_cipher_tfm(ctx->tweak), w->iv, w->iv);
+
+ goto first;
+
+ for (;;) {
+ do {
+- gf128mul_x_ble(&s.t, &s.t);
++ gf128mul_x_ble(s.t, s.t);
+
+ first:
+ xts_round(&s, wdst, wsrc);
+diff --git a/drivers/acorn/char/defkeymap-l7200.c b/drivers/acorn/char/defkeymap-l7200.c
+index 28a5fbc..93d80a1 100644
+--- a/drivers/acorn/char/defkeymap-l7200.c
++++ b/drivers/acorn/char/defkeymap-l7200.c
+@@ -347,40 +347,40 @@ char *func_table[MAX_NR_FUNC] = {
+ };
+
+ struct kbdiacruc accent_table[MAX_DIACR] = {
+- {'`', 'A', '\300'}, {'`', 'a', '\340'},
+- {'\'', 'A', '\301'}, {'\'', 'a', '\341'},
+- {'^', 'A', '\302'}, {'^', 'a', '\342'},
+- {'~', 'A', '\303'}, {'~', 'a', '\343'},
+- {'"', 'A', '\304'}, {'"', 'a', '\344'},
+- {'O', 'A', '\305'}, {'o', 'a', '\345'},
+- {'0', 'A', '\305'}, {'0', 'a', '\345'},
+- {'A', 'A', '\305'}, {'a', 'a', '\345'},
+- {'A', 'E', '\306'}, {'a', 'e', '\346'},
+- {',', 'C', '\307'}, {',', 'c', '\347'},
+- {'`', 'E', '\310'}, {'`', 'e', '\350'},
+- {'\'', 'E', '\311'}, {'\'', 'e', '\351'},
+- {'^', 'E', '\312'}, {'^', 'e', '\352'},
+- {'"', 'E', '\313'}, {'"', 'e', '\353'},
+- {'`', 'I', '\314'}, {'`', 'i', '\354'},
+- {'\'', 'I', '\315'}, {'\'', 'i', '\355'},
+- {'^', 'I', '\316'}, {'^', 'i', '\356'},
+- {'"', 'I', '\317'}, {'"', 'i', '\357'},
+- {'-', 'D', '\320'}, {'-', 'd', '\360'},
+- {'~', 'N', '\321'}, {'~', 'n', '\361'},
+- {'`', 'O', '\322'}, {'`', 'o', '\362'},
+- {'\'', 'O', '\323'}, {'\'', 'o', '\363'},
+- {'^', 'O', '\324'}, {'^', 'o', '\364'},
+- {'~', 'O', '\325'}, {'~', 'o', '\365'},
+- {'"', 'O', '\326'}, {'"', 'o', '\366'},
+- {'/', 'O', '\330'}, {'/', 'o', '\370'},
+- {'`', 'U', '\331'}, {'`', 'u', '\371'},
+- {'\'', 'U', '\332'}, {'\'', 'u', '\372'},
+- {'^', 'U', '\333'}, {'^', 'u', '\373'},
+- {'"', 'U', '\334'}, {'"', 'u', '\374'},
+- {'\'', 'Y', '\335'}, {'\'', 'y', '\375'},
+- {'T', 'H', '\336'}, {'t', 'h', '\376'},
+- {'s', 's', '\337'}, {'"', 'y', '\377'},
+- {'s', 'z', '\337'}, {'i', 'j', '\377'},
++ {'`', 'A', 0300}, {'`', 'a', 0340},
++ {'\'', 'A', 0301}, {'\'', 'a', 0341},
++ {'^', 'A', 0302}, {'^', 'a', 0342},
++ {'~', 'A', 0303}, {'~', 'a', 0343},
++ {'"', 'A', 0304}, {'"', 'a', 0344},
++ {'O', 'A', 0305}, {'o', 'a', 0345},
++ {'0', 'A', 0305}, {'0', 'a', 0345},
++ {'A', 'A', 0305}, {'a', 'a', 0345},
++ {'A', 'E', 0306}, {'a', 'e', 0346},
++ {',', 'C', 0307}, {',', 'c', 0347},
++ {'`', 'E', 0310}, {'`', 'e', 0350},
++ {'\'', 'E', 0311}, {'\'', 'e', 0351},
++ {'^', 'E', 0312}, {'^', 'e', 0352},
++ {'"', 'E', 0313}, {'"', 'e', 0353},
++ {'`', 'I', 0314}, {'`', 'i', 0354},
++ {'\'', 'I', 0315}, {'\'', 'i', 0355},
++ {'^', 'I', 0316}, {'^', 'i', 0356},
++ {'"', 'I', 0317}, {'"', 'i', 0357},
++ {'-', 'D', 0320}, {'-', 'd', 0360},
++ {'~', 'N', 0321}, {'~', 'n', 0361},
++ {'`', 'O', 0322}, {'`', 'o', 0362},
++ {'\'', 'O', 0323}, {'\'', 'o', 0363},
++ {'^', 'O', 0324}, {'^', 'o', 0364},
++ {'~', 'O', 0325}, {'~', 'o', 0365},
++ {'"', 'O', 0326}, {'"', 'o', 0366},
++ {'/', 'O', 0330}, {'/', 'o', 0370},
++ {'`', 'U', 0331}, {'`', 'u', 0371},
++ {'\'', 'U', 0332}, {'\'', 'u', 0372},
++ {'^', 'U', 0333}, {'^', 'u', 0373},
++ {'"', 'U', 0334}, {'"', 'u', 0374},
++ {'\'', 'Y', 0335}, {'\'', 'y', 0375},
++ {'T', 'H', 0336}, {'t', 'h', 0376},
++ {'s', 's', 0337}, {'"', 'y', 0377},
++ {'s', 'z', 0337}, {'i', 'j', 0377},
+ };
+
+ unsigned int accent_table_size = 68;
+diff --git a/drivers/ata/pata_hpt366.c b/drivers/ata/pata_hpt366.c
+index 0713872..a742efa 100644
+--- a/drivers/ata/pata_hpt366.c
++++ b/drivers/ata/pata_hpt366.c
+@@ -27,7 +27,7 @@
+ #include <linux/libata.h>
+
+ #define DRV_NAME "pata_hpt366"
+-#define DRV_VERSION "0.6.1"
++#define DRV_VERSION "0.6.2"
+
+ struct hpt_clock {
+ u8 xfer_speed;
+@@ -180,9 +180,9 @@ static unsigned long hpt366_filter(struct ata_device *adev, unsigned long mask)
+ if (hpt_dma_blacklisted(adev, "UDMA", bad_ata33))
+ mask &= ~ATA_MASK_UDMA;
+ if (hpt_dma_blacklisted(adev, "UDMA3", bad_ata66_3))
+- mask &= ~(0x07 << ATA_SHIFT_UDMA);
++ mask &= ~(0xF8 << ATA_SHIFT_UDMA);
+ if (hpt_dma_blacklisted(adev, "UDMA4", bad_ata66_4))
+- mask &= ~(0x0F << ATA_SHIFT_UDMA);
++ mask &= ~(0xF0 << ATA_SHIFT_UDMA);
+ }
+ return ata_pci_default_filter(adev, mask);
+ }
+diff --git a/drivers/ata/pata_hpt37x.c b/drivers/ata/pata_hpt37x.c
+index c79f066..eac6a2b 100644
+--- a/drivers/ata/pata_hpt37x.c
++++ b/drivers/ata/pata_hpt37x.c
+@@ -24,7 +24,7 @@
+ #include <linux/libata.h>
+
+ #define DRV_NAME "pata_hpt37x"
+-#define DRV_VERSION "0.6.9"
++#define DRV_VERSION "0.6.11"
+
+ struct hpt_clock {
+ u8 xfer_speed;
+@@ -281,7 +281,7 @@ static unsigned long hpt370_filter(struct ata_device *adev, unsigned long mask)
+ if (hpt_dma_blacklisted(adev, "UDMA", bad_ata33))
+ mask &= ~ATA_MASK_UDMA;
+ if (hpt_dma_blacklisted(adev, "UDMA100", bad_ata100_5))
+- mask &= ~(0x1F << ATA_SHIFT_UDMA);
++ mask &= ~(0xE0 << ATA_SHIFT_UDMA);
+ }
+ return ata_pci_default_filter(adev, mask);
+ }
+@@ -297,7 +297,7 @@ static unsigned long hpt370a_filter(struct ata_device *adev, unsigned long mask)
+ {
+ if (adev->class == ATA_DEV_ATA) {
+ if (hpt_dma_blacklisted(adev, "UDMA100", bad_ata100_5))
+- mask &= ~ (0x1F << ATA_SHIFT_UDMA);
++ mask &= ~(0xE0 << ATA_SHIFT_UDMA);
+ }
+ return ata_pci_default_filter(adev, mask);
+ }
+diff --git a/drivers/ata/pata_serverworks.c b/drivers/ata/pata_serverworks.c
+index 8bed888..004cac7 100644
+--- a/drivers/ata/pata_serverworks.c
++++ b/drivers/ata/pata_serverworks.c
+@@ -226,7 +226,7 @@ static unsigned long serverworks_csb_filter(struct ata_device *adev, unsigned lo
+
+ for (i = 0; (p = csb_bad_ata100[i]) != NULL; i++) {
+ if (!strcmp(p, model_num))
+- mask &= ~(0x1F << ATA_SHIFT_UDMA);
++ mask &= ~(0xE0 << ATA_SHIFT_UDMA);
+ }
+ return ata_pci_default_filter(adev, mask);
+ }
+diff --git a/drivers/base/platform.c b/drivers/base/platform.c
+index fb56092..39d8b7b 100644
+--- a/drivers/base/platform.c
++++ b/drivers/base/platform.c
+@@ -647,7 +647,7 @@ u64 dma_get_required_mask(struct device *dev)
+ high_totalram += high_totalram - 1;
+ mask = (((u64)high_totalram) << 32) + 0xffffffff;
+ }
+- return mask & *dev->dma_mask;
++ return mask;
+ }
+ EXPORT_SYMBOL_GPL(dma_get_required_mask);
+ #endif
+diff --git a/drivers/block/ub.c b/drivers/block/ub.c
+index 08e909d..7aca466 100644
+--- a/drivers/block/ub.c
++++ b/drivers/block/ub.c
+@@ -657,7 +657,6 @@ static int ub_request_fn_1(struct ub_lun *lun, struct request *rq)
+ if ((cmd = ub_get_cmd(lun)) == NULL)
+ return -1;
+ memset(cmd, 0, sizeof(struct ub_scsi_cmd));
+- sg_init_table(cmd->sgv, UB_MAX_REQ_SG);
+
+ blkdev_dequeue_request(rq);
+
+@@ -668,6 +667,7 @@ static int ub_request_fn_1(struct ub_lun *lun, struct request *rq)
+ /*
+ * get scatterlist from block layer
+ */
++ sg_init_table(&urq->sgv[0], UB_MAX_REQ_SG);
+ n_elem = blk_rq_map_sg(lun->disk->queue, rq, &urq->sgv[0]);
+ if (n_elem < 0) {
+ /* Impossible, because blk_rq_map_sg should not hit ENOMEM. */
+diff --git a/drivers/char/defkeymap.c_shipped b/drivers/char/defkeymap.c_shipped
+index 0aa419a..d2208df 100644
+--- a/drivers/char/defkeymap.c_shipped
++++ b/drivers/char/defkeymap.c_shipped
+@@ -223,40 +223,40 @@ char *func_table[MAX_NR_FUNC] = {
+ };
+
+ struct kbdiacruc accent_table[MAX_DIACR] = {
+- {'`', 'A', '\300'}, {'`', 'a', '\340'},
+- {'\'', 'A', '\301'}, {'\'', 'a', '\341'},
+- {'^', 'A', '\302'}, {'^', 'a', '\342'},
+- {'~', 'A', '\303'}, {'~', 'a', '\343'},
+- {'"', 'A', '\304'}, {'"', 'a', '\344'},
+- {'O', 'A', '\305'}, {'o', 'a', '\345'},
+- {'0', 'A', '\305'}, {'0', 'a', '\345'},
+- {'A', 'A', '\305'}, {'a', 'a', '\345'},
+- {'A', 'E', '\306'}, {'a', 'e', '\346'},
+- {',', 'C', '\307'}, {',', 'c', '\347'},
+- {'`', 'E', '\310'}, {'`', 'e', '\350'},
+- {'\'', 'E', '\311'}, {'\'', 'e', '\351'},
+- {'^', 'E', '\312'}, {'^', 'e', '\352'},
+- {'"', 'E', '\313'}, {'"', 'e', '\353'},
+- {'`', 'I', '\314'}, {'`', 'i', '\354'},
+- {'\'', 'I', '\315'}, {'\'', 'i', '\355'},
+- {'^', 'I', '\316'}, {'^', 'i', '\356'},
+- {'"', 'I', '\317'}, {'"', 'i', '\357'},
+- {'-', 'D', '\320'}, {'-', 'd', '\360'},
+- {'~', 'N', '\321'}, {'~', 'n', '\361'},
+- {'`', 'O', '\322'}, {'`', 'o', '\362'},
+- {'\'', 'O', '\323'}, {'\'', 'o', '\363'},
+- {'^', 'O', '\324'}, {'^', 'o', '\364'},
+- {'~', 'O', '\325'}, {'~', 'o', '\365'},
+- {'"', 'O', '\326'}, {'"', 'o', '\366'},
+- {'/', 'O', '\330'}, {'/', 'o', '\370'},
+- {'`', 'U', '\331'}, {'`', 'u', '\371'},
+- {'\'', 'U', '\332'}, {'\'', 'u', '\372'},
+- {'^', 'U', '\333'}, {'^', 'u', '\373'},
+- {'"', 'U', '\334'}, {'"', 'u', '\374'},
+- {'\'', 'Y', '\335'}, {'\'', 'y', '\375'},
+- {'T', 'H', '\336'}, {'t', 'h', '\376'},
+- {'s', 's', '\337'}, {'"', 'y', '\377'},
+- {'s', 'z', '\337'}, {'i', 'j', '\377'},
++ {'`', 'A', 0300}, {'`', 'a', 0340},
++ {'\'', 'A', 0301}, {'\'', 'a', 0341},
++ {'^', 'A', 0302}, {'^', 'a', 0342},
++ {'~', 'A', 0303}, {'~', 'a', 0343},
++ {'"', 'A', 0304}, {'"', 'a', 0344},
++ {'O', 'A', 0305}, {'o', 'a', 0345},
++ {'0', 'A', 0305}, {'0', 'a', 0345},
++ {'A', 'A', 0305}, {'a', 'a', 0345},
++ {'A', 'E', 0306}, {'a', 'e', 0346},
++ {',', 'C', 0307}, {',', 'c', 0347},
++ {'`', 'E', 0310}, {'`', 'e', 0350},
++ {'\'', 'E', 0311}, {'\'', 'e', 0351},
++ {'^', 'E', 0312}, {'^', 'e', 0352},
++ {'"', 'E', 0313}, {'"', 'e', 0353},
++ {'`', 'I', 0314}, {'`', 'i', 0354},
++ {'\'', 'I', 0315}, {'\'', 'i', 0355},
++ {'^', 'I', 0316}, {'^', 'i', 0356},
++ {'"', 'I', 0317}, {'"', 'i', 0357},
++ {'-', 'D', 0320}, {'-', 'd', 0360},
++ {'~', 'N', 0321}, {'~', 'n', 0361},
++ {'`', 'O', 0322}, {'`', 'o', 0362},
++ {'\'', 'O', 0323}, {'\'', 'o', 0363},
++ {'^', 'O', 0324}, {'^', 'o', 0364},
++ {'~', 'O', 0325}, {'~', 'o', 0365},
++ {'"', 'O', 0326}, {'"', 'o', 0366},
++ {'/', 'O', 0330}, {'/', 'o', 0370},
++ {'`', 'U', 0331}, {'`', 'u', 0371},
++ {'\'', 'U', 0332}, {'\'', 'u', 0372},
++ {'^', 'U', 0333}, {'^', 'u', 0373},
++ {'"', 'U', 0334}, {'"', 'u', 0374},
++ {'\'', 'Y', 0335}, {'\'', 'y', 0375},
++ {'T', 'H', 0336}, {'t', 'h', 0376},
++ {'s', 's', 0337}, {'"', 'y', 0377},
++ {'s', 'z', 0337}, {'i', 'j', 0377},
+ };
+
+ unsigned int accent_table_size = 68;
+diff --git a/drivers/char/vt.c b/drivers/char/vt.c
+index 7a5badf..93cfe4a 100644
+--- a/drivers/char/vt.c
++++ b/drivers/char/vt.c
+@@ -702,6 +702,7 @@ void redraw_screen(struct vc_data *vc, int is_switch)
+ if (is_switch) {
+ set_leds();
+ compute_shiftstate();
++ notify_update(vc);
+ }
+ }
+
+diff --git a/drivers/dma/ioat_dma.c b/drivers/dma/ioat_dma.c
+index 45e7b46..8cf542b 100644
+--- a/drivers/dma/ioat_dma.c
++++ b/drivers/dma/ioat_dma.c
