ia64/xen-unstable

changeset 5734:60fc40a82fa9

Remove 2.6.11 patches directory.
author kaf24@firebug.cl.cam.ac.uk
date Mon Jul 11 15:35:33 2005 +0000 (2005-07-11)
parents ece694762d7a
children de2e58cdec37
files
line diff
     1.1 --- a/patches/linux-2.6.11/agpgart.patch	Mon Jul 11 15:12:37 2005 +0000
     1.2 +++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
     1.3 @@ -1,437 +0,0 @@
     1.4 ---- linux-2.6.11/drivers/char/agp/agp.h	2005-03-02 07:38:07 +00:00
     1.5 -+++ linux-2.6.11-agp/drivers/char/agp/agp.h	2005-03-22 11:14:02 +00:00
     1.6 -@@ -272,6 +272,8 @@
     1.7 - #define AGP_GENERIC_SIZES_ENTRIES 11
     1.8 - extern struct aper_size_info_16 agp3_generic_sizes[];
     1.9 - 
    1.10 -+#define virt_to_gart(x) (phys_to_gart(virt_to_phys(x)))
    1.11 -+#define gart_to_virt(x) (phys_to_virt(gart_to_phys(x)))
    1.12 - 
    1.13 - extern int agp_off;
    1.14 - extern int agp_try_unsupported_boot;
    1.15 ---- linux-2.6.11/drivers/char/agp/ali-agp.c	2005-03-02 07:38:13 +00:00
    1.16 -+++ linux-2.6.11-agp/drivers/char/agp/ali-agp.c	2005-03-22 11:14:56 +00:00
    1.17 -@@ -150,7 +150,7 @@
    1.18 - 	pci_read_config_dword(agp_bridge->dev, ALI_CACHE_FLUSH_CTRL, &temp);
    1.19 - 	pci_write_config_dword(agp_bridge->dev, ALI_CACHE_FLUSH_CTRL,
    1.20 - 			(((temp & ALI_CACHE_FLUSH_ADDR_MASK) |
    1.21 --			  virt_to_phys(addr)) | ALI_CACHE_FLUSH_EN ));
    1.22 -+			  virt_to_gart(addr)) | ALI_CACHE_FLUSH_EN ));
    1.23 - 	return addr;
    1.24 - }
    1.25 - 
    1.26 -@@ -174,7 +174,7 @@
    1.27 - 	pci_read_config_dword(agp_bridge->dev, ALI_CACHE_FLUSH_CTRL, &temp);
    1.28 - 	pci_write_config_dword(agp_bridge->dev, ALI_CACHE_FLUSH_CTRL,
    1.29 - 			(((temp & ALI_CACHE_FLUSH_ADDR_MASK) |
    1.30 --			  virt_to_phys(addr)) | ALI_CACHE_FLUSH_EN));
    1.31 -+			  virt_to_gart(addr)) | ALI_CACHE_FLUSH_EN));
    1.32 - 	agp_generic_destroy_page(addr);
    1.33 - }
    1.34 - 
    1.35 ---- linux-2.6.11/drivers/char/agp/amd-k7-agp.c	2005-03-02 07:38:33 +00:00
    1.36 -+++ linux-2.6.11-agp/drivers/char/agp/amd-k7-agp.c	2005-03-22 11:14:56 +00:00
    1.37 -@@ -43,7 +43,7 @@
    1.38 - 
    1.39 - 	SetPageReserved(virt_to_page(page_map->real));
    1.40 - 	global_cache_flush();
    1.41 --	page_map->remapped = ioremap_nocache(virt_to_phys(page_map->real),
    1.42 -+	page_map->remapped = ioremap_nocache(virt_to_gart(page_map->real),
    1.43 - 					    PAGE_SIZE);
    1.44 - 	if (page_map->remapped == NULL) {
    1.45 - 		ClearPageReserved(virt_to_page(page_map->real));
    1.46 -@@ -154,7 +154,7 @@
    1.47 - 
    1.48 - 	agp_bridge->gatt_table_real = (u32 *)page_dir.real;
    1.49 - 	agp_bridge->gatt_table = (u32 __iomem *)page_dir.remapped;
    1.50 --	agp_bridge->gatt_bus_addr = virt_to_phys(page_dir.real);
    1.51 -+	agp_bridge->gatt_bus_addr = virt_to_gart(page_dir.real);
    1.52 - 
    1.53 - 	/* Get the address for the gart region.
    1.54 - 	 * This is a bus address even on the alpha, b/c its
    1.55 -@@ -167,7 +167,7 @@
    1.56 - 
    1.57 - 	/* Calculate the agp offset */
    1.58 - 	for (i = 0; i < value->num_entries / 1024; i++, addr += 0x00400000) {
    1.59 --		writel(virt_to_phys(amd_irongate_private.gatt_pages[i]->real) | 1,
    1.60 -+		writel(virt_to_gart(amd_irongate_private.gatt_pages[i]->real) | 1,
    1.61 - 			page_dir.remapped+GET_PAGE_DIR_OFF(addr));
    1.62 - 		readl(page_dir.remapped+GET_PAGE_DIR_OFF(addr));	/* PCI Posting. */
    1.63 - 	}
    1.64 ---- linux-2.6.11/drivers/char/agp/amd64-agp.c	2005-03-02 07:38:13 +00:00
    1.65 -+++ linux-2.6.11-agp/drivers/char/agp/amd64-agp.c	2005-03-22 11:14:56 +00:00
    1.66 -@@ -218,7 +218,7 @@
    1.67 - 
    1.68 - static int amd_8151_configure(void)
    1.69 - {
    1.70 --	unsigned long gatt_bus = virt_to_phys(agp_bridge->gatt_table_real);
    1.71 -+	unsigned long gatt_bus = virt_to_gart(agp_bridge->gatt_table_real);
    1.72 - 
    1.73 - 	/* Configure AGP regs in each x86-64 host bridge. */
    1.74 - 	for_each_nb() {
    1.75 -@@ -590,7 +590,7 @@
    1.76 - {
    1.77 - 	struct agp_bridge_data *bridge = pci_get_drvdata(pdev);
    1.78 - 
    1.79 --	release_mem_region(virt_to_phys(bridge->gatt_table_real),
    1.80 -+	release_mem_region(virt_to_gart(bridge->gatt_table_real),
    1.81 - 			   amd64_aperture_sizes[bridge->aperture_size_idx].size);
    1.82 - 	agp_remove_bridge(bridge);
    1.83 - 	agp_put_bridge(bridge);
    1.84 ---- linux-2.6.11/drivers/char/agp/ati-agp.c	2005-03-02 07:38:13 +00:00
    1.85 -+++ linux-2.6.11-agp/drivers/char/agp/ati-agp.c	2005-03-22 11:14:56 +00:00
    1.86 -@@ -61,7 +61,7 @@
    1.87 - 
    1.88 - 	SetPageReserved(virt_to_page(page_map->real));
    1.89 - 	err = map_page_into_agp(virt_to_page(page_map->real));
    1.90 --	page_map->remapped = ioremap_nocache(virt_to_phys(page_map->real),
    1.91 -+	page_map->remapped = ioremap_nocache(virt_to_gart(page_map->real),
    1.92 - 					    PAGE_SIZE);
    1.93 - 	if (page_map->remapped == NULL || err) {
    1.94 - 		ClearPageReserved(virt_to_page(page_map->real));
    1.95 ---- linux-2.6.11/drivers/char/agp/backend.c	2005-03-02 07:38:13 +00:00
    1.96 -+++ linux-2.6.11-agp/drivers/char/agp/backend.c	2005-03-22 11:14:56 +00:00
    1.97 -@@ -142,7 +142,7 @@
    1.98 - 			return -ENOMEM;
    1.99 - 		}
   1.100 - 
   1.101 --		bridge->scratch_page_real = virt_to_phys(addr);
   1.102 -+		bridge->scratch_page_real = virt_to_gart(addr);
   1.103 - 		bridge->scratch_page =
   1.104 - 		    bridge->driver->mask_memory(bridge->scratch_page_real, 0);
   1.105 - 	}
   1.106 -@@ -186,7 +186,7 @@
   1.107 - err_out:
   1.108 - 	if (bridge->driver->needs_scratch_page)
   1.109 - 		bridge->driver->agp_destroy_page(
   1.110 --				phys_to_virt(bridge->scratch_page_real));
   1.111 -+				gart_to_virt(bridge->scratch_page_real));
   1.112 - 	if (got_gatt)
   1.113 - 		bridge->driver->free_gatt_table();
   1.114 - 	if (got_keylist) {
   1.115 -@@ -211,7 +211,7 @@
   1.116 - 	if (bridge->driver->agp_destroy_page &&
   1.117 - 	    bridge->driver->needs_scratch_page)
   1.118 - 		bridge->driver->agp_destroy_page(
   1.119 --				phys_to_virt(bridge->scratch_page_real));
   1.120 -+				gart_to_virt(bridge->scratch_page_real));
   1.121 - }
   1.122 - 
   1.123 - /* XXX Kludge alert: agpgart isn't ready for multiple bridges yet */
   1.124 ---- linux-2.6.11/drivers/char/agp/efficeon-agp.c	2005-03-02 07:37:30 +00:00
   1.125 -+++ linux-2.6.11-agp/drivers/char/agp/efficeon-agp.c	2005-03-22 11:15:17 +00:00
   1.126 -@@ -219,7 +219,7 @@
   1.127 - 
   1.128 - 		efficeon_private.l1_table[index] = page;
   1.129 - 
   1.130 --		value = __pa(page) | pati | present | index;
   1.131 -+		value = virt_to_gart(page) | pati | present | index;
   1.132 - 
   1.133 - 		pci_write_config_dword(agp_bridge->dev,
   1.134 - 			EFFICEON_ATTPAGE, value);
   1.135 ---- linux-2.6.11/drivers/char/agp/generic.c	2005-03-02 07:37:55 +00:00
   1.136 -+++ linux-2.6.11-agp/drivers/char/agp/generic.c	2005-03-22 11:17:37 +00:00
   1.137 -@@ -151,7 +151,7 @@
   1.138 - 	}
   1.139 - 	if (curr->page_count != 0) {
   1.140 - 		for (i = 0; i < curr->page_count; i++) {
   1.141 --			agp_bridge->driver->agp_destroy_page(phys_to_virt(curr->memory[i]));
   1.142 -+			agp_bridge->driver->agp_destroy_page(gart_to_virt(curr->memory[i]));
   1.143 - 		}
   1.144 - 	}
   1.145 - 	agp_free_key(curr->key);
   1.146 -@@ -204,7 +204,7 @@
   1.147 - 			agp_free_memory(new);
   1.148 - 			return NULL;
   1.149 - 		}
   1.150 --		new->memory[i] = virt_to_phys(addr);
   1.151 -+		new->memory[i] = virt_to_gart(addr);
   1.152 - 		new->page_count++;
   1.153 - 	}
   1.154 - 
   1.155 -@@ -697,8 +697,7 @@
   1.156 - 				break;
   1.157 - 			}
   1.158 - 
   1.159 --			table = (char *) __get_free_pages(GFP_KERNEL,
   1.160 --							  page_order);
   1.161 -+			table = alloc_gatt_pages(page_order);
   1.162 - 
   1.163 - 			if (table == NULL) {
   1.164 - 				i++;
   1.165 -@@ -729,7 +728,7 @@
   1.166 - 		size = ((struct aper_size_info_fixed *) temp)->size;
   1.167 - 		page_order = ((struct aper_size_info_fixed *) temp)->page_order;
   1.168 - 		num_entries = ((struct aper_size_info_fixed *) temp)->num_entries;
   1.169 --		table = (char *) __get_free_pages(GFP_KERNEL, page_order);
   1.170 -+		table = alloc_gatt_pages(page_order);
   1.171 - 	}
   1.172 - 
   1.173 - 	if (table == NULL)
   1.174 -@@ -744,7 +743,7 @@
   1.175 - 	agp_gatt_table = (void *)table;
   1.176 - 
   1.177 - 	agp_bridge->driver->cache_flush();
   1.178 --	agp_bridge->gatt_table = ioremap_nocache(virt_to_phys(table),
   1.179 -+	agp_bridge->gatt_table = ioremap_nocache(virt_to_gart(table),
   1.180 - 					(PAGE_SIZE * (1 << page_order)));
   1.181 - 	agp_bridge->driver->cache_flush();
   1.182 - 
   1.183 -@@ -752,11 +751,11 @@
   1.184 - 		for (page = virt_to_page(table); page <= virt_to_page(table_end); page++)
   1.185 - 			ClearPageReserved(page);
   1.186 - 
   1.187 --		free_pages((unsigned long) table, page_order);
   1.188 -+		free_gatt_pages(table, page_order);
   1.189 - 
   1.190 - 		return -ENOMEM;
   1.191 - 	}
   1.192 --	agp_bridge->gatt_bus_addr = virt_to_phys(agp_bridge->gatt_table_real);
   1.193 -+	agp_bridge->gatt_bus_addr = virt_to_gart(agp_bridge->gatt_table_real);
   1.194 - 
   1.195 - 	/* AK: bogus, should encode addresses > 4GB */
   1.196 - 	for (i = 0; i < num_entries; i++) {
   1.197 -@@ -810,7 +809,7 @@
   1.198 - 	for (page = virt_to_page(table); page <= virt_to_page(table_end); page++)
   1.199 - 		ClearPageReserved(page);
   1.200 - 
   1.201 --	free_pages((unsigned long) agp_bridge->gatt_table_real, page_order);
   1.202 -+	free_gatt_pages(agp_bridge->gatt_table_real, page_order);
   1.203 - 
   1.204 - 	agp_gatt_table = NULL;
   1.205 - 	agp_bridge->gatt_table = NULL;
   1.206 ---- linux-2.6.11/drivers/char/agp/hp-agp.c	2005-03-02 07:38:19 +00:00
   1.207 -+++ linux-2.6.11-agp/drivers/char/agp/hp-agp.c	2005-03-22 11:14:56 +00:00
   1.208 -@@ -110,7 +110,7 @@
   1.209 - 	hp->gart_size = HP_ZX1_GART_SIZE;
   1.210 - 	hp->gatt_entries = hp->gart_size / hp->io_page_size;
   1.211 - 
   1.212 --	hp->io_pdir = phys_to_virt(readq(hp->ioc_regs+HP_ZX1_PDIR_BASE));
   1.213 -+	hp->io_pdir = gart_to_virt(readq(hp->ioc_regs+HP_ZX1_PDIR_BASE));
   1.214 - 	hp->gatt = &hp->io_pdir[HP_ZX1_IOVA_TO_PDIR(hp->gart_base)];
   1.215 - 
   1.216 - 	if (hp->gatt[0] != HP_ZX1_SBA_IOMMU_COOKIE) {
   1.217 -@@ -248,7 +248,7 @@
   1.218 - 	agp_bridge->mode = readl(hp->lba_regs+hp->lba_cap_offset+PCI_AGP_STATUS);
   1.219 - 
   1.220 - 	if (hp->io_pdir_owner) {
   1.221 --		writel(virt_to_phys(hp->io_pdir), hp->ioc_regs+HP_ZX1_PDIR_BASE);
   1.222 -+		writel(virt_to_gart(hp->io_pdir), hp->ioc_regs+HP_ZX1_PDIR_BASE);
   1.223 - 		readl(hp->ioc_regs+HP_ZX1_PDIR_BASE);
   1.224 - 		writel(hp->io_tlb_ps, hp->ioc_regs+HP_ZX1_TCNFG);
   1.225 - 		readl(hp->ioc_regs+HP_ZX1_TCNFG);
   1.226 ---- linux-2.6.11/drivers/char/agp/i460-agp.c	2005-03-02 07:38:10 +00:00
   1.227 -+++ linux-2.6.11-agp/drivers/char/agp/i460-agp.c	2005-03-22 11:14:56 +00:00
   1.228 -@@ -371,7 +371,7 @@
   1.229 - 	}
   1.230 - 	memset(lp->alloced_map, 0, map_size);
   1.231 - 
   1.232 --	lp->paddr = virt_to_phys(lpage);
   1.233 -+	lp->paddr = virt_to_gart(lpage);
   1.234 - 	lp->refcount = 0;
   1.235 - 	atomic_add(I460_KPAGES_PER_IOPAGE, &agp_bridge->current_memory_agp);
   1.236 - 	return 0;
   1.237 -@@ -382,7 +382,7 @@
   1.238 - 	kfree(lp->alloced_map);
   1.239 - 	lp->alloced_map = NULL;
   1.240 - 
   1.241 --	free_pages((unsigned long) phys_to_virt(lp->paddr), I460_IO_PAGE_SHIFT - PAGE_SHIFT);
   1.242 -+	free_pages((unsigned long) gart_to_virt(lp->paddr), I460_IO_PAGE_SHIFT - PAGE_SHIFT);
   1.243 - 	atomic_sub(I460_KPAGES_PER_IOPAGE, &agp_bridge->current_memory_agp);
   1.244 - }
   1.245 - 
   1.246 ---- linux-2.6.11/drivers/char/agp/intel-agp.c	2005-03-02 07:38:09 +00:00
   1.247 -+++ linux-2.6.11-agp/drivers/char/agp/intel-agp.c	2005-03-22 11:14:56 +00:00
   1.248 -@@ -285,7 +285,7 @@
   1.249 - 	if (new == NULL)
   1.250 - 		return NULL;
   1.251 - 
   1.252 --	new->memory[0] = virt_to_phys(addr);
   1.253 -+	new->memory[0] = virt_to_gart(addr);
   1.254 - 	if (pg_count == 4) {
   1.255 - 		/* kludge to get 4 physical pages for ARGB cursor */
   1.256 - 		new->memory[1] = new->memory[0] + PAGE_SIZE;
   1.257 -@@ -328,10 +328,10 @@
   1.258 - 	agp_free_key(curr->key);
   1.259 - 	if(curr->type == AGP_PHYS_MEMORY) {
   1.260 - 		if (curr->page_count == 4)
   1.261 --			i8xx_destroy_pages(phys_to_virt(curr->memory[0]));
   1.262 -+			i8xx_destroy_pages(gart_to_virt(curr->memory[0]));
   1.263 - 		else
   1.264 - 			agp_bridge->driver->agp_destroy_page(
   1.265 --				 phys_to_virt(curr->memory[0]));
   1.266 -+				 gart_to_virt(curr->memory[0]));
   1.267 - 		vfree(curr->memory);
   1.268 - 	}
   1.269 - 	kfree(curr);
   1.270 ---- linux-2.6.11/drivers/char/agp/intel-mch-agp.c	2005-03-02 07:37:48 +00:00
   1.271 -+++ linux-2.6.11-agp/drivers/char/agp/intel-mch-agp.c	2005-03-22 11:14:56 +00:00
   1.272 -@@ -51,7 +51,7 @@
   1.273 - 	if (new == NULL)
   1.274 - 		return NULL;
   1.275 - 
   1.276 --	new->memory[0] = virt_to_phys(addr);
   1.277 -+	new->memory[0] = virt_to_gart(addr);
   1.278 - 	new->page_count = 1;
   1.279 - 	new->num_scratch_pages = 1;
   1.280 - 	new->type = AGP_PHYS_MEMORY;
   1.281 -@@ -63,7 +63,7 @@
   1.282 - {
   1.283 - 	agp_free_key(curr->key);
   1.284 - 	if(curr->type == AGP_PHYS_MEMORY) {
   1.285 --		agp_bridge->driver->agp_destroy_page(phys_to_virt(curr->memory[0]));
   1.286 -+		agp_bridge->driver->agp_destroy_page(gart_to_virt(curr->memory[0]));
   1.287 - 		vfree(curr->memory);
   1.288 - 	}
   1.289 - 	kfree(curr);
   1.290 ---- linux-2.6.11/drivers/char/agp/sworks-agp.c	2005-03-02 07:38:37 +00:00
   1.291 -+++ linux-2.6.11-agp/drivers/char/agp/sworks-agp.c	2005-03-22 11:14:56 +00:00
   1.292 -@@ -51,7 +51,7 @@
   1.293 - 	}
   1.294 - 	SetPageReserved(virt_to_page(page_map->real));
   1.295 - 	global_cache_flush();
   1.296 --	page_map->remapped = ioremap_nocache(virt_to_phys(page_map->real), 
   1.297 -+	page_map->remapped = ioremap_nocache(virt_to_gart(page_map->real), 
   1.298 - 					    PAGE_SIZE);
   1.299 - 	if (page_map->remapped == NULL) {
   1.300 - 		ClearPageReserved(virt_to_page(page_map->real));
   1.301 -@@ -162,7 +162,7 @@
   1.302 - 	/* Create a fake scratch directory */
   1.303 - 	for(i = 0; i < 1024; i++) {
   1.304 - 		writel(agp_bridge->scratch_page, serverworks_private.scratch_dir.remapped+i);
   1.305 --		writel(virt_to_phys(serverworks_private.scratch_dir.real) | 1, page_dir.remapped+i);
   1.306 -+		writel(virt_to_gart(serverworks_private.scratch_dir.real) | 1, page_dir.remapped+i);
   1.307 - 	}
   1.308 - 
   1.309 - 	retval = serverworks_create_gatt_pages(value->num_entries / 1024);
   1.310 -@@ -174,7 +174,7 @@
   1.311 - 
   1.312 - 	agp_bridge->gatt_table_real = (u32 *)page_dir.real;
   1.313 - 	agp_bridge->gatt_table = (u32 __iomem *)page_dir.remapped;
   1.314 --	agp_bridge->gatt_bus_addr = virt_to_phys(page_dir.real);
   1.315 -+	agp_bridge->gatt_bus_addr = virt_to_gart(page_dir.real);
   1.316 - 
   1.317 - 	/* Get the address for the gart region.
   1.318 - 	 * This is a bus address even on the alpha, b/c its
   1.319 -@@ -187,7 +187,7 @@
   1.320 - 	/* Calculate the agp offset */	
   1.321 - 
   1.322 - 	for(i = 0; i < value->num_entries / 1024; i++)
   1.323 --		writel(virt_to_phys(serverworks_private.gatt_pages[i]->real)|1, page_dir.remapped+i);
   1.324 -+		writel(virt_to_gart(serverworks_private.gatt_pages[i]->real)|1, page_dir.remapped+i);
   1.325 - 
   1.326 - 	return 0;
   1.327 - }
   1.328 ---- linux-2.6.11/drivers/char/agp/uninorth-agp.c	2005-03-02 07:38:09 +00:00
   1.329 -+++ linux-2.6.11-agp/drivers/char/agp/uninorth-agp.c	2005-03-22 11:14:56 +00:00
   1.330 -@@ -200,7 +200,7 @@
   1.331 - 
   1.332 - 	agp_bridge->gatt_table_real = (u32 *) table;
   1.333 - 	agp_bridge->gatt_table = (u32 *)table;
   1.334 --	agp_bridge->gatt_bus_addr = virt_to_phys(table);
   1.335 -+	agp_bridge->gatt_bus_addr = virt_to_gart(table);
   1.336 - 
   1.337 - 	for (i = 0; i < num_entries; i++) {
   1.338 - 		agp_bridge->gatt_table[i] =
   1.339 ---- linux-2.6.11/include/asm-alpha/agp.h	2005-03-02 07:37:39 +00:00
   1.340 -+++ linux-2.6.11-agp/include/asm-alpha/agp.h	2005-03-22 11:18:34 +00:00
   1.341 -@@ -10,4 +10,14 @@
   1.342 - #define flush_agp_mappings() 
   1.343 - #define flush_agp_cache() mb()
   1.344 - 
   1.345 -+/* Convert a physical address to an address suitable for the GART. */
   1.346 -+#define phys_to_gart(x) (x)
   1.347 -+#define gart_to_phys(x) (x)
   1.348 -+
   1.349 -+/* GATT allocation. Returns/accepts GATT kernel virtual address. */
   1.350 -+#define alloc_gatt_pages(order)		\
   1.351 -+	((char *)__get_free_pages(GFP_KERNEL, (order)))
   1.352 -+#define free_gatt_pages(table, order)	\
   1.353 -+	free_pages((unsigned long)(table), (order))
   1.354 -+
   1.355 - #endif
   1.356 ---- linux-2.6.11/include/asm-i386/agp.h	2005-03-02 07:37:31 +00:00
   1.357 -+++ linux-2.6.11-agp/include/asm-i386/agp.h	2005-03-22 11:18:39 +00:00
   1.358 -@@ -21,4 +21,14 @@
   1.359 -    worth it. Would need a page for it. */
   1.360 - #define flush_agp_cache() asm volatile("wbinvd":::"memory")
   1.361 - 
   1.362 -+/* Convert a physical address to an address suitable for the GART. */
   1.363 -+#define phys_to_gart(x) (x)
   1.364 -+#define gart_to_phys(x) (x)
   1.365 -+
   1.366 -+/* GATT allocation. Returns/accepts GATT kernel virtual address. */
   1.367 -+#define alloc_gatt_pages(order)		\
   1.368 -+	((char *)__get_free_pages(GFP_KERNEL, (order)))
   1.369 -+#define free_gatt_pages(table, order)	\
   1.370 -+	free_pages((unsigned long)(table), (order))
   1.371 -+
   1.372 - #endif
   1.373 ---- linux-2.6.11/include/asm-ia64/agp.h	2005-03-02 07:38:09 +00:00
   1.374 -+++ linux-2.6.11-agp/include/asm-ia64/agp.h	2005-03-22 11:18:45 +00:00
   1.375 -@@ -18,4 +18,14 @@
   1.376 - #define flush_agp_mappings()		/* nothing */
   1.377 - #define flush_agp_cache()		mb()
   1.378 - 
   1.379 -+/* Convert a physical address to an address suitable for the GART. */
   1.380 -+#define phys_to_gart(x) (x)
   1.381 -+#define gart_to_phys(x) (x)
   1.382 -+
   1.383 -+/* GATT allocation. Returns/accepts GATT kernel virtual address. */
   1.384 -+#define alloc_gatt_pages(order)		\
   1.385 -+	((char *)__get_free_pages(GFP_KERNEL, (order)))
   1.386 -+#define free_gatt_pages(table, order)	\
   1.387 -+	free_pages((unsigned long)(table), (order))
   1.388 -+
   1.389 - #endif /* _ASM_IA64_AGP_H */
   1.390 ---- linux-2.6.11/include/asm-ppc/agp.h	2005-03-02 07:38:08 +00:00
   1.391 -+++ linux-2.6.11-agp/include/asm-ppc/agp.h	2005-03-22 11:18:52 +00:00
   1.392 -@@ -10,4 +10,14 @@
   1.393 - #define flush_agp_mappings()
   1.394 - #define flush_agp_cache() mb()
   1.395 - 
   1.396 -+/* Convert a physical address to an address suitable for the GART. */
   1.397 -+#define phys_to_gart(x) (x)
   1.398 -+#define gart_to_phys(x) (x)
   1.399 -+
   1.400 -+/* GATT allocation. Returns/accepts GATT kernel virtual address. */
   1.401 -+#define alloc_gatt_pages(order)		\
   1.402 -+	((char *)__get_free_pages(GFP_KERNEL, (order)))
   1.403 -+#define free_gatt_pages(table, order)	\
   1.404 -+	free_pages((unsigned long)(table), (order))
   1.405 -+
   1.406 - #endif
   1.407 ---- linux-2.6.11/include/asm-sparc64/agp.h	2005-03-02 07:37:48 +00:00
   1.408 -+++ linux-2.6.11-agp/include/asm-sparc64/agp.h	2005-03-22 11:18:59 +00:00
   1.409 -@@ -8,4 +8,14 @@
   1.410 - #define flush_agp_mappings() 
   1.411 - #define flush_agp_cache() mb()
   1.412 - 
   1.413 -+/* Convert a physical address to an address suitable for the GART. */
   1.414 -+#define phys_to_gart(x) (x)
   1.415 -+#define gart_to_phys(x) (x)
   1.416 -+
   1.417 -+/* GATT allocation. Returns/accepts GATT kernel virtual address. */
   1.418 -+#define alloc_gatt_pages(order)		\
   1.419 -+	((char *)__get_free_pages(GFP_KERNEL, (order)))
   1.420 -+#define free_gatt_pages(table, order)	\
   1.421 -+	free_pages((unsigned long)(table), (order))
   1.422 -+
   1.423 - #endif
   1.424 ---- linux-2.6.11/include/asm-x86_64/agp.h	2005-03-02 07:37:30 +00:00
   1.425 -+++ linux-2.6.11-agp/include/asm-x86_64/agp.h	2005-03-22 11:18:22 +00:00
   1.426 -@@ -19,4 +19,14 @@
   1.427 -    worth it. Would need a page for it. */
   1.428 - #define flush_agp_cache() asm volatile("wbinvd":::"memory")
   1.429 - 
   1.430 -+/* Convert a physical address to an address suitable for the GART. */
   1.431 -+#define phys_to_gart(x) (x)
   1.432 -+#define gart_to_phys(x) (x)
   1.433 -+
   1.434 -+/* GATT allocation. Returns/accepts GATT kernel virtual address. */
   1.435 -+#define alloc_gatt_pages(order)		\
   1.436 -+	((char *)__get_free_pages(GFP_KERNEL, (order)))
   1.437 -+#define free_gatt_pages(table, order)	\
   1.438 -+	free_pages((unsigned long)(table), (order))
   1.439 -+
   1.440 - #endif
     2.1 --- a/patches/linux-2.6.11/i386-cpu-hotplug-updated-for-mm.patch	Mon Jul 11 15:12:37 2005 +0000
     2.2 +++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
     2.3 @@ -1,656 +0,0 @@
     2.4 -
     2.5 -From: Zwane Mwaikambo <zwane@linuxpower.ca>
     2.6 -
     2.7 -Find attached the i386 cpu hotplug patch updated for Ingo's latest round of
     2.8 -goodies.  In order to avoid dumping cpu hotplug code into kernel/irq/* i
     2.9 -dropped the cpu_online check in do_IRQ() by modifying fixup_irqs().  The
    2.10 -difference being that on cpu offline, fixup_irqs() is called before we
    2.11 -clear the cpu from cpu_online_map and a long delay in order to ensure that
    2.12 -we never have any queued external interrupts on the APICs.  Due to my usual
    2.13 -test victims being in boxes a continent away this hasn't been tested, but
    2.14 -i'll cover bug reports (nudge, Nathan!  ;)
    2.15 -
    2.16 -1) Add CONFIG_HOTPLUG_CPU
    2.17 -2) disable local APIC timer on dead cpus.
    2.18 -3) Disable preempt around irq balancing to prevent CPUs going down.
    2.19 -4) Print irq stats for all possible cpus.
    2.20 -5) Debugging check for interrupts on offline cpus.
    2.21 -6) Hacky fixup_irqs() to redirect irqs when cpus go off/online.
    2.22 -7) play_dead() for offline cpus to spin inside.
    2.23 -8) Handle offline cpus set in flush_tlb_others().
    2.24 -9) Grab lock earlier in smp_call_function() to prevent CPUs going down.
    2.25 -10) Implement __cpu_disable() and __cpu_die().
    2.26 -11) Enable local interrupts in cpu_enable() after fixup_irqs()
    2.27 -12) Don't fiddle with NMI on dead cpu, but leave intact on other cpus.
    2.28 -13) Program IRQ affinity whilst cpu is still in cpu_online_map on offline.
    2.29 -
    2.30 -Signed-off-by: Zwane Mwaikambo <zwane@linuxpower.ca>
    2.31 -DESC
    2.32 -ppc64: fix hotplug cpu
    2.33 -EDESC
    2.34 -From: Zwane Mwaikambo <zwane@fsmlabs.com>
    2.35 -
    2.36 -I seem to have broken this when I moved the clearing of the dying cpu to 
    2.37 -arch specific code.
    2.38 -
    2.39 -Signed-off-by: Zwane Mwaikambo <zwane@fsmlabs.com>
    2.40 -Signed-off-by: Andrew Morton <akpm@osdl.org>
    2.41 ----
    2.42 -
    2.43 - 25-akpm/arch/i386/Kconfig               |    9 ++
    2.44 - 25-akpm/arch/i386/kernel/apic.c         |    3 
    2.45 - 25-akpm/arch/i386/kernel/io_apic.c      |    2 
    2.46 - 25-akpm/arch/i386/kernel/irq.c          |   66 +++++++++++++++++----
    2.47 - 25-akpm/arch/i386/kernel/msr.c          |    2 
    2.48 - 25-akpm/arch/i386/kernel/process.c      |   35 +++++++++++
    2.49 - 25-akpm/arch/i386/kernel/smp.c          |   25 +++++---
    2.50 - 25-akpm/arch/i386/kernel/smpboot.c      |   98 ++++++++++++++++++++++++++++++--
    2.51 - 25-akpm/arch/i386/kernel/traps.c        |    8 ++
    2.52 - 25-akpm/arch/ia64/kernel/smpboot.c      |    3 
    2.53 - 25-akpm/arch/ppc64/kernel/pSeries_smp.c |    5 +
    2.54 - 25-akpm/arch/s390/kernel/smp.c          |    4 -
    2.55 - 25-akpm/include/asm-i386/cpu.h          |    2 
    2.56 - 25-akpm/include/asm-i386/irq.h          |    4 +
    2.57 - 25-akpm/include/asm-i386/smp.h          |    3 
    2.58 - 25-akpm/kernel/cpu.c                    |   14 +---
    2.59 - arch/ppc64/kernel/smp.c                 |    0 
    2.60 - 17 files changed, 242 insertions(+), 41 deletions(-)
    2.61 -
    2.62 -diff -puN arch/i386/Kconfig~i386-cpu-hotplug-updated-for-mm arch/i386/Kconfig
    2.63 ---- 25/arch/i386/Kconfig~i386-cpu-hotplug-updated-for-mm	2005-02-23 02:20:06.000000000 -0800
    2.64 -+++ 25-akpm/arch/i386/Kconfig	2005-02-23 02:20:06.000000000 -0800
    2.65 -@@ -1205,6 +1205,15 @@ config SCx200
    2.66 - 	  This support is also available as a module.  If compiled as a
    2.67 - 	  module, it will be called scx200.
