ia64/xen-unstable

changeset 4875:fcec698401ea

bitkeeper revision 1.1389.1.43 (42835a07_9U_50pDnxsJHWFZtJqg5g)

Merge firebug.cl.cam.ac.uk:/auto/groups/xeno-xenod/BK/xen-2.0-testing.bk
into firebug.cl.cam.ac.uk:/local/scratch/cl349/xen-unstable.bk-clean
author cl349@firebug.cl.cam.ac.uk
date Thu May 12 13:28:39 2005 +0000 (2005-05-12)
parents e9ca570f9023 caa382d9c347
children 58b938b709e4 357faeff6316
files .rootkeys patches/linux-2.6.11/linux-2.6.11.8.patch
line diff
     1.1 --- a/.rootkeys	Thu May 12 13:08:06 2005 +0000
     1.2 +++ b/.rootkeys	Thu May 12 13:28:39 2005 +0000
     1.3 @@ -469,6 +469,7 @@ 413cb3b53nyOv1OIeDSsCXhBFDXvJA netbsd-2.
     1.4  413aa1d0oNP8HXLvfPuMe6cSroUfSA patches/linux-2.6.11/agpgart.patch
     1.5  427261074Iy1MkbbqIV6zdZDWWx_Jg patches/linux-2.6.11/i386-cpu-hotplug-updated-for-mm.patch
     1.6  42372652KCUP-IOH9RN19YQmGhs4aA patches/linux-2.6.11/iomap.patch
     1.7 +428359d4b3fDYtazwXi4UUmSWaOUew patches/linux-2.6.11/linux-2.6.11.8.patch
     1.8  424f001e_M1Tnxc52rDrmCLelnDWMQ patches/linux-2.6.11/x86_64-linux.patch
     1.9  3f776bd1Hy9rn69ntXBhPReUFw9IEA tools/Makefile
    1.10  40e1b09db5mN69Ijj0X_Eol-S7dXiw tools/Rules.mk
     2.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     2.2 +++ b/patches/linux-2.6.11/linux-2.6.11.8.patch	Thu May 12 13:28:39 2005 +0000
     2.3 @@ -0,0 +1,1613 @@
     2.4 +diff -Nru a/Makefile b/Makefile
     2.5 +--- a/Makefile	2005-04-29 18:34:28 -07:00
     2.6 ++++ b/Makefile	2005-04-29 18:34:28 -07:00
     2.7 +@@ -1,8 +1,8 @@
     2.8 + VERSION = 2
     2.9 + PATCHLEVEL = 6
    2.10 + SUBLEVEL = 11
    2.11 +-EXTRAVERSION =
    2.12 +-NAME=Woozy Numbat
    2.13 ++EXTRAVERSION = .8
    2.14 ++NAME=Woozy Beaver
    2.15 + 
    2.16 + # *DOCUMENTATION*
    2.17 + # To see a list of typical targets execute "make help"
    2.18 +diff -Nru a/arch/ia64/kernel/fsys.S b/arch/ia64/kernel/fsys.S
    2.19 +--- a/arch/ia64/kernel/fsys.S	2005-04-29 18:34:28 -07:00
    2.20 ++++ b/arch/ia64/kernel/fsys.S	2005-04-29 18:34:28 -07:00
    2.21 +@@ -611,8 +611,10 @@
    2.22 + 	movl r2=ia64_ret_from_syscall
    2.23 + 	;;
    2.24 + 	mov rp=r2				// set the real return addr
    2.25 +-	tbit.z p8,p0=r3,TIF_SYSCALL_TRACE
    2.26 ++	and r3=_TIF_SYSCALL_TRACEAUDIT,r3
    2.27 + 	;;
    2.28 ++	cmp.eq p8,p0=r3,r0
    2.29 ++
    2.30 + (p10)	br.cond.spnt.many ia64_ret_from_syscall	// p10==true means out registers are more than 8
    2.31 + (p8)	br.call.sptk.many b6=b6		// ignore this return addr
    2.32 + 	br.cond.sptk ia64_trace_syscall
    2.33 +diff -Nru a/arch/ia64/kernel/signal.c b/arch/ia64/kernel/signal.c
    2.34 +--- a/arch/ia64/kernel/signal.c	2005-04-29 18:34:28 -07:00
    2.35 ++++ b/arch/ia64/kernel/signal.c	2005-04-29 18:34:28 -07:00
    2.36 +@@ -224,7 +224,8 @@
    2.37 + 	 * could be corrupted.
    2.38 + 	 */
    2.39 + 	retval = (long) &ia64_leave_kernel;
    2.40 +-	if (test_thread_flag(TIF_SYSCALL_TRACE))
    2.41 ++	if (test_thread_flag(TIF_SYSCALL_TRACE)
    2.42 ++	    || test_thread_flag(TIF_SYSCALL_AUDIT))
    2.43 + 		/*
    2.44 + 		 * strace expects to be notified after sigreturn returns even though the
    2.45 + 		 * context to which we return may not be in the middle of a syscall.