+@@ -726,6 +726,7 @@ static struct dma_async_tx_descriptor *ioat1_dma_prep_memcpy(
+
+ if (new) {
+ new->len = len;
++ new->async_tx.ack = 0;
+ return &new->async_tx;
+ } else
+ return NULL;
+@@ -749,6 +750,7 @@ static struct dma_async_tx_descriptor *ioat2_dma_prep_memcpy(
+
+ if (new) {
+ new->len = len;
++ new->async_tx.ack = 0;
+ return &new->async_tx;
+ } else
+ return NULL;
+diff --git a/drivers/message/fusion/mptsas.c b/drivers/message/fusion/mptsas.c
+index e4c94f9..c8d3ffb 100644
+--- a/drivers/message/fusion/mptsas.c
++++ b/drivers/message/fusion/mptsas.c
+@@ -1699,6 +1699,11 @@ mptsas_sas_expander_pg0(MPT_ADAPTER *ioc, struct mptsas_portinfo *port_info,
+ if (error)
+ goto out_free_consistent;
+
++ if (!buffer->NumPhys) {
++ error = -ENODEV;
++ goto out_free_consistent;
++ }
++
+ /* save config data */
+ port_info->num_phys = buffer->NumPhys;
+ port_info->phy_info = kcalloc(port_info->num_phys,
+diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
+index 9cc5a6b..55584ee 100644
+--- a/drivers/net/e1000e/netdev.c
++++ b/drivers/net/e1000e/netdev.c
+@@ -1686,6 +1686,9 @@ static void e1000_setup_rctl(struct e1000_adapter *adapter)
+ else
+ rctl |= E1000_RCTL_LPE;
+
++ /* Enable hardware CRC frame stripping */
++ rctl |= E1000_RCTL_SECRC;
++
+ /* Setup buffer sizes */
+ rctl &= ~E1000_RCTL_SZ_4096;
+ rctl |= E1000_RCTL_BSEX;
+@@ -1751,9 +1754,6 @@ static void e1000_setup_rctl(struct e1000_adapter *adapter)
+
+ /* Enable Packet split descriptors */
+ rctl |= E1000_RCTL_DTYP_PS;
+-
+- /* Enable hardware CRC frame stripping */
+- rctl |= E1000_RCTL_SECRC;
+
+ psrctl |= adapter->rx_ps_bsize0 >>
+ E1000_PSRCTL_BSIZE0_SHIFT;
+diff --git a/drivers/net/macb.c b/drivers/net/macb.c
+index e10528e..c796948 100644
+--- a/drivers/net/macb.c
++++ b/drivers/net/macb.c
+@@ -148,7 +148,7 @@ static void macb_handle_link_change(struct net_device *dev)
+
+ if (phydev->duplex)
+ reg |= MACB_BIT(FD);
+- if (phydev->speed)
++ if (phydev->speed == SPEED_100)
+ reg |= MACB_BIT(SPD);
+
+ macb_writel(bp, NCFGR, reg);
+diff --git a/drivers/net/niu.c b/drivers/net/niu.c
+index 5f6beab..226dc54 100644
+--- a/drivers/net/niu.c
++++ b/drivers/net/niu.c
+@@ -33,8 +33,8 @@
+
+ #define DRV_MODULE_NAME "niu"
+ #define PFX DRV_MODULE_NAME ": "
+-#define DRV_MODULE_VERSION "0.6"
+-#define DRV_MODULE_RELDATE "January 5, 2008"
++#define DRV_MODULE_VERSION "0.7"
++#define DRV_MODULE_RELDATE "February 18, 2008"
+
+ static char version[] __devinitdata =
+ DRV_MODULE_NAME ".c:v" DRV_MODULE_VERSION " (" DRV_MODULE_RELDATE ")\n";
+@@ -1616,12 +1616,13 @@ static int niu_enable_alt_mac(struct niu *np, int index, int on)
+ if (index >= niu_num_alt_addr(np))
+ return -EINVAL;
+
+- if (np->flags & NIU_FLAGS_XMAC)
++ if (np->flags & NIU_FLAGS_XMAC) {
+ reg = XMAC_ADDR_CMPEN;
+- else
++ mask = 1 << index;
++ } else {
+ reg = BMAC_ADDR_CMPEN;
+-
+- mask = 1 << index;
++ mask = 1 << (index + 1);
++ }
+
+ val = nr64_mac(reg);
+ if (on)
+@@ -5147,7 +5148,12 @@ static void niu_set_rx_mode(struct net_device *dev)
+ index++;
+ }
+ } else {
+- for (i = 0; i < niu_num_alt_addr(np); i++) {
++ int alt_start;
++ if (np->flags & NIU_FLAGS_XMAC)
++ alt_start = 0;
++ else
++ alt_start = 1;
++ for (i = alt_start; i < niu_num_alt_addr(np); i++) {
+ err = niu_enable_alt_mac(np, i, 0);
+ if (err)
+ printk(KERN_WARNING PFX "%s: Error %d "
+diff --git a/drivers/net/niu.h b/drivers/net/niu.h
+index 0e8626a..59dc05f 100644
+--- a/drivers/net/niu.h
++++ b/drivers/net/niu.h
+@@ -499,7 +499,7 @@
+ #define BMAC_ADDR2 0x00110UL
+ #define BMAC_ADDR2_ADDR2 0x000000000000ffffULL
+
+-#define BMAC_NUM_ALT_ADDR 7
++#define BMAC_NUM_ALT_ADDR 6
+
+ #define BMAC_ALT_ADDR0(NUM) (0x00118UL + (NUM)*0x18UL)
+ #define BMAC_ALT_ADDR0_ADDR0 0x000000000000ffffULL
+diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
+index 559a9a9..ddcc0c4 100644
+--- a/drivers/net/wireless/b43/dma.c
++++ b/drivers/net/wireless/b43/dma.c
+@@ -165,7 +165,7 @@ static void op64_fill_descriptor(struct b43_dmaring *ring,
+ addrhi = (((u64) dmaaddr >> 32) & ~SSB_DMA_TRANSLATION_MASK);
+ addrext = (((u64) dmaaddr >> 32) & SSB_DMA_TRANSLATION_MASK)
+ >> SSB_DMA_TRANSLATION_SHIFT;
+- addrhi |= ssb_dma_translation(ring->dev->dev);
++ addrhi |= (ssb_dma_translation(ring->dev->dev) << 1);
+ if (slot == ring->nr_slots - 1)
+ ctl0 |= B43_DMA64_DCTL0_DTABLEEND;
+ if (start)
+@@ -426,9 +426,21 @@ static inline
+ static int alloc_ringmemory(struct b43_dmaring *ring)
+ {
+ struct device *dev = ring->dev->dev->dev;
+-
++ gfp_t flags = GFP_KERNEL;
++
++ /* The specs call for 4K buffers for 30- and 32-bit DMA with 4K
++ * alignment and 8K buffers for 64-bit DMA with 8K alignment. Testing
++ * has shown that 4K is sufficient for the latter as long as the buffer
++ * does not cross an 8K boundary.
++ *
++ * For unknown reasons - possibly a hardware error - the BCM4311 rev
++ * 02, which uses 64-bit DMA, needs the ring buffer in very low memory,
++ * which accounts for the GFP_DMA flag below.
++ */
++ if (ring->dma64)
++ flags |= GFP_DMA;
+ ring->descbase = dma_alloc_coherent(dev, B43_DMA_RINGMEMSIZE,
+- &(ring->dmabase), GFP_KERNEL);
++ &(ring->dmabase), flags);
+ if (!ring->descbase) {
+ b43err(ring->dev->wl, "DMA ringmemory allocation failed\n");
+ return -ENOMEM;
+@@ -483,7 +495,7 @@ int b43_dmacontroller_rx_reset(struct b43_wldev *dev, u16 mmio_base, int dma64)
+ return 0;
+ }
+
+-/* Reset the RX DMA channel */
++/* Reset the TX DMA channel */
+ int b43_dmacontroller_tx_reset(struct b43_wldev *dev, u16 mmio_base, int dma64)
+ {
+ int i;
+@@ -647,7 +659,7 @@ static int dmacontroller_setup(struct b43_dmaring *ring)
+ b43_dma_write(ring, B43_DMA64_TXRINGHI,
+ ((ringbase >> 32) &
+ ~SSB_DMA_TRANSLATION_MASK)
+- | trans);
++ | (trans << 1));
+ } else {
+ u32 ringbase = (u32) (ring->dmabase);
+
+@@ -680,8 +692,9 @@ static int dmacontroller_setup(struct b43_dmaring *ring)
+ b43_dma_write(ring, B43_DMA64_RXRINGHI,
+ ((ringbase >> 32) &
+ ~SSB_DMA_TRANSLATION_MASK)
+- | trans);
+- b43_dma_write(ring, B43_DMA64_RXINDEX, 200);
++ | (trans << 1));
++ b43_dma_write(ring, B43_DMA64_RXINDEX, ring->nr_slots *
++ sizeof(struct b43_dmadesc64));
+ } else {
+ u32 ringbase = (u32) (ring->dmabase);
+
+@@ -695,11 +708,12 @@ static int dmacontroller_setup(struct b43_dmaring *ring)
+ b43_dma_write(ring, B43_DMA32_RXRING,
+ (ringbase & ~SSB_DMA_TRANSLATION_MASK)
+ | trans);
+- b43_dma_write(ring, B43_DMA32_RXINDEX, 200);
++ b43_dma_write(ring, B43_DMA32_RXINDEX, ring->nr_slots *
++ sizeof(struct b43_dmadesc32));
+ }
+ }
+
+- out:
++out:
+ return err;
+ }
+
+diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
+index 69795fd..36a1de2 100644
+--- a/drivers/net/wireless/b43/main.c
++++ b/drivers/net/wireless/b43/main.c
+@@ -101,6 +101,7 @@ static const struct ssb_device_id b43_ssb_tbl[] = {
+ SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
+ SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
+ SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
++ SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
+ SSB_DEVTABLE_END
+ };
+
+@@ -3079,7 +3080,7 @@ static int b43_phy_versioning(struct b43_wldev *dev)
+ unsupported = 1;
+ break;
+ case B43_PHYTYPE_G:
+- if (phy_rev > 8)
++ if (phy_rev > 9)
+ unsupported = 1;
+ break;
+ default:
+diff --git a/drivers/s390/char/defkeymap.c b/drivers/s390/char/defkeymap.c
+index 389346c..07c7f31 100644
+--- a/drivers/s390/char/defkeymap.c
++++ b/drivers/s390/char/defkeymap.c
+@@ -151,8 +151,8 @@ char *func_table[MAX_NR_FUNC] = {
+ };
+
+ struct kbdiacruc accent_table[MAX_DIACR] = {
+- {'^', 'c', '\003'}, {'^', 'd', '\004'},
+- {'^', 'z', '\032'}, {'^', '\012', '\000'},
++ {'^', 'c', 0003}, {'^', 'd', 0004},
++ {'^', 'z', 0032}, {'^', 0012, 0000},
+ };
+
+ unsigned int accent_table_size = 4;
+diff --git a/drivers/scsi/advansys.c b/drivers/scsi/advansys.c
+index 38a1ee2..f40417b 100644
+--- a/drivers/scsi/advansys.c
++++ b/drivers/scsi/advansys.c
+@@ -566,7 +566,7 @@ typedef struct asc_dvc_var {
+ ASC_SCSI_BIT_ID_TYPE unit_not_ready;
+ ASC_SCSI_BIT_ID_TYPE queue_full_or_busy;
+ ASC_SCSI_BIT_ID_TYPE start_motor;
+- uchar overrun_buf[ASC_OVERRUN_BSIZE] __aligned(8);
++ uchar *overrun_buf;
+ dma_addr_t overrun_dma;
+ uchar scsi_reset_wait;
+ uchar chip_no;
+@@ -6439,7 +6439,7 @@ static int AdvLoadMicrocode(AdvPortAddr iop_base, unsigned char *buf, int size,
+ i += 2;
+ len += 2;
+ } else {
+- unsigned char off = buf[i] * 2;
++ unsigned int off = buf[i] * 2;
+ unsigned short word = (buf[off + 1] << 8) | buf[off];
+ AdvWriteWordAutoIncLram(iop_base, word);
+ len += 2;
+@@ -13833,6 +13833,12 @@ static int __devinit advansys_board_found(struct Scsi_Host *shost,
+ */
+ if (ASC_NARROW_BOARD(boardp)) {
+ ASC_DBG(2, "AscInitAsc1000Driver()\n");
++
++ asc_dvc_varp->overrun_buf = kzalloc(ASC_OVERRUN_BSIZE, GFP_KERNEL);
++ if (!asc_dvc_varp->overrun_buf) {
++ ret = -ENOMEM;
++ goto err_free_wide_mem;
++ }
+ warn_code = AscInitAsc1000Driver(asc_dvc_varp);
+
+ if (warn_code || asc_dvc_varp->err_code) {
+@@ -13840,8 +13846,10 @@ static int __devinit advansys_board_found(struct Scsi_Host *shost,
+ "warn 0x%x, error 0x%x\n",
+ asc_dvc_varp->init_state, warn_code,
+ asc_dvc_varp->err_code);
+- if (asc_dvc_varp->err_code)
++ if (asc_dvc_varp->err_code) {
+ ret = -ENODEV;
++ kfree(asc_dvc_varp->overrun_buf);
++ }
+ }
+ } else {
+ if (advansys_wide_init_chip(shost))
+@@ -13894,6 +13902,7 @@ static int advansys_release(struct Scsi_Host *shost)
+ dma_unmap_single(board->dev,
+ board->dvc_var.asc_dvc_var.overrun_dma,
+ ASC_OVERRUN_BSIZE, DMA_FROM_DEVICE);
++ kfree(board->dvc_var.asc_dvc_var.overrun_buf);
+ } else {
+ iounmap(board->ioremap_addr);
+ advansys_wide_free_mem(board);
+diff --git a/drivers/scsi/aic94xx/aic94xx_scb.c b/drivers/scsi/aic94xx/aic94xx_scb.c
+index db6ab1a..eae2d97 100644
+--- a/drivers/scsi/aic94xx/aic94xx_scb.c
++++ b/drivers/scsi/aic94xx/aic94xx_scb.c
+@@ -458,13 +458,19 @@ static void escb_tasklet_complete(struct asd_ascb *ascb,
+ tc_abort = le16_to_cpu(tc_abort);
+
+ list_for_each_entry_safe(a, b, &asd_ha->seq.pend_q, list) {
+- struct sas_task *task = ascb->uldd_task;
++ struct sas_task *task = a->uldd_task;
++
++ if (a->tc_index != tc_abort)
++ continue;
+
+- if (task && a->tc_index == tc_abort) {
++ if (task) {
+ failed_dev = task->dev;
+ sas_task_abort(task);
+- break;
++ } else {
++ ASD_DPRINTK("R_T_A for non TASK scb 0x%x\n",
++ a->scb->header.opcode);
+ }
++ break;
+ }
+
+ if (!failed_dev) {
+@@ -478,7 +484,7 @@ static void escb_tasklet_complete(struct asd_ascb *ascb,
+ * that the EH will wake up and do something.