    2.68 - 
    2.69 -+config HOTPLUG_CPU
    2.70 -+	bool "Support for hot-pluggable CPUs (EXPERIMENTAL)"
    2.71 -+	depends on SMP && HOTPLUG && EXPERIMENTAL
    2.72 -+	---help---
    2.73 -+	  Say Y here to experiment with turning CPUs off and on.  CPUs
    2.74 -+	  can be controlled through /sys/devices/system/cpu.
    2.75 -+
    2.76 -+	  Say N.
    2.77 -+
    2.78 - source "drivers/pcmcia/Kconfig"
    2.79 - 
    2.80 - source "drivers/pci/hotplug/Kconfig"
    2.81 -diff -puN arch/i386/kernel/apic.c~i386-cpu-hotplug-updated-for-mm arch/i386/kernel/apic.c
    2.82 ---- 25/arch/i386/kernel/apic.c~i386-cpu-hotplug-updated-for-mm	2005-02-23 02:20:06.000000000 -0800
    2.83 -+++ 25-akpm/arch/i386/kernel/apic.c	2005-02-23 02:20:06.000000000 -0800
    2.84 -@@ -26,6 +26,7 @@
    2.85 - #include <linux/mc146818rtc.h>
    2.86 - #include <linux/kernel_stat.h>
    2.87 - #include <linux/sysdev.h>
    2.88 -+#include <linux/cpu.h>
    2.89 - 
    2.90 - #include <asm/atomic.h>
    2.91 - #include <asm/smp.h>
    2.92 -@@ -1048,7 +1049,7 @@ void __init setup_secondary_APIC_clock(v
    2.93 - 	setup_APIC_timer(calibration_result);
    2.94 - }
    2.95 - 
    2.96 --void __init disable_APIC_timer(void)
    2.97 -+void __devinit disable_APIC_timer(void)
    2.98 - {
    2.99 - 	if (using_apic_timer) {
   2.100 - 		unsigned long v;
   2.101 -diff -puN arch/i386/kernel/io_apic.c~i386-cpu-hotplug-updated-for-mm arch/i386/kernel/io_apic.c
   2.102 ---- 25/arch/i386/kernel/io_apic.c~i386-cpu-hotplug-updated-for-mm	2005-02-23 02:20:06.000000000 -0800
   2.103 -+++ 25-akpm/arch/i386/kernel/io_apic.c	2005-02-23 02:20:06.000000000 -0800
   2.104 -@@ -576,9 +576,11 @@ static int balanced_irq(void *unused)
   2.105 - 		try_to_freeze(PF_FREEZE);
   2.106 - 		if (time_after(jiffies,
   2.107 - 				prev_balance_time+balanced_irq_interval)) {
   2.108 -+			preempt_disable();
   2.109 - 			do_irq_balance();
   2.110 - 			prev_balance_time = jiffies;
   2.111 - 			time_remaining = balanced_irq_interval;
   2.112 -+			preempt_enable();
   2.113 - 		}
   2.114 - 	}
   2.115 - 	return 0;
   2.116 -diff -puN arch/i386/kernel/irq.c~i386-cpu-hotplug-updated-for-mm arch/i386/kernel/irq.c
   2.117 ---- 25/arch/i386/kernel/irq.c~i386-cpu-hotplug-updated-for-mm	2005-02-23 02:20:06.000000000 -0800
   2.118 -+++ 25-akpm/arch/i386/kernel/irq.c	2005-02-23 02:20:06.000000000 -0800
   2.119 -@@ -15,6 +15,9 @@
   2.120 - #include <linux/seq_file.h>
   2.121 - #include <linux/interrupt.h>
   2.122 - #include <linux/kernel_stat.h>
   2.123 -+#include <linux/notifier.h>
   2.124 -+#include <linux/cpu.h>
   2.125 -+#include <linux/delay.h>
   2.126 - 
   2.127 - #ifndef CONFIG_X86_LOCAL_APIC
   2.128 - /*
   2.129 -@@ -209,9 +212,8 @@ int show_interrupts(struct seq_file *p, 
   2.130 - 
   2.131 - 	if (i == 0) {
   2.132 - 		seq_printf(p, "           ");
   2.133 --		for (j=0; j<NR_CPUS; j++)
   2.134 --			if (cpu_online(j))
   2.135 --				seq_printf(p, "CPU%d       ",j);
   2.136 -+		for_each_cpu(j)
   2.137 -+			seq_printf(p, "CPU%d       ",j);
   2.138 - 		seq_putc(p, '\n');
   2.139 - 	}
   2.140 - 
   2.141 -@@ -224,9 +226,8 @@ int show_interrupts(struct seq_file *p, 
   2.142 - #ifndef CONFIG_SMP
   2.143 - 		seq_printf(p, "%10u ", kstat_irqs(i));
   2.144 - #else
   2.145 --		for (j = 0; j < NR_CPUS; j++)
   2.146 --			if (cpu_online(j))
   2.147 --				seq_printf(p, "%10u ", kstat_cpu(j).irqs[i]);
   2.148 -+		for_each_cpu(j)
   2.149 -+			seq_printf(p, "%10u ", kstat_cpu(j).irqs[i]);
   2.150 - #endif
   2.151 - 		seq_printf(p, " %14s", irq_desc[i].handler->typename);
   2.152 - 		seq_printf(p, "  %s", action->name);
   2.153 -@@ -239,16 +240,13 @@ skip:
   2.154 - 		spin_unlock_irqrestore(&irq_desc[i].lock, flags);
   2.155 - 	} else if (i == NR_IRQS) {
   2.156 - 		seq_printf(p, "NMI: ");
   2.157 --		for (j = 0; j < NR_CPUS; j++)
   2.158 --			if (cpu_online(j))
   2.159 --				seq_printf(p, "%10u ", nmi_count(j));
   2.160 -+		for_each_cpu(j)
   2.161 -+			seq_printf(p, "%10u ", nmi_count(j));
   2.162 - 		seq_putc(p, '\n');
   2.163 - #ifdef CONFIG_X86_LOCAL_APIC
   2.164 - 		seq_printf(p, "LOC: ");
   2.165 --		for (j = 0; j < NR_CPUS; j++)
   2.166 --			if (cpu_online(j))
   2.167 --				seq_printf(p, "%10u ",
   2.168 --					irq_stat[j].apic_timer_irqs);
   2.169 -+		for_each_cpu(j)
   2.170 -+			seq_printf(p, "%10u ", irq_stat[j].apic_timer_irqs);
   2.171 - 		seq_putc(p, '\n');
   2.172 - #endif
   2.173 - 		seq_printf(p, "ERR: %10u\n", atomic_read(&irq_err_count));
   2.174 -@@ -258,3 +256,45 @@ skip:
   2.175 - 	}
   2.176 - 	return 0;
   2.177 - }
   2.178 -+
   2.179 -+#ifdef CONFIG_HOTPLUG_CPU
   2.180 -+#include <mach_apic.h>
   2.181 -+
   2.182 -+void fixup_irqs(cpumask_t map)
   2.183 -+{
   2.184 -+	unsigned int irq;
   2.185 -+	static int warned;
   2.186 -+
   2.187 -+	for (irq = 0; irq < NR_IRQS; irq++) {
   2.188 -+		cpumask_t mask;
   2.189 -+		if (irq == 2)
   2.190 -+			continue;
   2.191 -+
   2.192 -+		cpus_and(mask, irq_affinity[irq], map);
   2.193 -+		if (any_online_cpu(mask) == NR_CPUS) {
   2.194 -+			printk("Breaking affinity for irq %i\n", irq);
   2.195 -+			mask = map;
   2.196 -+		}
   2.197 -+		if (irq_desc[irq].handler->set_affinity)
   2.198 -+			irq_desc[irq].handler->set_affinity(irq, mask);
   2.199 -+		else if (irq_desc[irq].action && !(warned++))
   2.200 -+			printk("Cannot set affinity for irq %i\n", irq);
   2.201 -+	}
   2.202 -+
   2.203 -+#if 0
   2.204 -+	barrier();
   2.205 -+	/* Ingo Molnar says: "after the IO-APIC masks have been redirected
   2.206 -+	   [note the nop - the interrupt-enable boundary on x86 is two
   2.207 -+	   instructions from sti] - to flush out pending hardirqs and
   2.208 -+	   IPIs. After this point nothing is supposed to reach this CPU." */
   2.209 -+	__asm__ __volatile__("sti; nop; cli");
   2.210 -+	barrier();
   2.211 -+#else
   2.212 -+	/* That doesn't seem sufficient.  Give it 1ms. */
   2.213 -+	local_irq_enable();
   2.214 -+	mdelay(1);
   2.215 -+	local_irq_disable();
   2.216 -+#endif
   2.217 -+}
   2.218 -+#endif
   2.219 -+
   2.220 -diff -puN arch/i386/kernel/msr.c~i386-cpu-hotplug-updated-for-mm arch/i386/kernel/msr.c
   2.221 ---- 25/arch/i386/kernel/msr.c~i386-cpu-hotplug-updated-for-mm	2005-02-23 02:20:06.000000000 -0800
   2.222 -+++ 25-akpm/arch/i386/kernel/msr.c	2005-02-23 02:20:06.000000000 -0800
   2.223 -@@ -260,7 +260,7 @@ static struct file_operations msr_fops =
   2.224 - 	.open = msr_open,
   2.225 - };
   2.226 - 
   2.227 --static int msr_class_simple_device_add(int i)
   2.228 -+static int __devinit msr_class_simple_device_add(int i)
   2.229 - {
   2.230 - 	int err = 0;
   2.231 - 	struct class_device *class_err;
   2.232 -diff -puN arch/i386/kernel/process.c~i386-cpu-hotplug-updated-for-mm arch/i386/kernel/process.c
   2.233 ---- 25/arch/i386/kernel/process.c~i386-cpu-hotplug-updated-for-mm	2005-02-23 02:20:06.000000000 -0800
   2.234 -+++ 25-akpm/arch/i386/kernel/process.c	2005-02-23 02:20:06.000000000 -0800
   2.235 -@@ -13,6 +13,7 @@
   2.236 - 
   2.237 - #include <stdarg.h>
   2.238 - 
   2.239 -+#include <linux/cpu.h>
   2.240 - #include <linux/errno.h>
   2.241 - #include <linux/sched.h>
   2.242 - #include <linux/fs.h>
   2.243 -@@ -55,6 +56,9 @@
   2.244 - #include <linux/irq.h>
   2.245 - #include <linux/err.h>
   2.246 - 
   2.247 -+#include <asm/tlbflush.h>
   2.248 -+#include <asm/cpu.h>
   2.249 -+
   2.250 - asmlinkage void ret_from_fork(void) __asm__("ret_from_fork");
   2.251 - 
   2.252 - int hlt_counter;
   2.253 -@@ -139,6 +143,34 @@ static void poll_idle (void)
   2.254 - 	}
   2.255 - }
   2.256 - 
   2.257 -+#ifdef CONFIG_HOTPLUG_CPU
   2.258 -+#include <asm/nmi.h>
   2.259 -+/* We don't actually take CPU down, just spin without interrupts. */
   2.260 -+static inline void play_dead(void)
   2.261 -+{
   2.262 -+	/* Ack it */
   2.263 -+	__get_cpu_var(cpu_state) = CPU_DEAD;
   2.264 -+
   2.265 -+	/* We shouldn't have to disable interrupts while dead, but
   2.266 -+	 * some interrupts just don't seem to go away, and this makes
   2.267 -+	 * it "work" for testing purposes. */
   2.268 -+	/* Death loop */
   2.269 -+	while (__get_cpu_var(cpu_state) != CPU_UP_PREPARE)
   2.270 -+		cpu_relax();
   2.271 -+
   2.272 -+	local_irq_disable();
   2.273 -+	__flush_tlb_all();
   2.274 -+	cpu_set(smp_processor_id(), cpu_online_map);
   2.275 -+	enable_APIC_timer();
   2.276 -+	local_irq_enable();
   2.277 -+}
   2.278 -+#else
   2.279 -+static inline void play_dead(void)
   2.280 -+{
   2.281 -+	BUG();
   2.282 -+}
   2.283 -+#endif /* CONFIG_HOTPLUG_CPU */
   2.284 -+
   2.285 - /*
   2.286 -  * The idle thread. There's no useful work to be
   2.287 -  * done, so just try to conserve power and have a
   2.288 -@@ -162,6 +194,9 @@ void cpu_idle (void)
   2.289 - 			if (!idle)
   2.290 - 				idle = default_idle;
   2.291 - 
   2.292 -+			if (cpu_is_offline(cpu))
   2.293 -+				play_dead();
   2.294 -+
   2.295 - 			irq_stat[cpu].idle_timestamp = jiffies;
   2.296 - 			idle();
   2.297 - 		}
   2.298 -diff -puN arch/i386/kernel/smpboot.c~i386-cpu-hotplug-updated-for-mm arch/i386/kernel/smpboot.c
   2.299 ---- 25/arch/i386/kernel/smpboot.c~i386-cpu-hotplug-updated-for-mm	2005-02-23 02:20:06.000000000 -0800
   2.300 -+++ 25-akpm/arch/i386/kernel/smpboot.c	2005-02-23 02:20:06.000000000 -0800
   2.301 -@@ -44,6 +44,9 @@
   2.302 - #include <linux/smp_lock.h>
   2.303 - #include <linux/irq.h>
   2.304 - #include <linux/bootmem.h>
   2.305 -+#include <linux/notifier.h>
   2.306 -+#include <linux/cpu.h>
   2.307 -+#include <linux/percpu.h>
   2.308 - 
   2.309 - #include <linux/delay.h>
   2.310 - #include <linux/mc146818rtc.h>
   2.311 -@@ -89,6 +92,9 @@ extern unsigned char trampoline_end  [];
   2.312 - static unsigned char *trampoline_base;
   2.313 - static int trampoline_exec;
   2.314 - 
   2.315 -+/* State of each CPU. */
   2.316 -+DEFINE_PER_CPU(int, cpu_state) = { 0 };
   2.317 -+
   2.318 - /*
   2.319 -  * Currently trivial. Write the real->protected mode
   2.320 -  * bootstrap into the page concerned. The caller
   2.321 -@@ -1095,6 +1101,9 @@ static void __init smp_boot_cpus(unsigne
   2.322 -    who understands all this stuff should rewrite it properly. --RR 15/Jul/02 */
   2.323 - void __init smp_prepare_cpus(unsigned int max_cpus)
   2.324 - {
   2.325 -+	smp_commenced_mask = cpumask_of_cpu(0);
   2.326 -+	cpu_callin_map = cpumask_of_cpu(0);
   2.327 -+	mb();
   2.328 - 	smp_boot_cpus(max_cpus);
   2.329 - }
   2.330 - 
   2.331 -@@ -1104,20 +1113,99 @@ void __devinit smp_prepare_boot_cpu(void
   2.332 - 	cpu_set(smp_processor_id(), cpu_callout_map);
   2.333 - }
   2.334 - 
   2.335 --int __devinit __cpu_up(unsigned int cpu)
   2.336 -+#ifdef CONFIG_HOTPLUG_CPU
   2.337 -+
   2.338 -+/* must be called with the cpucontrol mutex held */
   2.339 -+static int __devinit cpu_enable(unsigned int cpu)
   2.340 - {
   2.341 --	/* This only works at boot for x86.  See "rewrite" above. */
   2.342 --	if (cpu_isset(cpu, smp_commenced_mask)) {
   2.343 --		local_irq_enable();
   2.344 --		return -ENOSYS;
   2.345 -+	/* get the target out of its holding state */
   2.346 -+	per_cpu(cpu_state, cpu) = CPU_UP_PREPARE;
   2.347 -+	wmb();
   2.348 -+
   2.349 -+	/* wait for the processor to ack it. timeout? */
   2.350 -+	while (!cpu_online(cpu))
   2.351 -+		cpu_relax();
   2.352 -+
   2.353 -+	fixup_irqs(cpu_online_map);
   2.354 -+	/* counter the disable in fixup_irqs() */
   2.355 -+	local_irq_enable();
   2.356 -+	return 0;
   2.357 -+}
   2.358 -+
   2.359 -+int __cpu_disable(void)
   2.360 -+{
   2.361 -+	cpumask_t map = cpu_online_map;
   2.362 -+	int cpu = smp_processor_id();
   2.363 -+
   2.364 -+	/*
   2.365 -+	 * Perhaps use cpufreq to drop frequency, but that could go
   2.366 -+	 * into generic code.
   2.367 -+ 	 *
   2.368 -+	 * We won't take down the boot processor on i386 due to some
   2.369 -+	 * interrupts only being able to be serviced by the BSP.
   2.370 -+	 * Especially so if we're not using an IOAPIC	-zwane
   2.371 -+	 */
   2.372 -+	if (cpu == 0)
   2.373 -+		return -EBUSY;
   2.374 -+
   2.375 -+	/* We enable the timer again on the exit path of the death loop */
   2.376 -+	disable_APIC_timer();
   2.377 -+	/* Allow any queued timer interrupts to get serviced */
   2.378 -+	local_irq_enable();
   2.379 -+	mdelay(1);
   2.380 -+	local_irq_disable();
   2.381 -+
   2.382 -+	cpu_clear(cpu, map);
   2.383 -+	fixup_irqs(map);
   2.384 -+	/* It's now safe to remove this processor from the online map */
   2.385 -+	cpu_clear(cpu, cpu_online_map);
   2.386 -+	return 0;
   2.387 -+}
   2.388 -+
   2.389 -+void __cpu_die(unsigned int cpu)
   2.390 -+{
   2.391 -+	/* We don't do anything here: idle task is faking death itself. */
   2.392 -+	unsigned int i;
   2.393 -+
   2.394 -+	for (i = 0; i < 10; i++) {
   2.395 -+		/* They ack this in play_dead by setting CPU_DEAD */
   2.396 -+		if (per_cpu(cpu_state, cpu) == CPU_DEAD)
   2.397 -+			return;
   2.398 -+		current->state = TASK_UNINTERRUPTIBLE;
   2.399 -+		schedule_timeout(HZ/10);
   2.400 - 	}
   2.401 -+ 	printk(KERN_ERR "CPU %u didn't die...\n", cpu);
   2.402 -+}
   2.403 -+#else /* ... !CONFIG_HOTPLUG_CPU */
   2.404 -+int __cpu_disable(void)
   2.405 -+{
   2.406 -+	return -ENOSYS;
   2.407 -+}
   2.408 - 
   2.409 -+void __cpu_die(unsigned int cpu)
   2.410 -+{
   2.411 -+	/* We said "no" in __cpu_disable */
   2.412 -+	BUG();
   2.413 -+}
   2.414 -+#endif /* CONFIG_HOTPLUG_CPU */
   2.415 -+
   2.416 -+int __devinit __cpu_up(unsigned int cpu)
   2.417 -+{
   2.418 - 	/* In case one didn't come up */
   2.419 - 	if (!cpu_isset(cpu, cpu_callin_map)) {
   2.420 -+		printk(KERN_DEBUG "skipping cpu%d, didn't come online\n", cpu);
   2.421 - 		local_irq_enable();
   2.422 - 		return -EIO;
   2.423 - 	}
   2.424 - 
   2.425 -+#ifdef CONFIG_HOTPLUG_CPU
   2.426 -+	/* Already up, and in cpu_quiescent now? */
   2.427 -+	if (cpu_isset(cpu, smp_commenced_mask)) {
   2.428 -+		cpu_enable(cpu);
   2.429 -+		return 0;
   2.430 -+	}
   2.431 -+#endif
   2.432 -+
   2.433 - 	local_irq_enable();
   2.434 - 	/* Unleash the CPU! */
   2.435 - 	cpu_set(cpu, smp_commenced_mask);
   2.436 -diff -puN arch/i386/kernel/smp.c~i386-cpu-hotplug-updated-for-mm arch/i386/kernel/smp.c
   2.437 ---- 25/arch/i386/kernel/smp.c~i386-cpu-hotplug-updated-for-mm	2005-02-23 02:20:06.000000000 -0800
   2.438 -+++ 25-akpm/arch/i386/kernel/smp.c	2005-02-23 02:20:06.000000000 -0800
   2.439 -@@ -19,6 +19,7 @@
   2.440 - #include <linux/mc146818rtc.h>
   2.441 - #include <linux/cache.h>
   2.442 - #include <linux/interrupt.h>
   2.443 -+#include <linux/cpu.h>
   2.444 - 
   2.445 - #include <asm/mtrr.h>
   2.446 - #include <asm/tlbflush.h>
   2.447 -@@ -163,7 +164,7 @@ void send_IPI_mask_bitmask(cpumask_t cpu
   2.448 - 	unsigned long flags;
   2.449 - 
   2.450 - 	local_irq_save(flags);
   2.451 --		
   2.452 -+	WARN_ON(mask & ~cpus_addr(cpu_online_map)[0]);
   2.453 - 	/*
   2.454 - 	 * Wait for idle.
   2.455 - 	 */
   2.456 -@@ -345,21 +346,21 @@ out:
   2.457 - static void flush_tlb_others(cpumask_t cpumask, struct mm_struct *mm,
   2.458 - 						unsigned long va)
   2.459 - {
   2.460 --	cpumask_t tmp;
   2.461 - 	/*
   2.462 - 	 * A couple of (to be removed) sanity checks:
   2.463 - 	 *
   2.464 --	 * - we do not send IPIs to not-yet booted CPUs.
   2.465 - 	 * - current CPU must not be in mask
   2.466 - 	 * - mask must exist :)
   2.467 - 	 */
   2.468 - 	BUG_ON(cpus_empty(cpumask));
   2.469 --
   2.470 --	cpus_and(tmp, cpumask, cpu_online_map);
   2.471 --	BUG_ON(!cpus_equal(cpumask, tmp));
   2.472 - 	BUG_ON(cpu_isset(smp_processor_id(), cpumask));
   2.473 - 	BUG_ON(!mm);
   2.474 - 
   2.475 -+	/* If a CPU which we ran on has gone down, OK. */
   2.476 -+	cpus_and(cpumask, cpumask, cpu_online_map);
   2.477 -+	if (cpus_empty(cpumask))
   2.478 -+		return;
   2.479 -+
   2.480 - 	/*
   2.481 - 	 * i'm not happy about this global shared spinlock in the
   2.482 - 	 * MM hot path, but we'll see how contended it is.
   2.483 -@@ -484,6 +485,7 @@ void smp_send_nmi_allbutself(void)
   2.484 -  */
   2.485 - void smp_send_reschedule(int cpu)
   2.486 - {
   2.487 -+	WARN_ON(cpu_is_offline(cpu));
   2.488 - 	send_IPI_mask(cpumask_of_cpu(cpu), RESCHEDULE_VECTOR);
   2.489 - }
   2.490 - 
   2.491 -@@ -524,10 +526,16 @@ int smp_call_function (void (*func) (voi
   2.492 -  */
   2.493 - {
   2.494 - 	struct call_data_struct data;
   2.495 --	int cpus = num_online_cpus()-1;
   2.496 -+	int cpus;
   2.497 - 
   2.498 --	if (!cpus)
   2.499 -+	/* Holding any lock stops cpus from going down. */
   2.500 -+	spin_lock(&call_lock);
   2.501 -+	cpus = num_online_cpus()-1;
   2.502 -+
   2.503 -+	if (!cpus) {
   2.504 -+		spin_unlock(&call_lock);
   2.505 - 		return 0;
   2.506 -+	}
   2.507 - 
   2.508 - 	/* Can deadlock when called with interrupts disabled */
   2.509 - 	WARN_ON(irqs_disabled());
   2.510 -@@ -539,7 +547,6 @@ int smp_call_function (void (*func) (voi
   2.511 - 	if (wait)
   2.512 - 		atomic_set(&data.finished, 0);
   2.513 - 
   2.514 --	spin_lock(&call_lock);
   2.515 - 	call_data = &data;
   2.516 - 	mb();
   2.517 - 	
   2.518 -diff -puN arch/i386/kernel/traps.c~i386-cpu-hotplug-updated-for-mm arch/i386/kernel/traps.c
   2.519 ---- 25/arch/i386/kernel/traps.c~i386-cpu-hotplug-updated-for-mm	2005-02-23 02:20:06.000000000 -0800
   2.520 -+++ 25-akpm/arch/i386/kernel/traps.c	2005-02-23 02:20:06.000000000 -0800
   2.521 -@@ -669,6 +669,14 @@ fastcall void do_nmi(struct pt_regs * re
   2.522 - 	nmi_enter();
   2.523 - 
   2.524 - 	cpu = smp_processor_id();
   2.525 -+
   2.526 -+#ifdef CONFIG_HOTPLUG_CPU
   2.527 -+	if (!cpu_online(cpu)) {
   2.528 -+		nmi_exit();
   2.529 -+		return;
   2.530 -+	}
   2.531 -+#endif
   2.532 -+
   2.533 - 	++nmi_count(cpu);
   2.534 - 
   2.535 - 	if (!nmi_callback(regs, cpu))
   2.536 -diff -puN arch/ia64/kernel/smpboot.c~i386-cpu-hotplug-updated-for-mm arch/ia64/kernel/smpboot.c
   2.537 ---- 25/arch/ia64/kernel/smpboot.c~i386-cpu-hotplug-updated-for-mm	2005-02-23 02:20:06.000000000 -0800
   2.538 -+++ 25-akpm/arch/ia64/kernel/smpboot.c	2005-02-23 02:20:06.000000000 -0800
   2.539 -@@ -590,9 +590,10 @@ int __cpu_disable(void)
   2.540 - 	if (cpu == 0)
   2.541 - 		return -EBUSY;
   2.542 - 
   2.543 -+	cpu_clear(cpu, cpu_online_map);
   2.544 - 	fixup_irqs();
   2.545 - 	local_flush_tlb_all();
   2.546 --	printk ("Disabled cpu %u\n", smp_processor_id());
   2.547 -+	printk("Disabled cpu %u\n", cpu);
   2.548 - 	return 0;
   2.549 - }
   2.550 - 
   2.551 -diff -puN arch/ppc64/kernel/smp.c~i386-cpu-hotplug-updated-for-mm arch/ppc64/kernel/smp.c
   2.552 -diff -puN arch/s390/kernel/smp.c~i386-cpu-hotplug-updated-for-mm arch/s390/kernel/smp.c
   2.553 ---- 25/arch/s390/kernel/smp.c~i386-cpu-hotplug-updated-for-mm	2005-02-23 02:20:06.000000000 -0800
   2.554 -+++ 25-akpm/arch/s390/kernel/smp.c	2005-02-23 02:20:06.000000000 -0800
   2.555 -@@ -679,12 +679,14 @@ __cpu_disable(void)
   2.556 - {
   2.557 - 	unsigned long flags;
   2.558 - 	ec_creg_mask_parms cr_parms;
   2.559 -+	int cpu = smp_processor_id();
   2.560 - 
   2.561 - 	spin_lock_irqsave(&smp_reserve_lock, flags);
   2.562 --	if (smp_cpu_reserved[smp_processor_id()] != 0) {
   2.563 -+	if (smp_cpu_reserved[cpu] != 0) {
   2.564 - 		spin_unlock_irqrestore(&smp_reserve_lock, flags);
   2.565 - 		return -EBUSY;
   2.566 - 	}
   2.567 -+	cpu_clear(cpu, cpu_online_map);
   2.568 - 
   2.569 - #ifdef CONFIG_PFAULT
   2.570 - 	/* Disable pfault pseudo page faults on this cpu. */
   2.571 -diff -puN include/asm-i386/cpu.h~i386-cpu-hotplug-updated-for-mm include/asm-i386/cpu.h
   2.572 ---- 25/include/asm-i386/cpu.h~i386-cpu-hotplug-updated-for-mm	2005-02-23 02:20:06.000000000 -0800
   2.573 -+++ 25-akpm/include/asm-i386/cpu.h	2005-02-23 02:20:06.000000000 -0800
   2.574 -@@ -5,6 +5,7 @@
   2.575 - #include <linux/cpu.h>
   2.576 - #include <linux/topology.h>
   2.577 - #include <linux/nodemask.h>
   2.578 -+#include <linux/percpu.h>
   2.579 - 
   2.580 - #include <asm/node.h>
   2.581 - 
   2.582 -@@ -17,4 +18,5 @@ extern int arch_register_cpu(int num);
   2.583 - extern void arch_unregister_cpu(int);
   2.584 - #endif
   2.585 - 
   2.586 -+DECLARE_PER_CPU(int, cpu_state);
   2.587 - #endif /* _ASM_I386_CPU_H_ */
   2.588 -diff -puN include/asm-i386/irq.h~i386-cpu-hotplug-updated-for-mm include/asm-i386/irq.h
   2.589 ---- 25/include/asm-i386/irq.h~i386-cpu-hotplug-updated-for-mm	2005-02-23 02:20:06.000000000 -0800
   2.590 -+++ 25-akpm/include/asm-i386/irq.h	2005-02-23 02:20:06.000000000 -0800
   2.591 -@@ -38,4 +38,8 @@ extern void release_vm86_irqs(struct tas
   2.592 - extern int irqbalance_disable(char *str);
   2.593 - #endif
   2.594 - 
   2.595 -+#ifdef CONFIG_HOTPLUG_CPU
   2.596 -+extern void fixup_irqs(cpumask_t map);
   2.597 -+#endif
   2.598 -+
   2.599 - #endif /* _ASM_IRQ_H */
   2.600 -diff -puN include/asm-i386/smp.h~i386-cpu-hotplug-updated-for-mm include/asm-i386/smp.h
   2.601 ---- 25/include/asm-i386/smp.h~i386-cpu-hotplug-updated-for-mm	2005-02-23 02:20:06.000000000 -0800
   2.602 -+++ 25-akpm/include/asm-i386/smp.h	2005-02-23 02:20:06.000000000 -0800
   2.603 -@@ -85,6 +85,9 @@ static __inline int logical_smp_processo
   2.604 - }
   2.605 - 
   2.606 - #endif
   2.607 -+
   2.608 -+extern int __cpu_disable(void);
   2.609 -+extern void __cpu_die(unsigned int cpu);
   2.610 - #endif /* !__ASSEMBLY__ */
   2.611 - 
   2.612 - #define NO_PROC_ID		0xFF		/* No processor magic marker */
   2.613 -diff -puN kernel/cpu.c~i386-cpu-hotplug-updated-for-mm kernel/cpu.c
   2.614 ---- 25/kernel/cpu.c~i386-cpu-hotplug-updated-for-mm	2005-02-23 02:20:06.000000000 -0800
   2.615 -+++ 25-akpm/kernel/cpu.c	2005-02-23 02:20:06.000000000 -0800
   2.616 -@@ -63,19 +63,15 @@ static int take_cpu_down(void *unused)
   2.617 - {
   2.618 - 	int err;
   2.619 - 
   2.620 --	/* Take offline: makes arch_cpu_down somewhat easier. */
   2.621 --	cpu_clear(smp_processor_id(), cpu_online_map);
   2.622 --
   2.623 - 	/* Ensure this CPU doesn't handle any more interrupts. */
   2.624 - 	err = __cpu_disable();
   2.625 - 	if (err < 0)
   2.626 --		cpu_set(smp_processor_id(), cpu_online_map);
   2.627 --	else
   2.628 --		/* Force idle task to run as soon as we yield: it should
   2.629 --		   immediately notice cpu is offline and die quickly. */
   2.630 --		sched_idle_next();
   2.631 -+		return err;
   2.632 - 
   2.633 --	return err;
   2.634 -+	/* Force idle task to run as soon as we yield: it should
   2.635 -+	   immediately notice cpu is offline and die quickly. */
   2.636 -+	sched_idle_next();
   2.637 -+	return 0;
   2.638 - }
   2.639 - 
   2.640 - int cpu_down(unsigned int cpu)
   2.641 -diff -puN arch/ppc64/kernel/pSeries_smp.c~i386-cpu-hotplug-updated-for-mm arch/ppc64/kernel/pSeries_smp.c
   2.642 ---- 25/arch/ppc64/kernel/pSeries_smp.c~i386-cpu-hotplug-updated-for-mm	2005-02-23 02:20:08.000000000 -0800
   2.643 -+++ 25-akpm/arch/ppc64/kernel/pSeries_smp.c	2005-02-23 02:20:08.000000000 -0800
   2.644 -@@ -86,10 +86,13 @@ static int query_cpu_stopped(unsigned in
   2.645 - 
   2.646 - int pSeries_cpu_disable(void)
   2.647 - {
   2.648 -+	int cpu = smp_processor_id();
   2.649 -+
   2.650 -+	cpu_clear(cpu, cpu_online_map);
   2.651 - 	systemcfg->processorCount--;
   2.652 - 
   2.653 - 	/*fix boot_cpuid here*/
   2.654 --	if (smp_processor_id() == boot_cpuid)
   2.655 -+	if (cpu == boot_cpuid)
   2.656 - 		boot_cpuid = any_online_cpu(cpu_online_map);
   2.657 - 
   2.658 - 	/* FIXME: abstract this to not be platform specific later on */
   2.659 -_
     3.1 --- a/patches/linux-2.6.11/iomap.patch	Mon Jul 11 15:12:37 2005 +0000
     3.2 +++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
     3.3 @@ -1,120 +0,0 @@
     3.4 -diff -ur linux-2.6.11/drivers/char/agp/frontend.c linux-2.6.11-io/drivers/char/agp/frontend.c
     3.5 ---- linux-2.6.11/drivers/char/agp/frontend.c	2005-03-02 07:37:49.000000000 +0000
     3.6 -+++ linux-2.6.11-io/drivers/char/agp/frontend.c	2005-03-15 17:38:30.000000000 +0000
     3.7 -@@ -627,7 +627,7 @@
     3.8 - 		DBG("client vm_ops=%p", kerninfo.vm_ops);
     3.9 - 		if (kerninfo.vm_ops) {
    3.10 - 			vma->vm_ops = kerninfo.vm_ops;
    3.11 --		} else if (remap_pfn_range(vma, vma->vm_start,
    3.12 -+		} else if (io_remap_pfn_range(vma, vma->vm_start,
    3.13 - 				(kerninfo.aper_base + offset) >> PAGE_SHIFT,
    3.14 - 					    size, vma->vm_page_prot)) {
    3.15 - 			goto out_again;
    3.16 -@@ -643,7 +643,7 @@
    3.17 - 		DBG("controller vm_ops=%p", kerninfo.vm_ops);
    3.18 - 		if (kerninfo.vm_ops) {
    3.19 - 			vma->vm_ops = kerninfo.vm_ops;
    3.20 --		} else if (remap_pfn_range(vma, vma->vm_start,
    3.21 -+		} else if (io_remap_pfn_range(vma, vma->vm_start,
    3.22 - 					    kerninfo.aper_base >> PAGE_SHIFT,
    3.23 - 					    size, vma->vm_page_prot)) {
    3.24 - 			goto out_again;
    3.25 -diff -ur linux-2.6.11/drivers/char/drm/drm_vm.c linux-2.6.11-io/drivers/char/drm/drm_vm.c
    3.26 ---- linux-2.6.11/drivers/char/drm/drm_vm.c	2005-03-02 07:38:33.000000000 +0000
    3.27 -+++ linux-2.6.11-io/drivers/char/drm/drm_vm.c	2005-03-15 17:43:26.000000000 +0000
    3.28 -@@ -630,7 +630,7 @@
    3.29 - 					vma->vm_end - vma->vm_start,
    3.30 - 					vma->vm_page_prot, 0))
    3.31 - #else
    3.32 --		if (remap_pfn_range(DRM_RPR_ARG(vma) vma->vm_start,
    3.33 -+		if (io_remap_pfn_range(vma, vma->vm_start,
    3.34 - 				     (VM_OFFSET(vma) + offset) >> PAGE_SHIFT,
    3.35 - 				     vma->vm_end - vma->vm_start,
    3.36 - 				     vma->vm_page_prot))
    3.37 -diff -ur linux-2.6.11/drivers/char/drm/i810_dma.c linux-2.6.11-io/drivers/char/drm/i810_dma.c
    3.38 ---- linux-2.6.11/drivers/char/drm/i810_dma.c	2005-03-02 07:37:55.000000000 +0000
    3.39 -+++ linux-2.6.11-io/drivers/char/drm/i810_dma.c	2005-03-15 17:53:36.000000000 +0000
    3.40 -@@ -139,7 +139,7 @@
    3.41 -    	buf_priv->currently_mapped = I810_BUF_MAPPED;
    3.42 - 	unlock_kernel();
    3.43 - 
    3.44 --	if (remap_pfn_range(DRM_RPR_ARG(vma) vma->vm_start,
    3.45 -+	if (io_remap_pfn_range(vma, vma->vm_start,
    3.46 - 			     VM_OFFSET(vma) >> PAGE_SHIFT,
    3.47 - 			     vma->vm_end - vma->vm_start,
    3.48 - 			     vma->vm_page_prot)) return -EAGAIN;
    3.49 -diff -ur linux-2.6.11/drivers/char/drm/i830_dma.c linux-2.6.11-io/drivers/char/drm/i830_dma.c
    3.50 ---- linux-2.6.11/drivers/char/drm/i830_dma.c	2005-03-02 07:37:48.000000000 +0000
    3.51 -+++ linux-2.6.11-io/drivers/char/drm/i830_dma.c	2005-03-15 17:53:46.000000000 +0000
    3.52 -@@ -157,7 +157,7 @@
    3.53 -    	buf_priv->currently_mapped = I830_BUF_MAPPED;
    3.54 - 	unlock_kernel();
    3.55 - 
    3.56 --	if (remap_pfn_range(DRM_RPR_ARG(vma) vma->vm_start,
    3.57 -+	if (io_remap_pfn_range(vma, vma->vm_start,
    3.58 - 			     VM_OFFSET(vma) >> PAGE_SHIFT,
    3.59 - 			     vma->vm_end - vma->vm_start,
    3.60 - 			     vma->vm_page_prot)) return -EAGAIN;
    3.61 -diff -ur linux-2.6.11/drivers/char/hpet.c linux-2.6.11-io/drivers/char/hpet.c
    3.62 ---- linux-2.6.11/drivers/char/hpet.c	2005-03-02 07:38:10.000000000 +0000
    3.63 -+++ linux-2.6.11-io/drivers/char/hpet.c	2005-03-15 17:37:22.000000000 +0000
    3.64 -@@ -76,6 +76,7 @@
    3.65 - struct hpets {
    3.66 - 	struct hpets *hp_next;
    3.67 - 	struct hpet __iomem *hp_hpet;
    3.68 -+	unsigned long hp_hpet_phys;
    3.69 - 	struct time_interpolator *hp_interpolator;
    3.70 - 	unsigned long hp_period;
    3.71 - 	unsigned long hp_delta;
    3.72 -@@ -265,7 +266,7 @@
    3.73 - 		return -EINVAL;
    3.74 - 
    3.75 - 	devp = file->private_data;
    3.76 --	addr = (unsigned long)devp->hd_hpet;
    3.77 -+	addr = devp->hd_hpets->hp_hpet_phys;
    3.78 - 
    3.79 - 	if (addr & (PAGE_SIZE - 1))
    3.80 - 		return -ENOSYS;
    3.81 -@@ -274,7 +275,7 @@
    3.82 - 	vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
    3.83 - 	addr = __pa(addr);
    3.84 - 
    3.85 --	if (remap_pfn_range(vma, vma->vm_start, addr >> PAGE_SHIFT,
    3.86 -+	if (io_remap_pfn_range(vma, vma->vm_start, addr >> PAGE_SHIFT,
    3.87 - 					PAGE_SIZE, vma->vm_page_prot)) {
    3.88 - 		printk(KERN_ERR "remap_pfn_range failed in hpet.c\n");
    3.89 - 		return -EAGAIN;
    3.90 -@@ -795,6 +796,7 @@
    3.91 - 
    3.92 - 	hpetp->hp_which = hpet_nhpet++;
    3.93 - 	hpetp->hp_hpet = hdp->hd_address;
    3.94 -+	hpetp->hp_hpet_phys = hdp->hd_phys_address;
    3.95 - 
    3.96 - 	hpetp->hp_ntimer = hdp->hd_nirqs;
    3.97 - 
    3.98 -diff -ur linux-2.6.11/drivers/sbus/char/flash.c linux-2.6.11-io/drivers/sbus/char/flash.c
    3.99 ---- linux-2.6.11/drivers/sbus/char/flash.c	2005-03-02 07:38:10.000000000 +0000
   3.100 -+++ linux-2.6.11-io/drivers/sbus/char/flash.c	2005-03-15 17:20:22.000000000 +0000
   3.101 -@@ -75,7 +75,7 @@
   3.102 - 	pgprot_val(vma->vm_page_prot) |= _PAGE_E;
   3.103 - 	vma->vm_flags |= (VM_SHM | VM_LOCKED);
   3.104 - 
   3.105 --	if (remap_pfn_range(vma, vma->vm_start, addr, size, vma->vm_page_prot))
   3.106 -+	if (io_remap_pfn_range(vma, vma->vm_start, addr, size, vma->vm_page_prot))
   3.107 - 		return -EAGAIN;
   3.108 - 		
   3.109 - 	return 0;
   3.110 -diff -ur linux-2.6.11/include/linux/mm.h linux-2.6.11-io/include/linux/mm.h
   3.111 ---- linux-2.6.11/include/linux/mm.h	2005-03-02 07:37:47.000000000 +0000
   3.112 -+++ linux-2.6.11-io/include/linux/mm.h	2005-03-15 17:03:46.000000000 +0000
   3.113 -@@ -815,6 +815,10 @@
   3.114 - extern int check_user_page_readable(struct mm_struct *mm, unsigned long address);
   3.115 - int remap_pfn_range(struct vm_area_struct *, unsigned long,
   3.116 - 		unsigned long, unsigned long, pgprot_t);
   3.117 -+/* Allow arch override for mapping of device and I/O (non-RAM) pages. */
   3.118 -+#ifndef io_remap_pfn_range
   3.119 -+#define io_remap_pfn_range remap_pfn_range
   3.120 -+#endif
   3.121 - 
   3.122 - #ifdef CONFIG_PROC_FS
   3.123 - void __vm_stat_account(struct mm_struct *, unsigned long, struct file *, long);
     4.1 --- a/patches/linux-2.6.11/linux-2.6.11.12.patch	Mon Jul 11 15:12:37 2005 +0000
     4.2 +++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
     4.3 @@ -1,2579 +0,0 @@
     4.4 -diff --git a/Documentation/SecurityBugs b/Documentation/SecurityBugs
     4.5 -new file mode 100644
     4.6 ---- /dev/null
     4.7 -+++ b/Documentation/SecurityBugs
     4.8 -@@ -0,0 +1,38 @@
     4.9 -+Linux kernel developers take security very seriously.  As such, we'd
    4.10 -+like to know when a security bug is found so that it can be fixed and
    4.11 -+disclosed as quickly as possible.  Please report security bugs to the
    4.12 -+Linux kernel security team.