    2.46 +diff -Nru a/arch/ppc/oprofile/op_model_fsl_booke.c b/arch/ppc/oprofile/op_model_fsl_booke.c
    2.47 +--- a/arch/ppc/oprofile/op_model_fsl_booke.c	2005-04-29 18:34:28 -07:00
    2.48 ++++ b/arch/ppc/oprofile/op_model_fsl_booke.c	2005-04-29 18:34:28 -07:00
    2.49 +@@ -150,7 +150,6 @@
    2.50 + 	int is_kernel;
    2.51 + 	int val;
    2.52 + 	int i;
    2.53 +-	unsigned int cpu = smp_processor_id();
    2.54 + 
    2.55 + 	/* set the PMM bit (see comment below) */
    2.56 + 	mtmsr(mfmsr() | MSR_PMM);
    2.57 +@@ -162,7 +161,7 @@
    2.58 + 		val = ctr_read(i);
    2.59 + 		if (val < 0) {
    2.60 + 			if (oprofile_running && ctr[i].enabled) {
    2.61 +-				oprofile_add_sample(pc, is_kernel, i, cpu);
    2.62 ++				oprofile_add_pc(pc, is_kernel, i);
    2.63 + 				ctr_write(i, reset_value[i]);
    2.64 + 			} else {
    2.65 + 				ctr_write(i, 0);
    2.66 +diff -Nru a/arch/ppc/platforms/4xx/ebony.h b/arch/ppc/platforms/4xx/ebony.h
    2.67 +--- a/arch/ppc/platforms/4xx/ebony.h	2005-04-29 18:34:28 -07:00
    2.68 ++++ b/arch/ppc/platforms/4xx/ebony.h	2005-04-29 18:34:28 -07:00
    2.69 +@@ -61,8 +61,8 @@
    2.70 +  */
    2.71 + 
    2.72 + /* OpenBIOS defined UART mappings, used before early_serial_setup */
    2.73 +-#define UART0_IO_BASE	(u8 *) 0xE0000200
    2.74 +-#define UART1_IO_BASE	(u8 *) 0xE0000300
    2.75 ++#define UART0_IO_BASE	0xE0000200
    2.76 ++#define UART1_IO_BASE	0xE0000300
    2.77 + 
    2.78 + /* external Epson SG-615P */
    2.79 + #define BASE_BAUD	691200
    2.80 +diff -Nru a/arch/ppc/platforms/4xx/luan.h b/arch/ppc/platforms/4xx/luan.h
    2.81 +--- a/arch/ppc/platforms/4xx/luan.h	2005-04-29 18:34:28 -07:00
    2.82 ++++ b/arch/ppc/platforms/4xx/luan.h	2005-04-29 18:34:28 -07:00
    2.83 +@@ -47,9 +47,9 @@
    2.84 + #define RS_TABLE_SIZE	3
    2.85 + 
    2.86 + /* PIBS defined UART mappings, used before early_serial_setup */
    2.87 +-#define UART0_IO_BASE	(u8 *) 0xa0000200
    2.88 +-#define UART1_IO_BASE	(u8 *) 0xa0000300
    2.89 +-#define UART2_IO_BASE	(u8 *) 0xa0000600
    2.90 ++#define UART0_IO_BASE	0xa0000200
    2.91 ++#define UART1_IO_BASE	0xa0000300
    2.92 ++#define UART2_IO_BASE	0xa0000600
    2.93 + 
    2.94 + #define BASE_BAUD	11059200
    2.95 + #define STD_UART_OP(num)					\
    2.96 +diff -Nru a/arch/ppc/platforms/4xx/ocotea.h b/arch/ppc/platforms/4xx/ocotea.h
    2.97 +--- a/arch/ppc/platforms/4xx/ocotea.h	2005-04-29 18:34:28 -07:00
    2.98 ++++ b/arch/ppc/platforms/4xx/ocotea.h	2005-04-29 18:34:28 -07:00
    2.99 +@@ -56,8 +56,8 @@
   2.100 + #define RS_TABLE_SIZE	2
   2.101 + 
   2.102 + /* OpenBIOS defined UART mappings, used before early_serial_setup */
   2.103 +-#define UART0_IO_BASE	(u8 *) 0xE0000200
   2.104 +-#define UART1_IO_BASE	(u8 *) 0xE0000300
   2.105 ++#define UART0_IO_BASE	0xE0000200
   2.106 ++#define UART1_IO_BASE	0xE0000300
   2.107 + 
   2.108 + #define BASE_BAUD	11059200/16
   2.109 + #define STD_UART_OP(num)					\
   2.110 +diff -Nru a/arch/sparc/kernel/ptrace.c b/arch/sparc/kernel/ptrace.c
   2.111 +--- a/arch/sparc/kernel/ptrace.c	2005-04-29 18:34:28 -07:00
   2.112 ++++ b/arch/sparc/kernel/ptrace.c	2005-04-29 18:34:28 -07:00
   2.113 +@@ -531,18 +531,6 @@