+ */
+ list_for_each_entry_safe(a, b, &asd_ha->seq.pend_q, list) {
+- struct sas_task *task = ascb->uldd_task;
++ struct sas_task *task = a->uldd_task;
+
+ if (task &&
+ task->dev == failed_dev &&
+diff --git a/drivers/scsi/arcmsr/arcmsr_hba.c b/drivers/scsi/arcmsr/arcmsr_hba.c
+index d466a2d..dcd6c9a 100644
+--- a/drivers/scsi/arcmsr/arcmsr_hba.c
++++ b/drivers/scsi/arcmsr/arcmsr_hba.c
+@@ -1380,17 +1380,16 @@ static int arcmsr_iop_message_xfer(struct AdapterControlBlock *acb, \
+ switch(controlcode) {
+
+ case ARCMSR_MESSAGE_READ_RQBUFFER: {
+- unsigned long *ver_addr;
+- dma_addr_t buf_handle;
++ unsigned char *ver_addr;
+ uint8_t *pQbuffer, *ptmpQbuffer;
+ int32_t allxfer_len = 0;
+
+- ver_addr = pci_alloc_consistent(acb->pdev, 1032, &buf_handle);
++ ver_addr = kmalloc(1032, GFP_ATOMIC);
+ if (!ver_addr) {
+ retvalue = ARCMSR_MESSAGE_FAIL;
+ goto message_out;
+ }
+- ptmpQbuffer = (uint8_t *) ver_addr;
++ ptmpQbuffer = ver_addr;
+ while ((acb->rqbuf_firstindex != acb->rqbuf_lastindex)
+ && (allxfer_len < 1031)) {
+ pQbuffer = &acb->rqbuffer[acb->rqbuf_firstindex];
+@@ -1419,25 +1418,24 @@ static int arcmsr_iop_message_xfer(struct AdapterControlBlock *acb, \
+ }
+ arcmsr_iop_message_read(acb);
+ }
+- memcpy(pcmdmessagefld->messagedatabuffer, (uint8_t *)ver_addr, allxfer_len);
++ memcpy(pcmdmessagefld->messagedatabuffer, ver_addr, allxfer_len);
+ pcmdmessagefld->cmdmessage.Length = allxfer_len;
+ pcmdmessagefld->cmdmessage.ReturnCode = ARCMSR_MESSAGE_RETURNCODE_OK;
+- pci_free_consistent(acb->pdev, 1032, ver_addr, buf_handle);
++ kfree(ver_addr);
+ }
+ break;
+
+ case ARCMSR_MESSAGE_WRITE_WQBUFFER: {
+- unsigned long *ver_addr;
+- dma_addr_t buf_handle;
++ unsigned char *ver_addr;
+ int32_t my_empty_len, user_len, wqbuf_firstindex, wqbuf_lastindex;
+ uint8_t *pQbuffer, *ptmpuserbuffer;
+
+- ver_addr = pci_alloc_consistent(acb->pdev, 1032, &buf_handle);
++ ver_addr = kmalloc(1032, GFP_ATOMIC);
+ if (!ver_addr) {
+ retvalue = ARCMSR_MESSAGE_FAIL;
+ goto message_out;
+ }
+- ptmpuserbuffer = (uint8_t *)ver_addr;
++ ptmpuserbuffer = ver_addr;
+ user_len = pcmdmessagefld->cmdmessage.Length;
+ memcpy(ptmpuserbuffer, pcmdmessagefld->messagedatabuffer, user_len);
+ wqbuf_lastindex = acb->wqbuf_lastindex;
+@@ -1483,7 +1481,7 @@ static int arcmsr_iop_message_xfer(struct AdapterControlBlock *acb, \
+ retvalue = ARCMSR_MESSAGE_FAIL;
+ }
+ }
+- pci_free_consistent(acb->pdev, 1032, ver_addr, buf_handle);
++ kfree(ver_addr);
+ }
+ break;
+
+diff --git a/drivers/scsi/gdth.c b/drivers/scsi/gdth.c
+index 8eb78be..b8b67f6 100644
+--- a/drivers/scsi/gdth.c
++++ b/drivers/scsi/gdth.c
+@@ -160,7 +160,7 @@ static void gdth_readapp_event(gdth_ha_str *ha, unchar application,
+ static void gdth_clear_events(void);
+
+ static void gdth_copy_internal_data(gdth_ha_str *ha, Scsi_Cmnd *scp,
+- char *buffer, ushort count, int to_buffer);
++ char *buffer, ushort count);
+ static int gdth_internal_cache_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp);
+ static int gdth_fill_cache_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp, ushort hdrive);
+
+@@ -183,7 +183,6 @@ static int gdth_ioctl(struct inode *inode, struct file *filep,
+ unsigned int cmd, unsigned long arg);
+
+ static void gdth_flush(gdth_ha_str *ha);
+-static int gdth_halt(struct notifier_block *nb, ulong event, void *buf);
+ static int gdth_queuecommand(Scsi_Cmnd *scp,void (*done)(Scsi_Cmnd *));
+ static int __gdth_queuecommand(gdth_ha_str *ha, struct scsi_cmnd *scp,
+ struct gdth_cmndinfo *cmndinfo);
+@@ -418,12 +417,6 @@ static inline void gdth_set_sglist(struct scsi_cmnd *cmd,
+ #include "gdth_proc.h"
+ #include "gdth_proc.c"
+
+-/* notifier block to get a notify on system shutdown/halt/reboot */
+-static struct notifier_block gdth_notifier = {
+- gdth_halt, NULL, 0
+-};
+-static int notifier_disabled = 0;
+-
+ static gdth_ha_str *gdth_find_ha(int hanum)
+ {
+ gdth_ha_str *ha;
+@@ -446,8 +439,8 @@ static struct gdth_cmndinfo *gdth_get_cmndinfo(gdth_ha_str *ha)
+ for (i=0; i<GDTH_MAXCMDS; ++i) {
+ if (ha->cmndinfo[i].index == 0) {
+ priv = &ha->cmndinfo[i];
+- priv->index = i+1;
+ memset(priv, 0, sizeof(*priv));
++ priv->index = i+1;
+ break;
+ }
+ }
+@@ -494,7 +487,6 @@ int __gdth_execute(struct scsi_device *sdev, gdth_cmd_str *gdtcmd, char *cmnd,
+ gdth_ha_str *ha = shost_priv(sdev->host);
+ Scsi_Cmnd *scp;
+ struct gdth_cmndinfo cmndinfo;
+- struct scatterlist one_sg;
+ DECLARE_COMPLETION_ONSTACK(wait);
+ int rval;
+
+@@ -508,13 +500,10 @@ int __gdth_execute(struct scsi_device *sdev, gdth_cmd_str *gdtcmd, char *cmnd,
+ /* use request field to save the ptr. to completion struct. */
+ scp->request = (struct request *)&wait;
+ scp->timeout_per_command = timeout*HZ;
+- sg_init_one(&one_sg, gdtcmd, sizeof(*gdtcmd));
+- gdth_set_sglist(scp, &one_sg);
+- gdth_set_sg_count(scp, 1);
+- gdth_set_bufflen(scp, sizeof(*gdtcmd));
+ scp->cmd_len = 12;
+ memcpy(scp->cmnd, cmnd, 12);
+ cmndinfo.priority = IOCTL_PRI;
++ cmndinfo.internal_cmd_str = gdtcmd;
+ cmndinfo.internal_command = 1;
+
+ TRACE(("__gdth_execute() cmd 0x%x\n", scp->cmnd[0]));
+@@ -2355,7 +2344,7 @@ static void gdth_next(gdth_ha_str *ha)
+ * buffers, kmap_atomic() as needed.