    4.13 -+
    4.14 -+1) Contact
    4.15 -+
    4.16 -+The Linux kernel security team can be contacted by email at
    4.17 -+<security@kernel.org>.  This is a private list of security officers
    4.18 -+who will help verify the bug report and develop and release a fix.
    4.19 -+It is possible that the security team will bring in extra help from
    4.20 -+area maintainers to understand and fix the security vulnerability.
    4.21 -+
    4.22 -+As it is with any bug, the more information provided the easier it
    4.23 -+will be to diagnose and fix.  Please review the procedure outlined in
    4.24 -+REPORTING-BUGS if you are unclear about what information is helpful.
    4.25 -+Any exploit code is very helpful and will not be released without
    4.26 -+consent from the reporter unless it has already been made public.
    4.27 -+
    4.28 -+2) Disclosure
    4.29 -+
    4.30 -+The goal of the Linux kernel security team is to work with the
    4.31 -+bug submitter to bug resolution as well as disclosure.  We prefer
    4.32 -+to fully disclose the bug as soon as possible.  It is reasonable to
    4.33 -+delay disclosure when the bug or the fix is not yet fully understood,
    4.34 -+the solution is not well-tested or for vendor coordination.  However, we
    4.35 -+expect these delays to be short, measurable in days, not weeks or months.
    4.36 -+A disclosure date is negotiated by the security team working with the
    4.37 -+bug submitter as well as vendors.  However, the kernel security team
    4.38 -+holds the final say when setting a disclosure date.  The timeframe for
    4.39 -+disclosure is from immediate (esp. if it's already publically known)
    4.40 -+to a few weeks.  As a basic default policy, we expect report date to
    4.41 -+disclosure date to be on the order of 7 days.
    4.42 -+
    4.43 -+3) Non-disclosure agreements
    4.44 -+
    4.45 -+The Linux kernel security team is not a formal body and therefore unable
    4.46 -+to enter any non-disclosure agreements.
    4.47 -diff --git a/MAINTAINERS b/MAINTAINERS
    4.48 ---- a/MAINTAINERS
    4.49 -+++ b/MAINTAINERS
    4.50 -@@ -1966,6 +1966,11 @@ M:	christer@weinigel.se
    4.51 - W:	http://www.weinigel.se
    4.52 - S:	Supported
    4.53 - 
    4.54 -+SECURITY CONTACT
    4.55 -+P:	Security Officers
    4.56 -+M:	security@kernel.org
    4.57 -+S:	Supported
    4.58 -+
    4.59 - SELINUX SECURITY MODULE
    4.60 - P:	Stephen Smalley
    4.61 - M:	sds@epoch.ncsc.mil
    4.62 -diff --git a/Makefile b/Makefile
    4.63 ---- a/Makefile
    4.64 -+++ b/Makefile
    4.65 -@@ -1,8 +1,8 @@
    4.66 - VERSION = 2
    4.67 - PATCHLEVEL = 6
    4.68 - SUBLEVEL = 11
    4.69 --EXTRAVERSION =
    4.70 --NAME=Woozy Numbat
    4.71 -+EXTRAVERSION = .12
    4.72 -+NAME=Woozy Beaver
    4.73 - 
    4.74 - # *DOCUMENTATION*
    4.75 - # To see a list of typical targets execute "make help"
    4.76 -diff --git a/REPORTING-BUGS b/REPORTING-BUGS
    4.77 ---- a/REPORTING-BUGS
    4.78 -+++ b/REPORTING-BUGS
    4.79 -@@ -16,6 +16,10 @@ code relevant to what you were doing. If
    4.80 - describe how to recreate it. That is worth even more than the oops itself.
    4.81 - The list of maintainers is in the MAINTAINERS file in this directory.
    4.82 - 
    4.83 -+      If it is a security bug, please copy the Security Contact listed
    4.84 -+in the MAINTAINERS file.  They can help coordinate bugfix and disclosure.
    4.85 -+See Documentation/SecurityBugs for more infomation.
    4.86 -+
    4.87 -       If you are totally stumped as to whom to send the report, send it to
    4.88 - linux-kernel@vger.kernel.org. (For more information on the linux-kernel
    4.89 - mailing list see http://www.tux.org/lkml/).
    4.90 -diff --git a/arch/ia64/kernel/fsys.S b/arch/ia64/kernel/fsys.S
    4.91 ---- a/arch/ia64/kernel/fsys.S
    4.92 -+++ b/arch/ia64/kernel/fsys.S
    4.93 -@@ -611,8 +611,10 @@ GLOBAL_ENTRY(fsys_bubble_down)
    4.94 - 	movl r2=ia64_ret_from_syscall
    4.95 - 	;;
    4.96 - 	mov rp=r2				// set the real return addr
    4.97 --	tbit.z p8,p0=r3,TIF_SYSCALL_TRACE
    4.98 -+	and r3=_TIF_SYSCALL_TRACEAUDIT,r3
    4.99 - 	;;
   4.100 -+	cmp.eq p8,p0=r3,r0
   4.101 -+
   4.102 - (p10)	br.cond.spnt.many ia64_ret_from_syscall	// p10==true means out registers are more than 8
   4.103 - (p8)	br.call.sptk.many b6=b6		// ignore this return addr
   4.104 - 	br.cond.sptk ia64_trace_syscall
   4.105 -diff --git a/arch/ia64/kernel/signal.c b/arch/ia64/kernel/signal.c
   4.106 ---- a/arch/ia64/kernel/signal.c
   4.107 -+++ b/arch/ia64/kernel/signal.c
   4.108 -@@ -224,7 +224,8 @@ ia64_rt_sigreturn (struct sigscratch *sc
   4.109 - 	 * could be corrupted.
   4.110 - 	 */
   4.111 - 	retval = (long) &ia64_leave_kernel;
   4.112 --	if (test_thread_flag(TIF_SYSCALL_TRACE))
   4.113 -+	if (test_thread_flag(TIF_SYSCALL_TRACE)
   4.114 -+	    || test_thread_flag(TIF_SYSCALL_AUDIT))
   4.115 - 		/*
   4.116 - 		 * strace expects to be notified after sigreturn returns even though the
   4.117 - 		 * context to which we return may not be in the middle of a syscall.
   4.118 -diff --git a/arch/ppc/oprofile/op_model_fsl_booke.c b/arch/ppc/oprofile/op_model_fsl_booke.c
   4.119 ---- a/arch/ppc/oprofile/op_model_fsl_booke.c
   4.120 -+++ b/arch/ppc/oprofile/op_model_fsl_booke.c
   4.121 -@@ -150,7 +150,6 @@ static void fsl_booke_handle_interrupt(s
   4.122 - 	int is_kernel;
   4.123 - 	int val;
   4.124 - 	int i;
   4.125 --	unsigned int cpu = smp_processor_id();
   4.126 - 
   4.127 - 	/* set the PMM bit (see comment below) */
   4.128 - 	mtmsr(mfmsr() | MSR_PMM);
   4.129 -@@ -162,7 +161,7 @@ static void fsl_booke_handle_interrupt(s
   4.130 - 		val = ctr_read(i);
   4.131 - 		if (val < 0) {
   4.132 - 			if (oprofile_running && ctr[i].enabled) {
   4.133 --				oprofile_add_sample(pc, is_kernel, i, cpu);
   4.134 -+				oprofile_add_pc(pc, is_kernel, i);
   4.135 - 				ctr_write(i, reset_value[i]);
   4.136 - 			} else {
   4.137 - 				ctr_write(i, 0);
   4.138 -diff --git a/arch/ppc/platforms/4xx/ebony.h b/arch/ppc/platforms/4xx/ebony.h
   4.139 ---- a/arch/ppc/platforms/4xx/ebony.h
   4.140 -+++ b/arch/ppc/platforms/4xx/ebony.h
   4.141 -@@ -61,8 +61,8 @@
   4.142 -  */
   4.143 - 
   4.144 - /* OpenBIOS defined UART mappings, used before early_serial_setup */
   4.145 --#define UART0_IO_BASE	(u8 *) 0xE0000200
   4.146 --#define UART1_IO_BASE	(u8 *) 0xE0000300
   4.147 -+#define UART0_IO_BASE	0xE0000200
   4.148 -+#define UART1_IO_BASE	0xE0000300
   4.149 - 
   4.150 - /* external Epson SG-615P */
   4.151 - #define BASE_BAUD	691200
   4.152 -diff --git a/arch/ppc/platforms/4xx/luan.h b/arch/ppc/platforms/4xx/luan.h
   4.153 ---- a/arch/ppc/platforms/4xx/luan.h
   4.154 -+++ b/arch/ppc/platforms/4xx/luan.h
   4.155 -@@ -47,9 +47,9 @@
   4.156 - #define RS_TABLE_SIZE	3
   4.157 - 
   4.158 - /* PIBS defined UART mappings, used before early_serial_setup */
   4.159 --#define UART0_IO_BASE	(u8 *) 0xa0000200
   4.160 --#define UART1_IO_BASE	(u8 *) 0xa0000300
   4.161 --#define UART2_IO_BASE	(u8 *) 0xa0000600
   4.162 -+#define UART0_IO_BASE	0xa0000200
   4.163 -+#define UART1_IO_BASE	0xa0000300
   4.164 -+#define UART2_IO_BASE	0xa0000600
   4.165 - 
   4.166 - #define BASE_BAUD	11059200
   4.167 - #define STD_UART_OP(num)					\
   4.168 -diff --git a/arch/ppc/platforms/4xx/ocotea.h b/arch/ppc/platforms/4xx/ocotea.h
   4.169 ---- a/arch/ppc/platforms/4xx/ocotea.h
   4.170 -+++ b/arch/ppc/platforms/4xx/ocotea.h
   4.171 -@@ -56,8 +56,8 @@
   4.172 - #define RS_TABLE_SIZE	2
   4.173 - 
   4.174 - /* OpenBIOS defined UART mappings, used before early_serial_setup */
   4.175 --#define UART0_IO_BASE	(u8 *) 0xE0000200
   4.176 --#define UART1_IO_BASE	(u8 *) 0xE0000300
   4.177 -+#define UART0_IO_BASE	0xE0000200
   4.178 -+#define UART1_IO_BASE	0xE0000300
   4.179 - 
   4.180 - #define BASE_BAUD	11059200/16
   4.181 - #define STD_UART_OP(num)					\
   4.182 -diff --git a/arch/ppc64/kernel/pSeries_iommu.c b/arch/ppc64/kernel/pSeries_iommu.c
   4.183 ---- a/arch/ppc64/kernel/pSeries_iommu.c
   4.184 -+++ b/arch/ppc64/kernel/pSeries_iommu.c
   4.185 -@@ -401,6 +401,8 @@ static void iommu_bus_setup_pSeriesLP(st
   4.186 - 	struct device_node *dn, *pdn;
   4.187 - 	unsigned int *dma_window = NULL;
   4.188 - 
   4.189 -+	DBG("iommu_bus_setup_pSeriesLP, bus %p, bus->self %p\n", bus, bus->self);
   4.190 -+
   4.191 - 	dn = pci_bus_to_OF_node(bus);
   4.192 - 
   4.193 - 	/* Find nearest ibm,dma-window, walking up the device tree */
   4.194 -@@ -455,6 +457,56 @@ static void iommu_dev_setup_pSeries(stru
   4.195 - 	}
   4.196 - }
   4.197 - 
   4.198 -+static void iommu_dev_setup_pSeriesLP(struct pci_dev *dev)
   4.199 -+{
   4.200 -+	struct device_node *pdn, *dn;
   4.201 -+	struct iommu_table *tbl;
   4.202 -+	int *dma_window = NULL;
   4.203 -+
   4.204 -+	DBG("iommu_dev_setup_pSeriesLP, dev %p (%s)\n", dev, dev->pretty_name);
   4.205 -+
   4.206 -+	/* dev setup for LPAR is a little tricky, since the device tree might
   4.207 -+	 * contain the dma-window properties per-device and not neccesarily
   4.208 -+	 * for the bus. So we need to search upwards in the tree until we
   4.209 -+	 * either hit a dma-window property, OR find a parent with a table
   4.210 -+	 * already allocated.
   4.211 -+	 */
   4.212 -+	dn = pci_device_to_OF_node(dev);
   4.213 -+
   4.214 -+	for (pdn = dn; pdn && !pdn->iommu_table; pdn = pdn->parent) {
   4.215 -+		dma_window = (unsigned int *)get_property(pdn, "ibm,dma-window", NULL);
   4.216 -+		if (dma_window)
   4.217 -+			break;
   4.218 -+	}
   4.219 -+
   4.220 -+	/* Check for parent == NULL so we don't try to setup the empty EADS
   4.221 -+	 * slots on POWER4 machines.
   4.222 -+	 */
   4.223 -+	if (dma_window == NULL || pdn->parent == NULL) {
   4.224 -+		/* Fall back to regular (non-LPAR) dev setup */
   4.225 -+		DBG("No dma window for device, falling back to regular setup\n");
   4.226 -+		iommu_dev_setup_pSeries(dev);
   4.227 -+		return;
   4.228 -+	} else {
   4.229 -+		DBG("Found DMA window, allocating table\n");
   4.230 -+	}
   4.231 -+
   4.232 -+	if (!pdn->iommu_table) {
   4.233 -+		/* iommu_table_setparms_lpar needs bussubno. */
   4.234 -+		pdn->bussubno = pdn->phb->bus->number;
   4.235 -+
   4.236 -+		tbl = (struct iommu_table *)kmalloc(sizeof(struct iommu_table),
   4.237 -+						    GFP_KERNEL);
   4.238 -+
   4.239 -+		iommu_table_setparms_lpar(pdn->phb, pdn, tbl, dma_window);
   4.240 -+
   4.241 -+		pdn->iommu_table = iommu_init_table(tbl);
   4.242 -+	}
   4.243 -+
   4.244 -+	if (pdn != dn)
   4.245 -+		dn->iommu_table = pdn->iommu_table;
   4.246 -+}
   4.247 -+
   4.248 - static void iommu_bus_setup_null(struct pci_bus *b) { }
   4.249 - static void iommu_dev_setup_null(struct pci_dev *d) { }
   4.250 - 
   4.251 -@@ -479,13 +531,14 @@ void iommu_init_early_pSeries(void)
   4.252 - 			ppc_md.tce_free	 = tce_free_pSeriesLP;
   4.253 - 		}
   4.254 - 		ppc_md.iommu_bus_setup = iommu_bus_setup_pSeriesLP;
   4.255 -+		ppc_md.iommu_dev_setup = iommu_dev_setup_pSeriesLP;
   4.256 - 	} else {
   4.257 - 		ppc_md.tce_build = tce_build_pSeries;
   4.258 - 		ppc_md.tce_free  = tce_free_pSeries;
   4.259 - 		ppc_md.iommu_bus_setup = iommu_bus_setup_pSeries;
   4.260 -+		ppc_md.iommu_dev_setup = iommu_dev_setup_pSeries;
   4.261 - 	}
   4.262 - 
   4.263 --	ppc_md.iommu_dev_setup = iommu_dev_setup_pSeries;
   4.264 - 
   4.265 - 	pci_iommu_init();
   4.266 - }
   4.267 -diff --git a/arch/sparc/kernel/ptrace.c b/arch/sparc/kernel/ptrace.c
   4.268 ---- a/arch/sparc/kernel/ptrace.c
   4.269 -+++ b/arch/sparc/kernel/ptrace.c
   4.270 -@@ -531,18 +531,6 @@ asmlinkage void do_ptrace(struct pt_regs
   4.271 - 			pt_error_return(regs, EIO);
   4.272 - 			goto out_tsk;
   4.273 - 		}
   4.274 --		if (addr != 1) {
   4.275 --			if (addr & 3) {
   4.276 --				pt_error_return(regs, EINVAL);
   4.277 --				goto out_tsk;
   4.278 --			}
   4.279 --#ifdef DEBUG_PTRACE
   4.280 --			printk ("Original: %08lx %08lx\n", child->thread.kregs->pc, child->thread.kregs->npc);
   4.281 --			printk ("Continuing with %08lx %08lx\n", addr, addr+4);
   4.282 --#endif
   4.283 --			child->thread.kregs->pc = addr;
   4.284 --			child->thread.kregs->npc = addr + 4;
   4.285 --		}
   4.286 - 
   4.287 - 		if (request == PTRACE_SYSCALL)
   4.288 - 			set_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
   4.289 -diff --git a/arch/sparc64/kernel/ptrace.c b/arch/sparc64/kernel/ptrace.c
   4.290 ---- a/arch/sparc64/kernel/ptrace.c
   4.291 -+++ b/arch/sparc64/kernel/ptrace.c
   4.292 -@@ -514,25 +514,6 @@ asmlinkage void do_ptrace(struct pt_regs
   4.293 - 			pt_error_return(regs, EIO);
   4.294 - 			goto out_tsk;
   4.295 - 		}
   4.296 --		if (addr != 1) {
   4.297 --			unsigned long pc_mask = ~0UL;
   4.298 --
   4.299 --			if ((child->thread_info->flags & _TIF_32BIT) != 0)
   4.300 --				pc_mask = 0xffffffff;
   4.301 --
   4.302 --			if (addr & 3) {
   4.303 --				pt_error_return(regs, EINVAL);
   4.304 --				goto out_tsk;
   4.305 --			}
   4.306 --#ifdef DEBUG_PTRACE
   4.307 --			printk ("Original: %016lx %016lx\n",
   4.308 --				child->thread_info->kregs->tpc,
   4.309 --				child->thread_info->kregs->tnpc);
   4.310 --			printk ("Continuing with %016lx %016lx\n", addr, addr+4);
   4.311 --#endif
   4.312 --			child->thread_info->kregs->tpc = (addr & pc_mask);
   4.313 --			child->thread_info->kregs->tnpc = ((addr + 4) & pc_mask);
   4.314 --		}
   4.315 - 
   4.316 - 		if (request == PTRACE_SYSCALL) {
   4.317 - 			set_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
   4.318 -diff --git a/arch/sparc64/kernel/signal32.c b/arch/sparc64/kernel/signal32.c
   4.319 ---- a/arch/sparc64/kernel/signal32.c
   4.320 -+++ b/arch/sparc64/kernel/signal32.c
   4.321 -@@ -192,10 +192,13 @@ int copy_siginfo_to_user32(compat_siginf
   4.322 - 			err |= __put_user(from->si_uid, &to->si_uid);
   4.323 - 			break;
   4.324 - 		case __SI_FAULT >> 16:
   4.325 --		case __SI_POLL >> 16:
   4.326 - 			err |= __put_user(from->si_trapno, &to->si_trapno);
   4.327 - 			err |= __put_user((unsigned long)from->si_addr, &to->si_addr);
   4.328 - 			break;
   4.329 -+		case __SI_POLL >> 16:
   4.330 -+			err |= __put_user(from->si_band, &to->si_band);
   4.331 -+			err |= __put_user(from->si_fd, &to->si_fd);
   4.332 -+			break;
   4.333 - 		case __SI_RT >> 16: /* This is not generated by the kernel as of now.  */
   4.334 - 		case __SI_MESGQ >> 16:
   4.335 - 			err |= __put_user(from->si_pid, &to->si_pid);
   4.336 -diff --git a/arch/sparc64/kernel/systbls.S b/arch/sparc64/kernel/systbls.S
   4.337 ---- a/arch/sparc64/kernel/systbls.S
   4.338 -+++ b/arch/sparc64/kernel/systbls.S
   4.339 -@@ -75,7 +75,7 @@ sys_call_table32:
   4.340 - /*260*/	.word compat_sys_sched_getaffinity, compat_sys_sched_setaffinity, sys32_timer_settime, compat_sys_timer_gettime, sys_timer_getoverrun
   4.341 - 	.word sys_timer_delete, sys32_timer_create, sys_ni_syscall, compat_sys_io_setup, sys_io_destroy
   4.342 - /*270*/	.word sys32_io_submit, sys_io_cancel, compat_sys_io_getevents, sys32_mq_open, sys_mq_unlink
   4.343 --	.word sys_mq_timedsend, sys_mq_timedreceive, compat_sys_mq_notify, compat_sys_mq_getsetattr, compat_sys_waitid
   4.344 -+	.word compat_sys_mq_timedsend, compat_sys_mq_timedreceive, compat_sys_mq_notify, compat_sys_mq_getsetattr, compat_sys_waitid
   4.345 - /*280*/	.word sys_ni_syscall, sys_add_key, sys_request_key, sys_keyctl
   4.346 - 
   4.347 - #endif /* CONFIG_COMPAT */
   4.348 -diff --git a/arch/um/include/sysdep-i386/syscalls.h b/arch/um/include/sysdep-i386/syscalls.h
   4.349 ---- a/arch/um/include/sysdep-i386/syscalls.h
   4.350 -+++ b/arch/um/include/sysdep-i386/syscalls.h
   4.351 -@@ -23,6 +23,9 @@ extern long sys_mmap2(unsigned long addr
   4.352 - 		      unsigned long prot, unsigned long flags,
   4.353 - 		      unsigned long fd, unsigned long pgoff);
   4.354 - 
   4.355 -+/* On i386 they choose a meaningless naming.*/
   4.356 -+#define __NR_kexec_load __NR_sys_kexec_load
   4.357 -+
   4.358 - #define ARCH_SYSCALLS \
   4.359 - 	[ __NR_waitpid ] = (syscall_handler_t *) sys_waitpid, \
   4.360 - 	[ __NR_break ] = (syscall_handler_t *) sys_ni_syscall, \
   4.361 -@@ -101,15 +104,12 @@ extern long sys_mmap2(unsigned long addr
   4.362 - 	[ 223 ] = (syscall_handler_t *) sys_ni_syscall, \
   4.363 - 	[ __NR_set_thread_area ] = (syscall_handler_t *) sys_ni_syscall, \
   4.364 - 	[ __NR_get_thread_area ] = (syscall_handler_t *) sys_ni_syscall, \
   4.365 --	[ __NR_fadvise64 ] = (syscall_handler_t *) sys_fadvise64, \
   4.366 - 	[ 251 ] = (syscall_handler_t *) sys_ni_syscall, \
   4.367 --        [ __NR_remap_file_pages ] = (syscall_handler_t *) sys_remap_file_pages, \
   4.368 --	[ __NR_utimes ] = (syscall_handler_t *) sys_utimes, \
   4.369 --	[ __NR_vserver ] = (syscall_handler_t *) sys_ni_syscall,
   4.370 --        
   4.371 -+	[ 285 ] = (syscall_handler_t *) sys_ni_syscall,
   4.372 -+
   4.373 - /* 222 doesn't yet have a name in include/asm-i386/unistd.h */
   4.374 - 
   4.375 --#define LAST_ARCH_SYSCALL __NR_vserver
   4.376 -+#define LAST_ARCH_SYSCALL 285
   4.377 - 
   4.378 - /*
   4.379 -  * Overrides for Emacs so that we follow Linus's tabbing style.