   2.114 + 			pt_error_return(regs, EIO);
   2.115 + 			goto out_tsk;
   2.116 + 		}
   2.117 +-		if (addr != 1) {
   2.118 +-			if (addr & 3) {
   2.119 +-				pt_error_return(regs, EINVAL);
   2.120 +-				goto out_tsk;
   2.121 +-			}
   2.122 +-#ifdef DEBUG_PTRACE
   2.123 +-			printk ("Original: %08lx %08lx\n", child->thread.kregs->pc, child->thread.kregs->npc);
   2.124 +-			printk ("Continuing with %08lx %08lx\n", addr, addr+4);
   2.125 +-#endif
   2.126 +-			child->thread.kregs->pc = addr;
   2.127 +-			child->thread.kregs->npc = addr + 4;
   2.128 +-		}
   2.129 + 
   2.130 + 		if (request == PTRACE_SYSCALL)
   2.131 + 			set_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
   2.132 +diff -Nru a/arch/sparc64/kernel/ptrace.c b/arch/sparc64/kernel/ptrace.c
   2.133 +--- a/arch/sparc64/kernel/ptrace.c	2005-04-29 18:34:28 -07:00
   2.134 ++++ b/arch/sparc64/kernel/ptrace.c	2005-04-29 18:34:28 -07:00
   2.135 +@@ -514,25 +514,6 @@
   2.136 + 			pt_error_return(regs, EIO);
   2.137 + 			goto out_tsk;
   2.138 + 		}
   2.139 +-		if (addr != 1) {
   2.140 +-			unsigned long pc_mask = ~0UL;
   2.141 +-
   2.142 +-			if ((child->thread_info->flags & _TIF_32BIT) != 0)
   2.143 +-				pc_mask = 0xffffffff;
   2.144 +-
   2.145 +-			if (addr & 3) {
   2.146 +-				pt_error_return(regs, EINVAL);
   2.147 +-				goto out_tsk;
   2.148 +-			}
   2.149 +-#ifdef DEBUG_PTRACE
   2.150 +-			printk ("Original: %016lx %016lx\n",
   2.151 +-				child->thread_info->kregs->tpc,
   2.152 +-				child->thread_info->kregs->tnpc);
   2.153 +-			printk ("Continuing with %016lx %016lx\n", addr, addr+4);
   2.154 +-#endif
   2.155 +-			child->thread_info->kregs->tpc = (addr & pc_mask);
   2.156 +-			child->thread_info->kregs->tnpc = ((addr + 4) & pc_mask);
   2.157 +-		}
   2.158 + 
   2.159 + 		if (request == PTRACE_SYSCALL) {
   2.160 + 			set_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
   2.161 +diff -Nru a/arch/sparc64/kernel/signal32.c b/arch/sparc64/kernel/signal32.c
   2.162 +--- a/arch/sparc64/kernel/signal32.c	2005-04-29 18:34:28 -07:00
   2.163 ++++ b/arch/sparc64/kernel/signal32.c	2005-04-29 18:34:28 -07:00
   2.164 +@@ -192,9 +192,12 @@
   2.165 + 			err |= __put_user(from->si_uid, &to->si_uid);
   2.166 + 			break;
   2.167 + 		case __SI_FAULT >> 16:
   2.168 +-		case __SI_POLL >> 16:
   2.169 + 			err |= __put_user(from->si_trapno, &to->si_trapno);
   2.170 + 			err |= __put_user((unsigned long)from->si_addr, &to->si_addr);
   2.171 ++			break;
   2.172 ++		case __SI_POLL >> 16:
   2.173 ++			err |= __put_user(from->si_band, &to->si_band);
   2.174 ++			err |= __put_user(from->si_fd, &to->si_fd);
   2.175 + 			break;
   2.176 + 		case __SI_RT >> 16: /* This is not generated by the kernel as of now.  */
   2.177 + 		case __SI_MESGQ >> 16:
   2.178 +diff -Nru a/arch/sparc64/kernel/systbls.S b/arch/sparc64/kernel/systbls.S
   2.179 +--- a/arch/sparc64/kernel/systbls.S	2005-04-29 18:34:27 -07:00
   2.180 ++++ b/arch/sparc64/kernel/systbls.S	2005-04-29 18:34:27 -07:00
   2.181 +@@ -75,7 +75,7 @@
   2.182 + /*260*/	.word compat_sys_sched_getaffinity, compat_sys_sched_setaffinity, sys32_timer_settime, compat_sys_timer_gettime, sys_timer_getoverrun