+ */
+ static void gdth_copy_internal_data(gdth_ha_str *ha, Scsi_Cmnd *scp,
+- char *buffer, ushort count, int to_buffer)
++ char *buffer, ushort count)
+ {
+ ushort cpcount,i, max_sg = gdth_sg_count(scp);
+ ushort cpsum,cpnow;
+@@ -2381,10 +2370,7 @@ static void gdth_copy_internal_data(gdth_ha_str *ha, Scsi_Cmnd *scp,
+ }
+ local_irq_save(flags);
+ address = kmap_atomic(sg_page(sl), KM_BIO_SRC_IRQ) + sl->offset;
+- if (to_buffer)
+- memcpy(buffer, address, cpnow);
+- else
+- memcpy(address, buffer, cpnow);
++ memcpy(address, buffer, cpnow);
+ flush_dcache_page(sg_page(sl));
+ kunmap_atomic(address, KM_BIO_SRC_IRQ);
+ local_irq_restore(flags);
+@@ -2438,7 +2424,7 @@ static int gdth_internal_cache_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp)
+ strcpy(inq.vendor,ha->oem_name);
+ sprintf(inq.product,"Host Drive #%02d",t);
+ strcpy(inq.revision," ");
+- gdth_copy_internal_data(ha, scp, (char*)&inq, sizeof(gdth_inq_data), 0);
++ gdth_copy_internal_data(ha, scp, (char*)&inq, sizeof(gdth_inq_data));
+ break;
+
+ case REQUEST_SENSE:
+@@ -2448,7 +2434,7 @@ static int gdth_internal_cache_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp)
+ sd.key = NO_SENSE;
+ sd.info = 0;
+ sd.add_length= 0;
+- gdth_copy_internal_data(ha, scp, (char*)&sd, sizeof(gdth_sense_data), 0);
++ gdth_copy_internal_data(ha, scp, (char*)&sd, sizeof(gdth_sense_data));
+ break;
+
+ case MODE_SENSE:
+@@ -2460,7 +2446,7 @@ static int gdth_internal_cache_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp)
+ mpd.bd.block_length[0] = (SECTOR_SIZE & 0x00ff0000) >> 16;
+ mpd.bd.block_length[1] = (SECTOR_SIZE & 0x0000ff00) >> 8;
+ mpd.bd.block_length[2] = (SECTOR_SIZE & 0x000000ff);
+- gdth_copy_internal_data(ha, scp, (char*)&mpd, sizeof(gdth_modep_data), 0);
++ gdth_copy_internal_data(ha, scp, (char*)&mpd, sizeof(gdth_modep_data));
+ break;
+
+ case READ_CAPACITY:
+@@ -2470,7 +2456,7 @@ static int gdth_internal_cache_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp)
+ else
+ rdc.last_block_no = cpu_to_be32(ha->hdr[t].size-1);
+ rdc.block_length = cpu_to_be32(SECTOR_SIZE);
+- gdth_copy_internal_data(ha, scp, (char*)&rdc, sizeof(gdth_rdcap_data), 0);
++ gdth_copy_internal_data(ha, scp, (char*)&rdc, sizeof(gdth_rdcap_data));
+ break;
+
+ case SERVICE_ACTION_IN:
+@@ -2482,7 +2468,7 @@ static int gdth_internal_cache_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp)
+ rdc16.last_block_no = cpu_to_be64(ha->hdr[t].size-1);
+ rdc16.block_length = cpu_to_be32(SECTOR_SIZE);
+ gdth_copy_internal_data(ha, scp, (char*)&rdc16,
+- sizeof(gdth_rdcap16_data), 0);
++ sizeof(gdth_rdcap16_data));
+ } else {
+ scp->result = DID_ABORT << 16;
+ }
+@@ -2852,6 +2838,7 @@ static int gdth_fill_raw_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp, unchar b)
+ static int gdth_special_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp)
+ {
+ register gdth_cmd_str *cmdp;
++ struct gdth_cmndinfo *cmndinfo = gdth_cmnd_priv(scp);
+ int cmd_index;
+
+ cmdp= ha->pccb;
+@@ -2860,7 +2847,7 @@ static int gdth_special_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp)
+ if (ha->type==GDT_EISA && ha->cmd_cnt>0)
+ return 0;
+
+- gdth_copy_internal_data(ha, scp, (char *)cmdp, sizeof(gdth_cmd_str), 1);
++ *cmdp = *cmndinfo->internal_cmd_str;
+ cmdp->RequestBuffer = scp;
+
+ /* search free command index */
+@@ -3793,6 +3780,8 @@ static void gdth_timeout(ulong data)
+ gdth_ha_str *ha;
+ ulong flags;
+
++ BUG_ON(list_empty(&gdth_instances));
++
+ ha = list_first_entry(&gdth_instances, gdth_ha_str, list);
+ spin_lock_irqsave(&ha->smp_lock, flags);
+
+@@ -4668,45 +4657,6 @@ static void gdth_flush(gdth_ha_str *ha)
+ }
+ }
+
+-/* shutdown routine */
+-static int gdth_halt(struct notifier_block *nb, ulong event, void *buf)
+-{
+- gdth_ha_str *ha;
+-#ifndef __alpha__
+- gdth_cmd_str gdtcmd;
+- char cmnd[MAX_COMMAND_SIZE];
+-#endif
+-
+- if (notifier_disabled)
+- return NOTIFY_OK;
+-
+- TRACE2(("gdth_halt() event %d\n",(int)event));
+- if (event != SYS_RESTART && event != SYS_HALT && event != SYS_POWER_OFF)
+- return NOTIFY_DONE;
+-
+- notifier_disabled = 1;
+- printk("GDT-HA: Flushing all host drives .. ");
+- list_for_each_entry(ha, &gdth_instances, list) {
+- gdth_flush(ha);
+-
+-#ifndef __alpha__
+- /* controller reset */
+- memset(cmnd, 0xff, MAX_COMMAND_SIZE);
+- gdtcmd.BoardNode = LOCALBOARD;
+- gdtcmd.Service = CACHESERVICE;
+- gdtcmd.OpCode = GDT_RESET;
+- TRACE2(("gdth_halt(): reset controller %d\n", ha->hanum));
+- gdth_execute(ha->shost, &gdtcmd, cmnd, 10, NULL);
+-#endif
+- }
+- printk("Done.\n");
+-
+-#ifdef GDTH_STATISTICS
+- del_timer(&gdth_timer);
+-#endif
+- return NOTIFY_OK;
+-}
+-
+ /* configure lun */
+ static int gdth_slave_configure(struct scsi_device *sdev)
+ {
+@@ -5141,13 +5091,13 @@ static void gdth_remove_one(gdth_ha_str *ha)
+
+ scsi_remove_host(shp);
+
++ gdth_flush(ha);
++
+ if (ha->sdev) {
+ scsi_free_host_dev(ha->sdev);
+ ha->sdev = NULL;
+ }
+
+- gdth_flush(ha);
+-
+ if (shp->irq)
+ free_irq(shp->irq,ha);
+
+@@ -5173,6 +5123,24 @@ static void gdth_remove_one(gdth_ha_str *ha)
+ scsi_host_put(shp);
+ }
+
++static int gdth_halt(struct notifier_block *nb, ulong event, void *buf)
++{
++ gdth_ha_str *ha;
++
++ TRACE2(("gdth_halt() event %d\n", (int)event));
++ if (event != SYS_RESTART && event != SYS_HALT && event != SYS_POWER_OFF)
++ return NOTIFY_DONE;
++
++ list_for_each_entry(ha, &gdth_instances, list)
++ gdth_flush(ha);
++
++ return NOTIFY_OK;
++}
++
++static struct notifier_block gdth_notifier = {
++ gdth_halt, NULL, 0
++};
++
+ static int __init gdth_init(void)
+ {
+ if (disable) {
+@@ -5235,7 +5203,6 @@ static int __init gdth_init(void)
+ add_timer(&gdth_timer);
+ #endif
+ major = register_chrdev(0,"gdth", &gdth_fops);
+- notifier_disabled = 0;
+ register_reboot_notifier(&gdth_notifier);
+ gdth_polling = FALSE;
+ return 0;
+@@ -5245,14 +5212,15 @@ static void __exit gdth_exit(void)
+ {
+ gdth_ha_str *ha;
+
+- list_for_each_entry(ha, &gdth_instances, list)
+- gdth_remove_one(ha);
++ unregister_chrdev(major, "gdth");
++ unregister_reboot_notifier(&gdth_notifier);
+
+ #ifdef GDTH_STATISTICS
+- del_timer(&gdth_timer);
++ del_timer_sync(&gdth_timer);
+ #endif
+- unregister_chrdev(major,"gdth");
+- unregister_reboot_notifier(&gdth_notifier);
++
++ list_for_each_entry(ha, &gdth_instances, list)
++ gdth_remove_one(ha);
+ }
+
+ module_init(gdth_init);
+diff --git a/drivers/scsi/gdth.h b/drivers/scsi/gdth.h
+index 1434c6b..26e4e92 100644
+--- a/drivers/scsi/gdth.h
++++ b/drivers/scsi/gdth.h
+@@ -915,6 +915,7 @@ typedef struct {
+ struct gdth_cmndinfo { /* per-command private info */
+ int index;
+ int internal_command; /* don't call scsi_done */
++ gdth_cmd_str *internal_cmd_str; /* crier for internal messages*/
+ dma_addr_t sense_paddr; /* sense dma-addr */
+ unchar priority;
+ int timeout;
+diff --git a/drivers/scsi/gdth_proc.c b/drivers/scsi/gdth_proc.c
+index de57734..ce0228e 100644
+--- a/drivers/scsi/gdth_proc.c
++++ b/drivers/scsi/gdth_proc.c
+@@ -694,15 +694,13 @@ static void gdth_ioctl_free(gdth_ha_str *ha, int size, char *buf, ulong64 paddr)
+ {
+ ulong flags;
+
+- spin_lock_irqsave(&ha->smp_lock, flags);
+-
+ if (buf == ha->pscratch) {
++ spin_lock_irqsave(&ha->smp_lock, flags);
+ ha->scratch_busy = FALSE;
++ spin_unlock_irqrestore(&ha->smp_lock, flags);
+ } else {
+ pci_free_consistent(ha->pdev, size, buf, paddr);
+ }
+-
+- spin_unlock_irqrestore(&ha->smp_lock, flags);
+ }
+
+ #ifdef GDTH_IOCTL_PROC
+diff --git a/drivers/scsi/ips.c b/drivers/scsi/ips.c
+index 5c5a9b2..f4e9c8d 100644
+--- a/drivers/scsi/ips.c
++++ b/drivers/scsi/ips.c
+@@ -1580,7 +1580,7 @@ ips_make_passthru(ips_ha_t *ha, struct scsi_cmnd *SC, ips_scb_t *scb, int intr)
+ METHOD_TRACE("ips_make_passthru", 1);
+
+ scsi_for_each_sg(SC, sg, scsi_sg_count(SC), i)
+- length += sg[i].length;
++ length += sg->length;
+
+ if (length < sizeof (ips_passthru_t)) {
+ /* wrong size */
+@@ -6842,13 +6842,10 @@ ips_register_scsi(int index)
+ if (request_irq(ha->irq, do_ipsintr, IRQF_SHARED, ips_name, ha)) {
+ IPS_PRINTK(KERN_WARNING, ha->pcidev,
+ "Unable to install interrupt handler\n");
+- scsi_host_put(sh);
+- return -1;
++ goto err_out_sh;
+ }
+
+ kfree(oldha);
+- ips_sh[index] = sh;
+- ips_ha[index] = ha;
+
+ /* Store away needed values for later use */
+ sh->io_port = ha->io_addr;
+@@ -6867,10 +6864,21 @@ ips_register_scsi(int index)
+ sh->max_channel = ha->nbus - 1;
+ sh->can_queue = ha->max_cmds - 1;
+
+- scsi_add_host(sh, NULL);
++ if (scsi_add_host(sh, &ha->pcidev->dev))
++ goto err_out;
++
++ ips_sh[index] = sh;
++ ips_ha[index] = ha;
++
+ scsi_scan_host(sh);
+
+ return 0;
++
++err_out:
++ free_irq(ha->pcidev->irq, ha);
++err_out_sh:
++ scsi_host_put(sh);
++ return -1;
+ }
+
+ /*---------------------------------------------------------------------------*/
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index a9ac5b1..273728e 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -298,7 +298,6 @@ static int scsi_req_map_sg(struct request *rq, struct scatterlist *sgl,
+ page = sg_page(sg);
+ off = sg->offset;
+ len = sg->length;
+- data_len += len;
+
+ while (len > 0 && data_len > 0) {
+ /*
+diff --git a/drivers/spi/atmel_spi.c b/drivers/spi/atmel_spi.c
+index ff10808..e9d7959 100644
+--- a/drivers/spi/atmel_spi.c
++++ b/drivers/spi/atmel_spi.c
+@@ -85,6 +85,16 @@ static void cs_activate(struct atmel_spi *as, struct spi_device *spi)
+ unsigned gpio = (unsigned) spi->controller_data;
+ unsigned active = spi->mode & SPI_CS_HIGH;
+ u32 mr;
++ int i;
++ u32 csr;
++ u32 cpol = (spi->mode & SPI_CPOL) ? SPI_BIT(CPOL) : 0;
++
++ /* Make sure clock polarity is correct */
++ for (i = 0; i < spi->master->num_chipselect; i++) {
++ csr = spi_readl(as, CSR0 + 4 * i);
++ if ((csr ^ cpol) & SPI_BIT(CPOL))
++ spi_writel(as, CSR0 + 4 * i, csr ^ SPI_BIT(CPOL));
++ }
+
+ mr = spi_readl(as, MR);
+ mr = SPI_BFINS(PCS, ~(1 << spi->chip_select), mr);
+diff --git a/drivers/spi/pxa2xx_spi.c b/drivers/spi/pxa2xx_spi.c
+index 1c2ab54..840e682 100644
+--- a/drivers/spi/pxa2xx_spi.c
++++ b/drivers/spi/pxa2xx_spi.c
+@@ -48,13 +48,19 @@ MODULE_LICENSE("GPL");
+ #define RESET_DMA_CHANNEL (DCSR_NODESC | DMA_INT_MASK)
+ #define IS_DMA_ALIGNED(x) (((u32)(x)&0x07)==0)
+
+-/* for testing SSCR1 changes that require SSP restart, basically
+- * everything except the service and interrupt enables */
+-#define SSCR1_CHANGE_MASK (SSCR1_TTELP | SSCR1_TTE | SSCR1_EBCEI | SSCR1_SCFR \
++/*
++ * for testing SSCR1 changes that require SSP restart, basically
++ * everything except the service and interrupt enables, the pxa270 developer
++ * manual says only SSCR1_SCFR, SSCR1_SPH, SSCR1_SPO need to be in this
++ * list, but the PXA255 dev man says all bits without really meaning the
++ * service and interrupt enables
++ */
++#define SSCR1_CHANGE_MASK (SSCR1_TTELP | SSCR1_TTE | SSCR1_SCFR \
+ | SSCR1_ECRA | SSCR1_ECRB | SSCR1_SCLKDIR \
+- | SSCR1_RWOT | SSCR1_TRAIL | SSCR1_PINTE \
+- | SSCR1_STRF | SSCR1_EFWR |SSCR1_RFT \
+- | SSCR1_TFT | SSCR1_SPH | SSCR1_SPO | SSCR1_LBM)
++ | SSCR1_SFRMDIR | SSCR1_RWOT | SSCR1_TRAIL \
++ | SSCR1_IFS | SSCR1_STRF | SSCR1_EFWR \
++ | SSCR1_RFT | SSCR1_TFT | SSCR1_MWDS \
++ | SSCR1_SPH | SSCR1_SPO | SSCR1_LBM)
+
+ #define DEFINE_SSP_REG(reg, off) \
+ static inline u32 read_##reg(void *p) { return __raw_readl(p + (off)); } \
+@@ -961,9 +967,6 @@ static void pump_transfers(unsigned long data)
+ if (drv_data->ssp_type == PXA25x_SSP)
+ DCMD(drv_data->tx_channel) |= DCMD_ENDIRQEN;
+
+- /* Fix me, need to handle cs polarity */
+- drv_data->cs_control(PXA2XX_CS_ASSERT);
+-
+ /* Clear status and start DMA engine */
+ cr1 = chip->cr1 | dma_thresh | drv_data->dma_cr1;
+ write_SSSR(drv_data->clear_sr, reg);
+@@ -973,9 +976,6 @@ static void pump_transfers(unsigned long data)
+ /* Ensure we have the correct interrupt handler */
+ drv_data->transfer_handler = interrupt_transfer;
+
+- /* Fix me, need to handle cs polarity */
+- drv_data->cs_control(PXA2XX_CS_ASSERT);
+-
+ /* Clear status */
+ cr1 = chip->cr1 | chip->threshold | drv_data->int_cr1;
+ write_SSSR(drv_data->clear_sr, reg);
+@@ -986,16 +986,29 @@ static void pump_transfers(unsigned long data)
+ || (read_SSCR1(reg) & SSCR1_CHANGE_MASK) !=
+ (cr1 & SSCR1_CHANGE_MASK)) {
+
++ /* stop the SSP, and update the other bits */
+ write_SSCR0(cr0 & ~SSCR0_SSE, reg);
+ if (drv_data->ssp_type != PXA25x_SSP)
+ write_SSTO(chip->timeout, reg);
+- write_SSCR1(cr1, reg);
++ /* first set CR1 without interrupt and service enables */
++ write_SSCR1(cr1 & SSCR1_CHANGE_MASK, reg);
++ /* restart the SSP */
+ write_SSCR0(cr0, reg);
++
+ } else {
+ if (drv_data->ssp_type != PXA25x_SSP)
+ write_SSTO(chip->timeout, reg);
+- write_SSCR1(cr1, reg);
+ }
++
++ /* FIXME, need to handle cs polarity,
++ * this driver uses struct pxa2xx_spi_chip.cs_control to
++ * specify a CS handling function, and it ignores most
++ * struct spi_device.mode[s], including SPI_CS_HIGH */
++ drv_data->cs_control(PXA2XX_CS_ASSERT);
++
++ /* after chip select, release the data by enabling service
++ * requests and interrupts, without changing any mode bits */
++ write_SSCR1(cr1, reg);
+ }
+
+ static void pump_messages(struct work_struct *work)
+diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
+index b10f39c..d1df9e9 100644
+--- a/drivers/usb/host/ehci-q.c
++++ b/drivers/usb/host/ehci-q.c
+@@ -315,10 +315,10 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh)
+ if (likely (last->urb != urb)) {
+ ehci_urb_done(ehci, last->urb, last_status);
+ count++;
++ last_status = -EINPROGRESS;
+ }
+ ehci_qtd_free (ehci, last);
+ last = NULL;
+- last_status = -EINPROGRESS;
+ }
+
+ /* ignore urbs submitted during completions we reported */
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 1382af9..c04beac 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -310,6 +310,7 @@ struct ftdi_sio_quirk {
+ };
+
+ static int ftdi_olimex_probe (struct usb_serial *serial);
++static int ftdi_mtxorb_hack_setup (struct usb_serial *serial);
+ static void ftdi_USB_UIRT_setup (struct ftdi_private *priv);
+ static void ftdi_HE_TIRA1_setup (struct ftdi_private *priv);
+
+@@ -317,6 +318,10 @@ static struct ftdi_sio_quirk ftdi_olimex_quirk = {
+ .probe = ftdi_olimex_probe,
+ };
+
++static struct ftdi_sio_quirk ftdi_mtxorb_hack_quirk = {
++ .probe = ftdi_mtxorb_hack_setup,
++};
++
+ static struct ftdi_sio_quirk ftdi_USB_UIRT_quirk = {
+ .port_probe = ftdi_USB_UIRT_setup,
+ };
+@@ -379,6 +384,8 @@ static struct usb_device_id id_table_combined [] = {
+ { USB_DEVICE(FTDI_VID, FTDI_MTXORB_4_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_MTXORB_5_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_MTXORB_6_PID) },
++ { USB_DEVICE(MTXORB_VK_VID, MTXORB_VK_PID),
++ .driver_info = (kernel_ulong_t)&ftdi_mtxorb_hack_quirk },
+ { USB_DEVICE(FTDI_VID, FTDI_PERLE_ULTRAPORT_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_PIEGROUP_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_TNC_X_PID) },
+@@ -492,6 +499,7 @@ static struct usb_device_id id_table_combined [] = {
+ { USB_DEVICE(FTDI_VID, FTDI_ELV_FS20SIG_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_ELV_WS300PC_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_ELV_FHZ1300PC_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_ELV_EM1010PC_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_ELV_WS500_PID) },
+ { USB_DEVICE(FTDI_VID, LINX_SDMUSBQSS_PID) },
+ { USB_DEVICE(FTDI_VID, LINX_MASTERDEVEL2_PID) },
+@@ -1301,6 +1309,23 @@ static int ftdi_olimex_probe(struct usb_serial *serial)
+ return 0;
+ }
+
++/*
++ * The Matrix Orbital VK204-25-USB has an invalid IN endpoint.