   4.380 -diff --git a/arch/um/include/sysdep-x86_64/syscalls.h b/arch/um/include/sysdep-x86_64/syscalls.h
   4.381 ---- a/arch/um/include/sysdep-x86_64/syscalls.h
   4.382 -+++ b/arch/um/include/sysdep-x86_64/syscalls.h
   4.383 -@@ -71,12 +71,7 @@ extern syscall_handler_t sys_arch_prctl;
   4.384 - 	[ __NR_iopl ] = (syscall_handler_t *) sys_ni_syscall, \
   4.385 - 	[ __NR_set_thread_area ] = (syscall_handler_t *) sys_ni_syscall, \
   4.386 - 	[ __NR_get_thread_area ] = (syscall_handler_t *) sys_ni_syscall, \
   4.387 --        [ __NR_remap_file_pages ] = (syscall_handler_t *) sys_remap_file_pages, \
   4.388 - 	[ __NR_semtimedop ] = (syscall_handler_t *) sys_semtimedop, \
   4.389 --	[ __NR_fadvise64 ] = (syscall_handler_t *) sys_fadvise64, \
   4.390 --	[ 223 ] = (syscall_handler_t *) sys_ni_syscall, \
   4.391 --	[ __NR_utimes ] = (syscall_handler_t *) sys_utimes, \
   4.392 --	[ __NR_vserver ] = (syscall_handler_t *) sys_ni_syscall, \
   4.393 - 	[ 251 ] = (syscall_handler_t *) sys_ni_syscall,
   4.394 - 
   4.395 - #define LAST_ARCH_SYSCALL 251
   4.396 -diff --git a/arch/um/kernel/skas/uaccess.c b/arch/um/kernel/skas/uaccess.c
   4.397 ---- a/arch/um/kernel/skas/uaccess.c
   4.398 -+++ b/arch/um/kernel/skas/uaccess.c
   4.399 -@@ -61,7 +61,8 @@ static void do_buffer_op(void *jmpbuf, v
   4.400 - 	void *arg;
   4.401 - 	int *res;
   4.402 - 
   4.403 --	va_copy(args, *(va_list *)arg_ptr);
   4.404 -+	/* Some old gccs recognize __va_copy, but not va_copy */
   4.405 -+	__va_copy(args, *(va_list *)arg_ptr);
   4.406 - 	addr = va_arg(args, unsigned long);
   4.407 - 	len = va_arg(args, int);
   4.408 - 	is_write = va_arg(args, int);
   4.409 -diff --git a/arch/um/kernel/sys_call_table.c b/arch/um/kernel/sys_call_table.c
   4.410 ---- a/arch/um/kernel/sys_call_table.c
   4.411 -+++ b/arch/um/kernel/sys_call_table.c
   4.412 -@@ -48,7 +48,6 @@ extern syscall_handler_t sys_vfork;
   4.413 - extern syscall_handler_t old_select;
   4.414 - extern syscall_handler_t sys_modify_ldt;
   4.415 - extern syscall_handler_t sys_rt_sigsuspend;
   4.416 --extern syscall_handler_t sys_vserver;
   4.417 - extern syscall_handler_t sys_mbind;
   4.418 - extern syscall_handler_t sys_get_mempolicy;
   4.419 - extern syscall_handler_t sys_set_mempolicy;
   4.420 -@@ -242,6 +241,7 @@ syscall_handler_t *sys_call_table[] = {
   4.421 - 	[ __NR_epoll_create ] = (syscall_handler_t *) sys_epoll_create,
   4.422 - 	[ __NR_epoll_ctl ] = (syscall_handler_t *) sys_epoll_ctl,
   4.423 - 	[ __NR_epoll_wait ] = (syscall_handler_t *) sys_epoll_wait,
   4.424 -+	[ __NR_remap_file_pages ] = (syscall_handler_t *) sys_remap_file_pages,
   4.425 -         [ __NR_set_tid_address ] = (syscall_handler_t *) sys_set_tid_address,
   4.426 - 	[ __NR_timer_create ] = (syscall_handler_t *) sys_timer_create,
   4.427 - 	[ __NR_timer_settime ] = (syscall_handler_t *) sys_timer_settime,
   4.428 -@@ -252,12 +252,10 @@ syscall_handler_t *sys_call_table[] = {
   4.429 - 	[ __NR_clock_gettime ] = (syscall_handler_t *) sys_clock_gettime,
   4.430 - 	[ __NR_clock_getres ] = (syscall_handler_t *) sys_clock_getres,
   4.431 - 	[ __NR_clock_nanosleep ] = (syscall_handler_t *) sys_clock_nanosleep,
   4.432 --	[ __NR_statfs64 ] = (syscall_handler_t *) sys_statfs64,
   4.433 --	[ __NR_fstatfs64 ] = (syscall_handler_t *) sys_fstatfs64,
   4.434 - 	[ __NR_tgkill ] = (syscall_handler_t *) sys_tgkill,
   4.435 - 	[ __NR_utimes ] = (syscall_handler_t *) sys_utimes,
   4.436 --	[ __NR_fadvise64_64 ] = (syscall_handler_t *) sys_fadvise64_64,
   4.437 --	[ __NR_vserver ] = (syscall_handler_t *) sys_vserver,
   4.438 -+	[ __NR_fadvise64 ] = (syscall_handler_t *) sys_fadvise64,
   4.439 -+	[ __NR_vserver ] = (syscall_handler_t *) sys_ni_syscall,
   4.440 - 	[ __NR_mbind ] = (syscall_handler_t *) sys_mbind,
   4.441 - 	[ __NR_get_mempolicy ] = (syscall_handler_t *) sys_get_mempolicy,
   4.442 - 	[ __NR_set_mempolicy ] = (syscall_handler_t *) sys_set_mempolicy,
   4.443 -@@ -267,9 +265,8 @@ syscall_handler_t *sys_call_table[] = {
   4.444 - 	[ __NR_mq_timedreceive ] = (syscall_handler_t *) sys_mq_timedreceive,
   4.445 - 	[ __NR_mq_notify ] = (syscall_handler_t *) sys_mq_notify,
   4.446 - 	[ __NR_mq_getsetattr ] = (syscall_handler_t *) sys_mq_getsetattr,
   4.447 --	[ __NR_sys_kexec_load ] = (syscall_handler_t *) sys_ni_syscall,
   4.448 -+	[ __NR_kexec_load ] = (syscall_handler_t *) sys_ni_syscall,
   4.449 - 	[ __NR_waitid ] = (syscall_handler_t *) sys_waitid,
   4.450 --	[ 285 ] = (syscall_handler_t *) sys_ni_syscall,
   4.451 - 	[ __NR_add_key ] = (syscall_handler_t *) sys_add_key,
   4.452 - 	[ __NR_request_key ] = (syscall_handler_t *) sys_request_key,
   4.453 - 	[ __NR_keyctl ] = (syscall_handler_t *) sys_keyctl,
   4.454 -diff --git a/arch/x86_64/kernel/apic.c b/arch/x86_64/kernel/apic.c
   4.455 ---- a/arch/x86_64/kernel/apic.c
   4.456 -+++ b/arch/x86_64/kernel/apic.c
   4.457 -@@ -775,9 +775,7 @@ void __init setup_boot_APIC_clock (void)
   4.458 - 
   4.459 - void __init setup_secondary_APIC_clock(void)
   4.460 - {
   4.461 --	local_irq_disable(); /* FIXME: Do we need this? --RR */
   4.462 - 	setup_APIC_timer(calibration_result);
   4.463 --	local_irq_enable();
   4.464 - }
   4.465 - 
   4.466 - void __init disable_APIC_timer(void)
   4.467 -diff --git a/arch/x86_64/kernel/ptrace.c b/arch/x86_64/kernel/ptrace.c
   4.468 ---- a/arch/x86_64/kernel/ptrace.c
   4.469 -+++ b/arch/x86_64/kernel/ptrace.c
   4.470 -@@ -129,13 +129,13 @@ static int putreg(struct task_struct *ch
   4.471 - 			value &= 0xffff;
   4.472 - 			return 0;
   4.473 - 		case offsetof(struct user_regs_struct,fs_base):
   4.474 --			if (!((value >> 48) == 0 || (value >> 48) == 0xffff))
   4.475 --				return -EIO; 
   4.476 -+			if (value >= TASK_SIZE)
   4.477 -+				return -EIO;
   4.478 - 			child->thread.fs = value;
   4.479 - 			return 0;
   4.480 - 		case offsetof(struct user_regs_struct,gs_base):
   4.481 --			if (!((value >> 48) == 0 || (value >> 48) == 0xffff))
   4.482 --				return -EIO; 
   4.483 -+			if (value >= TASK_SIZE)
   4.484 -+				return -EIO;
   4.485 - 			child->thread.gs = value;
   4.486 - 			return 0;
   4.487 - 		case offsetof(struct user_regs_struct, eflags):
   4.488 -@@ -149,6 +149,11 @@ static int putreg(struct task_struct *ch
   4.489 - 				return -EIO;
   4.490 - 			value &= 0xffff;
   4.491 - 			break;
   4.492 -+		case offsetof(struct user_regs_struct, rip):
   4.493 -+			/* Check if the new RIP address is canonical */
   4.494 -+			if (value >= TASK_SIZE)
   4.495 -+				return -EIO;
   4.496 -+			break;
   4.497 - 	}
   4.498 - 	put_stack_long(child, regno - sizeof(struct pt_regs), value);
   4.499 - 	return 0;
   4.500 -@@ -247,7 +252,7 @@ asmlinkage long sys_ptrace(long request,
   4.501 - 			break;
   4.502 - 
   4.503 - 		switch (addr) { 
   4.504 --		case 0 ... sizeof(struct user_regs_struct):
   4.505 -+		case 0 ... sizeof(struct user_regs_struct) - sizeof(long):
   4.506 - 			tmp = getreg(child, addr);
   4.507 - 			break;
   4.508 - 		case offsetof(struct user, u_debugreg[0]):
   4.509 -@@ -292,7 +297,7 @@ asmlinkage long sys_ptrace(long request,
   4.510 - 			break;
   4.511 - 
   4.512 - 		switch (addr) { 
   4.513 --		case 0 ... sizeof(struct user_regs_struct): 
   4.514 -+		case 0 ... sizeof(struct user_regs_struct) - sizeof(long):
   4.515 - 			ret = putreg(child, addr, data);
   4.516 - 			break;
   4.517 - 		/* Disallows to set a breakpoint into the vsyscall */
   4.518 -diff --git a/arch/x86_64/kernel/smpboot.c b/arch/x86_64/kernel/smpboot.c
   4.519 ---- a/arch/x86_64/kernel/smpboot.c
   4.520 -+++ b/arch/x86_64/kernel/smpboot.c
   4.521 -@@ -309,8 +309,6 @@ void __init smp_callin(void)
   4.522 - 	Dprintk("CALLIN, before setup_local_APIC().\n");
   4.523 - 	setup_local_APIC();
   4.524 - 
   4.525 --	local_irq_enable();
   4.526 --
   4.527 - 	/*
   4.528 - 	 * Get our bogomips.
   4.529 - 	 */
   4.530 -@@ -324,8 +322,6 @@ void __init smp_callin(void)
   4.531 - 	 */
   4.532 -  	smp_store_cpu_info(cpuid);
   4.533 - 
   4.534 --	local_irq_disable();
   4.535 --
   4.536 - 	/*
   4.537 - 	 * Allow the master to continue.
   4.538 - 	 */
   4.539 -diff --git a/arch/x86_64/mm/fault.c b/arch/x86_64/mm/fault.c
   4.540 ---- a/arch/x86_64/mm/fault.c
   4.541 -+++ b/arch/x86_64/mm/fault.c
   4.542 -@@ -236,6 +236,8 @@ static noinline void pgtable_bad(unsigne
   4.543 - 
   4.544 - /*
   4.545 -  * Handle a fault on the vmalloc or module mapping area
   4.546 -+ *
   4.547 -+ * This assumes no large pages in there.
   4.548 -  */
   4.549 - static int vmalloc_fault(unsigned long address)
   4.550 - {
   4.551 -@@ -274,7 +276,10 @@ static int vmalloc_fault(unsigned long a
   4.552 - 	if (!pte_present(*pte_ref))
   4.553 - 		return -1;
   4.554 - 	pte = pte_offset_kernel(pmd, address);
   4.555 --	if (!pte_present(*pte) || pte_page(*pte) != pte_page(*pte_ref))
   4.556 -+	/* Don't use pte_page here, because the mappings can point
   4.557 -+	   outside mem_map, and the NUMA hash lookup cannot handle
   4.558 -+	   that. */
   4.559 -+	if (!pte_present(*pte) || pte_pfn(*pte) != pte_pfn(*pte_ref))
   4.560 - 		BUG();
   4.561 - 	__flush_tlb_all();
   4.562 - 	return 0;
   4.563 -@@ -348,7 +353,9 @@ asmlinkage void do_page_fault(struct pt_
   4.564 - 	 * protection error (error_code & 1) == 0.
   4.565 - 	 */
   4.566 - 	if (unlikely(address >= TASK_SIZE)) {
   4.567 --		if (!(error_code & 5)) {
   4.568 -+		if (!(error_code & 5) &&
   4.569 -+		      ((address >= VMALLOC_START && address < VMALLOC_END) ||
   4.570 -+		       (address >= MODULES_VADDR && address < MODULES_END))) {
   4.571 - 			if (vmalloc_fault(address) < 0)
   4.572 - 				goto bad_area_nosemaphore;
   4.573 - 			return;
   4.574 -diff --git a/arch/x86_64/mm/ioremap.c b/arch/x86_64/mm/ioremap.c
   4.575 ---- a/arch/x86_64/mm/ioremap.c
   4.576 -+++ b/arch/x86_64/mm/ioremap.c
   4.577 -@@ -266,7 +266,7 @@ void iounmap(volatile void __iomem *addr
   4.578 - 	if ((p->flags >> 20) &&
   4.579 - 		p->phys_addr + p->size - 1 < virt_to_phys(high_memory)) {
   4.580 - 		/* p->size includes the guard page, but cpa doesn't like that */
   4.581 --		change_page_attr(virt_to_page(__va(p->phys_addr)),
   4.582 -+		change_page_attr_addr((unsigned long)(__va(p->phys_addr)),
   4.583 - 				 (p->size - PAGE_SIZE) >> PAGE_SHIFT,
   4.584 - 				 PAGE_KERNEL); 				 
   4.585 - 		global_flush_tlb();
   4.586 -diff --git a/drivers/block/ioctl.c b/drivers/block/ioctl.c
   4.587 ---- a/drivers/block/ioctl.c
   4.588 -+++ b/drivers/block/ioctl.c
   4.589 -@@ -237,3 +237,5 @@ long compat_blkdev_ioctl(struct file *fi
   4.590 - 	}
   4.591 - 	return ret;
   4.592 - }
   4.593 -+
   4.594 -+EXPORT_SYMBOL_GPL(blkdev_ioctl);
   4.595 -diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
   4.596 ---- a/drivers/block/pktcdvd.c
   4.597 -+++ b/drivers/block/pktcdvd.c
   4.598 -@@ -2400,7 +2400,7 @@ static int pkt_ioctl(struct inode *inode
   4.599 - 	case CDROM_LAST_WRITTEN:
   4.600 - 	case CDROM_SEND_PACKET:
   4.601 - 	case SCSI_IOCTL_SEND_COMMAND:
   4.602 --		return ioctl_by_bdev(pd->bdev, cmd, arg);
   4.603 -+		return blkdev_ioctl(pd->bdev->bd_inode, file, cmd, arg);
   4.604 - 
   4.605 - 	case CDROMEJECT:
   4.606 - 		/*
   4.607 -@@ -2408,7 +2408,7 @@ static int pkt_ioctl(struct inode *inode
   4.608 - 		 * have to unlock it or else the eject command fails.
   4.609 - 		 */
   4.610 - 		pkt_lock_door(pd, 0);
   4.611 --		return ioctl_by_bdev(pd->bdev, cmd, arg);
   4.612 -+		return blkdev_ioctl(pd->bdev->bd_inode, file, cmd, arg);
   4.613 - 
   4.614 - 	default:
   4.615 - 		printk("pktcdvd: Unknown ioctl for %s (%x)\n", pd->name, cmd);
   4.616 -diff --git a/drivers/char/drm/drm_ioctl.c b/drivers/char/drm/drm_ioctl.c
   4.617 ---- a/drivers/char/drm/drm_ioctl.c
   4.618 -+++ b/drivers/char/drm/drm_ioctl.c
   4.619 -@@ -326,6 +326,8 @@ int drm_setversion(DRM_IOCTL_ARGS)
   4.620 - 
   4.621 - 	DRM_COPY_FROM_USER_IOCTL(sv, argp, sizeof(sv));
   4.622 - 
   4.623 -+	memset(&version, 0, sizeof(version));
   4.624 -+
   4.625 - 	dev->driver->version(&version);
   4.626 - 	retv.drm_di_major = DRM_IF_MAJOR;
   4.627 - 	retv.drm_di_minor = DRM_IF_MINOR;
   4.628 -diff --git a/drivers/char/raw.c b/drivers/char/raw.c
   4.629 ---- a/drivers/char/raw.c
   4.630 -+++ b/drivers/char/raw.c
   4.631 -@@ -122,7 +122,7 @@ raw_ioctl(struct inode *inode, struct fi
   4.632 - {
   4.633 - 	struct block_device *bdev = filp->private_data;
   4.634 - 
   4.635 --	return ioctl_by_bdev(bdev, command, arg);
   4.636 -+	return blkdev_ioctl(bdev->bd_inode, filp, command, arg);
   4.637 - }
   4.638 - 
   4.639 - static void bind_device(struct raw_config_request *rq)
   4.640 -diff --git a/drivers/i2c/chips/eeprom.c b/drivers/i2c/chips/eeprom.c
   4.641 ---- a/drivers/i2c/chips/eeprom.c
   4.642 -+++ b/drivers/i2c/chips/eeprom.c
   4.643 -@@ -130,7 +130,8 @@ static ssize_t eeprom_read(struct kobjec
   4.644 - 
   4.645 - 	/* Hide Vaio security settings to regular users (16 first bytes) */
   4.646 - 	if (data->nature == VAIO && off < 16 && !capable(CAP_SYS_ADMIN)) {
   4.647 --		int in_row1 = 16 - off;
   4.648 -+		size_t in_row1 = 16 - off;
   4.649 -+		in_row1 = min(in_row1, count);
   4.650 - 		memset(buf, 0, in_row1);
   4.651 - 		if (count - in_row1 > 0)
   4.652 - 			memcpy(buf + in_row1, &data->data[16], count - in_row1);
   4.653 -diff --git a/drivers/i2c/chips/it87.c b/drivers/i2c/chips/it87.c
   4.654 ---- a/drivers/i2c/chips/it87.c
   4.655 -+++ b/drivers/i2c/chips/it87.c
   4.656 -@@ -631,7 +631,7 @@ static ssize_t show_alarms(struct device
   4.657 - 	struct it87_data *data = it87_update_device(dev);
   4.658 - 	return sprintf(buf,"%d\n", ALARMS_FROM_REG(data->alarms));
   4.659 - }
   4.660 --static DEVICE_ATTR(alarms, S_IRUGO | S_IWUSR, show_alarms, NULL);
   4.661 -+static DEVICE_ATTR(alarms, S_IRUGO, show_alarms, NULL);
   4.662 - 
   4.663 - static ssize_t
   4.664 - show_vrm_reg(struct device *dev, char *buf)
   4.665 -diff --git a/drivers/i2c/chips/via686a.c b/drivers/i2c/chips/via686a.c
   4.666 ---- a/drivers/i2c/chips/via686a.c
   4.667 -+++ b/drivers/i2c/chips/via686a.c
   4.668 -@@ -554,7 +554,7 @@ static ssize_t show_alarms(struct device
   4.669 - 	struct via686a_data *data = via686a_update_device(dev);
   4.670 - 	return sprintf(buf,"%d\n", ALARMS_FROM_REG(data->alarms));
   4.671 - }
   4.672 --static DEVICE_ATTR(alarms, S_IRUGO | S_IWUSR, show_alarms, NULL);
   4.673 -+static DEVICE_ATTR(alarms, S_IRUGO, show_alarms, NULL);
   4.674 - 
   4.675 - /* The driver. I choose to use type i2c_driver, as at is identical to both
   4.676 -    smbus_driver and isa_driver, and clients could be of either kind */
   4.677 -diff --git a/drivers/ide/ide-disk.c b/drivers/ide/ide-disk.c
   4.678 ---- a/drivers/ide/ide-disk.c
   4.679 -+++ b/drivers/ide/ide-disk.c
   4.680 -@@ -133,6 +133,8 @@ static ide_startstop_t __ide_do_rw_disk(
   4.681 - 	if (hwif->no_lba48_dma && lba48 && dma) {
   4.682 - 		if (block + rq->nr_sectors > 1ULL << 28)
   4.683 - 			dma = 0;
   4.684 -+		else
   4.685 -+			lba48 = 0;
   4.686 - 	}
   4.687 - 
   4.688 - 	if (!dma) {
   4.689 -@@ -146,7 +148,7 @@ static ide_startstop_t __ide_do_rw_disk(
   4.690 - 	/* FIXME: SELECT_MASK(drive, 0) ? */
   4.691 - 
   4.692 - 	if (drive->select.b.lba) {
   4.693 --		if (drive->addressing == 1) {
   4.694 -+		if (lba48) {
   4.695 - 			task_ioreg_t tasklets[10];
   4.696 - 
   4.697 - 			pr_debug("%s: LBA=0x%012llx\n", drive->name, block);
   4.698 -diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
   4.699 ---- a/drivers/input/serio/i8042-x86ia64io.h
   4.700 -+++ b/drivers/input/serio/i8042-x86ia64io.h
   4.701 -@@ -88,7 +88,7 @@ static struct dmi_system_id __initdata i
   4.702 - };
   4.703 - #endif
   4.704 - 
   4.705 --#ifdef CONFIG_ACPI
   4.706 -+#if defined(__ia64__) && defined(CONFIG_ACPI)
   4.707 - #include <linux/acpi.h>
   4.708 - #include <acpi/acpi_bus.h>
   4.709 - 
   4.710 -@@ -281,7 +281,7 @@ static inline int i8042_platform_init(vo
   4.711 - 	i8042_kbd_irq = I8042_MAP_IRQ(1);
   4.712 - 	i8042_aux_irq = I8042_MAP_IRQ(12);
   4.713 - 
   4.714 --#ifdef CONFIG_ACPI
   4.715 -+#if defined(__ia64__) && defined(CONFIG_ACPI)
   4.716 - 	if (i8042_acpi_init())
   4.717 - 		return -1;
   4.718 - #endif
   4.719 -@@ -300,7 +300,7 @@ static inline int i8042_platform_init(vo
   4.720 - 
   4.721 - static inline void i8042_platform_exit(void)
   4.722 - {
   4.723 --#ifdef CONFIG_ACPI
   4.724 -+#if defined(__ia64__) && defined(CONFIG_ACPI)
   4.725 - 	i8042_acpi_exit();
   4.726 - #endif
   4.727 - }
   4.728 -diff --git a/drivers/md/raid6altivec.uc b/drivers/md/raid6altivec.uc
   4.729 ---- a/drivers/md/raid6altivec.uc
   4.730 -+++ b/drivers/md/raid6altivec.uc
   4.731 -@@ -108,7 +108,11 @@ int raid6_have_altivec(void);
   4.732 - int raid6_have_altivec(void)
   4.733 - {
   4.734 - 	/* This assumes either all CPUs have Altivec or none does */
   4.735 -+#ifdef CONFIG_PPC64
   4.736 - 	return cur_cpu_spec->cpu_features & CPU_FTR_ALTIVEC;
   4.737 -+#else
   4.738 -+	return cur_cpu_spec[0]->cpu_features & CPU_FTR_ALTIVEC;
   4.739 -+#endif
   4.740 - }
   4.741 - #endif
   4.742 - 
   4.743 -diff --git a/drivers/media/video/adv7170.c b/drivers/media/video/adv7170.c
   4.744 ---- a/drivers/media/video/adv7170.c
   4.745 -+++ b/drivers/media/video/adv7170.c
   4.746 -@@ -130,7 +130,7 @@ adv7170_write_block (struct i2c_client *
   4.747 - 		u8 block_data[32];
   4.748 - 
   4.749 - 		msg.addr = client->addr;
   4.750 --		msg.flags = client->flags;
   4.751 -+		msg.flags = 0;
   4.752 - 		while (len >= 2) {
   4.753 - 			msg.buf = (char *) block_data;
   4.754 - 			msg.len = 0;
   4.755 -diff --git a/drivers/media/video/adv7175.c b/drivers/media/video/adv7175.c
   4.756 ---- a/drivers/media/video/adv7175.c
   4.757 -+++ b/drivers/media/video/adv7175.c
   4.758 -@@ -126,7 +126,7 @@ adv7175_write_block (struct i2c_client *
   4.759 - 		u8 block_data[32];
   4.760 - 
   4.761 - 		msg.addr = client->addr;
   4.762 --		msg.flags = client->flags;
   4.763 -+		msg.flags = 0;
   4.764 - 		while (len >= 2) {
   4.765 - 			msg.buf = (char *) block_data;
   4.766 - 			msg.len = 0;
   4.767 -diff --git a/drivers/media/video/bt819.c b/drivers/media/video/bt819.c
   4.768 ---- a/drivers/media/video/bt819.c
   4.769 -+++ b/drivers/media/video/bt819.c
   4.770 -@@ -146,7 +146,7 @@ bt819_write_block (struct i2c_client *cl
   4.771 - 		u8 block_data[32];
   4.772 - 
   4.773 - 		msg.addr = client->addr;
   4.774 --		msg.flags = client->flags;
   4.775 -+		msg.flags = 0;
   4.776 - 		while (len >= 2) {
   4.777 - 			msg.buf = (char *) block_data;
   4.778 - 			msg.len = 0;
   4.779 -diff --git a/drivers/media/video/bttv-cards.c b/drivers/media/video/bttv-cards.c
   4.780 ---- a/drivers/media/video/bttv-cards.c
   4.781 -+++ b/drivers/media/video/bttv-cards.c
   4.782 -@@ -1939,7 +1939,6 @@ struct tvcard bttv_tvcards[] = {
   4.783 -         .no_tda9875     = 1,
   4.784 -         .no_tda7432     = 1,
   4.785 -         .tuner_type     = TUNER_ABSENT,
   4.786 --        .no_video       = 1,
   4.787 - 	.pll            = PLL_28,
   4.788 - },{
   4.789 - 	.name           = "Teppro TEV-560/InterVision IV-560",
   4.790 -@@ -2718,8 +2717,6 @@ void __devinit bttv_init_card2(struct bt
   4.791 -         }
   4.792 - 	btv->pll.pll_current = -1;
   4.793 - 
   4.794 --	bttv_reset_audio(btv);
   4.795 --
   4.796 - 	/* tuner configuration (from card list / autodetect / insmod option) */
   4.797 -  	if (UNSET != bttv_tvcards[btv->c.type].tuner_type)
   4.798 - 		if(UNSET == btv->tuner_type)
   4.799 -diff --git a/drivers/media/video/saa7110.c b/drivers/media/video/saa7110.c
   4.800 ---- a/drivers/media/video/saa7110.c
   4.801 -+++ b/drivers/media/video/saa7110.c
   4.802 -@@ -60,8 +60,10 @@ MODULE_PARM_DESC(debug, "Debug level (0-
   4.803 - 
   4.804 - #define	I2C_SAA7110		0x9C	/* or 0x9E */
   4.805 - 
   4.806 -+#define SAA7110_NR_REG		0x35
   4.807 -+
   4.808 - struct saa7110 {
   4.809 --	unsigned char reg[54];
   4.810 -+	u8 reg[SAA7110_NR_REG];
   4.811 - 
   4.812 - 	int norm;
   4.813 - 	int input;
   4.814 -@@ -95,31 +97,28 @@ saa7110_write_block (struct i2c_client *
   4.815 - 		     unsigned int       len)
   4.816 - {
   4.817 - 	int ret = -1;
   4.818 --	u8 reg = *data++;
   4.819 -+	u8 reg = *data;		/* first register to write to */
   4.820 - 
   4.821 --	len--;
   4.822 -+	/* Sanity check */
   4.823 -+	if (reg + (len - 1) > SAA7110_NR_REG)
   4.824 -+		return ret;
   4.825 - 
   4.826 - 	/* the saa7110 has an autoincrement function, use it if
   4.827 - 	 * the adapter understands raw I2C */
   4.828 - 	if (i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
   4.829 - 		struct saa7110 *decoder = i2c_get_clientdata(client);
   4.830 - 		struct i2c_msg msg;
   4.831 --		u8 block_data[54];
   4.832 - 
   4.833 --		msg.len = 0;
   4.834 --		msg.buf = (char *) block_data;
   4.835 -+		msg.len = len;
   4.836 -+		msg.buf = (char *) data;
   4.837 - 		msg.addr = client->addr;
   4.838 --		msg.flags = client->flags;
   4.839 --		while (len >= 1) {
   4.840 --			msg.len = 0;
   4.841 --			block_data[msg.len++] = reg;
   4.842 --			while (len-- >= 1 && msg.len < 54)
   4.843 --				block_data[msg.len++] =
   4.844 --				    decoder->reg[reg++] = *data++;
   4.845 --			ret = i2c_transfer(client->adapter, &msg, 1);
   4.846 --		}
   4.847 -+		msg.flags = 0;
   4.848 -+		ret = i2c_transfer(client->adapter, &msg, 1);
   4.849 -+
   4.850 -+		/* Cache the written data */
   4.851 -+		memcpy(decoder->reg + reg, data + 1, len - 1);
   4.852 - 	} else {
   4.853 --		while (len-- >= 1) {
   4.854 -+		for (++data, --len; len; len--) {
   4.855 - 			if ((ret = saa7110_write(client, reg++,
   4.856 - 						 *data++)) < 0)
   4.857 - 				break;
   4.858 -@@ -192,7 +191,7 @@ saa7110_selmux (struct i2c_client *clien
   4.859 - 	return 0;
   4.860 - }
   4.861 - 
   4.862 --static const unsigned char initseq[] = {
   4.863 -+static const unsigned char initseq[1 + SAA7110_NR_REG] = {
   4.864 - 	0, 0x4C, 0x3C, 0x0D, 0xEF, 0xBD, 0xF2, 0x03, 0x00,
   4.865 - 	/* 0x08 */ 0xF8, 0xF8, 0x60, 0x60, 0x00, 0x86, 0x18, 0x90,
   4.866 - 	/* 0x10 */ 0x00, 0x59, 0x40, 0x46, 0x42, 0x1A, 0xFF, 0xDA,
   4.867 -diff --git a/drivers/media/video/saa7114.c b/drivers/media/video/saa7114.c
   4.868 ---- a/drivers/media/video/saa7114.c
   4.869 -+++ b/drivers/media/video/saa7114.c
   4.870 -@@ -163,7 +163,7 @@ saa7114_write_block (struct i2c_client *
   4.871 - 		u8 block_data[32];
   4.872 - 
   4.873 - 		msg.addr = client->addr;
   4.874 --		msg.flags = client->flags;
   4.875 -+		msg.flags = 0;
   4.876 - 		while (len >= 2) {
   4.877 - 			msg.buf = (char *) block_data;
   4.878 - 			msg.len = 0;
   4.879 -diff --git a/drivers/media/video/saa7185.c b/drivers/media/video/saa7185.c
   4.880 ---- a/drivers/media/video/saa7185.c
   4.881 -+++ b/drivers/media/video/saa7185.c
   4.882 -@@ -118,7 +118,7 @@ saa7185_write_block (struct i2c_client *
   4.883 - 		u8 block_data[32];
   4.884 - 
   4.885 - 		msg.addr = client->addr;
   4.886 --		msg.flags = client->flags;
   4.887 -+		msg.flags = 0;
   4.888 - 		while (len >= 2) {
   4.889 - 			msg.buf = (char *) block_data;
   4.890 - 			msg.len = 0;
   4.891 -diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c
   4.892 ---- a/drivers/net/3c59x.c
   4.893 -+++ b/drivers/net/3c59x.c
   4.894 -@@ -1581,7 +1581,8 @@ vortex_up(struct net_device *dev)
   4.895 - 
   4.896 - 	if (VORTEX_PCI(vp)) {
   4.897 - 		pci_set_power_state(VORTEX_PCI(vp), PCI_D0);	/* Go active */
   4.898 --		pci_restore_state(VORTEX_PCI(vp));
   4.899 -+		if (vp->pm_state_valid)
   4.900 -+			pci_restore_state(VORTEX_PCI(vp));
   4.901 - 		pci_enable_device(VORTEX_PCI(vp));
   4.902 - 	}
   4.903 - 
   4.904 -@@ -2741,6 +2742,7 @@ vortex_down(struct net_device *dev, int 
   4.905 - 		outl(0, ioaddr + DownListPtr);
   4.906 - 
   4.907 - 	if (final_down && VORTEX_PCI(vp)) {
   4.908 -+		vp->pm_state_valid = 1;
   4.909 - 		pci_save_state(VORTEX_PCI(vp));
   4.910 - 		acpi_set_WOL(dev);
   4.911 - 	}
   4.912 -@@ -3243,9 +3245,10 @@ static void acpi_set_WOL(struct net_devi
   4.913 - 		outw(RxEnable, ioaddr + EL3_CMD);
   4.914 - 
   4.915 - 		pci_enable_wake(VORTEX_PCI(vp), 0, 1);
   4.916 -+
   4.917 -+		/* Change the power state to D3; RxEnable doesn't take effect. */
   4.918 -+		pci_set_power_state(VORTEX_PCI(vp), PCI_D3hot);
   4.919 - 	}
   4.920 --	/* Change the power state to D3; RxEnable doesn't take effect. */
   4.921 --	pci_set_power_state(VORTEX_PCI(vp), PCI_D3hot);
   4.922 - }
   4.923 - 
   4.924 - 
   4.925 -diff --git a/drivers/net/amd8111e.c b/drivers/net/amd8111e.c
   4.926 ---- a/drivers/net/amd8111e.c
   4.927 -+++ b/drivers/net/amd8111e.c
   4.928 -@@ -1381,6 +1381,8 @@ static int amd8111e_open(struct net_devi
   4.929 - 
   4.930 - 	if(amd8111e_restart(dev)){
   4.931 - 		spin_unlock_irq(&lp->lock);
   4.932 -+		if (dev->irq)
   4.933 -+			free_irq(dev->irq, dev);
   4.934 - 		return -ENOMEM;
   4.935 - 	}
   4.936 - 	/* Start ipg timer */
   4.937 -diff --git a/drivers/net/ppp_async.c b/drivers/net/ppp_async.c
   4.938 ---- a/drivers/net/ppp_async.c
   4.939 -+++ b/drivers/net/ppp_async.c
   4.940 -@@ -1000,7 +1000,7 @@ static void async_lcp_peek(struct asyncp
   4.941 - 	data += 4;
   4.942 - 	dlen -= 4;
   4.943 - 	/* data[0] is code, data[1] is length */
   4.944 --	while (dlen >= 2 && dlen >= data[1]) {
   4.945 -+	while (dlen >= 2 && dlen >= data[1] && data[1] >= 2) {
   4.946 - 		switch (data[0]) {
   4.947 - 		case LCP_MRU:
   4.948 - 			val = (data[2] << 8) + data[3];
   4.949 -diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
   4.950 ---- a/drivers/net/r8169.c
   4.951 -+++ b/drivers/net/r8169.c
   4.952 -@@ -1683,16 +1683,19 @@ static void rtl8169_free_rx_skb(struct r
   4.953 - 	rtl8169_make_unusable_by_asic(desc);
   4.954 - }
   4.955 - 
   4.956 --static inline void rtl8169_return_to_asic(struct RxDesc *desc, int rx_buf_sz)
   4.957 -+static inline void rtl8169_mark_to_asic(struct RxDesc *desc, u32 rx_buf_sz)
   4.958 - {
   4.959 --	desc->opts1 |= cpu_to_le32(DescOwn + rx_buf_sz);
   4.960 -+	u32 eor = le32_to_cpu(desc->opts1) & RingEnd;
   4.961 -+
   4.962 -+	desc->opts1 = cpu_to_le32(DescOwn | eor | rx_buf_sz);
   4.963 - }
   4.964 - 
   4.965 --static inline void rtl8169_give_to_asic(struct RxDesc *desc, dma_addr_t mapping,
   4.966 --					int rx_buf_sz)
   4.967 -+static inline void rtl8169_map_to_asic(struct RxDesc *desc, dma_addr_t mapping,
   4.968 -+				       u32 rx_buf_sz)
   4.969 - {
   4.970 - 	desc->addr = cpu_to_le64(mapping);
   4.971 --	desc->opts1 |= cpu_to_le32(DescOwn + rx_buf_sz);
   4.972 -+	wmb();
   4.973 -+	rtl8169_mark_to_asic(desc, rx_buf_sz);
   4.974 - }
   4.975 - 
   4.976 - static int rtl8169_alloc_rx_skb(struct pci_dev *pdev, struct sk_buff **sk_buff,
   4.977 -@@ -1712,7 +1715,7 @@ static int rtl8169_alloc_rx_skb(struct p
   4.978 - 	mapping = pci_map_single(pdev, skb->tail, rx_buf_sz,