++ * We have to correct it if we want to read from it.
++ */
++static int ftdi_mtxorb_hack_setup(struct usb_serial *serial)
++{
++ struct usb_host_endpoint *ep = serial->dev->ep_in[1];
++ struct usb_endpoint_descriptor *ep_desc = &ep->desc;
++
++ if (ep->enabled && ep_desc->wMaxPacketSize == 0) {
++ ep_desc->wMaxPacketSize = 0x40;
++ info("Fixing invalid wMaxPacketSize on read pipe");
++ }
++
++ return 0;
++}
++
+ /* ftdi_shutdown is called from usbserial:usb_serial_disconnect
+ * it is called when the usb device is disconnected
+ *
+diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
+index f6053da..893b429 100644
+--- a/drivers/usb/serial/ftdi_sio.h
++++ b/drivers/usb/serial/ftdi_sio.h
+@@ -98,6 +98,13 @@
+ #define FTDI_MTXORB_5_PID 0xFA05 /* Matrix Orbital Product Id */
+ #define FTDI_MTXORB_6_PID 0xFA06 /* Matrix Orbital Product Id */
+
++/*
++ * The following are the values for the Matrix Orbital VK204-25-USB
++ * display, which use the FT232RL.
++ */
++#define MTXORB_VK_VID 0x1b3d
++#define MTXORB_VK_PID 0x0158
++
+ /* Interbiometrics USB I/O Board */
+ /* Developed for Interbiometrics by Rudolf Gugler */
+ #define INTERBIOMETRICS_VID 0x1209
+diff --git a/drivers/usb/storage/protocol.c b/drivers/usb/storage/protocol.c
+index 889622b..45262f3 100644
+--- a/drivers/usb/storage/protocol.c
++++ b/drivers/usb/storage/protocol.c
+@@ -194,7 +194,7 @@ unsigned int usb_stor_access_xfer_buf(unsigned char *buffer,
+ * and the starting offset within the page, and update
+ * the *offset and *index values for the next loop. */
+ cnt = 0;
+- while (cnt < buflen) {
++ while (cnt < buflen && sg) {
+ struct page *page = sg_page(sg) +
+ ((sg->offset + *offset) >> PAGE_SHIFT);
+ unsigned int poff =
+@@ -249,7 +249,8 @@ void usb_stor_set_xfer_buf(unsigned char *buffer,
+ unsigned int offset = 0;
+ struct scatterlist *sg = NULL;
+
+- usb_stor_access_xfer_buf(buffer, buflen, srb, &sg, &offset,
++ buflen = min(buflen, srb->request_bufflen);
++ buflen = usb_stor_access_xfer_buf(buffer, buflen, srb, &sg, &offset,
+ TO_XFER_BUF);
+ if (buflen < srb->request_bufflen)
+ srb->resid = srb->request_bufflen - buflen;
+diff --git a/fs/aio.c b/fs/aio.c
+index 9dec7d2..758f911 100644
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -997,6 +997,14 @@ put_rq:
+ /* everything turned out well, dispose of the aiocb. */
+ ret = __aio_put_req(ctx, iocb);
+
++ /*
++ * We have to order our ring_info tail store above and test
++ * of the wait list below outside the wait lock. This is
++ * like in wake_up_bit() where clearing a bit has to be
++ * ordered with the unlocked test.
++ */
++ smp_mb();
++
+ if (waitqueue_active(&ctx->wait))
+ wake_up(&ctx->wait);
+
+diff --git a/fs/ecryptfs/mmap.c b/fs/ecryptfs/mmap.c
+index 32c5711..a985a8f 100644
+--- a/fs/ecryptfs/mmap.c
++++ b/fs/ecryptfs/mmap.c
+@@ -263,52 +263,102 @@ out:
+ return 0;
+ }
+
+-/* This function must zero any hole we create */
++/**
++ * ecryptfs_prepare_write
++ * @file: The eCryptfs file
++ * @page: The eCryptfs page
++ * @from: The start byte from which we will write
++ * @to: The end byte to which we will write
++ *
++ * This function must zero any hole we create
++ *
++ * Returns zero on success; non-zero otherwise
++ */
+ static int ecryptfs_prepare_write(struct file *file, struct page *page,
+ unsigned from, unsigned to)
+ {
+- int rc = 0;
+ loff_t prev_page_end_size;
++ int rc = 0;
+
+ if (!PageUptodate(page)) {
+- rc = ecryptfs_read_lower_page_segment(page, page->index, 0,
+- PAGE_CACHE_SIZE,
+- page->mapping->host);
+- if (rc) {
+- printk(KERN_ERR "%s: Error attemping to read lower "
+- "page segment; rc = [%d]\n", __FUNCTION__, rc);
+- ClearPageUptodate(page);
+- goto out;
+- } else
++ struct ecryptfs_crypt_stat *crypt_stat =
++ &ecryptfs_inode_to_private(
++ file->f_path.dentry->d_inode)->crypt_stat;
++
++ if (!(crypt_stat->flags & ECRYPTFS_ENCRYPTED)
++ || (crypt_stat->flags & ECRYPTFS_NEW_FILE)) {
++ rc = ecryptfs_read_lower_page_segment(
++ page, page->index, 0, PAGE_CACHE_SIZE,
++ page->mapping->host);
++ if (rc) {
++ printk(KERN_ERR "%s: Error attemping to read "
++ "lower page segment; rc = [%d]\n",
++ __FUNCTION__, rc);
++ ClearPageUptodate(page);
++ goto out;
++ } else
++ SetPageUptodate(page);
++ } else if (crypt_stat->flags & ECRYPTFS_VIEW_AS_ENCRYPTED) {
++ if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR) {
++ rc = ecryptfs_copy_up_encrypted_with_header(
++ page, crypt_stat);
++ if (rc) {
++ printk(KERN_ERR "%s: Error attempting "
++ "to copy the encrypted content "
++ "from the lower file whilst "
++ "inserting the metadata from "
++ "the xattr into the header; rc "
++ "= [%d]\n", __FUNCTION__, rc);
++ ClearPageUptodate(page);
++ goto out;
++ }
++ SetPageUptodate(page);
++ } else {
++ rc = ecryptfs_read_lower_page_segment(
++ page, page->index, 0, PAGE_CACHE_SIZE,
++ page->mapping->host);
++ if (rc) {
++ printk(KERN_ERR "%s: Error reading "
++ "page; rc = [%d]\n",
++ __FUNCTION__, rc);
++ ClearPageUptodate(page);
++ goto out;
++ }
++ SetPageUptodate(page);
++ }
++ } else {
++ rc = ecryptfs_decrypt_page(page);
++ if (rc) {
++ printk(KERN_ERR "%s: Error decrypting page "
++ "at index [%ld]; rc = [%d]\n",
++ __FUNCTION__, page->index, rc);
++ ClearPageUptodate(page);
++ goto out;
++ }
+ SetPageUptodate(page);
++ }
+ }
+-
+ prev_page_end_size = ((loff_t)page->index << PAGE_CACHE_SHIFT);
+-
+- /*
+- * If creating a page or more of holes, zero them out via truncate.
+- * Note, this will increase i_size.
+- */
++ /* If creating a page or more of holes, zero them out via truncate.
++ * Note, this will increase i_size. */
+ if (page->index != 0) {
+ if (prev_page_end_size > i_size_read(page->mapping->host)) {
+ rc = ecryptfs_truncate(file->f_path.dentry,
+ prev_page_end_size);
+ if (rc) {
+- printk(KERN_ERR "Error on attempt to "
++ printk(KERN_ERR "%s: Error on attempt to "
+ "truncate to (higher) offset [%lld];"
+- " rc = [%d]\n", prev_page_end_size, rc);
++ " rc = [%d]\n", __FUNCTION__,
++ prev_page_end_size, rc);
+ goto out;
+ }
+ }
+ }
+- /*
+- * Writing to a new page, and creating a small hole from start of page?
+- * Zero it out.
+- */
+- if ((i_size_read(page->mapping->host) == prev_page_end_size) &&
+- (from != 0)) {
++ /* Writing to a new page, and creating a small hole from start
++ * of page? Zero it out. */
++ if ((i_size_read(page->mapping->host) == prev_page_end_size)
++ && (from != 0))
+ zero_user_page(page, 0, PAGE_CACHE_SIZE, KM_USER0);
+- }
+ out:
+ return rc;
+ }
+diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
+index 80d2f52..dcac591 100644
+--- a/fs/fuse/dir.c
++++ b/fs/fuse/dir.c
+@@ -905,7 +905,7 @@ static int fuse_permission(struct inode *inode, int mask, struct nameidata *nd)
+ }
+
+ if (fc->flags & FUSE_DEFAULT_PERMISSIONS) {
+- int err = generic_permission(inode, mask, NULL);
++ err = generic_permission(inode, mask, NULL);
+
+ /* If permission is denied, try to refresh file
+ attributes. This is also needed, because the root
+diff --git a/fs/isofs/compress.c b/fs/isofs/compress.c
+index 37dbd64..defb932 100644
+--- a/fs/isofs/compress.c
++++ b/fs/isofs/compress.c
+@@ -72,6 +72,17 @@ static int zisofs_readpage(struct file *file, struct page *page)
+ offset = index & ~zisofs_block_page_mask;
+ blockindex = offset >> zisofs_block_page_shift;
+ maxpage = (inode->i_size + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
++
++ /*
++ * If this page is wholly outside i_size we just return zero;
++ * do_generic_file_read() will handle this for us
++ */
++ if (page->index >= maxpage) {
++ SetPageUptodate(page);
++ unlock_page(page);
++ return 0;
++ }
++
+ maxpage = min(zisofs_block_pages, maxpage-offset);
+
+ for ( i = 0 ; i < maxpage ; i++, offset++ ) {
+diff --git a/fs/jbd/recovery.c b/fs/jbd/recovery.c
+index c5d9694..9aaa4fa 100644
+--- a/fs/jbd/recovery.c
++++ b/fs/jbd/recovery.c
+@@ -478,7 +478,7 @@ static int do_one_pass(journal_t *journal,
+ memcpy(nbh->b_data, obh->b_data,
+ journal->j_blocksize);
+ if (flags & JFS_FLAG_ESCAPE) {
+- *((__be32 *)bh->b_data) =
++ *((__be32 *)nbh->b_data) =
+ cpu_to_be32(JFS_MAGIC_NUMBER);
+ }
+
+diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c
+index d0ce627..fa0d4e9 100644
+--- a/fs/jbd2/recovery.c
++++ b/fs/jbd2/recovery.c
+@@ -488,7 +488,7 @@ static int do_one_pass(journal_t *journal,
+ memcpy(nbh->b_data, obh->b_data,
+ journal->j_blocksize);
+ if (flags & JBD2_FLAG_ESCAPE) {
+- *((__be32 *)bh->b_data) =
++ *((__be32 *)nbh->b_data) =
+ cpu_to_be32(JBD2_MAGIC_NUMBER);
+ }
+
+diff --git a/fs/nfsd/nfsfh.c b/fs/nfsd/nfsfh.c
+index 468f17a..429cec2 100644
+--- a/fs/nfsd/nfsfh.c
++++ b/fs/nfsd/nfsfh.c
+@@ -231,6 +231,7 @@ fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, int access)
+ fhp->fh_dentry = dentry;
+ fhp->fh_export = exp;
+ nfsd_nr_verified++;
++ cache_get(&exp->h);
+ } else {
+ /*
+ * just rechecking permissions
+@@ -240,6 +241,7 @@ fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, int access)
+ dprintk("nfsd: fh_verify - just checking\n");
+ dentry = fhp->fh_dentry;
+ exp = fhp->fh_export;
++ cache_get(&exp->h);
+ /*
+ * Set user creds for this exportpoint; necessary even
+ * in the "just checking" case because this may be a
+@@ -251,8 +253,6 @@ fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, int access)
+ if (error)
+ goto out;
+ }
+- cache_get(&exp->h);
+-
+
+ error = nfsd_mode_check(rqstp, dentry->d_inode->i_mode, type);
+ if (error)
+diff --git a/fs/ufs/util.h b/fs/ufs/util.h
+index b26fc4d..23ceed8 100644
+--- a/fs/ufs/util.h
++++ b/fs/ufs/util.h
+@@ -58,7 +58,7 @@ ufs_set_fs_state(struct super_block *sb, struct ufs_super_block_first *usb1,
+ {
+ switch (UFS_SB(sb)->s_flags & UFS_ST_MASK) {
+ case UFS_ST_SUNOS:
+- if (fs32_to_cpu(sb, usb3->fs_postblformat == UFS_42POSTBLFMT)) {
++ if (fs32_to_cpu(sb, usb3->fs_postblformat) == UFS_42POSTBLFMT) {
+ usb1->fs_u0.fs_sun.fs_state = cpu_to_fs32(sb, value);
+ break;
+ }
+diff --git a/include/asm-arm/arch-pxa/pxa-regs.h b/include/asm-arm/arch-pxa/pxa-regs.h
+index 1bd398d..c12c294 100644
+--- a/include/asm-arm/arch-pxa/pxa-regs.h
++++ b/include/asm-arm/arch-pxa/pxa-regs.h
+@@ -1669,6 +1669,7 @@
+ #define SSCR1_RSRE (1 << 20) /* Receive Service Request Enable */
+ #define SSCR1_TINTE (1 << 19) /* Receiver Time-out Interrupt enable */
+ #define SSCR1_PINTE (1 << 18) /* Peripheral Trailing Byte Interupt Enable */
++#define SSCR1_IFS (1 << 16) /* Invert Frame Signal */
+ #define SSCR1_STRF (1 << 15) /* Select FIFO or EFWR */
+ #define SSCR1_EFWR (1 << 14) /* Enable FIFO Write/Read */
+
+diff --git a/include/asm-x86/apic_32.h b/include/asm-x86/apic_32.h
+index be158b2..04fbe7f 100644
+--- a/include/asm-x86/apic_32.h
++++ b/include/asm-x86/apic_32.h
+@@ -109,7 +109,7 @@ extern void setup_boot_APIC_clock (void);
+ extern void setup_secondary_APIC_clock (void);
+ extern int APIC_init_uniprocessor (void);
+
+-extern void enable_NMI_through_LVT0 (void * dummy);
++extern void enable_NMI_through_LVT0(void);
+
+ #define ARCH_APICTIMER_STOPS_ON_C3 1
+
+diff --git a/include/asm-x86/futex_32.h b/include/asm-x86/futex_32.h
+index 438ef0e..80964fd 100644
+--- a/include/asm-x86/futex_32.h
++++ b/include/asm-x86/futex_32.h
+@@ -28,7 +28,7 @@
+ "1: movl %2, %0\n\
+ movl %0, %3\n" \
+ insn "\n" \
+-"2: " LOCK_PREFIX "cmpxchgl %3, %2\n\
++"2: lock ; cmpxchgl %3, %2\n\
+ jnz 1b\n\
+ 3: .section .fixup,\"ax\"\n\
+ 4: mov %5, %1\n\
+@@ -68,7 +68,7 @@ futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
+ #endif
+ switch (op) {
+ case FUTEX_OP_ADD:
+- __futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret,
++ __futex_atomic_op1("lock ; xaddl %0, %2", ret,
+ oldval, uaddr, oparg);
+ break;
+ case FUTEX_OP_OR:
+@@ -111,7 +111,7 @@ futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval, int newval)
+ return -EFAULT;
+
+ __asm__ __volatile__(
+- "1: " LOCK_PREFIX "cmpxchgl %3, %1 \n"
++ "1: lock ; cmpxchgl %3, %1 \n"
+
+ "2: .section .fixup, \"ax\" \n"
+ "3: mov %2, %0 \n"
+diff --git a/include/asm-x86/futex_64.h b/include/asm-x86/futex_64.h
+index 5cdfb08..423c051 100644
+--- a/include/asm-x86/futex_64.h
++++ b/include/asm-x86/futex_64.h
+@@ -27,7 +27,7 @@
+ "1: movl %2, %0\n\
+ movl %0, %3\n" \
+ insn "\n" \
+-"2: " LOCK_PREFIX "cmpxchgl %3, %2\n\
++"2: lock ; cmpxchgl %3, %2\n\
+ jnz 1b\n\
+ 3: .section .fixup,\"ax\"\n\
+ 4: mov %5, %1\n\
+@@ -62,7 +62,7 @@ futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
+ __futex_atomic_op1("xchgl %0, %2", ret, oldval, uaddr, oparg);
+ break;
+ case FUTEX_OP_ADD:
+- __futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret, oldval,
++ __futex_atomic_op1("lock ; xaddl %0, %2", ret, oldval,
+ uaddr, oparg);
+ break;
+ case FUTEX_OP_OR:
+@@ -101,7 +101,7 @@ futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval, int newval)
+ return -EFAULT;
+
+ __asm__ __volatile__(
+- "1: " LOCK_PREFIX "cmpxchgl %3, %1 \n"
++ "1: lock ; cmpxchgl %3, %1 \n"
+
+ "2: .section .fixup, \"ax\" \n"
+ "3: mov %2, %0 \n"
+diff --git a/include/asm-x86/io_apic_64.h b/include/asm-x86/io_apic_64.h
+index e2c1367..1913ad0 100644
+--- a/include/asm-x86/io_apic_64.h
++++ b/include/asm-x86/io_apic_64.h
+@@ -129,7 +129,7 @@ extern int io_apic_set_pci_routing (int ioapic, int pin, int irq, int, int);
+
+ extern int sis_apic_bug; /* dummy */
+
+-void enable_NMI_through_LVT0 (void * dummy);
++void enable_NMI_through_LVT0(void);
+
+ extern spinlock_t i8259A_lock;
+
+diff --git a/include/asm-x86/processor_32.h b/include/asm-x86/processor_32.h
+index 13976b0..787ee2e 100644
+--- a/include/asm-x86/processor_32.h
++++ b/include/asm-x86/processor_32.h
+@@ -712,9 +712,10 @@ static inline unsigned int cpuid_edx(unsigned int op)
+ #define ASM_NOP6 K7_NOP6
+ #define ASM_NOP7 K7_NOP7
+ #define ASM_NOP8 K7_NOP8
+-#elif defined(CONFIG_M686) || defined(CONFIG_MPENTIUMII) || \
++#elif (defined(CONFIG_M686) || defined(CONFIG_MPENTIUMII) || \
+ defined(CONFIG_MPENTIUMIII) || defined(CONFIG_MPENTIUMM) || \
+- defined(CONFIG_MCORE2) || defined(CONFIG_PENTIUM4)
++ defined(CONFIG_MCORE2) || defined(CONFIG_PENTIUM4)) && \
++ !defined(CONFIG_X86_GENERIC)
+ #define ASM_NOP1 P6_NOP1
+ #define ASM_NOP2 P6_NOP2
+ #define ASM_NOP3 P6_NOP3
+diff --git a/include/linux/Kbuild b/include/linux/Kbuild
+index 4b32bb1..f30fa92 100644
+--- a/include/linux/Kbuild
++++ b/include/linux/Kbuild
+@@ -217,7 +217,6 @@ unifdef-y += i2o-dev.h
+ unifdef-y += icmp.h
+ unifdef-y += icmpv6.h
+ unifdef-y += if_addr.h
+-unifdef-y += if_addrlabel.h
+ unifdef-y += if_arp.h
+ unifdef-y += if_bridge.h
+ unifdef-y += if_ec.h
+diff --git a/include/linux/futex.h b/include/linux/futex.h
+index 92d420f..e5f3b84 100644
+--- a/include/linux/futex.h
++++ b/include/linux/futex.h
+@@ -153,6 +153,7 @@ union futex_key {
+ #ifdef CONFIG_FUTEX
+ extern void exit_robust_list(struct task_struct *curr);
+ extern void exit_pi_state_list(struct task_struct *curr);
++extern int futex_cmpxchg_enabled;
+ #else
+ static inline void exit_robust_list(struct task_struct *curr)
+ {
+diff --git a/include/linux/irq.h b/include/linux/irq.h
+index 4669be0..1fc1cb8 100644
+--- a/include/linux/irq.h
++++ b/include/linux/irq.h
+@@ -367,6 +367,9 @@ set_irq_chained_handler(unsigned int irq,
+ __set_irq_handler(irq, handle, 1, NULL);
+ }
+
++extern void set_irq_noprobe(unsigned int irq);
++extern void set_irq_probe(unsigned int irq);
++
+ /* Handle dynamic irq creation and destruction */
+ extern int create_irq(void);
+ extern void destroy_irq(unsigned int irq);
+diff --git a/include/linux/moduleparam.h b/include/linux/moduleparam.h
+index 13410b2..c1d64c2 100644
+--- a/include/linux/moduleparam.h
++++ b/include/linux/moduleparam.h
+@@ -62,6 +62,16 @@ struct kparam_array
+ void *elem;
+ };
+
++/* On alpha, ia64 and ppc64 relocations to global data cannot go into
++ read-only sections (which is part of respective UNIX ABI on these
++ platforms). So 'const' makes no sense and even causes compile failures
++ with some compilers. */
++#if defined(CONFIG_ALPHA) || defined(CONFIG_IA64) || defined(CONFIG_PPC64)
++#define __moduleparam_const
++#else
++#define __moduleparam_const const
++#endif
++
+ /* This is the fundamental function for registering boot/module
+ parameters. perm sets the visibility in sysfs: 000 means it's
+ not there, read bits mean it's readable, write bits mean it's
+@@ -71,7 +81,7 @@ struct kparam_array
+ static int __param_perm_check_##name __attribute__((unused)) = \
+ BUILD_BUG_ON_ZERO((perm) < 0 || (perm) > 0777 || ((perm) & 2)); \
+ static const char __param_str_##name[] = prefix #name; \
+- static struct kernel_param const __param_##name \
++ static struct kernel_param __moduleparam_const __param_##name \
+ __attribute_used__ \
+ __attribute__ ((unused,__section__ ("__param"),aligned(sizeof(void *)))) \
+ = { __param_str_##name, perm, set, get, { arg } }
+diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
+index 70013c5..89cd011 100644
+--- a/include/net/inet_sock.h
++++ b/include/net/inet_sock.h
+@@ -175,7 +175,8 @@ extern void build_ehash_secret(void);
+ static inline unsigned int inet_ehashfn(const __be32 laddr, const __u16 lport,
+ const __be32 faddr, const __be16 fport)
+ {
+- return jhash_2words((__force __u32) laddr ^ (__force __u32) faddr,
++ return jhash_3words((__force __u32) laddr,
++ (__force __u32) faddr,
+ ((__u32) lport) << 16 | (__force __u32)fport,
+ inet_ehash_secret);
+ }
+diff --git a/kernel/futex.c b/kernel/futex.c
+index 55d78b5..d166080 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -60,6 +60,8 @@
+
+ #include "rtmutex_common.h"
+
++int __read_mostly futex_cmpxchg_enabled;
++
+ #define FUTEX_HASHBITS (CONFIG_BASE_SMALL ? 4 : 8)
+
+ /*
+@@ -466,6 +468,8 @@ void exit_pi_state_list(struct task_struct *curr)
+ struct futex_hash_bucket *hb;
+ union futex_key key;
+
++ if (!futex_cmpxchg_enabled)
++ return;
+ /*
+ * We are a ZOMBIE and nobody can enqueue itself on
+ * pi_state_list anymore, but we have to be careful
+@@ -1854,6 +1858,8 @@ asmlinkage long
+ sys_set_robust_list(struct robust_list_head __user *head,
+ size_t len)
+ {
++ if (!futex_cmpxchg_enabled)
++ return -ENOSYS;
+ /*
+ * The kernel knows only one size for now:
+ */
+@@ -1878,6 +1884,9 @@ sys_get_robust_list(int pid, struct robust_list_head __user * __user *head_ptr,
+ struct robust_list_head __user *head;
+ unsigned long ret;
+
++ if (!futex_cmpxchg_enabled)
++ return -ENOSYS;
++
+ if (!pid)
+ head = current->robust_list;
+ else {
+@@ -1980,6 +1989,9 @@ void exit_robust_list(struct task_struct *curr)
+ unsigned long futex_offset;
+ int rc;
+
++ if (!futex_cmpxchg_enabled)
++ return;
++
+ /*
+ * Fetch the list head (which was registered earlier, via
+ * sys_set_robust_list()):
+@@ -2034,7 +2046,7 @@ void exit_robust_list(struct task_struct *curr)
+ long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
+ u32 __user *uaddr2, u32 val2, u32 val3)
+ {
+- int ret;
++ int ret = -ENOSYS;
+ int cmd = op & FUTEX_CMD_MASK;
+ struct rw_semaphore *fshared = NULL;
+
+@@ -2062,13 +2074,16 @@ long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
+ ret = futex_wake_op(uaddr, fshared, uaddr2, val, val2, val3);
+ break;
+ case FUTEX_LOCK_PI:
+- ret = futex_lock_pi(uaddr, fshared, val, timeout, 0);
++ if (futex_cmpxchg_enabled)
++ ret = futex_lock_pi(uaddr, fshared, val, timeout, 0);
+ break;
+ case FUTEX_UNLOCK_PI:
+- ret = futex_unlock_pi(uaddr, fshared);
++ if (futex_cmpxchg_enabled)
++ ret = futex_unlock_pi(uaddr, fshared);
+ break;
+ case FUTEX_TRYLOCK_PI:
+- ret = futex_lock_pi(uaddr, fshared, 0, timeout, 1);
++ if (futex_cmpxchg_enabled)
++ ret = futex_lock_pi(uaddr, fshared, 0, timeout, 1);
+ break;
+ default:
+ ret = -ENOSYS;
+@@ -2123,8 +2138,29 @@ static struct file_system_type futex_fs_type = {
+
+ static int __init init(void)
+ {
+- int i = register_filesystem(&futex_fs_type);
++ u32 curval;
++ int i;
++
++ /*
++ * This will fail and we want it. Some arch implementations do
++ * runtime detection of the futex_atomic_cmpxchg_inatomic()
++ * functionality. We want to know that before we call in any
++ * of the complex code paths. Also we want to prevent
++ * registration of robust lists in that case. NULL is
++ * guaranteed to fault and we get -EFAULT on functional
++ * implementation, the non functional ones will return
++ * -ENOSYS.