   4.979 - 				 PCI_DMA_FROMDEVICE);
   4.980 - 
   4.981 --	rtl8169_give_to_asic(desc, mapping, rx_buf_sz);
   4.982 -+	rtl8169_map_to_asic(desc, mapping, rx_buf_sz);
   4.983 - 
   4.984 - out:
   4.985 - 	return ret;
   4.986 -@@ -2150,7 +2153,7 @@ static inline int rtl8169_try_rx_copy(st
   4.987 - 			skb_reserve(skb, NET_IP_ALIGN);
   4.988 - 			eth_copy_and_sum(skb, sk_buff[0]->tail, pkt_size, 0);
   4.989 - 			*sk_buff = skb;
   4.990 --			rtl8169_return_to_asic(desc, rx_buf_sz);
   4.991 -+			rtl8169_mark_to_asic(desc, rx_buf_sz);
   4.992 - 			ret = 0;
   4.993 - 		}
   4.994 - 	}
   4.995 -diff --git a/drivers/net/sis900.c b/drivers/net/sis900.c
   4.996 ---- a/drivers/net/sis900.c
   4.997 -+++ b/drivers/net/sis900.c
   4.998 -@@ -236,7 +236,7 @@ static int __devinit sis900_get_mac_addr
   4.999 - 	signature = (u16) read_eeprom(ioaddr, EEPROMSignature);    
  4.1000 - 	if (signature == 0xffff || signature == 0x0000) {
  4.1001 - 		printk (KERN_INFO "%s: Error EERPOM read %x\n", 
  4.1002 --			net_dev->name, signature);
  4.1003 -+			pci_name(pci_dev), signature);
  4.1004 - 		return 0;
  4.1005 - 	}
  4.1006 - 
  4.1007 -@@ -268,7 +268,7 @@ static int __devinit sis630e_get_mac_add
  4.1008 - 	if (!isa_bridge)
  4.1009 - 		isa_bridge = pci_get_device(PCI_VENDOR_ID_SI, 0x0018, isa_bridge);
  4.1010 - 	if (!isa_bridge) {
  4.1011 --		printk("%s: Can not find ISA bridge\n", net_dev->name);
  4.1012 -+		printk("%s: Can not find ISA bridge\n", pci_name(pci_dev));
  4.1013 - 		return 0;
  4.1014 - 	}
  4.1015 - 	pci_read_config_byte(isa_bridge, 0x48, &reg);
  4.1016 -@@ -456,10 +456,6 @@ static int __devinit sis900_probe(struct
  4.1017 - 	net_dev->tx_timeout = sis900_tx_timeout;
  4.1018 - 	net_dev->watchdog_timeo = TX_TIMEOUT;
  4.1019 - 	net_dev->ethtool_ops = &sis900_ethtool_ops;
  4.1020 --	
  4.1021 --	ret = register_netdev(net_dev);
  4.1022 --	if (ret)
  4.1023 --		goto err_unmap_rx;
  4.1024 - 		
  4.1025 - 	/* Get Mac address according to the chip revision */
  4.1026 - 	pci_read_config_byte(pci_dev, PCI_CLASS_REVISION, &revision);
  4.1027 -@@ -476,7 +472,7 @@ static int __devinit sis900_probe(struct
  4.1028 - 
  4.1029 - 	if (ret == 0) {
  4.1030 - 		ret = -ENODEV;
  4.1031 --		goto err_out_unregister;
  4.1032 -+		goto err_unmap_rx;
  4.1033 - 	}
  4.1034 - 	
  4.1035 - 	/* 630ET : set the mii access mode as software-mode */
  4.1036 -@@ -486,7 +482,7 @@ static int __devinit sis900_probe(struct
  4.1037 - 	/* probe for mii transceiver */
  4.1038 - 	if (sis900_mii_probe(net_dev) == 0) {
  4.1039 - 		ret = -ENODEV;
  4.1040 --		goto err_out_unregister;
  4.1041 -+		goto err_unmap_rx;
  4.1042 - 	}
  4.1043 - 
  4.1044 - 	/* save our host bridge revision */
  4.1045 -@@ -496,6 +492,10 @@ static int __devinit sis900_probe(struct
  4.1046 - 		pci_dev_put(dev);
  4.1047 - 	}
  4.1048 - 
  4.1049 -+	ret = register_netdev(net_dev);
  4.1050 -+	if (ret)
  4.1051 -+		goto err_unmap_rx;
  4.1052 -+
  4.1053 - 	/* print some information about our NIC */
  4.1054 - 	printk(KERN_INFO "%s: %s at %#lx, IRQ %d, ", net_dev->name,
  4.1055 - 	       card_name, ioaddr, net_dev->irq);
  4.1056 -@@ -505,8 +505,6 @@ static int __devinit sis900_probe(struct
  4.1057 - 
  4.1058 - 	return 0;
  4.1059 - 
  4.1060 -- err_out_unregister:
  4.1061 -- 	unregister_netdev(net_dev);
  4.1062 -  err_unmap_rx:
  4.1063 - 	pci_free_consistent(pci_dev, RX_TOTAL_SIZE, sis_priv->rx_ring,
  4.1064 - 		sis_priv->rx_ring_dma);
  4.1065 -@@ -533,6 +531,7 @@ static int __devinit sis900_probe(struct
  4.1066 - static int __init sis900_mii_probe(struct net_device * net_dev)
  4.1067 - {
  4.1068 - 	struct sis900_private * sis_priv = net_dev->priv;
  4.1069 -+	const char *dev_name = pci_name(sis_priv->pci_dev);
  4.1070 - 	u16 poll_bit = MII_STAT_LINK, status = 0;
  4.1071 - 	unsigned long timeout = jiffies + 5 * HZ;
  4.1072 - 	int phy_addr;
  4.1073 -@@ -582,21 +581,20 @@ static int __init sis900_mii_probe(struc
  4.1074 - 					mii_phy->phy_types =
  4.1075 - 					    (mii_status & (MII_STAT_CAN_TX_FDX | MII_STAT_CAN_TX)) ? LAN : HOME;
  4.1076 - 				printk(KERN_INFO "%s: %s transceiver found at address %d.\n",
  4.1077 --				       net_dev->name, mii_chip_table[i].name,
  4.1078 -+				       dev_name, mii_chip_table[i].name,
  4.1079 - 				       phy_addr);
  4.1080 - 				break;
  4.1081 - 			}
  4.1082 - 			
  4.1083 - 		if( !mii_chip_table[i].phy_id1 ) {
  4.1084 - 			printk(KERN_INFO "%s: Unknown PHY transceiver found at address %d.\n",
  4.1085 --			       net_dev->name, phy_addr);
  4.1086 -+			       dev_name, phy_addr);
  4.1087 - 			mii_phy->phy_types = UNKNOWN;
  4.1088 - 		}
  4.1089 - 	}
  4.1090 - 	
  4.1091 - 	if (sis_priv->mii == NULL) {
  4.1092 --		printk(KERN_INFO "%s: No MII transceivers found!\n",
  4.1093 --			net_dev->name);
  4.1094 -+		printk(KERN_INFO "%s: No MII transceivers found!\n", dev_name);
  4.1095 - 		return 0;
  4.1096 - 	}
  4.1097 - 
  4.1098 -@@ -621,7 +619,7 @@ static int __init sis900_mii_probe(struc
  4.1099 - 			poll_bit ^= (mdio_read(net_dev, sis_priv->cur_phy, MII_STATUS) & poll_bit);
  4.1100 - 			if (time_after_eq(jiffies, timeout)) {
  4.1101 - 				printk(KERN_WARNING "%s: reset phy and link down now\n",
  4.1102 --					net_dev->name);
  4.1103 -+				       dev_name);
  4.1104 - 				return -ETIME;
  4.1105 - 			}
  4.1106 - 		}
  4.1107 -@@ -691,7 +689,7 @@ static u16 sis900_default_phy(struct net
  4.1108 - 		sis_priv->mii = default_phy;
  4.1109 - 		sis_priv->cur_phy = default_phy->phy_addr;
  4.1110 - 		printk(KERN_INFO "%s: Using transceiver found at address %d as default\n",
  4.1111 --					net_dev->name,sis_priv->cur_phy);
  4.1112 -+		       pci_name(sis_priv->pci_dev), sis_priv->cur_phy);
  4.1113 - 	}
  4.1114 - 	
  4.1115 - 	status = mdio_read(net_dev, sis_priv->cur_phy, MII_CONTROL);
  4.1116 -diff --git a/drivers/net/tun.c b/drivers/net/tun.c
  4.1117 ---- a/drivers/net/tun.c
  4.1118 -+++ b/drivers/net/tun.c
  4.1119 -@@ -229,7 +229,7 @@ static __inline__ ssize_t tun_get_user(s
  4.1120 - 	size_t len = count;
  4.1121 - 
  4.1122 - 	if (!(tun->flags & TUN_NO_PI)) {
  4.1123 --		if ((len -= sizeof(pi)) > len)
  4.1124 -+		if ((len -= sizeof(pi)) > count)
  4.1125 - 			return -EINVAL;
  4.1126 - 
  4.1127 - 		if(memcpy_fromiovec((void *)&pi, iv, sizeof(pi)))
  4.1128 -diff --git a/drivers/net/via-rhine.c b/drivers/net/via-rhine.c
  4.1129 ---- a/drivers/net/via-rhine.c
  4.1130 -+++ b/drivers/net/via-rhine.c
  4.1131 -@@ -1197,8 +1197,10 @@ static int rhine_open(struct net_device 
  4.1132 - 		       dev->name, rp->pdev->irq);
  4.1133 - 
  4.1134 - 	rc = alloc_ring(dev);
  4.1135 --	if (rc)
  4.1136 -+	if (rc) {
  4.1137 -+		free_irq(rp->pdev->irq, dev);
  4.1138 - 		return rc;
  4.1139 -+	}
  4.1140 - 	alloc_rbufs(dev);
  4.1141 - 	alloc_tbufs(dev);
  4.1142 - 	rhine_chip_reset(dev);
  4.1143 -@@ -1899,6 +1901,9 @@ static void rhine_shutdown (struct devic
  4.1144 - 	struct rhine_private *rp = netdev_priv(dev);
  4.1145 - 	void __iomem *ioaddr = rp->base;
  4.1146 - 
  4.1147 -+	if (!(rp->quirks & rqWOL))
  4.1148 -+		return; /* Nothing to do for non-WOL adapters */
  4.1149 -+
  4.1150 - 	rhine_power_init(dev);
  4.1151 - 
  4.1152 - 	/* Make sure we use pattern 0, 1 and not 4, 5 */
  4.1153 -diff --git a/drivers/net/wan/hd6457x.c b/drivers/net/wan/hd6457x.c
  4.1154 ---- a/drivers/net/wan/hd6457x.c
  4.1155 -+++ b/drivers/net/wan/hd6457x.c
  4.1156 -@@ -315,7 +315,7 @@ static inline void sca_rx(card_t *card, 
  4.1157 - #endif
  4.1158 - 	stats->rx_packets++;
  4.1159 - 	stats->rx_bytes += skb->len;
  4.1160 --	skb->dev->last_rx = jiffies;
  4.1161 -+	dev->last_rx = jiffies;
  4.1162 - 	skb->protocol = hdlc_type_trans(skb, dev);
  4.1163 - 	netif_rx(skb);
  4.1164 - }
  4.1165 -diff --git a/drivers/pci/hotplug/pciehp_ctrl.c b/drivers/pci/hotplug/pciehp_ctrl.c
  4.1166 ---- a/drivers/pci/hotplug/pciehp_ctrl.c
  4.1167 -+++ b/drivers/pci/hotplug/pciehp_ctrl.c
  4.1168 -@@ -1354,10 +1354,11 @@ static u32 remove_board(struct pci_func 
  4.1169 - 				dbg("PCI Bridge Hot-Remove s:b:d:f(%02x:%02x:%02x:%02x)\n", 
  4.1170 - 					ctrl->seg, func->bus, func->device, func->function);
  4.1171 - 				bridge_slot_remove(func);
  4.1172 --			} else
  4.1173 -+			} else {
  4.1174 - 				dbg("PCI Function Hot-Remove s:b:d:f(%02x:%02x:%02x:%02x)\n", 
  4.1175 - 					ctrl->seg, func->bus, func->device, func->function);
  4.1176 - 				slot_remove(func);
  4.1177 -+			}
  4.1178 - 
  4.1179 - 			func = pciehp_slot_find(ctrl->slot_bus, device, 0);
  4.1180 - 		}
  4.1181 -diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c
  4.1182 ---- a/drivers/usb/serial/visor.c
  4.1183 -+++ b/drivers/usb/serial/visor.c
  4.1184 -@@ -386,6 +386,7 @@ struct visor_private {
  4.1185 - 	int bytes_in;
  4.1186 - 	int bytes_out;
  4.1187 - 	int outstanding_urbs;
  4.1188 -+	int throttled;
  4.1189 - };
  4.1190 - 
  4.1191 - /* number of outstanding urbs to prevent userspace DoS from happening */
  4.1192 -@@ -415,6 +416,7 @@ static int visor_open (struct usb_serial
  4.1193 - 	priv->bytes_in = 0;
  4.1194 - 	priv->bytes_out = 0;
  4.1195 - 	priv->outstanding_urbs = 0;
  4.1196 -+	priv->throttled = 0;
  4.1197 - 	spin_unlock_irqrestore(&priv->lock, flags);
  4.1198 - 
  4.1199 - 	/*
  4.1200 -@@ -602,6 +604,7 @@ static void visor_read_bulk_callback (st
  4.1201 - 	struct tty_struct *tty;
  4.1202 - 	unsigned long flags;
  4.1203 - 	int i;
  4.1204 -+	int throttled;
  4.1205 - 	int result;
  4.1206 - 
  4.1207 - 	dbg("%s - port %d", __FUNCTION__, port->number);
  4.1208 -@@ -627,18 +630,21 @@ static void visor_read_bulk_callback (st
  4.1209 - 	}
  4.1210 - 	spin_lock_irqsave(&priv->lock, flags);
  4.1211 - 	priv->bytes_in += urb->actual_length;
  4.1212 -+	throttled = priv->throttled;
  4.1213 - 	spin_unlock_irqrestore(&priv->lock, flags);
  4.1214 - 
  4.1215 --	/* Continue trying to always read  */
  4.1216 --	usb_fill_bulk_urb (port->read_urb, port->serial->dev,
  4.1217 --			   usb_rcvbulkpipe(port->serial->dev,
  4.1218 --					   port->bulk_in_endpointAddress),
  4.1219 --			   port->read_urb->transfer_buffer,
  4.1220 --			   port->read_urb->transfer_buffer_length,
  4.1221 --			   visor_read_bulk_callback, port);
  4.1222 --	result = usb_submit_urb(port->read_urb, GFP_ATOMIC);
  4.1223 --	if (result)
  4.1224 --		dev_err(&port->dev, "%s - failed resubmitting read urb, error %d\n", __FUNCTION__, result);
  4.1225 -+	/* Continue trying to always read if we should */
  4.1226 -+	if (!throttled) {
  4.1227 -+		usb_fill_bulk_urb (port->read_urb, port->serial->dev,
  4.1228 -+				   usb_rcvbulkpipe(port->serial->dev,
  4.1229 -+						   port->bulk_in_endpointAddress),
  4.1230 -+				   port->read_urb->transfer_buffer,
  4.1231 -+				   port->read_urb->transfer_buffer_length,
  4.1232 -+				   visor_read_bulk_callback, port);
  4.1233 -+		result = usb_submit_urb(port->read_urb, GFP_ATOMIC);
  4.1234 -+		if (result)
  4.1235 -+			dev_err(&port->dev, "%s - failed resubmitting read urb, error %d\n", __FUNCTION__, result);
  4.1236 -+	}
  4.1237 - 	return;
  4.1238 - }
  4.1239 - 
  4.1240 -@@ -683,16 +689,26 @@ exit:
  4.1241 - 
  4.1242 - static void visor_throttle (struct usb_serial_port *port)
  4.1243 - {
  4.1244 -+	struct visor_private *priv = usb_get_serial_port_data(port);
  4.1245 -+	unsigned long flags;
  4.1246 -+
  4.1247 - 	dbg("%s - port %d", __FUNCTION__, port->number);
  4.1248 --	usb_kill_urb(port->read_urb);
  4.1249 -+	spin_lock_irqsave(&priv->lock, flags);
  4.1250 -+	priv->throttled = 1;
  4.1251 -+	spin_unlock_irqrestore(&priv->lock, flags);
  4.1252 - }
  4.1253 - 
  4.1254 - 
  4.1255 - static void visor_unthrottle (struct usb_serial_port *port)
  4.1256 - {
  4.1257 -+	struct visor_private *priv = usb_get_serial_port_data(port);
  4.1258 -+	unsigned long flags;
  4.1259 - 	int result;
  4.1260 - 
  4.1261 - 	dbg("%s - port %d", __FUNCTION__, port->number);
  4.1262 -+	spin_lock_irqsave(&priv->lock, flags);
  4.1263 -+	priv->throttled = 0;
  4.1264 -+	spin_unlock_irqrestore(&priv->lock, flags);
  4.1265 - 
  4.1266 - 	port->read_urb->dev = port->serial->dev;
  4.1267 - 	result = usb_submit_urb(port->read_urb, GFP_ATOMIC);
  4.1268 -diff --git a/drivers/video/matrox/matroxfb_accel.c b/drivers/video/matrox/matroxfb_accel.c
  4.1269 ---- a/drivers/video/matrox/matroxfb_accel.c
  4.1270 -+++ b/drivers/video/matrox/matroxfb_accel.c
  4.1271 -@@ -438,13 +438,21 @@ static void matroxfb_1bpp_imageblit(WPMI
  4.1272 - 		} else if (step == 1) {
  4.1273 - 			/* Special case for 1..8bit widths */
  4.1274 - 			while (height--) {
  4.1275 --				mga_writel(mmio, 0, *chardata);
  4.1276 -+#if defined(__BIG_ENDIAN)
  4.1277 -+				fb_writel((*chardata) << 24, mmio.vaddr);
  4.1278 -+#else
  4.1279 -+				fb_writel(*chardata, mmio.vaddr);
  4.1280 -+#endif
  4.1281 - 				chardata++;
  4.1282 - 			}
  4.1283 - 		} else if (step == 2) {
  4.1284 - 			/* Special case for 9..15bit widths */
  4.1285 - 			while (height--) {
  4.1286 --				mga_writel(mmio, 0, *(u_int16_t*)chardata);
  4.1287 -+#if defined(__BIG_ENDIAN)
  4.1288 -+				fb_writel((*(u_int16_t*)chardata) << 16, mmio.vaddr);
  4.1289 -+#else
  4.1290 -+				fb_writel(*(u_int16_t*)chardata, mmio.vaddr);
  4.1291 -+#endif
  4.1292 - 				chardata += 2;
  4.1293 - 			}
  4.1294 - 		} else {
  4.1295 -@@ -454,7 +462,7 @@ static void matroxfb_1bpp_imageblit(WPMI
  4.1296 - 				
  4.1297 - 				for (i = 0; i < step; i += 4) {
  4.1298 - 					/* Hope that there are at least three readable bytes beyond the end of bitmap */
  4.1299 --					mga_writel(mmio, 0, get_unaligned((u_int32_t*)(chardata + i)));
  4.1300 -+					fb_writel(get_unaligned((u_int32_t*)(chardata + i)),mmio.vaddr);
  4.1301 - 				}
  4.1302 - 				chardata += step;
  4.1303 - 			}
  4.1304 -diff --git a/drivers/video/matrox/matroxfb_base.h b/drivers/video/matrox/matroxfb_base.h
  4.1305 ---- a/drivers/video/matrox/matroxfb_base.h
  4.1306 -+++ b/drivers/video/matrox/matroxfb_base.h
  4.1307 -@@ -170,14 +170,14 @@ static inline void mga_memcpy_toio(vaddr
  4.1308 - 
  4.1309 - 	if ((unsigned long)src & 3) {
  4.1310 - 		while (len >= 4) {
  4.1311 --			writel(get_unaligned((u32 *)src), addr);
  4.1312 -+			fb_writel(get_unaligned((u32 *)src), addr);
  4.1313 - 			addr++;
  4.1314 - 			len -= 4;
  4.1315 - 			src += 4;
  4.1316 - 		}
  4.1317 - 	} else {
  4.1318 - 		while (len >= 4) {
  4.1319 --			writel(*(u32 *)src, addr);
  4.1320 -+			fb_writel(*(u32 *)src, addr);
  4.1321 - 			addr++;
  4.1322 - 			len -= 4;
  4.1323 - 			src += 4;
  4.1324 -diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
  4.1325 ---- a/fs/binfmt_elf.c
  4.1326 -+++ b/fs/binfmt_elf.c
  4.1327 -@@ -257,7 +257,7 @@ create_elf_tables(struct linux_binprm *b
  4.1328 - 	}
  4.1329 - 
  4.1330 - 	/* Populate argv and envp */
  4.1331 --	p = current->mm->arg_start;
  4.1332 -+	p = current->mm->arg_end = current->mm->arg_start;
  4.1333 - 	while (argc-- > 0) {
  4.1334 - 		size_t len;
  4.1335 - 		__put_user((elf_addr_t)p, argv++);
  4.1336 -@@ -1008,6 +1008,7 @@ out_free_ph:
  4.1337 - static int load_elf_library(struct file *file)
  4.1338 - {
  4.1339 - 	struct elf_phdr *elf_phdata;
  4.1340 -+	struct elf_phdr *eppnt;
  4.1341 - 	unsigned long elf_bss, bss, len;
  4.1342 - 	int retval, error, i, j;
  4.1343 - 	struct elfhdr elf_ex;
  4.1344 -@@ -1031,44 +1032,47 @@ static int load_elf_library(struct file 
  4.1345 - 	/* j < ELF_MIN_ALIGN because elf_ex.e_phnum <= 2 */
  4.1346 - 
  4.1347 - 	error = -ENOMEM;
  4.1348 --	elf_phdata = (struct elf_phdr *) kmalloc(j, GFP_KERNEL);
  4.1349 -+	elf_phdata = kmalloc(j, GFP_KERNEL);
  4.1350 - 	if (!elf_phdata)
  4.1351 - 		goto out;
  4.1352 - 
  4.1353 -+	eppnt = elf_phdata;
  4.1354 - 	error = -ENOEXEC;
  4.1355 --	retval = kernel_read(file, elf_ex.e_phoff, (char *) elf_phdata, j);
  4.1356 -+	retval = kernel_read(file, elf_ex.e_phoff, (char *)eppnt, j);
  4.1357 - 	if (retval != j)
  4.1358 - 		goto out_free_ph;
  4.1359 - 
  4.1360 - 	for (j = 0, i = 0; i<elf_ex.e_phnum; i++)
  4.1361 --		if ((elf_phdata + i)->p_type == PT_LOAD) j++;
  4.1362 -+		if ((eppnt + i)->p_type == PT_LOAD)
  4.1363 -+			j++;
  4.1364 - 	if (j != 1)
  4.1365 - 		goto out_free_ph;
  4.1366 - 
  4.1367 --	while (elf_phdata->p_type != PT_LOAD) elf_phdata++;
  4.1368 -+	while (eppnt->p_type != PT_LOAD)
  4.1369 -+		eppnt++;
  4.1370 - 
  4.1371 - 	/* Now use mmap to map the library into memory. */
  4.1372 - 	down_write(&current->mm->mmap_sem);
  4.1373 - 	error = do_mmap(file,
  4.1374 --			ELF_PAGESTART(elf_phdata->p_vaddr),
  4.1375 --			(elf_phdata->p_filesz +
  4.1376 --			 ELF_PAGEOFFSET(elf_phdata->p_vaddr)),
  4.1377 -+			ELF_PAGESTART(eppnt->p_vaddr),
  4.1378 -+			(eppnt->p_filesz +
  4.1379 -+			 ELF_PAGEOFFSET(eppnt->p_vaddr)),
  4.1380 - 			PROT_READ | PROT_WRITE | PROT_EXEC,
  4.1381 - 			MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE,
  4.1382 --			(elf_phdata->p_offset -
  4.1383 --			 ELF_PAGEOFFSET(elf_phdata->p_vaddr)));
  4.1384 -+			(eppnt->p_offset -
  4.1385 -+			 ELF_PAGEOFFSET(eppnt->p_vaddr)));
  4.1386 - 	up_write(&current->mm->mmap_sem);
  4.1387 --	if (error != ELF_PAGESTART(elf_phdata->p_vaddr))
  4.1388 -+	if (error != ELF_PAGESTART(eppnt->p_vaddr))
  4.1389 - 		goto out_free_ph;
  4.1390 - 
  4.1391 --	elf_bss = elf_phdata->p_vaddr + elf_phdata->p_filesz;
  4.1392 -+	elf_bss = eppnt->p_vaddr + eppnt->p_filesz;
  4.1393 - 	if (padzero(elf_bss)) {
  4.1394 - 		error = -EFAULT;
  4.1395 - 		goto out_free_ph;
  4.1396 - 	}
  4.1397 - 
  4.1398 --	len = ELF_PAGESTART(elf_phdata->p_filesz + elf_phdata->p_vaddr + ELF_MIN_ALIGN - 1);
  4.1399 --	bss = elf_phdata->p_memsz + elf_phdata->p_vaddr;
  4.1400 -+	len = ELF_PAGESTART(eppnt->p_filesz + eppnt->p_vaddr + ELF_MIN_ALIGN - 1);
  4.1401 -+	bss = eppnt->p_memsz + eppnt->p_vaddr;
  4.1402 - 	if (bss > len) {
  4.1403 - 		down_write(&current->mm->mmap_sem);
  4.1404 - 		do_brk(len, bss - len);
  4.1405 -@@ -1275,7 +1279,7 @@ static void fill_prstatus(struct elf_prs
  4.1406 - static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p,
  4.1407 - 		       struct mm_struct *mm)
  4.1408 - {
  4.1409 --	int i, len;
  4.1410 -+	unsigned int i, len;
  4.1411 - 	
  4.1412 - 	/* first copy the parameters from user space */
  4.1413 - 	memset(psinfo, 0, sizeof(struct elf_prpsinfo));
  4.1414 -diff --git a/fs/cramfs/inode.c b/fs/cramfs/inode.c
  4.1415 ---- a/fs/cramfs/inode.c
  4.1416 -+++ b/fs/cramfs/inode.c
  4.1417 -@@ -70,6 +70,7 @@ static struct inode *get_cramfs_inode(st
  4.1418 - 			inode->i_data.a_ops = &cramfs_aops;
  4.1419 - 		} else {
  4.1420 - 			inode->i_size = 0;
  4.1421 -+			inode->i_blocks = 0;
  4.1422 - 			init_special_inode(inode, inode->i_mode,
  4.1423 - 				old_decode_dev(cramfs_inode->size));
  4.1424 - 		}
  4.1425 -diff --git a/fs/eventpoll.c b/fs/eventpoll.c
  4.1426 ---- a/fs/eventpoll.c
  4.1427 -+++ b/fs/eventpoll.c
  4.1428 -@@ -619,6 +619,7 @@ eexit_1:
  4.1429 - 	return error;
  4.1430 - }
  4.1431 - 
  4.1432 -+#define MAX_EVENTS (INT_MAX / sizeof(struct epoll_event))
  4.1433 - 
  4.1434 - /*
  4.1435 -  * Implement the event wait interface for the eventpoll file. It is the kernel
  4.1436 -@@ -635,7 +636,7 @@ asmlinkage long sys_epoll_wait(int epfd,
  4.1437 - 		     current, epfd, events, maxevents, timeout));
  4.1438 - 
  4.1439 - 	/* The maximum number of event must be greater than zero */
  4.1440 --	if (maxevents <= 0)
  4.1441 -+	if (maxevents <= 0 || maxevents > MAX_EVENTS)
  4.1442 - 		return -EINVAL;
  4.1443 - 
  4.1444 - 	/* Verify that the area passed by the user is writeable */
  4.1445 -diff --git a/fs/exec.c b/fs/exec.c
  4.1446 ---- a/fs/exec.c
  4.1447 -+++ b/fs/exec.c
  4.1448 -@@ -814,7 +814,7 @@ void get_task_comm(char *buf, struct tas
  4.1449 - {
  4.1450 - 	/* buf must be at least sizeof(tsk->comm) in size */
  4.1451 - 	task_lock(tsk);
  4.1452 --	memcpy(buf, tsk->comm, sizeof(tsk->comm));
  4.1453 -+	strncpy(buf, tsk->comm, sizeof(tsk->comm));
  4.1454 - 	task_unlock(tsk);
  4.1455 - }
  4.1456 - 
  4.1457 -diff --git a/fs/ext2/dir.c b/fs/ext2/dir.c
  4.1458 ---- a/fs/ext2/dir.c
  4.1459 -+++ b/fs/ext2/dir.c
  4.1460 -@@ -592,6 +592,7 @@ int ext2_make_empty(struct inode *inode,
  4.1461 - 		goto fail;
  4.1462 - 	}
  4.1463 - 	kaddr = kmap_atomic(page, KM_USER0);
  4.1464 -+       memset(kaddr, 0, chunk_size);
  4.1465 - 	de = (struct ext2_dir_entry_2 *)kaddr;
  4.1466 - 	de->name_len = 1;
  4.1467 - 	de->rec_len = cpu_to_le16(EXT2_DIR_REC_LEN(1));
  4.1468 -diff --git a/fs/ext3/balloc.c b/fs/ext3/balloc.c
  4.1469 ---- a/fs/ext3/balloc.c
  4.1470 -+++ b/fs/ext3/balloc.c
  4.1471 -@@ -268,7 +268,8 @@ void ext3_discard_reservation(struct ino
  4.1472 - 
  4.1473 - 	if (!rsv_is_empty(&rsv->rsv_window)) {
  4.1474 - 		spin_lock(rsv_lock);
  4.1475 --		rsv_window_remove(inode->i_sb, rsv);
  4.1476 -+		if (!rsv_is_empty(&rsv->rsv_window))
  4.1477 -+			rsv_window_remove(inode->i_sb, rsv);
  4.1478 - 		spin_unlock(rsv_lock);
  4.1479 - 	}
  4.1480 - }
  4.1481 -diff --git a/fs/hfs/mdb.c b/fs/hfs/mdb.c
  4.1482 ---- a/fs/hfs/mdb.c
  4.1483 -+++ b/fs/hfs/mdb.c
  4.1484 -@@ -333,6 +333,8 @@ void hfs_mdb_close(struct super_block *s
  4.1485 -  * Release the resources associated with the in-core MDB.  */
  4.1486 - void hfs_mdb_put(struct super_block *sb)
  4.1487 - {
  4.1488 -+	if (!HFS_SB(sb))
  4.1489 -+		return;
  4.1490 - 	/* free the B-trees */
  4.1491 - 	hfs_btree_close(HFS_SB(sb)->ext_tree);
  4.1492 - 	hfs_btree_close(HFS_SB(sb)->cat_tree);
  4.1493 -@@ -340,4 +342,7 @@ void hfs_mdb_put(struct super_block *sb)
  4.1494 - 	/* free the buffers holding the primary and alternate MDBs */
  4.1495 - 	brelse(HFS_SB(sb)->mdb_bh);
  4.1496 - 	brelse(HFS_SB(sb)->alt_mdb_bh);
  4.1497 -+
  4.1498 -+	kfree(HFS_SB(sb));
  4.1499 -+	sb->s_fs_info = NULL;
  4.1500 - }
  4.1501 -diff --git a/fs/hfs/super.c b/fs/hfs/super.c
  4.1502 ---- a/fs/hfs/super.c
  4.1503 -+++ b/fs/hfs/super.c
  4.1504 -@@ -263,7 +263,7 @@ static int hfs_fill_super(struct super_b
  4.1505 - 	res = -EINVAL;
  4.1506 - 	if (!parse_options((char *)data, sbi)) {
  4.1507 - 		hfs_warn("hfs_fs: unable to parse mount options.\n");
  4.1508 --		goto bail3;
  4.1509 -+		goto bail;
  4.1510 - 	}
  4.1511 - 
  4.1512 - 	sb->s_op = &hfs_super_operations;
  4.1513 -@@ -276,7 +276,7 @@ static int hfs_fill_super(struct super_b
  4.1514 - 			hfs_warn("VFS: Can't find a HFS filesystem on dev %s.\n",
  4.1515 - 				hfs_mdb_name(sb));
  4.1516 - 		res = -EINVAL;
  4.1517 --		goto bail2;
  4.1518 -+		goto bail;
  4.1519 - 	}
  4.1520 - 
  4.1521 - 	/* try to get the root inode */
  4.1522 -@@ -306,10 +306,8 @@ bail_iput:
  4.1523 - 	iput(root_inode);
  4.1524 - bail_no_root:
  4.1525 - 	hfs_warn("hfs_fs: get root inode failed.\n");
  4.1526 -+bail:
  4.1527 - 	hfs_mdb_put(sb);
  4.1528 --bail2:
  4.1529 --bail3:
  4.1530 --	kfree(sbi);
  4.1531 - 	return res;
  4.1532 - }
  4.1533 - 
  4.1534 -diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
  4.1535 ---- a/fs/hfsplus/super.c
  4.1536 -+++ b/fs/hfsplus/super.c
  4.1537 -@@ -207,7 +207,9 @@ static void hfsplus_write_super(struct s
  4.1538 - static void hfsplus_put_super(struct super_block *sb)
  4.1539 - {
  4.1540 - 	dprint(DBG_SUPER, "hfsplus_put_super\n");
  4.1541 --	if (!(sb->s_flags & MS_RDONLY)) {
  4.1542 -+	if (!sb->s_fs_info)
  4.1543 -+		return;
  4.1544 -+	if (!(sb->s_flags & MS_RDONLY) && HFSPLUS_SB(sb).s_vhdr) {
  4.1545 - 		struct hfsplus_vh *vhdr = HFSPLUS_SB(sb).s_vhdr;
  4.1546 - 
  4.1547 - 		vhdr->modify_date = hfsp_now2mt();
  4.1548 -@@ -223,6 +225,8 @@ static void hfsplus_put_super(struct sup
  4.1549 - 	iput(HFSPLUS_SB(sb).alloc_file);
  4.1550 - 	iput(HFSPLUS_SB(sb).hidden_dir);
  4.1551 - 	brelse(HFSPLUS_SB(sb).s_vhbh);
  4.1552 -+	kfree(sb->s_fs_info);
  4.1553 -+	sb->s_fs_info = NULL;
  4.1554 - }
  4.1555 - 
  4.1556 - static int hfsplus_statfs(struct super_block *sb, struct kstatfs *buf)
  4.1557 -diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
  4.1558 ---- a/fs/isofs/inode.c
  4.1559 -+++ b/fs/isofs/inode.c
  4.1560 -@@ -685,6 +685,8 @@ root_found:
  4.1561 - 	  sbi->s_log_zone_size = isonum_723 (h_pri->logical_block_size);
  4.1562 - 	  sbi->s_max_size = isonum_733(h_pri->volume_space_size);
  4.1563 - 	} else {
  4.1564 -+	  if (!pri)
  4.1565 -+	    goto out_freebh;
  4.1566 - 	  rootp = (struct iso_directory_record *) pri->root_directory_record;
  4.1567 - 	  sbi->s_nzones = isonum_733 (pri->volume_space_size);
  4.1568 - 	  sbi->s_log_zone_size = isonum_723 (pri->logical_block_size);
  4.1569 -@@ -1395,6 +1397,9 @@ struct inode *isofs_iget(struct super_bl
  4.1570 - 	struct inode *inode;
  4.1571 - 	struct isofs_iget5_callback_data data;
  4.1572 - 
  4.1573 -+	if (offset >= 1ul << sb->s_blocksize_bits)
  4.1574 -+		return NULL;
  4.1575 -+
  4.1576 - 	data.block = block;
  4.1577 - 	data.offset = offset;
  4.1578 - 
  4.1579 -diff --git a/fs/isofs/rock.c b/fs/isofs/rock.c
  4.1580 ---- a/fs/isofs/rock.c
  4.1581 -+++ b/fs/isofs/rock.c
  4.1582 -@@ -53,6 +53,7 @@
  4.1583 -   if(LEN & 1) LEN++;						\
  4.1584 -   CHR = ((unsigned char *) DE) + LEN;				\
  4.1585 -   LEN = *((unsigned char *) DE) - LEN;                          \
  4.1586 -+  if (LEN<0) LEN=0;                                             \
  4.1587 -   if (ISOFS_SB(inode->i_sb)->s_rock_offset!=-1)                \
  4.1588 -   {                                                             \
  4.1589 -      LEN-=ISOFS_SB(inode->i_sb)->s_rock_offset;                \
  4.1590 -@@ -73,6 +74,10 @@
  4.1591 -     offset1 = 0; \
  4.1592 -     pbh = sb_bread(DEV->i_sb, block); \
  4.1593 -     if(pbh){       \
  4.1594 -+      if (offset > pbh->b_size || offset + cont_size > pbh->b_size){	\
  4.1595 -+	brelse(pbh); \
  4.1596 -+	goto out; \
  4.1597 -+      } \
  4.1598 -       memcpy(buffer + offset1, pbh->b_data + offset, cont_size - offset1); \
  4.1599 -       brelse(pbh); \
  4.1600 -       chr = (unsigned char *) buffer; \
  4.1601 -@@ -103,12 +108,13 @@ int get_rock_ridge_filename(struct iso_d
  4.1602 -     struct rock_ridge * rr;
  4.1603 -     int sig;
  4.1604 -     
  4.1605 --    while (len > 1){ /* There may be one byte for padding somewhere */
  4.1606 -+    while (len > 2){ /* There may be one byte for padding somewhere */
  4.1607 -       rr = (struct rock_ridge *) chr;
  4.1608 --      if (rr->len == 0) goto out; /* Something got screwed up here */
  4.1609 -+      if (rr->len < 3) goto out; /* Something got screwed up here */
  4.1610 -       sig = isonum_721(chr);
  4.1611 -       chr += rr->len; 
  4.1612 -       len -= rr->len;
  4.1613 -+      if (len < 0) goto out;	/* corrupted isofs */
  4.1614 - 
  4.1615 -       switch(sig){
  4.1616 -       case SIG('R','R'):
  4.1617 -@@ -122,6 +128,7 @@ int get_rock_ridge_filename(struct iso_d
  4.1618 - 	break;
  4.1619 -       case SIG('N','M'):
  4.1620 - 	if (truncate) break;
  4.1621 -+	if (rr->len < 5) break;
  4.1622 -         /*
  4.1623 - 	 * If the flags are 2 or 4, this indicates '.' or '..'.