++ */
++ curval = cmpxchg_futex_value_locked(NULL, 0, 0);
++ if (curval == -EFAULT)
++ futex_cmpxchg_enabled = 1;
+
++ for (i = 0; i < ARRAY_SIZE(futex_queues); i++) {
++ plist_head_init(&futex_queues[i].chain, &futex_queues[i].lock);
++ spin_lock_init(&futex_queues[i].lock);
++ }
++
++ i = register_filesystem(&futex_fs_type);
+ if (i)
+ return i;
+
+@@ -2134,10 +2170,6 @@ static int __init init(void)
+ return PTR_ERR(futex_mnt);
+ }
+
+- for (i = 0; i < ARRAY_SIZE(futex_queues); i++) {
+- plist_head_init(&futex_queues[i].chain, &futex_queues[i].lock);
+- spin_lock_init(&futex_queues[i].lock);
+- }
+ return 0;
+ }
+ __initcall(init);
+diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c
+index 8682c79..d95f79b 100644
+--- a/kernel/futex_compat.c
++++ b/kernel/futex_compat.c
+@@ -54,6 +54,9 @@ void compat_exit_robust_list(struct task_struct *curr)
+ compat_long_t futex_offset;
+ int rc;
+
++ if (!futex_cmpxchg_enabled)
++ return;
++
+ /*
+ * Fetch the list head (which was registered earlier, via
+ * sys_set_robust_list()):
+@@ -115,6 +118,9 @@ asmlinkage long
+ compat_sys_set_robust_list(struct compat_robust_list_head __user *head,
+ compat_size_t len)
+ {
++ if (!futex_cmpxchg_enabled)
++ return -ENOSYS;
++
+ if (unlikely(len != sizeof(*head)))
+ return -EINVAL;
+
+@@ -130,6 +136,9 @@ compat_sys_get_robust_list(int pid, compat_uptr_t __user *head_ptr,
+ struct compat_robust_list_head __user *head;
+ unsigned long ret;
+
++ if (!futex_cmpxchg_enabled)
++ return -ENOSYS;
++
+ if (!pid)
+ head = current->compat_robust_list;
+ else {
+diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
+index 465c69c..e4e1c99 100644
+--- a/kernel/irq/chip.c
++++ b/kernel/irq/chip.c
+@@ -607,3 +607,39 @@ set_irq_chip_and_handler_name(unsigned int irq, struct irq_chip *chip,
+ set_irq_chip(irq, chip);
+ __set_irq_handler(irq, handle, 0, name);
+ }
++
++void __init set_irq_noprobe(unsigned int irq)
++{
++ struct irq_desc *desc;
++ unsigned long flags;
++
++ if (irq >= NR_IRQS) {
++ printk(KERN_ERR "Trying to mark IRQ%d non-probeable\n", irq);
++
++ return;
++ }
++
++ desc = irq_desc + irq;
++
++ spin_lock_irqsave(&desc->lock, flags);
++ desc->status |= IRQ_NOPROBE;
++ spin_unlock_irqrestore(&desc->lock, flags);
++}
++
++void __init set_irq_probe(unsigned int irq)
++{
++ struct irq_desc *desc;
++ unsigned long flags;
++
++ if (irq >= NR_IRQS) {
++ printk(KERN_ERR "Trying to mark IRQ%d probeable\n", irq);
++
++ return;
++ }
++
++ desc = irq_desc + irq;
++
++ spin_lock_irqsave(&desc->lock, flags);
++ desc->status &= ~IRQ_NOPROBE;
++ spin_unlock_irqrestore(&desc->lock, flags);
++}
+diff --git a/kernel/relay.c b/kernel/relay.c
+index 7c03733..889102a 100644
+--- a/kernel/relay.c
++++ b/kernel/relay.c
+@@ -1072,7 +1072,7 @@ static int subbuf_splice_actor(struct file *in,
+ unsigned int flags,
+ int *nonpad_ret)
+ {
+- unsigned int pidx, poff, total_len, subbuf_pages, ret;
++ unsigned int pidx, poff, total_len, subbuf_pages, nr_pages, ret;
+ struct rchan_buf *rbuf = in->private_data;
+ unsigned int subbuf_size = rbuf->chan->subbuf_size;
+ uint64_t pos = (uint64_t) *ppos;
+@@ -1103,8 +1103,9 @@ static int subbuf_splice_actor(struct file *in,
+ subbuf_pages = rbuf->chan->alloc_size >> PAGE_SHIFT;
+ pidx = (read_start / PAGE_SIZE) % subbuf_pages;
+ poff = read_start & ~PAGE_MASK;
++ nr_pages = min_t(unsigned int, subbuf_pages, PIPE_BUFFERS);
+
+- for (total_len = 0; spd.nr_pages < subbuf_pages; spd.nr_pages++) {
++ for (total_len = 0; spd.nr_pages < nr_pages; spd.nr_pages++) {
+ unsigned int this_len, this_end, private;
+ unsigned int cur_pos = read_start + total_len;
+
+diff --git a/kernel/sched.c b/kernel/sched.c
+index e76b11c..5ba5db9 100644
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -4028,11 +4028,10 @@ void rt_mutex_setprio(struct task_struct *p, int prio)
+ oldprio = p->prio;
+ on_rq = p->se.on_rq;
+ running = task_current(rq, p);
+- if (on_rq) {
++ if (on_rq)
+ dequeue_task(rq, p, 0);
+- if (running)
+- p->sched_class->put_prev_task(rq, p);
+- }
++ if (running)
++ p->sched_class->put_prev_task(rq, p);
+
+ if (rt_prio(prio))
+ p->sched_class = &rt_sched_class;
+@@ -4041,9 +4040,9 @@ void rt_mutex_setprio(struct task_struct *p, int prio)
+
+ p->prio = prio;
+
++ if (running)
++ p->sched_class->set_curr_task(rq);
+ if (on_rq) {
+- if (running)
+- p->sched_class->set_curr_task(rq);
+ enqueue_task(rq, p, 0);
+ /*
+ * Reschedule if we are currently running on this runqueue and
+@@ -4339,18 +4338,17 @@ recheck:
+ update_rq_clock(rq);
+ on_rq = p->se.on_rq;
+ running = task_current(rq, p);
+- if (on_rq) {
++ if (on_rq)
+ deactivate_task(rq, p, 0);
+- if (running)
+- p->sched_class->put_prev_task(rq, p);
+- }
++ if (running)
++ p->sched_class->put_prev_task(rq, p);
+
+ oldprio = p->prio;
+ __setscheduler(rq, p, policy, param->sched_priority);
+
++ if (running)
++ p->sched_class->set_curr_task(rq);
+ if (on_rq) {
+- if (running)
+- p->sched_class->set_curr_task(rq);
+ activate_task(rq, p, 0);
+ /*
+ * Reschedule if we are currently running on this runqueue and
+@@ -7110,19 +7108,17 @@ void sched_move_task(struct task_struct *tsk)
+ running = task_current(rq, tsk);
+ on_rq = tsk->se.on_rq;
+
+- if (on_rq) {
++ if (on_rq)
+ dequeue_task(rq, tsk, 0);
+- if (unlikely(running))
+- tsk->sched_class->put_prev_task(rq, tsk);
+- }
++ if (unlikely(running))
++ tsk->sched_class->put_prev_task(rq, tsk);
+
+ set_task_cfs_rq(tsk, task_cpu(tsk));
+
+- if (on_rq) {
+- if (unlikely(running))
+- tsk->sched_class->set_curr_task(rq);
++ if (unlikely(running))
++ tsk->sched_class->set_curr_task(rq);
++ if (on_rq)
+ enqueue_task(rq, tsk, 0);
+- }
+
+ done:
+ task_rq_unlock(rq, &flags);
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index e3e0ee3..397ff8c 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -306,7 +306,7 @@ static struct ctl_table kern_table[] = {
+ .procname = "sched_nr_migrate",
+ .data = &sysctl_sched_nr_migrate,
+ .maxlen = sizeof(unsigned int),
+- .mode = 644,
++ .mode = 0644,
+ .proc_handler = &proc_dointvec,
+ },
+ #endif
+diff --git a/mm/filemap.c b/mm/filemap.c
+index 69430d2..76b036f 100644
+--- a/mm/filemap.c
++++ b/mm/filemap.c
+@@ -1725,21 +1725,27 @@ size_t iov_iter_copy_from_user(struct page *page,
+ }
+ EXPORT_SYMBOL(iov_iter_copy_from_user);
+
+-static void __iov_iter_advance_iov(struct iov_iter *i, size_t bytes)
++void iov_iter_advance(struct iov_iter *i, size_t bytes)
+ {
++ BUG_ON(i->count < bytes);
++
+ if (likely(i->nr_segs == 1)) {
+ i->iov_offset += bytes;
++ i->count -= bytes;
+ } else {
+ const struct iovec *iov = i->iov;
+ size_t base = i->iov_offset;
+
+ /*
+ * The !iov->iov_len check ensures we skip over unlikely
+- * zero-length segments.
++ * zero-length segments (without overruning the iovec).
+ */
+- while (bytes || !iov->iov_len) {
+- int copy = min(bytes, iov->iov_len - base);
++ while (bytes || unlikely(!iov->iov_len && i->count)) {
++ int copy;
+
++ copy = min(bytes, iov->iov_len - base);
++ BUG_ON(!i->count || i->count < copy);
++ i->count -= copy;
+ bytes -= copy;
+ base += copy;
+ if (iov->iov_len == base) {
+@@ -1751,14 +1757,6 @@ static void __iov_iter_advance_iov(struct iov_iter *i, size_t bytes)
+ i->iov_offset = base;
+ }
+ }
+-
+-void iov_iter_advance(struct iov_iter *i, size_t bytes)
+-{
+- BUG_ON(i->count < bytes);
+-
+- __iov_iter_advance_iov(i, bytes);
+- i->count -= bytes;
+-}
+ EXPORT_SYMBOL(iov_iter_advance);
+
+ /*
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 9c746cb..d95ce35 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -119,6 +119,7 @@ static void free_huge_page(struct page *page)
+ struct address_space *mapping;
+
+ mapping = (struct address_space *) page_private(page);
++ set_page_private(page, 0);
+ BUG_ON(page_count(page));
+ INIT_LIST_HEAD(&page->lru);
+
+@@ -133,7 +134,6 @@ static void free_huge_page(struct page *page)
+ spin_unlock(&hugetlb_lock);
+ if (mapping)
+ hugetlb_put_quota(mapping, 1);
+- set_page_private(page, 0);
+ }
+
+ /*
+diff --git a/mm/slab.c b/mm/slab.c
+index ff31261..79c3be0 100644
+--- a/mm/slab.c
++++ b/mm/slab.c
+@@ -2961,11 +2961,10 @@ static void *cache_alloc_refill(struct kmem_cache *cachep, gfp_t flags)
+ struct array_cache *ac;
+ int node;
+
+- node = numa_node_id();
+-
++retry:
+ check_irq_off();
++ node = numa_node_id();
+ ac = cpu_cache_get(cachep);
+-retry:
+ batchcount = ac->batchcount;
+ if (!ac->touched && batchcount > BATCHREFILL_LIMIT) {
+ /*
+diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
+index 2726adc..e13cf5e 100644
+--- a/net/bluetooth/hci_sysfs.c
++++ b/net/bluetooth/hci_sysfs.c
+@@ -282,6 +282,7 @@ static void add_conn(struct work_struct *work)
+ int i;
+
+ flush_workqueue(btdelconn);
++
+ if (device_add(&conn->dev) < 0) {
+ BT_ERR("Failed to register connection device");
+ return;
+@@ -317,7 +318,6 @@ void hci_conn_add_sysfs(struct hci_conn *conn)
+ INIT_WORK(&conn->work, add_conn);
+
+ queue_work(btaddconn, &conn->work);
+- schedule_work(&conn->work);
+ }
+
+ static int __match_tty(struct device *dev, void *data)
+@@ -354,7 +354,6 @@ void hci_conn_del_sysfs(struct hci_conn *conn)
+ INIT_WORK(&conn->work, del_conn);
+
+ queue_work(btdelconn, &conn->work);
+- schedule_work(&conn->work);
+ }
+
+ int hci_register_sysfs(struct hci_dev *hdev)
+@@ -408,6 +407,7 @@ int __init bt_sysfs_init(void)
+ err = -ENOMEM;
+ goto out;
+ }
++
+ btdelconn = create_singlethread_workqueue("btdelconn");
+ if (!btdelconn) {
+ err = -ENOMEM;
+@@ -447,8 +447,12 @@ out:
+ void bt_sysfs_cleanup(void)
+ {
+ destroy_workqueue(btaddconn);
++
+ destroy_workqueue(btdelconn);
++
+ class_destroy(bt_class);
++
+ bus_unregister(&bt_bus);
++
+ platform_device_unregister(bt_platform);
+ }
+diff --git a/net/bridge/netfilter/ebt_dnat.c b/net/bridge/netfilter/ebt_dnat.c
+index 74262e9..1024511 100644
+--- a/net/bridge/netfilter/ebt_dnat.c
++++ b/net/bridge/netfilter/ebt_dnat.c
+@@ -20,8 +20,8 @@ static int ebt_target_dnat(struct sk_buff *skb, unsigned int hooknr,
+ {
+ struct ebt_nat_info *info = (struct ebt_nat_info *)data;
+
+- if (skb_make_writable(skb, 0))
+- return NF_DROP;
++ if (!skb_make_writable(skb, 0))
++ return EBT_DROP;
+
+ memcpy(eth_hdr(skb)->h_dest, info->mac, ETH_ALEN);
+ return info->target;
+diff --git a/net/bridge/netfilter/ebt_redirect.c b/net/bridge/netfilter/ebt_redirect.c
+index 422cb83..88afc34 100644
+--- a/net/bridge/netfilter/ebt_redirect.c
++++ b/net/bridge/netfilter/ebt_redirect.c
+@@ -21,8 +21,8 @@ static int ebt_target_redirect(struct sk_buff *skb, unsigned int hooknr,
+ {
+ struct ebt_redirect_info *info = (struct ebt_redirect_info *)data;
+
+- if (skb_make_writable(skb, 0))
+- return NF_DROP;
++ if (!skb_make_writable(skb, 0))
++ return EBT_DROP;
+
+ if (hooknr != NF_BR_BROUTING)
+ memcpy(eth_hdr(skb)->h_dest,
+diff --git a/net/bridge/netfilter/ebt_snat.c b/net/bridge/netfilter/ebt_snat.c
+index 425ac92..4c5a5a9 100644
+--- a/net/bridge/netfilter/ebt_snat.c
++++ b/net/bridge/netfilter/ebt_snat.c
+@@ -22,8 +22,8 @@ static int ebt_target_snat(struct sk_buff *skb, unsigned int hooknr,
+ {
+ struct ebt_nat_info *info = (struct ebt_nat_info *) data;
+
+- if (skb_make_writable(skb, 0))
+- return NF_DROP;
++ if (!skb_make_writable(skb, 0))
++ return EBT_DROP;
+
+ memcpy(eth_hdr(skb)->h_source, info->mac, ETH_ALEN);
+ if (!(info->target & NAT_ARP_BIT) &&
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 0879f52..4d44372 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -1068,8 +1068,6 @@ int dev_close(struct net_device *dev)
+ */
+ call_netdevice_notifiers(NETDEV_GOING_DOWN, dev);
+
+- dev_deactivate(dev);
+-
+ clear_bit(__LINK_STATE_START, &dev->state);
+
+ /* Synchronize to scheduled poll. We cannot touch poll list,
+@@ -1080,6 +1078,8 @@ int dev_close(struct net_device *dev)
+ */
+ smp_mb__after_clear_bit(); /* Commit netif_running(). */
+
++ dev_deactivate(dev);
++
+ /*
+ * Call the device specific close. This cannot fail.