  4.1624 - 	 * We don't want to do anything with this, because it
  4.1625 -@@ -186,12 +193,13 @@ parse_rock_ridge_inode_internal(struct i
  4.1626 -     struct rock_ridge * rr;
  4.1627 -     int rootflag;
  4.1628 -     
  4.1629 --    while (len > 1){ /* There may be one byte for padding somewhere */
  4.1630 -+    while (len > 2){ /* There may be one byte for padding somewhere */
  4.1631 -       rr = (struct rock_ridge *) chr;
  4.1632 --      if (rr->len == 0) goto out; /* Something got screwed up here */
  4.1633 -+      if (rr->len < 3) goto out; /* Something got screwed up here */
  4.1634 -       sig = isonum_721(chr);
  4.1635 -       chr += rr->len; 
  4.1636 -       len -= rr->len;
  4.1637 -+      if (len < 0) goto out;	/* corrupted isofs */
  4.1638 -       
  4.1639 -       switch(sig){
  4.1640 - #ifndef CONFIG_ZISOFS		/* No flag for SF or ZF */
  4.1641 -@@ -462,7 +470,7 @@ static int rock_ridge_symlink_readpage(s
  4.1642 - 	struct rock_ridge *rr;
  4.1643 - 
  4.1644 - 	if (!ISOFS_SB(inode->i_sb)->s_rock)
  4.1645 --		panic ("Cannot have symlink with high sierra variant of iso filesystem\n");
  4.1646 -+		goto error;
  4.1647 - 
  4.1648 - 	block = ei->i_iget5_block;
  4.1649 - 	lock_kernel();
  4.1650 -@@ -487,13 +495,15 @@ static int rock_ridge_symlink_readpage(s
  4.1651 - 	SETUP_ROCK_RIDGE(raw_inode, chr, len);
  4.1652 - 
  4.1653 -       repeat:
  4.1654 --	while (len > 1) { /* There may be one byte for padding somewhere */
  4.1655 -+	while (len > 2) { /* There may be one byte for padding somewhere */
  4.1656 - 		rr = (struct rock_ridge *) chr;
  4.1657 --		if (rr->len == 0)
  4.1658 -+		if (rr->len < 3)
  4.1659 - 			goto out;	/* Something got screwed up here */
  4.1660 - 		sig = isonum_721(chr);
  4.1661 - 		chr += rr->len;
  4.1662 - 		len -= rr->len;
  4.1663 -+		if (len < 0)
  4.1664 -+			goto out;	/* corrupted isofs */
  4.1665 - 
  4.1666 - 		switch (sig) {
  4.1667 - 		case SIG('R', 'R'):
  4.1668 -@@ -543,6 +553,7 @@ static int rock_ridge_symlink_readpage(s
  4.1669 -       fail:
  4.1670 - 	brelse(bh);
  4.1671 - 	unlock_kernel();
  4.1672 -+      error:
  4.1673 - 	SetPageError(page);
  4.1674 - 	kunmap(page);
  4.1675 - 	unlock_page(page);
  4.1676 -diff --git a/fs/jbd/checkpoint.c b/fs/jbd/checkpoint.c
  4.1677 ---- a/fs/jbd/checkpoint.c
  4.1678 -+++ b/fs/jbd/checkpoint.c
  4.1679 -@@ -339,8 +339,10 @@ int log_do_checkpoint(journal_t *journal
  4.1680 - 			}
  4.1681 - 		} while (jh != last_jh && !retry);
  4.1682 - 
  4.1683 --		if (batch_count)
  4.1684 -+		if (batch_count) {
  4.1685 - 			__flush_batch(journal, bhs, &batch_count);
  4.1686 -+			retry = 1;
  4.1687 -+		}
  4.1688 - 
  4.1689 - 		/*
  4.1690 - 		 * If someone cleaned up this transaction while we slept, we're
  4.1691 -diff --git a/fs/jbd/transaction.c b/fs/jbd/transaction.c
  4.1692 ---- a/fs/jbd/transaction.c
  4.1693 -+++ b/fs/jbd/transaction.c
  4.1694 -@@ -1775,10 +1775,10 @@ static int journal_unmap_buffer(journal_
  4.1695 - 			JBUFFER_TRACE(jh, "checkpointed: add to BJ_Forget");
  4.1696 - 			ret = __dispose_buffer(jh,
  4.1697 - 					journal->j_running_transaction);
  4.1698 -+			journal_put_journal_head(jh);
  4.1699 - 			spin_unlock(&journal->j_list_lock);
  4.1700 - 			jbd_unlock_bh_state(bh);
  4.1701 - 			spin_unlock(&journal->j_state_lock);
  4.1702 --			journal_put_journal_head(jh);
  4.1703 - 			return ret;
  4.1704 - 		} else {
  4.1705 - 			/* There is no currently-running transaction. So the
  4.1706 -@@ -1789,10 +1789,10 @@ static int journal_unmap_buffer(journal_
  4.1707 - 				JBUFFER_TRACE(jh, "give to committing trans");
  4.1708 - 				ret = __dispose_buffer(jh,
  4.1709 - 					journal->j_committing_transaction);
  4.1710 -+				journal_put_journal_head(jh);
  4.1711 - 				spin_unlock(&journal->j_list_lock);
  4.1712 - 				jbd_unlock_bh_state(bh);
  4.1713 - 				spin_unlock(&journal->j_state_lock);
  4.1714 --				journal_put_journal_head(jh);
  4.1715 - 				return ret;
  4.1716 - 			} else {
  4.1717 - 				/* The orphan record's transaction has
  4.1718 -@@ -1813,10 +1813,10 @@ static int journal_unmap_buffer(journal_
  4.1719 - 					journal->j_running_transaction);
  4.1720 - 			jh->b_next_transaction = NULL;
  4.1721 - 		}
  4.1722 -+		journal_put_journal_head(jh);
  4.1723 - 		spin_unlock(&journal->j_list_lock);
  4.1724 - 		jbd_unlock_bh_state(bh);
  4.1725 - 		spin_unlock(&journal->j_state_lock);
  4.1726 --		journal_put_journal_head(jh);
  4.1727 - 		return 0;
  4.1728 - 	} else {
  4.1729 - 		/* Good, the buffer belongs to the running transaction.
  4.1730 -diff --git a/include/asm-x86_64/processor.h b/include/asm-x86_64/processor.h
  4.1731 ---- a/include/asm-x86_64/processor.h
  4.1732 -+++ b/include/asm-x86_64/processor.h
  4.1733 -@@ -160,9 +160,9 @@ static inline void clear_in_cr4 (unsigne
  4.1734 - 
  4.1735 - 
  4.1736 - /*
  4.1737 -- * User space process size. 47bits.
  4.1738 -+ * User space process size. 47bits minus one guard page.
  4.1739 -  */
  4.1740 --#define TASK_SIZE	(0x800000000000UL)
  4.1741 -+#define TASK_SIZE	(0x800000000000UL - 4096)
  4.1742 - 
  4.1743 - /* This decides where the kernel will search for a free chunk of vm
  4.1744 -  * space during mmap's.
  4.1745 -diff --git a/include/linux/err.h b/include/linux/err.h
  4.1746 ---- a/include/linux/err.h
  4.1747 -+++ b/include/linux/err.h
  4.1748 -@@ -13,6 +13,8 @@
  4.1749 -  * This should be a per-architecture thing, to allow different
  4.1750 -  * error and pointer decisions.
  4.1751 -  */
  4.1752 -+#define IS_ERR_VALUE(x) unlikely((x) > (unsigned long)-1000L)
  4.1753 -+
  4.1754 - static inline void *ERR_PTR(long error)
  4.1755 - {
  4.1756 - 	return (void *) error;
  4.1757 -@@ -25,7 +27,7 @@ static inline long PTR_ERR(const void *p
  4.1758 - 
  4.1759 - static inline long IS_ERR(const void *ptr)
  4.1760 - {
  4.1761 --	return unlikely((unsigned long)ptr > (unsigned long)-1000L);
  4.1762 -+	return IS_ERR_VALUE((unsigned long)ptr);
  4.1763 - }
  4.1764 - 
  4.1765 - #endif /* _LINUX_ERR_H */
  4.1766 -diff --git a/kernel/exit.c b/kernel/exit.c
  4.1767 ---- a/kernel/exit.c
  4.1768 -+++ b/kernel/exit.c
  4.1769 -@@ -516,8 +516,6 @@ static inline void choose_new_parent(tas
  4.1770 - 	 */
  4.1771 - 	BUG_ON(p == reaper || reaper->exit_state >= EXIT_ZOMBIE);
  4.1772 - 	p->real_parent = reaper;
  4.1773 --	if (p->parent == p->real_parent)
  4.1774 --		BUG();
  4.1775 - }
  4.1776 - 
  4.1777 - static inline void reparent_thread(task_t *p, task_t *father, int traced)
  4.1778 -diff --git a/kernel/signal.c b/kernel/signal.c
  4.1779 ---- a/kernel/signal.c
  4.1780 -+++ b/kernel/signal.c
  4.1781 -@@ -1728,6 +1728,7 @@ do_signal_stop(int signr)
  4.1782 - 			 * with another processor delivering a stop signal,
  4.1783 - 			 * then the SIGCONT that wakes us up should clear it.
  4.1784 - 			 */
  4.1785 -+			read_unlock(&tasklist_lock);
  4.1786 - 			return 0;
  4.1787 - 		}
  4.1788 - 
  4.1789 -diff --git a/lib/rwsem-spinlock.c b/lib/rwsem-spinlock.c
  4.1790 ---- a/lib/rwsem-spinlock.c
  4.1791 -+++ b/lib/rwsem-spinlock.c
  4.1792 -@@ -140,12 +140,12 @@ void fastcall __sched __down_read(struct
  4.1793 - 
  4.1794 - 	rwsemtrace(sem, "Entering __down_read");
  4.1795 - 
  4.1796 --	spin_lock(&sem->wait_lock);
  4.1797 -+	spin_lock_irq(&sem->wait_lock);
  4.1798 - 
  4.1799 - 	if (sem->activity >= 0 && list_empty(&sem->wait_list)) {
  4.1800 - 		/* granted */
  4.1801 - 		sem->activity++;
  4.1802 --		spin_unlock(&sem->wait_lock);
  4.1803 -+		spin_unlock_irq(&sem->wait_lock);
  4.1804 - 		goto out;
  4.1805 - 	}
  4.1806 - 
  4.1807 -@@ -160,7 +160,7 @@ void fastcall __sched __down_read(struct
  4.1808 - 	list_add_tail(&waiter.list, &sem->wait_list);
  4.1809 - 
  4.1810 - 	/* we don't need to touch the semaphore struct anymore */
  4.1811 --	spin_unlock(&sem->wait_lock);
  4.1812 -+	spin_unlock_irq(&sem->wait_lock);
  4.1813 - 
  4.1814 - 	/* wait to be given the lock */
  4.1815 - 	for (;;) {
  4.1816 -@@ -181,10 +181,12 @@ void fastcall __sched __down_read(struct
  4.1817 -  */
  4.1818 - int fastcall __down_read_trylock(struct rw_semaphore *sem)
  4.1819 - {
  4.1820 -+	unsigned long flags;
  4.1821 - 	int ret = 0;
  4.1822 -+
  4.1823 - 	rwsemtrace(sem, "Entering __down_read_trylock");
  4.1824 - 
  4.1825 --	spin_lock(&sem->wait_lock);
  4.1826 -+	spin_lock_irqsave(&sem->wait_lock, flags);
  4.1827 - 
  4.1828 - 	if (sem->activity >= 0 && list_empty(&sem->wait_list)) {
  4.1829 - 		/* granted */
  4.1830 -@@ -192,7 +194,7 @@ int fastcall __down_read_trylock(struct 
  4.1831 - 		ret = 1;
  4.1832 - 	}
  4.1833 - 
  4.1834 --	spin_unlock(&sem->wait_lock);
  4.1835 -+	spin_unlock_irqrestore(&sem->wait_lock, flags);
  4.1836 - 
  4.1837 - 	rwsemtrace(sem, "Leaving __down_read_trylock");
  4.1838 - 	return ret;
  4.1839 -@@ -209,12 +211,12 @@ void fastcall __sched __down_write(struc
  4.1840 - 
  4.1841 - 	rwsemtrace(sem, "Entering __down_write");
  4.1842 - 
  4.1843 --	spin_lock(&sem->wait_lock);
  4.1844 -+	spin_lock_irq(&sem->wait_lock);
  4.1845 - 
  4.1846 - 	if (sem->activity == 0 && list_empty(&sem->wait_list)) {
  4.1847 - 		/* granted */
  4.1848 - 		sem->activity = -1;
  4.1849 --		spin_unlock(&sem->wait_lock);
  4.1850 -+		spin_unlock_irq(&sem->wait_lock);
  4.1851 - 		goto out;
  4.1852 - 	}
  4.1853 - 
  4.1854 -@@ -229,7 +231,7 @@ void fastcall __sched __down_write(struc
  4.1855 - 	list_add_tail(&waiter.list, &sem->wait_list);
  4.1856 - 
  4.1857 - 	/* we don't need to touch the semaphore struct anymore */
  4.1858 --	spin_unlock(&sem->wait_lock);
  4.1859 -+	spin_unlock_irq(&sem->wait_lock);
  4.1860 - 
  4.1861 - 	/* wait to be given the lock */
  4.1862 - 	for (;;) {
  4.1863 -@@ -250,10 +252,12 @@ void fastcall __sched __down_write(struc
  4.1864 -  */
  4.1865 - int fastcall __down_write_trylock(struct rw_semaphore *sem)
  4.1866 - {
  4.1867 -+	unsigned long flags;
  4.1868 - 	int ret = 0;
  4.1869 -+
  4.1870 - 	rwsemtrace(sem, "Entering __down_write_trylock");
  4.1871 - 
  4.1872 --	spin_lock(&sem->wait_lock);
  4.1873 -+	spin_lock_irqsave(&sem->wait_lock, flags);
  4.1874 - 
  4.1875 - 	if (sem->activity == 0 && list_empty(&sem->wait_list)) {
  4.1876 - 		/* granted */
  4.1877 -@@ -261,7 +265,7 @@ int fastcall __down_write_trylock(struct
  4.1878 - 		ret = 1;
  4.1879 - 	}
  4.1880 - 
  4.1881 --	spin_unlock(&sem->wait_lock);
  4.1882 -+	spin_unlock_irqrestore(&sem->wait_lock, flags);
  4.1883 - 
  4.1884 - 	rwsemtrace(sem, "Leaving __down_write_trylock");
  4.1885 - 	return ret;
  4.1886 -@@ -272,14 +276,16 @@ int fastcall __down_write_trylock(struct
  4.1887 -  */
  4.1888 - void fastcall __up_read(struct rw_semaphore *sem)
  4.1889 - {
  4.1890 -+	unsigned long flags;
  4.1891 -+
  4.1892 - 	rwsemtrace(sem, "Entering __up_read");
  4.1893 - 
  4.1894 --	spin_lock(&sem->wait_lock);
  4.1895 -+	spin_lock_irqsave(&sem->wait_lock, flags);
  4.1896 - 
  4.1897 - 	if (--sem->activity == 0 && !list_empty(&sem->wait_list))
  4.1898 - 		sem = __rwsem_wake_one_writer(sem);
  4.1899 - 
  4.1900 --	spin_unlock(&sem->wait_lock);
  4.1901 -+	spin_unlock_irqrestore(&sem->wait_lock, flags);
  4.1902 - 
  4.1903 - 	rwsemtrace(sem, "Leaving __up_read");
  4.1904 - }
  4.1905 -@@ -289,15 +295,17 @@ void fastcall __up_read(struct rw_semaph
  4.1906 -  */
  4.1907 - void fastcall __up_write(struct rw_semaphore *sem)
  4.1908 - {
  4.1909 -+	unsigned long flags;
  4.1910 -+
  4.1911 - 	rwsemtrace(sem, "Entering __up_write");
  4.1912 - 
  4.1913 --	spin_lock(&sem->wait_lock);
  4.1914 -+	spin_lock_irqsave(&sem->wait_lock, flags);
  4.1915 - 
  4.1916 - 	sem->activity = 0;
  4.1917 - 	if (!list_empty(&sem->wait_list))
  4.1918 - 		sem = __rwsem_do_wake(sem, 1);
  4.1919 - 
  4.1920 --	spin_unlock(&sem->wait_lock);
  4.1921 -+	spin_unlock_irqrestore(&sem->wait_lock, flags);
  4.1922 - 
  4.1923 - 	rwsemtrace(sem, "Leaving __up_write");
  4.1924 - }
  4.1925 -@@ -308,15 +316,17 @@ void fastcall __up_write(struct rw_semap
  4.1926 -  */
  4.1927 - void fastcall __downgrade_write(struct rw_semaphore *sem)
  4.1928 - {
  4.1929 -+	unsigned long flags;
  4.1930 -+
  4.1931 - 	rwsemtrace(sem, "Entering __downgrade_write");
  4.1932 - 
  4.1933 --	spin_lock(&sem->wait_lock);
  4.1934 -+	spin_lock_irqsave(&sem->wait_lock, flags);
  4.1935 - 
  4.1936 - 	sem->activity = 1;
  4.1937 - 	if (!list_empty(&sem->wait_list))
  4.1938 - 		sem = __rwsem_do_wake(sem, 0);
  4.1939 - 
  4.1940 --	spin_unlock(&sem->wait_lock);
  4.1941 -+	spin_unlock_irqrestore(&sem->wait_lock, flags);
  4.1942 - 
  4.1943 - 	rwsemtrace(sem, "Leaving __downgrade_write");
  4.1944 - }
  4.1945 -diff --git a/lib/rwsem.c b/lib/rwsem.c
  4.1946 ---- a/lib/rwsem.c
  4.1947 -+++ b/lib/rwsem.c
  4.1948 -@@ -150,7 +150,7 @@ rwsem_down_failed_common(struct rw_semap
  4.1949 - 	set_task_state(tsk, TASK_UNINTERRUPTIBLE);
  4.1950 - 
  4.1951 - 	/* set up my own style of waitqueue */
  4.1952 --	spin_lock(&sem->wait_lock);
  4.1953 -+	spin_lock_irq(&sem->wait_lock);
  4.1954 - 	waiter->task = tsk;
  4.1955 - 	get_task_struct(tsk);
  4.1956 - 
  4.1957 -@@ -163,7 +163,7 @@ rwsem_down_failed_common(struct rw_semap
  4.1958 - 	if (!(count & RWSEM_ACTIVE_MASK))
  4.1959 - 		sem = __rwsem_do_wake(sem, 0);
  4.1960 - 
  4.1961 --	spin_unlock(&sem->wait_lock);
  4.1962 -+	spin_unlock_irq(&sem->wait_lock);
  4.1963 - 
  4.1964 - 	/* wait to be given the lock */
  4.1965 - 	for (;;) {
  4.1966 -@@ -219,15 +219,17 @@ rwsem_down_write_failed(struct rw_semaph
  4.1967 -  */
  4.1968 - struct rw_semaphore fastcall *rwsem_wake(struct rw_semaphore *sem)
  4.1969 - {
  4.1970 -+	unsigned long flags;
  4.1971 -+
  4.1972 - 	rwsemtrace(sem, "Entering rwsem_wake");
  4.1973 - 
  4.1974 --	spin_lock(&sem->wait_lock);
  4.1975 -+	spin_lock_irqsave(&sem->wait_lock, flags);
  4.1976 - 
  4.1977 - 	/* do nothing if list empty */
  4.1978 - 	if (!list_empty(&sem->wait_list))
  4.1979 - 		sem = __rwsem_do_wake(sem, 0);
  4.1980 - 
  4.1981 --	spin_unlock(&sem->wait_lock);
  4.1982 -+	spin_unlock_irqrestore(&sem->wait_lock, flags);
  4.1983 - 
  4.1984 - 	rwsemtrace(sem, "Leaving rwsem_wake");
  4.1985 - 
  4.1986 -@@ -241,15 +243,17 @@ struct rw_semaphore fastcall *rwsem_wake
  4.1987 -  */
  4.1988 - struct rw_semaphore fastcall *rwsem_downgrade_wake(struct rw_semaphore *sem)
  4.1989 - {
  4.1990 -+	unsigned long flags;
  4.1991 -+
  4.1992 - 	rwsemtrace(sem, "Entering rwsem_downgrade_wake");
  4.1993 - 
  4.1994 --	spin_lock(&sem->wait_lock);
  4.1995 -+	spin_lock_irqsave(&sem->wait_lock, flags);
  4.1996 - 
  4.1997 - 	/* do nothing if list empty */
  4.1998 - 	if (!list_empty(&sem->wait_list))
  4.1999 - 		sem = __rwsem_do_wake(sem, 1);
  4.2000 - 
  4.2001 --	spin_unlock(&sem->wait_lock);
  4.2002 -+	spin_unlock_irqrestore(&sem->wait_lock, flags);
  4.2003 - 
  4.2004 - 	rwsemtrace(sem, "Leaving rwsem_downgrade_wake");
  4.2005 - 	return sem;
  4.2006 -diff --git a/mm/mmap.c b/mm/mmap.c
  4.2007 ---- a/mm/mmap.c
  4.2008 -+++ b/mm/mmap.c
  4.2009 -@@ -1315,37 +1315,40 @@ unsigned long
  4.2010 - get_unmapped_area(struct file *file, unsigned long addr, unsigned long len,
  4.2011 - 		unsigned long pgoff, unsigned long flags)
  4.2012 - {
  4.2013 --	if (flags & MAP_FIXED) {
  4.2014 --		unsigned long ret;
  4.2015 -+	unsigned long ret;
  4.2016 - 
  4.2017 --		if (addr > TASK_SIZE - len)
  4.2018 --			return -ENOMEM;
  4.2019 --		if (addr & ~PAGE_MASK)
  4.2020 --			return -EINVAL;
  4.2021 --		if (file && is_file_hugepages(file))  {
  4.2022 --			/*
  4.2023 --			 * Check if the given range is hugepage aligned, and
  4.2024 --			 * can be made suitable for hugepages.
  4.2025 --			 */
  4.2026 --			ret = prepare_hugepage_range(addr, len);
  4.2027 --		} else {
  4.2028 --			/*
  4.2029 --			 * Ensure that a normal request is not falling in a
  4.2030 --			 * reserved hugepage range.  For some archs like IA-64,
  4.2031 --			 * there is a separate region for hugepages.
  4.2032 --			 */
  4.2033 --			ret = is_hugepage_only_range(addr, len);
  4.2034 --		}
  4.2035 --		if (ret)
  4.2036 --			return -EINVAL;
  4.2037 --		return addr;
  4.2038 --	}
  4.2039 -+	if (!(flags & MAP_FIXED)) {
  4.2040 -+		unsigned long (*get_area)(struct file *, unsigned long, unsigned long, unsigned long, unsigned long);
  4.2041 - 
  4.2042 --	if (file && file->f_op && file->f_op->get_unmapped_area)
  4.2043 --		return file->f_op->get_unmapped_area(file, addr, len,
  4.2044 --						pgoff, flags);
  4.2045 -+		get_area = current->mm->get_unmapped_area;
  4.2046 -+		if (file && file->f_op && file->f_op->get_unmapped_area)
  4.2047 -+			get_area = file->f_op->get_unmapped_area;
  4.2048 -+		addr = get_area(file, addr, len, pgoff, flags);
  4.2049 -+		if (IS_ERR_VALUE(addr))
  4.2050 -+			return addr;
  4.2051 -+	}
  4.2052 - 
  4.2053 --	return current->mm->get_unmapped_area(file, addr, len, pgoff, flags);
  4.2054 -+	if (addr > TASK_SIZE - len)
  4.2055 -+		return -ENOMEM;
  4.2056 -+	if (addr & ~PAGE_MASK)
  4.2057 -+		return -EINVAL;
  4.2058 -+	if (file && is_file_hugepages(file))  {
  4.2059 -+		/*
  4.2060 -+		 * Check if the given range is hugepage aligned, and
  4.2061 -+		 * can be made suitable for hugepages.
  4.2062 -+		 */
  4.2063 -+		ret = prepare_hugepage_range(addr, len);
  4.2064 -+	} else {
  4.2065 -+		/*
  4.2066 -+		 * Ensure that a normal request is not falling in a
  4.2067 -+		 * reserved hugepage range.  For some archs like IA-64,
  4.2068 -+		 * there is a separate region for hugepages.
  4.2069 -+		 */
  4.2070 -+		ret = is_hugepage_only_range(addr, len);
  4.2071 -+	}
  4.2072 -+	if (ret)
  4.2073 -+		return -EINVAL;
  4.2074 -+	return addr;
  4.2075 - }
  4.2076 - 
  4.2077 - EXPORT_SYMBOL(get_unmapped_area);
  4.2078 -diff --git a/mm/rmap.c b/mm/rmap.c
  4.2079 ---- a/mm/rmap.c
  4.2080 -+++ b/mm/rmap.c
  4.2081 -@@ -641,7 +641,7 @@ static void try_to_unmap_cluster(unsigne
  4.2082 - 	pgd_t *pgd;
  4.2083 - 	pud_t *pud;
  4.2084 - 	pmd_t *pmd;
  4.2085 --	pte_t *pte;
  4.2086 -+	pte_t *pte, *original_pte;
  4.2087 - 	pte_t pteval;
  4.2088 - 	struct page *page;
  4.2089 - 	unsigned long address;
  4.2090 -@@ -673,7 +673,7 @@ static void try_to_unmap_cluster(unsigne
  4.2091 - 	if (!pmd_present(*pmd))
  4.2092 - 		goto out_unlock;
  4.2093 - 
  4.2094 --	for (pte = pte_offset_map(pmd, address);
  4.2095 -+	for (original_pte = pte = pte_offset_map(pmd, address);
  4.2096 - 			address < end; pte++, address += PAGE_SIZE) {
  4.2097 - 
  4.2098 - 		if (!pte_present(*pte))
  4.2099 -@@ -710,7 +710,7 @@ static void try_to_unmap_cluster(unsigne
  4.2100 - 		(*mapcount)--;
  4.2101 - 	}
  4.2102 - 
  4.2103 --	pte_unmap(pte);
  4.2104 -+	pte_unmap(original_pte);
  4.2105 - 
  4.2106 - out_unlock:
  4.2107 - 	spin_unlock(&mm->page_table_lock);
  4.2108 -diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
  4.2109 ---- a/net/bluetooth/af_bluetooth.c
  4.2110 -+++ b/net/bluetooth/af_bluetooth.c
  4.2111 -@@ -64,7 +64,7 @@ static kmem_cache_t *bt_sock_cache;
  4.2112 - 
  4.2113 - int bt_sock_register(int proto, struct net_proto_family *ops)
  4.2114 - {
  4.2115 --	if (proto >= BT_MAX_PROTO)
  4.2116 -+	if (proto < 0 || proto >= BT_MAX_PROTO)
  4.2117 - 		return -EINVAL;
  4.2118 - 
  4.2119 - 	if (bt_proto[proto])
  4.2120 -@@ -77,7 +77,7 @@ EXPORT_SYMBOL(bt_sock_register);
  4.2121 - 
  4.2122 - int bt_sock_unregister(int proto)
  4.2123 - {
  4.2124 --	if (proto >= BT_MAX_PROTO)
  4.2125 -+	if (proto < 0 || proto >= BT_MAX_PROTO)
  4.2126 - 		return -EINVAL;
  4.2127 - 
  4.2128 - 	if (!bt_proto[proto])
  4.2129 -@@ -92,7 +92,7 @@ static int bt_sock_create(struct socket 
  4.2130 - {
  4.2131 - 	int err = 0;
  4.2132 - 
  4.2133 --	if (proto >= BT_MAX_PROTO)
  4.2134 -+	if (proto < 0 || proto >= BT_MAX_PROTO)
  4.2135 - 		return -EINVAL;
  4.2136 - 
  4.2137 - #if defined(CONFIG_KMOD)
  4.2138 -diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
  4.2139 ---- a/net/bridge/br_input.c
  4.2140 -+++ b/net/bridge/br_input.c
  4.2141 -@@ -54,6 +54,9 @@ int br_handle_frame_finish(struct sk_buf
  4.2142 - 	struct net_bridge_fdb_entry *dst;
  4.2143 - 	int passedup = 0;
  4.2144 - 
  4.2145 -+	/* insert into forwarding database after filtering to avoid spoofing */
  4.2146 -+	br_fdb_insert(p->br, p, eth_hdr(skb)->h_source, 0);
  4.2147 -+
  4.2148 - 	if (br->dev->flags & IFF_PROMISC) {
  4.2149 - 		struct sk_buff *skb2;
  4.2150 - 
  4.2151 -@@ -108,8 +111,7 @@ int br_handle_frame(struct net_bridge_po
  4.2152 - 	if (eth_hdr(skb)->h_source[0] & 1)
  4.2153 - 		goto err;
  4.2154 - 
  4.2155 --	if (p->state == BR_STATE_LEARNING ||
  4.2156 --	    p->state == BR_STATE_FORWARDING)
  4.2157 -+	if (p->state == BR_STATE_LEARNING)
  4.2158 - 		br_fdb_insert(p->br, p, eth_hdr(skb)->h_source, 0);
  4.2159 - 
  4.2160 - 	if (p->br->stp_enabled &&
  4.2161 -diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c
  4.2162 ---- a/net/bridge/br_stp_bpdu.c
  4.2163 -+++ b/net/bridge/br_stp_bpdu.c
  4.2164 -@@ -140,6 +140,9 @@ int br_stp_handle_bpdu(struct sk_buff *s
  4.2165 - 	struct net_bridge *br = p->br;
  4.2166 - 	unsigned char *buf;
  4.2167 - 
  4.2168 -+	/* insert into forwarding database after filtering to avoid spoofing */
  4.2169 -+	br_fdb_insert(p->br, p, eth_hdr(skb)->h_source, 0);
  4.2170 -+
  4.2171 - 	/* need at least the 802 and STP headers */
  4.2172 - 	if (!pskb_may_pull(skb, sizeof(header)+1) ||
  4.2173 - 	    memcmp(skb->data, header, sizeof(header)))
  4.2174 -diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
  4.2175 ---- a/net/bridge/netfilter/ebtables.c
  4.2176 -+++ b/net/bridge/netfilter/ebtables.c
  4.2177 -@@ -179,9 +179,10 @@ unsigned int ebt_do_table (unsigned int 
  4.2178 - 	struct ebt_chainstack *cs;
  4.2179 - 	struct ebt_entries *chaininfo;
  4.2180 - 	char *base;
  4.2181 --	struct ebt_table_info *private = table->private;
  4.2182 -+	struct ebt_table_info *private;
  4.2183 - 
  4.2184 - 	read_lock_bh(&table->lock);
  4.2185 -+	private = table->private;
  4.2186 - 	cb_base = COUNTER_BASE(private->counters, private->nentries,
  4.2187 - 	   smp_processor_id());
  4.2188 - 	if (private->chainstack)
  4.2189 -diff --git a/net/ipv4/fib_hash.c b/net/ipv4/fib_hash.c
  4.2190 ---- a/net/ipv4/fib_hash.c
  4.2191 -+++ b/net/ipv4/fib_hash.c
  4.2192 -@@ -919,13 +919,23 @@ out:
  4.2193 - 	return fa;
  4.2194 - }
  4.2195 - 
  4.2196 -+static struct fib_alias *fib_get_idx(struct seq_file *seq, loff_t pos)
  4.2197 -+{
  4.2198 -+	struct fib_alias *fa = fib_get_first(seq);
  4.2199 -+
  4.2200 -+	if (fa)
  4.2201 -+		while (pos && (fa = fib_get_next(seq)))
  4.2202 -+			--pos;
  4.2203 -+	return pos ? NULL : fa;
  4.2204 -+}
  4.2205 -+
  4.2206 - static void *fib_seq_start(struct seq_file *seq, loff_t *pos)
  4.2207 - {
  4.2208 - 	void *v = NULL;
  4.2209 - 
  4.2210 - 	read_lock(&fib_hash_lock);
  4.2211 - 	if (ip_fib_main_table)
  4.2212 --		v = *pos ? fib_get_next(seq) : SEQ_START_TOKEN;
  4.2213 -+		v = *pos ? fib_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
  4.2214 - 	return v;
  4.2215 - }
  4.2216 - 
  4.2217 -diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
  4.2218 ---- a/net/ipv4/netfilter/ip_queue.c
  4.2219 -+++ b/net/ipv4/netfilter/ip_queue.c
  4.2220 -@@ -3,6 +3,7 @@
  4.2221 -  * communicating with userspace via netlink.
  4.2222 -  *
  4.2223 -  * (C) 2000-2002 James Morris <jmorris@intercode.com.au>
  4.2224 -+ * (C) 2003-2005 Netfilter Core Team <coreteam@netfilter.org>
  4.2225 -  *
  4.2226 -  * This program is free software; you can redistribute it and/or modify
  4.2227 -  * it under the terms of the GNU General Public License version 2 as
  4.2228 -@@ -14,6 +15,7 @@
  4.2229 -  *             Zander).
  4.2230 -  * 2000-08-01: Added Nick Williams' MAC support.
  4.2231 -  * 2002-06-25: Code cleanup.
  4.2232 -+ * 2005-05-26: local_bh_{disable,enable} around nf_reinject (Harald Welte)
  4.2233 -  *
  4.2234 -  */
  4.2235 - #include <linux/module.h>
  4.2236 -@@ -66,7 +68,15 @@ static DECLARE_MUTEX(ipqnl_sem);
  4.2237 - static void
  4.2238 - ipq_issue_verdict(struct ipq_queue_entry *entry, int verdict)
  4.2239 - {
  4.2240 -+	/* TCP input path (and probably other bits) assume to be called
  4.2241 -+	 * from softirq context, not from syscall, like ipq_issue_verdict is
  4.2242 -+	 * called.  TCP input path deadlocks with locks taken from timer
  4.2243 -+	 * softirq, e.g.  We therefore emulate this by local_bh_disable() */
  4.2244 -+
  4.2245 -+	local_bh_disable();
  4.2246 - 	nf_reinject(entry->skb, entry->info, verdict);
  4.2247 -+	local_bh_enable();
  4.2248 -+
  4.2249 - 	kfree(entry);
  4.2250 - }
  4.2251 - 
  4.2252 -diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
  4.2253 ---- a/net/ipv4/tcp_input.c
  4.2254 -+++ b/net/ipv4/tcp_input.c
  4.2255 -@@ -1653,7 +1653,10 @@ static void DBGUNDO(struct sock *sk, str
  4.2256 - static void tcp_undo_cwr(struct tcp_sock *tp, int undo)
  4.2257 - {
  4.2258 - 	if (tp->prior_ssthresh) {
  4.2259 --		tp->snd_cwnd = max(tp->snd_cwnd, tp->snd_ssthresh<<1);
  4.2260 -+		if (tcp_is_bic(tp))
  4.2261 -+			tp->snd_cwnd = max(tp->snd_cwnd, tp->bictcp.last_max_cwnd);
  4.2262 -+		else
  4.2263 -+			tp->snd_cwnd = max(tp->snd_cwnd, tp->snd_ssthresh<<1);
  4.2264 - 
  4.2265 - 		if (undo && tp->prior_ssthresh > tp->snd_ssthresh) {
  4.2266 - 			tp->snd_ssthresh = tp->prior_ssthresh;
  4.2267 -diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
  4.2268 ---- a/net/ipv4/tcp_timer.c
  4.2269 -+++ b/net/ipv4/tcp_timer.c
  4.2270 -@@ -38,6 +38,7 @@ static void tcp_keepalive_timer (unsigne
  4.2271 - 
  4.2272 - #ifdef TCP_DEBUG
  4.2273 - const char tcp_timer_bug_msg[] = KERN_DEBUG "tcpbug: unknown timer value\n";
  4.2274 -+EXPORT_SYMBOL(tcp_timer_bug_msg);
  4.2275 - #endif
  4.2276 - 
  4.2277 - /*
  4.2278 -diff --git a/net/ipv4/xfrm4_output.c b/net/ipv4/xfrm4_output.c
  4.2279 ---- a/net/ipv4/xfrm4_output.c
  4.2280 -+++ b/net/ipv4/xfrm4_output.c
  4.2281 -@@ -103,17 +103,17 @@ int xfrm4_output(struct sk_buff *skb)
  4.2282 - 			goto error_nolock;
  4.2283 - 	}
  4.2284 - 
  4.2285 --	spin_lock_bh(&x->lock);
  4.2286 --	err = xfrm_state_check(x, skb);
  4.2287 --	if (err)
  4.2288 --		goto error;
  4.2289 --
  4.2290 - 	if (x->props.mode) {
  4.2291 - 		err = xfrm4_tunnel_check_size(skb);
  4.2292 - 		if (err)
  4.2293 --			goto error;
  4.2294 -+			goto error_nolock;
  4.2295 - 	}
  4.2296 - 
  4.2297 -+	spin_lock_bh(&x->lock);
  4.2298 -+	err = xfrm_state_check(x, skb);
  4.2299 -+	if (err)
  4.2300 -+		goto error;
  4.2301 -+
  4.2302 - 	xfrm4_encap(skb);
  4.2303 - 
  4.2304 - 	err = x->type->output(skb);
  4.2305 -diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
  4.2306 ---- a/net/ipv6/xfrm6_output.c
  4.2307 -+++ b/net/ipv6/xfrm6_output.c
  4.2308 -@@ -103,17 +103,17 @@ int xfrm6_output(struct sk_buff *skb)
  4.2309 - 			goto error_nolock;
  4.2310 - 	}
  4.2311 - 
  4.2312 --	spin_lock_bh(&x->lock);
  4.2313 --	err = xfrm_state_check(x, skb);
  4.2314 --	if (err)
  4.2315 --		goto error;
  4.2316 --
  4.2317 - 	if (x->props.mode) {
  4.2318 - 		err = xfrm6_tunnel_check_size(skb);
  4.2319 - 		if (err)
  4.2320 --			goto error;
  4.2321 -+			goto error_nolock;
  4.2322 - 	}
  4.2323 - 
  4.2324 -+	spin_lock_bh(&x->lock);
  4.2325 -+	err = xfrm_state_check(x, skb);
  4.2326 -+	if (err)
  4.2327 -+		goto error;
  4.2328 -+
  4.2329 - 	xfrm6_encap(skb);
  4.2330 - 
  4.2331 - 	err = x->type->output(skb);
  4.2332 -diff --git a/net/netrom/nr_in.c b/net/netrom/nr_in.c
  4.2333 ---- a/net/netrom/nr_in.c
  4.2334 -+++ b/net/netrom/nr_in.c
  4.2335 -@@ -74,7 +74,6 @@ static int nr_queue_rx_frame(struct sock
  4.2336 - static int nr_state1_machine(struct sock *sk, struct sk_buff *skb,
  4.2337 - 	int frametype)
  4.2338 - {
  4.2339 --	bh_lock_sock(sk);
  4.2340 - 	switch (frametype) {
  4.2341 - 	case NR_CONNACK: {
  4.2342 - 		nr_cb *nr = nr_sk(sk);
  4.2343 -@@ -103,8 +102,6 @@ static int nr_state1_machine(struct sock
  4.2344 - 	default:
  4.2345 - 		break;
  4.2346 - 	}
  4.2347 --	bh_unlock_sock(sk);
  4.2348 --
  4.2349 - 	return 0;
  4.2350 - }
  4.2351 - 
  4.2352 -@@ -116,7 +113,6 @@ static int nr_state1_machine(struct sock
  4.2353 - static int nr_state2_machine(struct sock *sk, struct sk_buff *skb,
  4.2354 - 	int frametype)
  4.2355 - {
  4.2356 --	bh_lock_sock(sk);
  4.2357 - 	switch (frametype) {
  4.2358 - 	case NR_CONNACK | NR_CHOKE_FLAG:
  4.2359 - 		nr_disconnect(sk, ECONNRESET);
  4.2360 -@@ -132,8 +128,6 @@ static int nr_state2_machine(struct sock
  4.2361 - 	default:
  4.2362 - 		break;
  4.2363 - 	}
  4.2364 --	bh_unlock_sock(sk);
  4.2365 --
  4.2366 - 	return 0;
  4.2367 - }
  4.2368 - 
  4.2369 -@@ -154,7 +148,6 @@ static int nr_state3_machine(struct sock
  4.2370 - 	nr = skb->data[18];
  4.2371 - 	ns = skb->data[17];
  4.2372 - 
  4.2373 --	bh_lock_sock(sk);
  4.2374 - 	switch (frametype) {
  4.2375 - 	case NR_CONNREQ:
  4.2376 - 		nr_write_internal(sk, NR_CONNACK);
  4.2377 -@@ -265,8 +258,6 @@ static int nr_state3_machine(struct sock
  4.2378 - 	default:
  4.2379 - 		break;
  4.2380 - 	}
  4.2381 --	bh_unlock_sock(sk);
  4.2382 --
  4.2383 - 	return queued;
  4.2384 - }
  4.2385 - 
  4.2386 -diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
  4.2387 ---- a/net/rose/rose_route.c
  4.2388 -+++ b/net/rose/rose_route.c
  4.2389 -@@ -727,7 +727,8 @@ int rose_rt_ioctl(unsigned int cmd, void
  4.2390 - 		}
  4.2391 - 		if (rose_route.mask > 10) /* Mask can't be more than 10 digits */
  4.2392 - 			return -EINVAL;
  4.2393 --
  4.2394 -+		if (rose_route.ndigis > 8) /* No more than 8 digipeats */
  4.2395 -+			return -EINVAL;
  4.2396 - 		err = rose_add_node(&rose_route, dev);
  4.2397 - 		dev_put(dev);
  4.2398 - 		return err;
  4.2399 -diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
  4.2400 ---- a/net/sched/sch_netem.c
  4.2401 -+++ b/net/sched/sch_netem.c
  4.2402 -@@ -184,10 +184,15 @@ static int netem_enqueue(struct sk_buff 
  4.2403 - 	/* Random duplication */
  4.2404 - 	if (q->duplicate && q->duplicate >= get_crandom(&q->dup_cor)) {
  4.2405 - 		struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
  4.2406 --
  4.2407 --		pr_debug("netem_enqueue: dup %p\n", skb2);
  4.2408 --		if (skb2)
  4.2409 --			delay_skb(sch, skb2);
  4.2410 -+		if (skb2) {
  4.2411 -+			struct Qdisc *rootq = sch->dev->qdisc;
  4.2412 -+			u32 dupsave = q->duplicate;
  4.2413 -+
  4.2414 -+			/* prevent duplicating a dup... */
  4.2415 -+			q->duplicate = 0;
  4.2416 -+			rootq->enqueue(skb2, rootq);
  4.2417 -+			q->duplicate = dupsave;
  4.2418 -+		}
  4.2419 - 	}
  4.2420 - 
  4.2421 - 	/* If doing simple delay then gap == 0 so all packets
  4.2422 -diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
  4.2423 ---- a/net/xfrm/xfrm_state.c
  4.2424 -+++ b/net/xfrm/xfrm_state.c
  4.2425 -@@ -609,7 +609,7 @@ static struct xfrm_state *__xfrm_find_ac
  4.2426 - 
  4.2427 - 	for (i = 0; i < XFRM_DST_HSIZE; i++) {
  4.2428 - 		list_for_each_entry(x, xfrm_state_bydst+i, bydst) {
  4.2429 --			if (x->km.seq == seq) {
  4.2430 -+			if (x->km.seq == seq && x->km.state == XFRM_STATE_ACQ) {
  4.2431 - 				xfrm_state_hold(x);
  4.2432 - 				return x;
  4.2433 - 			}
  4.2434 -diff --git a/security/keys/key.c b/security/keys/key.c
  4.2435 ---- a/security/keys/key.c
  4.2436 -+++ b/security/keys/key.c
  4.2437 -@@ -57,9 +57,10 @@ struct key_user *key_user_lookup(uid_t u
  4.2438 - {
  4.2439 - 	struct key_user *candidate = NULL, *user;
  4.2440 - 	struct rb_node *parent = NULL;
  4.2441 --	struct rb_node **p = &key_user_tree.rb_node;
  4.2442 -+	struct rb_node **p;
  4.2443 - 
  4.2444 -  try_again:
  4.2445 -+	p = &key_user_tree.rb_node;
  4.2446 - 	spin_lock(&key_user_lock);
  4.2447 - 
  4.2448 - 	/* search the tree for a user record with a matching UID */
  4.2449 -diff --git a/sound/core/timer.c b/sound/core/timer.c
  4.2450 ---- a/sound/core/timer.c
  4.2451 -+++ b/sound/core/timer.c
  4.2452 -@@ -1117,7 +1117,8 @@ static void snd_timer_user_append_to_tqu
  4.2453 - 	if (tu->qused >= tu->queue_size) {
  4.2454 - 		tu->overrun++;
  4.2455 - 	} else {
  4.2456 --		memcpy(&tu->queue[tu->qtail++], tread, sizeof(*tread));
  4.2457 -+		memcpy(&tu->tqueue[tu->qtail++], tread, sizeof(*tread));
  4.2458 -+		tu->qtail %= tu->queue_size;
  4.2459 - 		tu->qused++;
  4.2460 - 	}
  4.2461 - }
  4.2462 -@@ -1140,6 +1141,8 @@ static void snd_timer_user_ccallback(snd
  4.2463 - 	spin_lock(&tu->qlock);
  4.2464 - 	snd_timer_user_append_to_tqueue(tu, &r1);
  4.2465 - 	spin_unlock(&tu->qlock);
  4.2466 -+	kill_fasync(&tu->fasync, SIGIO, POLL_IN);
  4.2467 -+	wake_up(&tu->qchange_sleep);
  4.2468 - }
  4.2469 - 
  4.2470 - static void snd_timer_user_tinterrupt(snd_timer_instance_t *timeri,
  4.2471 -diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c
  4.2472 ---- a/sound/pci/ac97/ac97_codec.c
  4.2473 -+++ b/sound/pci/ac97/ac97_codec.c
  4.2474 -@@ -1185,7 +1185,7 @@ snd_kcontrol_t *snd_ac97_cnew(const snd_
  4.2475 - /*
  4.2476 -  * create mute switch(es) for normal stereo controls
  4.2477 -  */
  4.2478 --static int snd_ac97_cmute_new(snd_card_t *card, char *name, int reg, ac97_t *ac97)
  4.2479 -+static int snd_ac97_cmute_new_stereo(snd_card_t *card, char *name, int reg, int check_stereo, ac97_t *ac97)
  4.2480 - {
  4.2481 - 	snd_kcontrol_t *kctl;
  4.2482 - 	int err;
  4.2483 -@@ -1196,7 +1196,7 @@ static int snd_ac97_cmute_new(snd_card_t
  4.2484 - 
  4.2485 - 	mute_mask = 0x8000;
  4.2486 - 	val = snd_ac97_read(ac97, reg);
  4.2487 --	if (ac97->flags & AC97_STEREO_MUTES) {
  4.2488 -+	if (check_stereo || (ac97->flags & AC97_STEREO_MUTES)) {
  4.2489 - 		/* check whether both mute bits work */
  4.2490 - 		val1 = val | 0x8080;
  4.2491 - 		snd_ac97_write(ac97, reg, val1);
  4.2492 -@@ -1254,7 +1254,7 @@ static int snd_ac97_cvol_new(snd_card_t 
  4.2493 - /*
  4.2494 -  * create a mute-switch and a volume for normal stereo/mono controls
  4.2495 -  */
  4.2496 --static int snd_ac97_cmix_new(snd_card_t *card, const char *pfx, int reg, ac97_t *ac97)
  4.2497 -+static int snd_ac97_cmix_new_stereo(snd_card_t *card, const char *pfx, int reg, int check_stereo, ac97_t *ac97)
  4.2498 - {
  4.2499 - 	int err;
  4.2500 - 	char name[44];
  4.2501 -@@ -1265,7 +1265,7 @@ static int snd_ac97_cmix_new(snd_card_t 
  4.2502 - 
  4.2503 - 	if (snd_ac97_try_bit(ac97, reg, 15)) {
  4.2504 - 		sprintf(name, "%s Switch", pfx);
  4.2505 --		if ((err = snd_ac97_cmute_new(card, name, reg, ac97)) < 0)
  4.2506 -+		if ((err = snd_ac97_cmute_new_stereo(card, name, reg, check_stereo, ac97)) < 0)
  4.2507 - 			return err;
  4.2508 - 	}
  4.2509 - 	check_volume_resolution(ac97, reg, &lo_max, &hi_max);
  4.2510 -@@ -1277,6 +1277,8 @@ static int snd_ac97_cmix_new(snd_card_t 
  4.2511 - 	return 0;
  4.2512 - }
  4.2513 - 
  4.2514 -+#define snd_ac97_cmix_new(card, pfx, reg, ac97)	snd_ac97_cmix_new_stereo(card, pfx, reg, 0, ac97)
  4.2515 -+#define snd_ac97_cmute_new(card, name, reg, ac97)	snd_ac97_cmute_new_stereo(card, name, reg, 0, ac97)
  4.2516 - 
  4.2517 - static unsigned int snd_ac97_determine_spdif_rates(ac97_t *ac97);
  4.2518 - 
  4.2519 -@@ -1327,7 +1329,8 @@ static int snd_ac97_mixer_build(ac97_t *
  4.2520 - 
  4.2521 - 	/* build surround controls */
  4.2522 - 	if (snd_ac97_try_volume_mix(ac97, AC97_SURROUND_MASTER)) {
  4.2523 --		if ((err = snd_ac97_cmix_new(card, "Surround Playback", AC97_SURROUND_MASTER, ac97)) < 0)
  4.2524 -+		/* Surround Master (0x38) is with stereo mutes */
  4.2525 -+		if ((err = snd_ac97_cmix_new_stereo(card, "Surround Playback", AC97_SURROUND_MASTER, 1, ac97)) < 0)
  4.2526 - 			return err;
  4.2527 - 	}
  4.2528 - 
  4.2529 -diff --git a/sound/usb/usbaudio.c b/sound/usb/usbaudio.c
  4.2530 ---- a/sound/usb/usbaudio.c
  4.2531 -+++ b/sound/usb/usbaudio.c
  4.2532 -@@ -3276,7 +3276,7 @@ static void snd_usb_audio_disconnect(str
  4.2533 - 		}
  4.2534 - 		usb_chip[chip->index] = NULL;
  4.2535 - 		up(&register_mutex);
  4.2536 --		snd_card_free_in_thread(card);
  4.2537 -+		snd_card_free(card);
  4.2538 - 	} else {
  4.2539 - 		up(&register_mutex);
  4.2540 - 	}
  4.2541 -diff --git a/sound/usb/usx2y/usbusx2y.c b/sound/usb/usx2y/usbusx2y.c
  4.2542 ---- a/sound/usb/usx2y/usbusx2y.c
  4.2543 -+++ b/sound/usb/usx2y/usbusx2y.c
  4.2544 -@@ -1,6 +1,11 @@
  4.2545 - /*
  4.2546 -  * usbusy2y.c - ALSA USB US-428 Driver
  4.2547 -  *
  4.2548 -+2005-04-14 Karsten Wiese
  4.2549 -+	Version 0.8.7.2:
  4.2550 -+	Call snd_card_free() instead of snd_card_free_in_thread() to prevent oops with dead keyboard symptom.
  4.2551 -+	Tested ok with kernel 2.6.12-rc2.
  4.2552 -+
  4.2553 - 2004-12-14 Karsten Wiese
  4.2554 - 	Version 0.8.7.1:
  4.2555 - 	snd_pcm_open for rawusb pcm-devices now returns -EBUSY if called without rawusb's hwdep device being open.
  4.2556 -@@ -143,7 +148,7 @@
  4.2557 - 
  4.2558 - 
  4.2559 - MODULE_AUTHOR("Karsten Wiese <annabellesgarden@yahoo.de>");
  4.2560 --MODULE_DESCRIPTION("TASCAM "NAME_ALLCAPS" Version 0.8.7.1");
  4.2561 -+MODULE_DESCRIPTION("TASCAM "NAME_ALLCAPS" Version 0.8.7.2");
  4.2562 - MODULE_LICENSE("GPL");
  4.2563 - MODULE_SUPPORTED_DEVICE("{{TASCAM(0x1604), "NAME_ALLCAPS"(0x8001)(0x8005)(0x8007) }}");
  4.2564 - 
  4.2565 -@@ -430,8 +435,6 @@ static void usX2Y_usb_disconnect(struct 
  4.2566 - 	if (ptr) {
  4.2567 - 		usX2Ydev_t* usX2Y = usX2Y((snd_card_t*)ptr);
  4.2568 - 		struct list_head* p;
  4.2569 --		if (usX2Y->chip_status == USX2Y_STAT_CHIP_HUP)	// on 2.6.1 kernel snd_usbmidi_disconnect()
  4.2570 --			return;					// calls us back. better leave :-) .
  4.2571 - 		usX2Y->chip.shutdown = 1;
  4.2572 - 		usX2Y->chip_status = USX2Y_STAT_CHIP_HUP;
  4.2573 - 		usX2Y_unlinkSeq(&usX2Y->AS04);
  4.2574 -@@ -443,7 +446,7 @@ static void usX2Y_usb_disconnect(struct 
  4.2575 - 		}
  4.2576 - 		if (usX2Y->us428ctls_sharedmem) 
  4.2577 - 			wake_up(&usX2Y->us428ctls_wait_queue_head);
  4.2578 --		snd_card_free_in_thread((snd_card_t*)ptr);
  4.2579 -+		snd_card_free((snd_card_t*)ptr);
  4.2580 - 	}
  4.2581 - }
  4.2582 - 
     5.1 --- a/patches/linux-2.6.11/net-csum.patch	Mon Jul 11 15:12:37 2005 +0000
     5.2 +++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
     5.3 @@ -1,22 +0,0 @@
     5.4 -diff -ur linux-2.6.11/net/ipv4/netfilter/ip_conntrack_proto_tcp.c linux-2.6.11-csum/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
     5.5 ---- linux-2.6.11/net/ipv4/netfilter/ip_conntrack_proto_tcp.c	2005-05-27 11:47:48 +01:00
     5.6 -+++ linux-2.6.11-csum/net/ipv4/netfilter/ip_conntrack_proto_tcp.c	2005-05-27 11:48:07 +01:00
     5.7 -@@ -803,6 +803,7 @@
     5.8 - 	 */
     5.9 - 	/* FIXME: Source route IP option packets --RR */
    5.10 - 	if (hooknum == NF_IP_PRE_ROUTING
    5.11 -+	    && skb->ip_summed != CHECKSUM_UNNECESSARY
    5.12 - 	    && csum_tcpudp_magic(iph->saddr, iph->daddr, tcplen, IPPROTO_TCP,
    5.13 - 			         skb->ip_summed == CHECKSUM_HW ? skb->csum
    5.14 - 			      	 : skb_checksum(skb, iph->ihl*4, tcplen, 0))) {
    5.15 -diff -ur linux-2.6.11/net/ipv4/netfilter/ip_conntrack_proto_udp.c linux-2.6.11-csum/net/ipv4/netfilter/ip_conntrack_proto_udp.c
    5.16 ---- linux-2.6.11/net/ipv4/netfilter/ip_conntrack_proto_udp.c	2005-05-27 11:47:48 +01:00
    5.17 -+++ linux-2.6.11-csum/net/ipv4/netfilter/ip_conntrack_proto_udp.c	2005-05-27 11:48:07 +01:00
    5.18 -@@ -120,6 +120,7 @@
    5.19 - 	 * and moreover root might send raw packets.
    5.20 - 	 * FIXME: Source route IP option packets --RR */
    5.21 - 	if (hooknum == NF_IP_PRE_ROUTING
    5.22 -+	    && skb->ip_summed != CHECKSUM_UNNECESSARY
    5.23 - 	    && csum_tcpudp_magic(iph->saddr, iph->daddr, udplen, IPPROTO_UDP,
    5.24 - 			         skb->ip_summed == CHECKSUM_HW ? skb->csum
    5.25 - 			      	 : skb_checksum(skb, iph->ihl*4, udplen, 0))) {
     6.1 --- a/patches/linux-2.6.11/rcu-nohz.patch	Mon Jul 11 15:12:37 2005 +0000
     6.2 +++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
     6.3 @@ -1,16 +0,0 @@
     6.4 -diff -ur linux-2.6.11/kernel/rcupdate.c linux-2.6.11-rcu/kernel/rcupdate.c
     6.5 ---- linux-2.6.11/kernel/rcupdate.c	2005-05-30 10:51:41 +01:00
     6.6 -+++ linux-2.6.11-rcu/kernel/rcupdate.c	2005-05-30 10:53:53 +01:00
     6.7 -@@ -202,8 +202,11 @@
     6.8 -  */
     6.9 - static void cpu_quiet(int cpu, struct rcu_ctrlblk *rcp, struct rcu_state *rsp)
    6.10 - {
    6.11 -+	cpumask_t mask;
    6.12 -+
    6.13 - 	cpu_clear(cpu, rsp->cpumask);
    6.14 --	if (cpus_empty(rsp->cpumask)) {
    6.15 -+	cpus_andnot(mask, rsp->cpumask, nohz_cpu_mask);
    6.16 -+	if (cpus_empty(mask)) {
    6.17 - 		/* batch completed ! */
    6.18 - 		rcp->completed = rcp->cur;
    6.19 - 		rcu_start_batch(rcp, rsp, 0);
     7.1 --- a/patches/linux-2.6.11/smp-alts.patch	Mon Jul 11 15:12:37 2005 +0000
     7.2 +++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
     7.3 @@ -1,563 +0,0 @@
     7.4 -diff -Naur linux-2.6.11/arch/i386/Kconfig linux-2.6.11.post/arch/i386/Kconfig
     7.5 ---- linux-2.6.11/arch/i386/Kconfig	2005-03-02 07:37:49.000000000 +0000
     7.6 -+++ linux-2.6.11.post/arch/i386/Kconfig	2005-06-10 13:42:35.000000000 +0100
     7.7 -@@ -481,6 +481,19 @@
     7.8 - 
     7.9 - 	  If you don't know what to do here, say N.
    7.10 - 
    7.11 -+config SMP_ALTERNATIVES
    7.12 -+	bool "SMP alternatives support (EXPERIMENTAL)"
    7.13 -+	depends on SMP && EXPERIMENTAL
    7.14 -+	help
    7.15 -+	  Try to reduce the overhead of running an SMP kernel on a uniprocessor
    7.16 -+	  host slightly by replacing certain key instruction sequences
    7.17 -+	  according to whether we currently have more than one CPU available.
    7.18 -+	  This should provide a noticeable boost to performance when
    7.19 -+	  running SMP kernels on UP machines, and have negligible impact
    7.20 -+	  when running on an true SMP host.
    7.21 -+
    7.22 -+          If unsure, say N.
    7.23 -+	  
    7.24 - config NR_CPUS
    7.25 - 	int "Maximum number of CPUs (2-255)"
    7.26 - 	range 2 255
    7.27 -diff -Naur linux-2.6.11/arch/i386/kernel/Makefile linux-2.6.11.post/arch/i386/kernel/Makefile
    7.28 ---- linux-2.6.11/arch/i386/kernel/Makefile	2005-03-02 07:37:49.000000000 +0000
    7.29 -+++ linux-2.6.11.post/arch/i386/kernel/Makefile	2005-06-16 11:16:18.555332435 +0100
    7.30 -@@ -32,6 +32,7 @@
    7.31 - obj-$(CONFIG_HPET_TIMER) 	+= time_hpet.o
    7.32 - obj-$(CONFIG_EFI) 		+= efi.o efi_stub.o
    7.33 - obj-$(CONFIG_EARLY_PRINTK)	+= early_printk.o
    7.34 -+obj-$(CONFIG_SMP_ALTERNATIVES)  += smpalts.o
    7.35 - 
    7.36 - EXTRA_AFLAGS   := -traditional
    7.37 - 
    7.38 -diff -Naur linux-2.6.11/arch/i386/kernel/smpalts.c linux-2.6.11.post/arch/i386/kernel/smpalts.c
    7.39 ---- linux-2.6.11/arch/i386/kernel/smpalts.c	1970-01-01 01:00:00.000000000 +0100
    7.40 -+++ linux-2.6.11.post/arch/i386/kernel/smpalts.c	2005-06-16 11:23:39.300902424 +0100
    7.41 -@@ -0,0 +1,85 @@
    7.42 -+#include <linux/kernel.h>
    7.43 -+#include <asm/system.h>
    7.44 -+#include <asm/smp_alt.h>
    7.45 -+#include <asm/processor.h>
    7.46 -+#include <asm/string.h>
    7.47 -+
    7.48 -+struct smp_replacement_record {
    7.49 -+	unsigned char targ_size;
    7.50 -+	unsigned char smp1_size;
    7.51 -+	unsigned char smp2_size;
    7.52 -+	unsigned char up_size;
    7.53 -+	unsigned char feature;
    7.54 -+	unsigned char data[0];
    7.55 -+};
    7.56 -+
    7.57 -+struct smp_alternative_record {
    7.58 -+	void *targ_start;
    7.59 -+	struct smp_replacement_record *repl;
    7.60 -+};
    7.61 -+
    7.62 -+extern struct smp_alternative_record __start_smp_alternatives_table,
    7.63 -+  __stop_smp_alternatives_table;
    7.64 -+extern unsigned long __init_begin, __init_end;
    7.65 -+
    7.66 -+void prepare_for_smp(void)
    7.67 -+{
    7.68 -+	struct smp_alternative_record *r;
    7.69 -+	printk(KERN_INFO "Enabling SMP...\n");
    7.70 -+	for (r = &__start_smp_alternatives_table;
    7.71 -+	     r != &__stop_smp_alternatives_table;
    7.72 -+	     r++) {
    7.73 -+		BUG_ON(r->repl->targ_size < r->repl->smp1_size);
    7.74 -+		BUG_ON(r->repl->targ_size < r->repl->smp2_size);
    7.75 -+		BUG_ON(r->repl->targ_size < r->repl->up_size);
    7.76 -+               if (system_state == SYSTEM_RUNNING &&
    7.77 -+                   r->targ_start >= (void *)&__init_begin &&
    7.78 -+                   r->targ_start < (void *)&__init_end)
    7.79 -+                       continue;
    7.80 -+		if (r->repl->feature != (unsigned char)-1 &&
    7.81 -+		    boot_cpu_has(r->repl->feature)) {
    7.82 -+			memcpy(r->targ_start,
    7.83 -+			       r->repl->data + r->repl->smp1_size,
    7.84 -+			       r->repl->smp2_size);
    7.85 -+			memset(r->targ_start + r->repl->smp2_size,
    7.86 -+			       0x90,
    7.87 -+			       r->repl->targ_size - r->repl->smp2_size);
    7.88 -+		} else {
    7.89 -+			memcpy(r->targ_start,
    7.90 -+			       r->repl->data,
    7.91 -+			       r->repl->smp1_size);
    7.92 -+			memset(r->targ_start + r->repl->smp1_size,
    7.93 -+			       0x90,
    7.94 -+			       r->repl->targ_size - r->repl->smp1_size);
    7.95 -+		}
    7.96 -+	}
    7.97 -+	/* Paranoia */
    7.98 -+	asm volatile ("jmp 1f\n1:");
    7.99 -+	mb();
   7.100 -+}
   7.101 -+
   7.102 -+void unprepare_for_smp(void)
   7.103 -+{
   7.104 -+	struct smp_alternative_record *r;
   7.105 -+	printk(KERN_INFO "Disabling SMP...\n");
   7.106 -+	for (r = &__start_smp_alternatives_table;
   7.107 -+	     r != &__stop_smp_alternatives_table;
   7.108 -+	     r++) {
   7.109 -+		BUG_ON(r->repl->targ_size < r->repl->smp1_size);
   7.110 -+		BUG_ON(r->repl->targ_size < r->repl->smp2_size);
   7.111 -+		BUG_ON(r->repl->targ_size < r->repl->up_size);
   7.112 -+               if (system_state == SYSTEM_RUNNING &&
   7.113 -+                   r->targ_start >= (void *)&__init_begin &&
   7.114 -+                   r->targ_start < (void *)&__init_end)
   7.115 -+                       continue;
   7.116 -+		memcpy(r->targ_start,
   7.117 -+		       r->repl->data + r->repl->smp1_size + r->repl->smp2_size,
   7.118 -+		       r->repl->up_size);
   7.119 -+		memset(r->targ_start + r->repl->up_size,
   7.120 -+		       0x90,
   7.121 -+		       r->repl->targ_size - r->repl->up_size);
   7.122 -+	}
   7.123 -+	/* Paranoia */
   7.124 -+	asm volatile ("jmp 1f\n1:");
   7.125 -+	mb();
   7.126 -+}
   7.127 -diff -Naur linux-2.6.11/arch/i386/kernel/smpboot.c linux-2.6.11.post/arch/i386/kernel/smpboot.c
   7.128 ---- linux-2.6.11/arch/i386/kernel/smpboot.c	2005-03-02 07:38:09.000000000 +0000
   7.129 -+++ linux-2.6.11.post/arch/i386/kernel/smpboot.c	2005-06-16 11:17:09.287064617 +0100
   7.130 -@@ -1003,6 +1003,11 @@
   7.131 - 		if (max_cpus <= cpucount+1)
   7.132 - 			continue;
   7.133 - 
   7.134 -+#ifdef CONFIG_SMP_ALTERNATIVES
   7.135 -+		if (kicked == 1)
   7.136 -+			prepare_for_smp();
   7.137 -+#endif
   7.138 -+
   7.139 - 		if (do_boot_cpu(apicid))
   7.140 - 			printk("CPU #%d not responding - cannot use it.\n",
   7.141 - 								apicid);
   7.142 -@@ -1118,6 +1123,11 @@
   7.143 - 		return -EIO;
   7.144 - 	}
   7.145 - 
   7.146 -+#ifdef CONFIG_SMP_ALTERNATIVES
   7.147 -+	if (num_online_cpus() == 1)
   7.148 -+		prepare_for_smp();
   7.149 -+#endif
   7.150 -+
   7.151 - 	local_irq_enable();
   7.152 - 	/* Unleash the CPU! */
   7.153 - 	cpu_set(cpu, smp_commenced_mask);
   7.154 -diff -Naur linux-2.6.11/arch/i386/kernel/vmlinux.lds.S linux-2.6.11.post/arch/i386/kernel/vmlinux.lds.S
   7.155 ---- linux-2.6.11/arch/i386/kernel/vmlinux.lds.S	2005-03-02 07:38:37.000000000 +0000
   7.156 -+++ linux-2.6.11.post/arch/i386/kernel/vmlinux.lds.S	2005-06-10 11:14:14.000000000 +0100
   7.157 -@@ -30,6 +30,13 @@
   7.158 -   __ex_table : { *(__ex_table) }
   7.159 -   __stop___ex_table = .;
   7.160 - 
   7.161 -+  . = ALIGN(16);
   7.162 -+  __start_smp_alternatives_table = .;
   7.163 -+  __smp_alternatives : { *(__smp_alternatives) }
   7.164 -+  __stop_smp_alternatives_table = .;
   7.165 -+
   7.166 -+  __smp_replacements : { *(__smp_replacements) }
   7.167 -+
   7.168 -   RODATA
   7.169 - 
   7.170 -   /* writeable */
   7.171 -diff -Naur linux-2.6.11/include/asm-i386/atomic.h linux-2.6.11.post/include/asm-i386/atomic.h
   7.172 ---- linux-2.6.11/include/asm-i386/atomic.h	2005-03-02 07:37:51.000000000 +0000
   7.173 -+++ linux-2.6.11.post/include/asm-i386/atomic.h	2005-06-13 10:10:39.000000000 +0100
   7.174 -@@ -4,18 +4,13 @@
   7.175 - #include <linux/config.h>
   7.176 - #include <linux/compiler.h>
   7.177 - #include <asm/processor.h>
   7.178 -+#include <asm/smp_alt.h>
   7.179 - 
   7.180 - /*
   7.181 -  * Atomic operations that C can't guarantee us.  Useful for
   7.182 -  * resource counting etc..