+ * Only if device is UP
+@@ -2906,7 +2906,7 @@ int __dev_addr_add(struct dev_addr_list **list, int *count,
+ }
+ }
+
+- da = kmalloc(sizeof(*da), GFP_ATOMIC);
++ da = kzalloc(sizeof(*da), GFP_ATOMIC);
+ if (da == NULL)
+ return -ENOMEM;
+ memcpy(da->da_addr, addr, alen);
+diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
+index 82817e5..7794e17 100644
+--- a/net/ipv4/ip_sockglue.c
++++ b/net/ipv4/ip_sockglue.c
+@@ -514,11 +514,6 @@ static int do_ip_setsockopt(struct sock *sk, int level,
+ val &= ~3;
+ val |= inet->tos & 3;
+ }
+- if (IPTOS_PREC(val) >= IPTOS_PREC_CRITIC_ECP &&
+- !capable(CAP_NET_ADMIN)) {
+- err = -EPERM;
+- break;
+- }
+ if (inet->tos != val) {
+ inet->tos = val;
+ sk->sk_priority = rt_tos2priority(val);
+diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
+index 80cab8c..b284b4e 100644
+--- a/net/ipv4/ipcomp.c
++++ b/net/ipv4/ipcomp.c
+@@ -108,8 +108,11 @@ static int ipcomp_compress(struct xfrm_state *x, struct sk_buff *skb)
+ const int cpu = get_cpu();
+ u8 *scratch = *per_cpu_ptr(ipcomp_scratches, cpu);
+ struct crypto_comp *tfm = *per_cpu_ptr(ipcd->tfms, cpu);
+- int err = crypto_comp_compress(tfm, start, plen, scratch, &dlen);
++ int err;
+
++ local_bh_disable();
++ err = crypto_comp_compress(tfm, start, plen, scratch, &dlen);
++ local_bh_enable();
+ if (err)
+ goto out;
+
+diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
+index b8f7763..15dc11e 100644
+--- a/net/ipv4/ipconfig.c
++++ b/net/ipv4/ipconfig.c
+@@ -739,9 +739,9 @@ static void __init ic_bootp_send_if(struct ic_device *d, unsigned long jiffies_d
+ printk("Unknown ARP type 0x%04x for device %s\n", dev->type, dev->name);
+ b->htype = dev->type; /* can cause undefined behavior */
+ }
++
++ /* server_ip and your_ip address are both already zero per RFC2131 */
+ b->hlen = dev->addr_len;
+- b->your_ip = NONE;
+- b->server_ip = NONE;
+ memcpy(b->hw_addr, dev->dev_addr, dev->addr_len);
+ b->secs = htons(jiffies_diff / HZ);
+ b->xid = d->xid;
+diff --git a/net/ipv4/netfilter/arpt_mangle.c b/net/ipv4/netfilter/arpt_mangle.c
+index 45fa4e2..3f4222b 100644
+--- a/net/ipv4/netfilter/arpt_mangle.c
++++ b/net/ipv4/netfilter/arpt_mangle.c
+@@ -19,7 +19,7 @@ target(struct sk_buff *skb,
+ unsigned char *arpptr;
+ int pln, hln;
+
+- if (skb_make_writable(skb, skb->len))
++ if (!skb_make_writable(skb, skb->len))
+ return NF_DROP;
+
+ arp = arp_hdr(skb);
+diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
+index 14d64a3..16d0fb3 100644
+--- a/net/ipv4/netfilter/ip_queue.c
++++ b/net/ipv4/netfilter/ip_queue.c
+@@ -336,8 +336,8 @@ static int
+ ipq_mangle_ipv4(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
+ {
+ int diff;
+- int err;
+ struct iphdr *user_iph = (struct iphdr *)v->payload;
++ struct sk_buff *nskb;
+
+ if (v->data_len < sizeof(*user_iph))
+ return 0;
+@@ -349,14 +349,16 @@ ipq_mangle_ipv4(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
+ if (v->data_len > 0xFFFF)
+ return -EINVAL;
+ if (diff > skb_tailroom(e->skb)) {
+- err = pskb_expand_head(e->skb, 0,
++ nskb = skb_copy_expand(e->skb, 0,
+ diff - skb_tailroom(e->skb),
+ GFP_ATOMIC);
+- if (err) {
++ if (!nskb) {
+ printk(KERN_WARNING "ip_queue: error "
+- "in mangle, dropping packet: %d\n", -err);
+- return err;
++ "in mangle, dropping packet\n");
++ return -ENOMEM;
+ }
++ kfree_skb(e->skb);
++ e->skb = nskb;
+ }
+ skb_put(e->skb, diff);
+ }
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 2f59baa..5b4095b 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -593,7 +593,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
+ * or if the skb it not generated by a local socket. (This last
+ * check should be redundant, but it's free.)
+ */
+- if (!np || np->pmtudisc >= IPV6_PMTUDISC_DO) {
++ if (!skb->local_df) {
+ skb->dev = skb->dst->dev;
+ icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
+ IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_FRAGFAILS);
+@@ -1389,6 +1389,10 @@ int ip6_push_pending_frames(struct sock *sk)
+ tmp_skb->sk = NULL;
+ }
+
++ /* Allow local fragmentation. */
++ if (np->pmtudisc < IPV6_PMTUDISC_DO)
++ skb->local_df = 1;
++
+ ipv6_addr_copy(final_dst, &fl->fl6_dst);
+ __skb_pull(skb, skb_network_header_len(skb));
+ if (opt && opt->opt_flen)
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index 5383b33..81941a1 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -550,6 +550,7 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
+ ip_rt_put(rt);
+ goto out;
+ }
++ skb2->dst = (struct dst_entry *)rt;
+ } else {
+ ip_rt_put(rt);
+ if (ip_route_input(skb2, eiph->daddr, eiph->saddr, eiph->tos,
+diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
+index 1c5b09f..f46c38f 100644
+--- a/net/ipv6/ipcomp6.c
++++ b/net/ipv6/ipcomp6.c
+@@ -146,7 +146,9 @@ static int ipcomp6_output(struct xfrm_state *x, struct sk_buff *skb)
+ scratch = *per_cpu_ptr(ipcomp6_scratches, cpu);
+ tfm = *per_cpu_ptr(ipcd->tfms, cpu);
+
++ local_bh_disable();
+ err = crypto_comp_compress(tfm, start, plen, scratch, &dlen);
++ local_bh_enable();
+ if (err || (dlen + sizeof(*ipch)) >= plen) {
+ put_cpu();
+ goto out_ok;
+diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
+index e273605..710a04f 100644
+--- a/net/ipv6/netfilter/ip6_queue.c
++++ b/net/ipv6/netfilter/ip6_queue.c
+@@ -333,8 +333,8 @@ static int
+ ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
+ {
+ int diff;
+- int err;
+ struct ipv6hdr *user_iph = (struct ipv6hdr *)v->payload;
++ struct sk_buff *nskb;
+
+ if (v->data_len < sizeof(*user_iph))
+ return 0;
+@@ -346,14 +346,16 @@ ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
+ if (v->data_len > 0xFFFF)
+ return -EINVAL;
+ if (diff > skb_tailroom(e->skb)) {
+- err = pskb_expand_head(e->skb, 0,
++ nskb = skb_copy_expand(e->skb, 0,
+ diff - skb_tailroom(e->skb),
+ GFP_ATOMIC);
+- if (err) {
++ if (!nskb) {
+ printk(KERN_WARNING "ip6_queue: OOM "
+ "in mangle, dropping packet\n");
+- return err;
++ return -ENOMEM;
+ }
++ kfree_skb(e->skb);
++ e->skb = nskb;
+ }
+ skb_put(e->skb, diff);
+ }
+diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
+index 6569767..dc22909 100644
+--- a/net/ipv6/xfrm6_output.c
++++ b/net/ipv6/xfrm6_output.c
+@@ -34,7 +34,7 @@ static int xfrm6_tunnel_check_size(struct sk_buff *skb)
+ if (mtu < IPV6_MIN_MTU)
+ mtu = IPV6_MIN_MTU;
+
+- if (skb->len > mtu) {
++ if (!skb->local_df && skb->len > mtu) {
+ skb->dev = dst->dev;
+ icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
+ ret = -EMSGSIZE;
+diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
+index 2c7bd2e..dc43df1 100644
+--- a/net/netfilter/nfnetlink_log.c
++++ b/net/netfilter/nfnetlink_log.c
+@@ -594,7 +594,7 @@ nfulnl_log_packet(unsigned int pf,
+ /* FIXME: do we want to make the size calculation conditional based on
+ * what is actually present? way more branches and checks, but more
+ * memory efficient... */
+- size = NLMSG_ALIGN(sizeof(struct nfgenmsg))
++ size = NLMSG_SPACE(sizeof(struct nfgenmsg))
+ + nla_total_size(sizeof(struct nfulnl_msg_packet_hdr))
+ + nla_total_size(sizeof(u_int32_t)) /* ifindex */
+ + nla_total_size(sizeof(u_int32_t)) /* ifindex */
+diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
+index 3ceeffc..7c3646c 100644
+--- a/net/netfilter/nfnetlink_queue.c
++++ b/net/netfilter/nfnetlink_queue.c
+@@ -353,7 +353,7 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
+
+ QDEBUG("entered\n");
+
+- size = NLMSG_ALIGN(sizeof(struct nfgenmsg))
++ size = NLMSG_SPACE(sizeof(struct nfgenmsg))
+ + nla_total_size(sizeof(struct nfqnl_msg_packet_hdr))
+ + nla_total_size(sizeof(u_int32_t)) /* ifindex */
+ + nla_total_size(sizeof(u_int32_t)) /* ifindex */
+@@ -616,8 +616,8 @@ err_out_put:
+ static int
+ nfqnl_mangle(void *data, int data_len, struct nfqnl_queue_entry *e)
+ {
++ struct sk_buff *nskb;
+ int diff;
+- int err;
+
+ diff = data_len - e->skb->len;
+ if (diff < 0) {
+@@ -627,14 +627,16 @@ nfqnl_mangle(void *data, int data_len, struct nfqnl_queue_entry *e)
+ if (data_len > 0xFFFF)
+ return -EINVAL;
+ if (diff > skb_tailroom(e->skb)) {
+- err = pskb_expand_head(e->skb, 0,
++ nskb = skb_copy_expand(e->skb, 0,
+ diff - skb_tailroom(e->skb),
+ GFP_ATOMIC);
+- if (err) {
++ if (!nskb) {
+ printk(KERN_WARNING "nf_queue: OOM "
+ "in mangle, dropping packet\n");
+- return err;
++ return -ENOMEM;
+ }
++ kfree_skb(e->skb);
++ e->skb = nskb;
+ }
+ skb_put(e->skb, diff);
+ }
+diff --git a/net/netfilter/xt_time.c b/net/netfilter/xt_time.c
+index f9c55dc..5222a97 100644
+--- a/net/netfilter/xt_time.c
++++ b/net/netfilter/xt_time.c
+@@ -95,8 +95,11 @@ static inline void localtime_2(struct xtm *r, time_t time)
+ */
+ r->dse = time / 86400;
+
+- /* 1970-01-01 (w=0) was a Thursday (4). */
+- r->weekday = (4 + r->dse) % 7;
++ /*
++ * 1970-01-01 (w=0) was a Thursday (4).
++ * -1 and +1 map Sunday properly onto 7.
++ */
++ r->weekday = (4 + r->dse - 1) % 7 + 1;
+ }
+
+ static void localtime_3(struct xtm *r, time_t time)
+diff --git a/security/commoncap.c b/security/commoncap.c
+index ea61bc7..e87422e 100644
+--- a/security/commoncap.c
++++ b/security/commoncap.c
+@@ -539,7 +539,7 @@ int cap_task_kill(struct task_struct *p, struct siginfo *info,
+ * allowed.
+ * We must preserve legacy signal behavior in this case.
+ */
+- if (p->euid == 0 && p->uid == current->uid)
++ if (p->uid == current->uid)
+ return 0;
+
+ /* sigcont is permitted within same session */
Modified: dists/sid/linux-2.6/debian/patches/series/5
==============================================================================
--- dists/sid/linux-2.6/debian/patches/series/5 (original)
+++ dists/sid/linux-2.6/debian/patches/series/5 Mon Mar 24 21:19:33 2008
@@ -1,3 +1,2 @@
+ bugfix/all/stable/2.6.24.3.patch
-+ bugfix/all/stable/2.6.24.3-fix1.patch
-+ bugfix/net-mcast-zero-addr-list.patch
++ bugfix/all/stable/2.6.24.4.patch
More information about the Kernel-svn-changes
mailing list