   7.183 -  */
   7.184 - 
   7.185 --#ifdef CONFIG_SMP
   7.186 --#define LOCK "lock ; "
   7.187 --#else
   7.188 --#define LOCK ""
   7.189 --#endif
   7.190 --
   7.191 - /*
   7.192 -  * Make sure gcc doesn't try to be clever and move things around
   7.193 -  * on us. We need to use _exactly_ the address the user gave us,
   7.194 -diff -Naur linux-2.6.11/include/asm-i386/bitops.h linux-2.6.11.post/include/asm-i386/bitops.h
   7.195 ---- linux-2.6.11/include/asm-i386/bitops.h	2005-03-02 07:38:12.000000000 +0000
   7.196 -+++ linux-2.6.11.post/include/asm-i386/bitops.h	2005-06-13 10:11:54.000000000 +0100
   7.197 -@@ -7,6 +7,7 @@
   7.198 - 
   7.199 - #include <linux/config.h>
   7.200 - #include <linux/compiler.h>
   7.201 -+#include <asm/smp_alt.h>
   7.202 - 
   7.203 - /*
   7.204 -  * These have to be done with inline assembly: that way the bit-setting
   7.205 -@@ -16,12 +17,6 @@
   7.206 -  * bit 0 is the LSB of addr; bit 32 is the LSB of (addr+1).
   7.207 -  */
   7.208 - 
   7.209 --#ifdef CONFIG_SMP
   7.210 --#define LOCK_PREFIX "lock ; "
   7.211 --#else
   7.212 --#define LOCK_PREFIX ""
   7.213 --#endif
   7.214 --
   7.215 - #define ADDR (*(volatile long *) addr)
   7.216 - 
   7.217 - /**
   7.218 -@@ -41,7 +36,7 @@
   7.219 -  */
   7.220 - static inline void set_bit(int nr, volatile unsigned long * addr)
   7.221 - {
   7.222 --	__asm__ __volatile__( LOCK_PREFIX
   7.223 -+	__asm__ __volatile__( LOCK
   7.224 - 		"btsl %1,%0"
   7.225 - 		:"=m" (ADDR)
   7.226 - 		:"Ir" (nr));
   7.227 -@@ -76,7 +71,7 @@
   7.228 -  */
   7.229 - static inline void clear_bit(int nr, volatile unsigned long * addr)
   7.230 - {
   7.231 --	__asm__ __volatile__( LOCK_PREFIX
   7.232 -+	__asm__ __volatile__( LOCK
   7.233 - 		"btrl %1,%0"
   7.234 - 		:"=m" (ADDR)
   7.235 - 		:"Ir" (nr));
   7.236 -@@ -121,7 +116,7 @@
   7.237 -  */
   7.238 - static inline void change_bit(int nr, volatile unsigned long * addr)
   7.239 - {
   7.240 --	__asm__ __volatile__( LOCK_PREFIX
   7.241 -+	__asm__ __volatile__( LOCK
   7.242 - 		"btcl %1,%0"
   7.243 - 		:"=m" (ADDR)
   7.244 - 		:"Ir" (nr));
   7.245 -@@ -140,7 +135,7 @@
   7.246 - {
   7.247 - 	int oldbit;
   7.248 - 
   7.249 --	__asm__ __volatile__( LOCK_PREFIX
   7.250 -+	__asm__ __volatile__( LOCK
   7.251 - 		"btsl %2,%1\n\tsbbl %0,%0"
   7.252 - 		:"=r" (oldbit),"=m" (ADDR)
   7.253 - 		:"Ir" (nr) : "memory");
   7.254 -@@ -180,7 +175,7 @@
   7.255 - {
   7.256 - 	int oldbit;
   7.257 - 
   7.258 --	__asm__ __volatile__( LOCK_PREFIX
   7.259 -+	__asm__ __volatile__( LOCK
   7.260 - 		"btrl %2,%1\n\tsbbl %0,%0"
   7.261 - 		:"=r" (oldbit),"=m" (ADDR)
   7.262 - 		:"Ir" (nr) : "memory");
   7.263 -@@ -231,7 +226,7 @@
   7.264 - {
   7.265 - 	int oldbit;
   7.266 - 
   7.267 --	__asm__ __volatile__( LOCK_PREFIX
   7.268 -+	__asm__ __volatile__( LOCK
   7.269 - 		"btcl %2,%1\n\tsbbl %0,%0"
   7.270 - 		:"=r" (oldbit),"=m" (ADDR)
   7.271 - 		:"Ir" (nr) : "memory");
   7.272 -diff -Naur linux-2.6.11/include/asm-i386/rwsem.h linux-2.6.11.post/include/asm-i386/rwsem.h
   7.273 ---- linux-2.6.11/include/asm-i386/rwsem.h	2005-03-02 07:38:08.000000000 +0000
   7.274 -+++ linux-2.6.11.post/include/asm-i386/rwsem.h	2005-06-13 10:13:06.000000000 +0100
   7.275 -@@ -40,6 +40,7 @@
   7.276 - 
   7.277 - #include <linux/list.h>
   7.278 - #include <linux/spinlock.h>
   7.279 -+#include <asm/smp_alt.h>
   7.280 - 
   7.281 - struct rwsem_waiter;
   7.282 - 
   7.283 -@@ -99,7 +100,7 @@
   7.284 - {
   7.285 - 	__asm__ __volatile__(
   7.286 - 		"# beginning down_read\n\t"
   7.287 --LOCK_PREFIX	"  incl      (%%eax)\n\t" /* adds 0x00000001, returns the old value */
   7.288 -+LOCK	        "  incl      (%%eax)\n\t" /* adds 0x00000001, returns the old value */
   7.289 - 		"  js        2f\n\t" /* jump if we weren't granted the lock */
   7.290 - 		"1:\n\t"
   7.291 - 		LOCK_SECTION_START("")
   7.292 -@@ -130,7 +131,7 @@
   7.293 - 		"  movl	     %1,%2\n\t"
   7.294 - 		"  addl      %3,%2\n\t"
   7.295 - 		"  jle	     2f\n\t"
   7.296 --LOCK_PREFIX	"  cmpxchgl  %2,%0\n\t"
   7.297 -+LOCK	        "  cmpxchgl  %2,%0\n\t"
   7.298 - 		"  jnz	     1b\n\t"
   7.299 - 		"2:\n\t"
   7.300 - 		"# ending __down_read_trylock\n\t"
   7.301 -@@ -150,7 +151,7 @@
   7.302 - 	tmp = RWSEM_ACTIVE_WRITE_BIAS;
   7.303 - 	__asm__ __volatile__(
   7.304 - 		"# beginning down_write\n\t"
   7.305 --LOCK_PREFIX	"  xadd      %%edx,(%%eax)\n\t" /* subtract 0x0000ffff, returns the old value */
   7.306 -+LOCK	        "  xadd      %%edx,(%%eax)\n\t" /* subtract 0x0000ffff, returns the old value */
   7.307 - 		"  testl     %%edx,%%edx\n\t" /* was the count 0 before? */
   7.308 - 		"  jnz       2f\n\t" /* jump if we weren't granted the lock */
   7.309 - 		"1:\n\t"
   7.310 -@@ -188,7 +189,7 @@
   7.311 - 	__s32 tmp = -RWSEM_ACTIVE_READ_BIAS;
   7.312 - 	__asm__ __volatile__(
   7.313 - 		"# beginning __up_read\n\t"
   7.314 --LOCK_PREFIX	"  xadd      %%edx,(%%eax)\n\t" /* subtracts 1, returns the old value */
   7.315 -+LOCK	        "  xadd      %%edx,(%%eax)\n\t" /* subtracts 1, returns the old value */
   7.316 - 		"  js        2f\n\t" /* jump if the lock is being waited upon */
   7.317 - 		"1:\n\t"
   7.318 - 		LOCK_SECTION_START("")
   7.319 -@@ -214,7 +215,7 @@
   7.320 - 	__asm__ __volatile__(
   7.321 - 		"# beginning __up_write\n\t"
   7.322 - 		"  movl      %2,%%edx\n\t"
   7.323 --LOCK_PREFIX	"  xaddl     %%edx,(%%eax)\n\t" /* tries to transition 0xffff0001 -> 0x00000000 */
   7.324 -+LOCK	        "  xaddl     %%edx,(%%eax)\n\t" /* tries to transition 0xffff0001 -> 0x00000000 */
   7.325 - 		"  jnz       2f\n\t" /* jump if the lock is being waited upon */
   7.326 - 		"1:\n\t"
   7.327 - 		LOCK_SECTION_START("")
   7.328 -@@ -239,7 +240,7 @@
   7.329 - {
   7.330 - 	__asm__ __volatile__(
   7.331 - 		"# beginning __downgrade_write\n\t"
   7.332 --LOCK_PREFIX	"  addl      %2,(%%eax)\n\t" /* transitions 0xZZZZ0001 -> 0xYYYY0001 */
   7.333 -+LOCK	        "  addl      %2,(%%eax)\n\t" /* transitions 0xZZZZ0001 -> 0xYYYY0001 */
   7.334 - 		"  js        2f\n\t" /* jump if the lock is being waited upon */
   7.335 - 		"1:\n\t"
   7.336 - 		LOCK_SECTION_START("")
   7.337 -@@ -263,7 +264,7 @@
   7.338 - static inline void rwsem_atomic_add(int delta, struct rw_semaphore *sem)
   7.339 - {
   7.340 - 	__asm__ __volatile__(
   7.341 --LOCK_PREFIX	"addl %1,%0"
   7.342 -+LOCK	          "addl %1,%0"
   7.343 - 		: "=m"(sem->count)
   7.344 - 		: "ir"(delta), "m"(sem->count));
   7.345 - }
   7.346 -@@ -276,7 +277,7 @@
   7.347 - 	int tmp = delta;
   7.348 - 
   7.349 - 	__asm__ __volatile__(
   7.350 --LOCK_PREFIX	"xadd %0,(%2)"
   7.351 -+LOCK  	          "xadd %0,(%2)"
   7.352 - 		: "+r"(tmp), "=m"(sem->count)
   7.353 - 		: "r"(sem), "m"(sem->count)
   7.354 - 		: "memory");
   7.355 -diff -Naur linux-2.6.11/include/asm-i386/smp_alt.h linux-2.6.11.post/include/asm-i386/smp_alt.h
   7.356 ---- linux-2.6.11/include/asm-i386/smp_alt.h	1970-01-01 01:00:00.000000000 +0100
   7.357 -+++ linux-2.6.11.post/include/asm-i386/smp_alt.h	2005-06-16 11:16:50.109433206 +0100
   7.358 -@@ -0,0 +1,32 @@
   7.359 -+#ifndef __ASM_SMP_ALT_H__
   7.360 -+#define __ASM_SMP_ALT_H__
   7.361 -+
   7.362 -+#include <linux/config.h>
   7.363 -+
   7.364 -+#ifdef CONFIG_SMP
   7.365 -+#if defined(CONFIG_SMP_ALTERNATIVES) && !defined(MODULE)
   7.366 -+#define LOCK \
   7.367 -+        "6677: nop\n" \
   7.368 -+	".section __smp_alternatives,\"a\"\n" \
   7.369 -+	".long 6677b\n" \
   7.370 -+	".long 6678f\n" \
   7.371 -+	".previous\n" \
   7.372 -+	".section __smp_replacements,\"a\"\n" \
   7.373 -+	"6678: .byte 1\n" \
   7.374 -+	".byte 1\n" \
   7.375 -+	".byte 0\n" \
   7.376 -+        ".byte 1\n" \
   7.377 -+	".byte -1\n" \
   7.378 -+	"lock\n" \
   7.379 -+	"nop\n" \
   7.380 -+	".previous\n"
   7.381 -+void prepare_for_smp(void);
   7.382 -+void unprepare_for_smp(void);
   7.383 -+#else
   7.384 -+#define LOCK "lock ; "
   7.385 -+#endif
   7.386 -+#else
   7.387 -+#define LOCK ""
   7.388 -+#endif
   7.389 -+
   7.390 -+#endif /* __ASM_SMP_ALT_H__ */
   7.391 -diff -Naur linux-2.6.11/include/asm-i386/spinlock.h linux-2.6.11.post/include/asm-i386/spinlock.h
   7.392 ---- linux-2.6.11/include/asm-i386/spinlock.h	2005-03-02 07:37:50.000000000 +0000
   7.393 -+++ linux-2.6.11.post/include/asm-i386/spinlock.h	2005-06-13 14:13:52.000000000 +0100
   7.394 -@@ -6,6 +6,7 @@
   7.395 - #include <asm/page.h>
   7.396 - #include <linux/config.h>
   7.397 - #include <linux/compiler.h>
   7.398 -+#include <asm/smp_alt.h>
   7.399 - 
   7.400 - asmlinkage int printk(const char * fmt, ...)
   7.401 - 	__attribute__ ((format (printf, 1, 2)));
   7.402 -@@ -47,8 +48,9 @@
   7.403 - #define spin_unlock_wait(x)	do { barrier(); } while(spin_is_locked(x))
   7.404 - 
   7.405 - #define spin_lock_string \
   7.406 --	"\n1:\t" \
   7.407 --	"lock ; decb %0\n\t" \
   7.408 -+        "1:\n" \
   7.409 -+	LOCK \
   7.410 -+	"decb %0\n\t" \
   7.411 - 	"jns 3f\n" \
   7.412 - 	"2:\t" \
   7.413 - 	"rep;nop\n\t" \
   7.414 -@@ -58,8 +60,9 @@
   7.415 - 	"3:\n\t"
   7.416 - 
   7.417 - #define spin_lock_string_flags \
   7.418 --	"\n1:\t" \
   7.419 --	"lock ; decb %0\n\t" \
   7.420 -+        "1:\n" \
   7.421 -+	LOCK \
   7.422 -+	"decb %0\n\t" \
   7.423 - 	"jns 4f\n\t" \
   7.424 - 	"2:\t" \
   7.425 - 	"testl $0x200, %1\n\t" \
   7.426 -@@ -121,10 +124,34 @@
   7.427 - static inline int _raw_spin_trylock(spinlock_t *lock)
   7.428 - {
   7.429 - 	char oldval;
   7.430 -+#ifdef CONFIG_SMP_ALTERNATIVES
   7.431 - 	__asm__ __volatile__(
   7.432 --		"xchgb %b0,%1"
   7.433 -+		"1:movb %1,%b0\n"
   7.434 -+		"movb $0,%1\n"
   7.435 -+		"2:"
   7.436 -+		".section __smp_alternatives,\"a\"\n"
   7.437 -+		".long 1b\n"
   7.438 -+		".long 3f\n"
   7.439 -+		".previous\n"
   7.440 -+		".section __smp_replacements,\"a\"\n"
   7.441 -+		"3: .byte 2b - 1b\n"
   7.442 -+		".byte 5f-4f\n"
   7.443 -+		".byte 0\n"
   7.444 -+		".byte 6f-5f\n"
   7.445 -+		".byte -1\n"
   7.446 -+		"4: xchgb %b0,%1\n"
   7.447 -+		"5: movb %1,%b0\n"
   7.448 -+		"movb $0,%1\n"
   7.449 -+		"6:\n"
   7.450 -+		".previous\n"
   7.451 - 		:"=q" (oldval), "=m" (lock->slock)
   7.452 - 		:"0" (0) : "memory");
   7.453 -+#else
   7.454 -+	__asm__ __volatile__(
   7.455 -+		"xchgb %b0,%1\n"
   7.456 -+		:"=q" (oldval), "=m" (lock->slock)
   7.457 -+		:"0" (0) : "memory");
   7.458 -+#endif
   7.459 - 	return oldval > 0;
   7.460 - }
   7.461 - 
   7.462 -@@ -225,8 +252,8 @@
   7.463 - 	__build_write_lock(rw, "__write_lock_failed");
   7.464 - }
   7.465 - 
   7.466 --#define _raw_read_unlock(rw)		asm volatile("lock ; incl %0" :"=m" ((rw)->lock) : : "memory")
   7.467 --#define _raw_write_unlock(rw)	asm volatile("lock ; addl $" RW_LOCK_BIAS_STR ",%0":"=m" ((rw)->lock) : : "memory")
   7.468 -+#define _raw_read_unlock(rw)	asm volatile(LOCK "incl %0" :"=m" ((rw)->lock) : : "memory")
   7.469 -+#define _raw_write_unlock(rw)	asm volatile(LOCK "addl $" RW_LOCK_BIAS_STR ",%0":"=m" ((rw)->lock) : : "memory")
   7.470 - 
   7.471 - static inline int _raw_read_trylock(rwlock_t *lock)
   7.472 - {
   7.473 -diff -Naur linux-2.6.11/include/asm-i386/system.h linux-2.6.11.post/include/asm-i386/system.h
   7.474 ---- linux-2.6.11/include/asm-i386/system.h	2005-03-02 07:37:30.000000000 +0000
   7.475 -+++ linux-2.6.11.post/include/asm-i386/system.h	2005-06-15 13:21:40.000000000 +0100
   7.476 -@@ -5,7 +5,7 @@
   7.477 - #include <linux/kernel.h>
   7.478 - #include <asm/segment.h>
   7.479 - #include <asm/cpufeature.h>
   7.480 --#include <linux/bitops.h> /* for LOCK_PREFIX */
   7.481 -+#include <asm/smp_alt.h>
   7.482 - 
   7.483 - #ifdef __KERNEL__
   7.484 - 
   7.485 -@@ -249,19 +249,19 @@
   7.486 - 	unsigned long prev;
   7.487 - 	switch (size) {
   7.488 - 	case 1:
   7.489 --		__asm__ __volatile__(LOCK_PREFIX "cmpxchgb %b1,%2"
   7.490 -+		__asm__ __volatile__(LOCK "cmpxchgb %b1,%2"
   7.491 - 				     : "=a"(prev)
   7.492 - 				     : "q"(new), "m"(*__xg(ptr)), "0"(old)
   7.493 - 				     : "memory");
   7.494 - 		return prev;
   7.495 - 	case 2:
   7.496 --		__asm__ __volatile__(LOCK_PREFIX "cmpxchgw %w1,%2"
   7.497 -+		__asm__ __volatile__(LOCK "cmpxchgw %w1,%2"
   7.498 - 				     : "=a"(prev)
   7.499 - 				     : "q"(new), "m"(*__xg(ptr)), "0"(old)
   7.500 - 				     : "memory");
   7.501 - 		return prev;
   7.502 - 	case 4:
   7.503 --		__asm__ __volatile__(LOCK_PREFIX "cmpxchgl %1,%2"
   7.504 -+		__asm__ __volatile__(LOCK "cmpxchgl %1,%2"
   7.505 - 				     : "=a"(prev)
   7.506 - 				     : "q"(new), "m"(*__xg(ptr)), "0"(old)
   7.507 - 				     : "memory");
   7.508 -@@ -425,11 +425,55 @@
   7.509 - #endif
   7.510 - 
   7.511 - #ifdef CONFIG_SMP
   7.512 --#define smp_mb()	mb()
   7.513 --#define smp_rmb()	rmb()
   7.514 - #define smp_wmb()	wmb()
   7.515 --#define smp_read_barrier_depends()	read_barrier_depends()
   7.516 -+#if defined(CONFIG_SMP_ALTERNATIVES) && !defined(MODULE)
   7.517 -+#define smp_alt_mb(instr)                                           \
   7.518 -+__asm__ __volatile__("6667:\nnop\nnop\nnop\nnop\nnop\nnop\n6668:\n" \
   7.519 -+		     ".section __smp_alternatives,\"a\"\n"          \
   7.520 -+		     ".long 6667b\n"                                \
   7.521 -+                     ".long 6673f\n"                                \
   7.522 -+		     ".previous\n"                                  \
   7.523 -+		     ".section __smp_replacements,\"a\"\n"          \
   7.524 -+		     "6673:.byte 6668b-6667b\n"                     \
   7.525 -+		     ".byte 6670f-6669f\n"                          \
   7.526 -+		     ".byte 6671f-6670f\n"                          \
   7.527 -+                     ".byte 0\n"                                    \
   7.528 -+		     ".byte %c0\n"                                  \
   7.529 -+		     "6669:lock;addl $0,0(%%esp)\n"                 \
   7.530 -+		     "6670:" instr "\n"                             \
   7.531 -+		     "6671:\n"                                      \
   7.532 -+		     ".previous\n"                                  \
   7.533 -+		     :                                              \
   7.534 -+		     : "i" (X86_FEATURE_XMM2)                       \
   7.535 -+		     : "memory")
   7.536 -+#define smp_rmb() smp_alt_mb("lfence")
   7.537 -+#define smp_mb()  smp_alt_mb("mfence")
   7.538 -+#define set_mb(var, value) do {                                     \
   7.539 -+unsigned long __set_mb_temp;                                        \
   7.540 -+__asm__ __volatile__("6667:movl %1, %0\n6668:\n"                    \
   7.541 -+		     ".section __smp_alternatives,\"a\"\n"          \
   7.542 -+		     ".long 6667b\n"                                \
   7.543 -+		     ".long 6673f\n"                                \
   7.544 -+		     ".previous\n"                                  \
   7.545 -+		     ".section __smp_replacements,\"a\"\n"          \
   7.546 -+		     "6673: .byte 6668b-6667b\n"                    \
   7.547 -+		     ".byte 6670f-6669f\n"                          \
   7.548 -+		     ".byte 0\n"                                    \
   7.549 -+		     ".byte 6671f-6670f\n"                          \
   7.550 -+		     ".byte -1\n"                                   \
   7.551 -+		     "6669: xchg %1, %0\n"                          \
   7.552 -+		     "6670:movl %1, %0\n"                           \
   7.553 -+		     "6671:\n"                                      \
   7.554 -+		     ".previous\n"                                  \
   7.555 -+		     : "=m" (var), "=r" (__set_mb_temp)             \
   7.556 -+		     : "1" (value)                                  \
   7.557 -+		     : "memory"); } while (0)
   7.558 -+#else
   7.559 -+#define smp_rmb()	rmb()
   7.560 -+#define smp_mb()	mb()
   7.561 - #define set_mb(var, value) do { xchg(&var, value); } while (0)
   7.562 -+#endif
   7.563 -+#define smp_read_barrier_depends()	read_barrier_depends()
   7.564 - #else
   7.565 - #define smp_mb()	barrier()
   7.566 - #define smp_rmb()	barrier()
     8.1 --- a/patches/linux-2.6.11/udp-frag.patch	Mon Jul 11 15:12:37 2005 +0000
     8.2 +++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
     8.3 @@ -1,55 +0,0 @@
     8.4 -diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
     8.5 ---- a/net/ipv4/udp.c
     8.6 -+++ b/net/ipv4/udp.c
     8.7 -@@ -738,7 +738,7 @@ int udp_ioctl(struct sock *sk, int cmd, 
     8.8 - 			unsigned long amount;
     8.9 - 
    8.10 - 			amount = 0;
    8.11 --			spin_lock_irq(&sk->sk_receive_queue.lock);
    8.12 -+			spin_lock_bh(&sk->sk_receive_queue.lock);
    8.13 - 			skb = skb_peek(&sk->sk_receive_queue);
    8.14 - 			if (skb != NULL) {
    8.15 - 				/*
    8.16 -@@ -748,7 +748,7 @@ int udp_ioctl(struct sock *sk, int cmd, 
    8.17 - 				 */
    8.18 - 				amount = skb->len - sizeof(struct udphdr);
    8.19 - 			}
    8.20 --			spin_unlock_irq(&sk->sk_receive_queue.lock);
    8.21 -+			spin_unlock_bh(&sk->sk_receive_queue.lock);
    8.22 - 			return put_user(amount, (int __user *)arg);
    8.23 - 		}
    8.24 - 
    8.25 -@@ -848,12 +848,12 @@ csum_copy_err:
    8.26 - 	/* Clear queue. */
    8.27 - 	if (flags&MSG_PEEK) {
    8.28 - 		int clear = 0;
    8.29 --		spin_lock_irq(&sk->sk_receive_queue.lock);
    8.30 -+		spin_lock_bh(&sk->sk_receive_queue.lock);
    8.31 - 		if (skb == skb_peek(&sk->sk_receive_queue)) {
    8.32 - 			__skb_unlink(skb, &sk->sk_receive_queue);
    8.33 - 			clear = 1;
    8.34 - 		}
    8.35 --		spin_unlock_irq(&sk->sk_receive_queue.lock);
    8.36 -+		spin_unlock_bh(&sk->sk_receive_queue.lock);
    8.37 - 		if (clear)
    8.38 - 			kfree_skb(skb);
    8.39 - 	}
    8.40 -@@ -1334,7 +1334,7 @@ unsigned int udp_poll(struct file *file,
    8.41 - 		struct sk_buff_head *rcvq = &sk->sk_receive_queue;
    8.42 - 		struct sk_buff *skb;
    8.43 - 
    8.44 --		spin_lock_irq(&rcvq->lock);
    8.45 -+		spin_lock_bh(&rcvq->lock);
    8.46 - 		while ((skb = skb_peek(rcvq)) != NULL) {
    8.47 - 			if (udp_checksum_complete(skb)) {
    8.48 - 				UDP_INC_STATS_BH(UDP_MIB_INERRORS);
    8.49 -@@ -1345,7 +1345,7 @@ unsigned int udp_poll(struct file *file,
    8.50 - 				break;
    8.51 - 			}
    8.52 - 		}
    8.53 --		spin_unlock_irq(&rcvq->lock);
    8.54 -+		spin_unlock_bh(&rcvq->lock);
    8.55 - 
    8.56 - 		/* nothing to see, move along */
    8.57 - 		if (skb == NULL)
    8.58 -
     9.1 --- a/patches/linux-2.6.11/x86_64-linux.patch	Mon Jul 11 15:12:37 2005 +0000
     9.2 +++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
     9.3 @@ -1,68 +0,0 @@
     9.4 -diff -urN linux-2.6.10-orig/include/asm-x86_64/hw_irq.h linux-2.6.10/include/asm-x86_64/hw_irq.h
     9.5 ---- linux-2.6.10-orig/include/asm-x86_64/hw_irq.h	2005-01-06 00:34:38.000000000 -0500
     9.6 -+++ linux-2.6.10/include/asm-x86_64/hw_irq.h	2005-02-25 17:45:37.181518088 -0500
     9.7 -@@ -48,6 +48,7 @@
     9.8 -  *
     9.9 -  *  Vectors 0xf0-0xf9 are free (reserved for future Linux use).
    9.10 -  */
    9.11 -+#ifndef CONFIG_XEN
    9.12 - #define SPURIOUS_APIC_VECTOR	0xff
    9.13 - #define ERROR_APIC_VECTOR	0xfe
    9.14 - #define INVALIDATE_TLB_VECTOR	0xfd
    9.15 -@@ -57,7 +58,7 @@
    9.16 - #define KDB_VECTOR	0xf9
    9.17 - 
    9.18 - #define THERMAL_APIC_VECTOR	0xf0
    9.19 --
    9.20 -+#endif
    9.21 - 
    9.22 - /*
    9.23 -  * Local APIC timer IRQ vector is on a different priority level,
    9.24 -diff -urN linux-2.6.10-orig/include/asm-x86_64/irq.h linux-2.6.10/include/asm-x86_64/irq.h
    9.25 ---- linux-2.6.10-orig/include/asm-x86_64/irq.h	2005-01-06 00:34:38.000000000 -0500
    9.26 -+++ linux-2.6.10/include/asm-x86_64/irq.h	2005-02-25 17:45:37.181518088 -0500
    9.27 -@@ -10,6 +10,9 @@
    9.28 -  *	<tomsoft@informatik.tu-chemnitz.de>
    9.29 -  */
    9.30 - 
    9.31 -+#ifdef CONFIG_XEN
    9.32 -+#include "irq_vectors.h"
    9.33 -+#endif
    9.34 - #define TIMER_IRQ 0
    9.35 - 
    9.36 - /*
    9.37 -@@ -22,6 +25,7 @@
    9.38 -  * the usable vector space is 0x20-0xff (224 vectors)
    9.39 -  */
    9.40 - 
    9.41 -+#ifndef CONFIG_XEN
    9.42 - /*
    9.43 -  * The maximum number of vectors supported by x86_64 processors
    9.44 -  * is limited to 256. For processors other than x86_64, NR_VECTORS
    9.45 -@@ -38,6 +42,7 @@
    9.46 - #define NR_IRQS 224
    9.47 - #define NR_IRQ_VECTORS 1024
    9.48 - #endif
    9.49 -+#endif
    9.50 - 
    9.51 - static __inline__ int irq_canonicalize(int irq)
    9.52 - {
    9.53 -diff -urN linux-2.6.10-orig/include/asm-x86_64/posix_types.h linux-2.6.10/include/asm-x86_64/posix_types.h
    9.54 ---- linux-2.6.10-orig/include/asm-x86_64/posix_types.h	2004-10-18 17:55:29.000000000 -0400
    9.55 -+++ linux-2.6.10/include/asm-x86_64/posix_types.h	2005-02-25 17:45:37.183517784 -0500
    9.56 -@@ -6,7 +6,7 @@
    9.57 -  * be a little careful about namespace pollution etc.  Also, we cannot
    9.58 -  * assume GCC is being used.
    9.59 -  */
    9.60 --
    9.61 -+#ifndef __ASSEMBLY__
    9.62 - typedef unsigned long	__kernel_ino_t;
    9.63 - typedef unsigned int	__kernel_mode_t;
    9.64 - typedef unsigned long	__kernel_nlink_t;
    9.65 -@@ -115,5 +115,5 @@
    9.66 - }
    9.67 - 
    9.68 - #endif /* defined(__KERNEL__) */
    9.69 --
    9.70 -+#endif
    9.71 - #endif