   2.183 + 	.word sys_timer_delete, sys32_timer_create, sys_ni_syscall, compat_sys_io_setup, sys_io_destroy
   2.184 + /*270*/	.word sys32_io_submit, sys_io_cancel, compat_sys_io_getevents, sys32_mq_open, sys_mq_unlink
   2.185 +-	.word sys_mq_timedsend, sys_mq_timedreceive, compat_sys_mq_notify, compat_sys_mq_getsetattr, compat_sys_waitid
   2.186 ++	.word compat_sys_mq_timedsend, compat_sys_mq_timedreceive, compat_sys_mq_notify, compat_sys_mq_getsetattr, compat_sys_waitid
   2.187 + /*280*/	.word sys_ni_syscall, sys_add_key, sys_request_key, sys_keyctl
   2.188 + 
   2.189 + #endif /* CONFIG_COMPAT */
   2.190 +diff -Nru a/arch/um/include/sysdep-i386/syscalls.h b/arch/um/include/sysdep-i386/syscalls.h
   2.191 +--- a/arch/um/include/sysdep-i386/syscalls.h	2005-04-29 18:34:27 -07:00
   2.192 ++++ b/arch/um/include/sysdep-i386/syscalls.h	2005-04-29 18:34:27 -07:00
   2.193 +@@ -23,6 +23,9 @@
   2.194 + 		      unsigned long prot, unsigned long flags,
   2.195 + 		      unsigned long fd, unsigned long pgoff);
   2.196 + 
   2.197 ++/* On i386 they choose a meaningless naming.*/
   2.198 ++#define __NR_kexec_load __NR_sys_kexec_load
   2.199 ++
   2.200 + #define ARCH_SYSCALLS \
   2.201 + 	[ __NR_waitpid ] = (syscall_handler_t *) sys_waitpid, \
   2.202 + 	[ __NR_break ] = (syscall_handler_t *) sys_ni_syscall, \
   2.203 +@@ -101,15 +104,12 @@
   2.204 + 	[ 223 ] = (syscall_handler_t *) sys_ni_syscall, \
   2.205 + 	[ __NR_set_thread_area ] = (syscall_handler_t *) sys_ni_syscall, \
   2.206 + 	[ __NR_get_thread_area ] = (syscall_handler_t *) sys_ni_syscall, \
   2.207 +-	[ __NR_fadvise64 ] = (syscall_handler_t *) sys_fadvise64, \
   2.208 + 	[ 251 ] = (syscall_handler_t *) sys_ni_syscall, \
   2.209 +-        [ __NR_remap_file_pages ] = (syscall_handler_t *) sys_remap_file_pages, \
   2.210 +-	[ __NR_utimes ] = (syscall_handler_t *) sys_utimes, \
   2.211 +-	[ __NR_vserver ] = (syscall_handler_t *) sys_ni_syscall,
   2.212 +-        
   2.213 ++	[ 285 ] = (syscall_handler_t *) sys_ni_syscall,
   2.214 ++
   2.215 + /* 222 doesn't yet have a name in include/asm-i386/unistd.h */
   2.216 + 
   2.217 +-#define LAST_ARCH_SYSCALL __NR_vserver
   2.218 ++#define LAST_ARCH_SYSCALL 285
   2.219 + 
   2.220 + /*
   2.221 +  * Overrides for Emacs so that we follow Linus's tabbing style.
   2.222 +diff -Nru a/arch/um/include/sysdep-x86_64/syscalls.h b/arch/um/include/sysdep-x86_64/syscalls.h
   2.223 +--- a/arch/um/include/sysdep-x86_64/syscalls.h	2005-04-29 18:34:28 -07:00
   2.224 ++++ b/arch/um/include/sysdep-x86_64/syscalls.h	2005-04-29 18:34:28 -07:00
   2.225 +@@ -71,12 +71,7 @@
   2.226 + 	[ __NR_iopl ] = (syscall_handler_t *) sys_ni_syscall, \
   2.227 + 	[ __NR_set_thread_area ] = (syscall_handler_t *) sys_ni_syscall, \
   2.228 + 	[ __NR_get_thread_area ] = (syscall_handler_t *) sys_ni_syscall, \
   2.229 +-        [ __NR_remap_file_pages ] = (syscall_handler_t *) sys_remap_file_pages, \
   2.230 + 	[ __NR_semtimedop ] = (syscall_handler_t *) sys_semtimedop, \
   2.231 +-	[ __NR_fadvise64 ] = (syscall_handler_t *) sys_fadvise64, \
   2.232 +-	[ 223 ] = (syscall_handler_t *) sys_ni_syscall, \
   2.233 +-	[ __NR_utimes ] = (syscall_handler_t *) sys_utimes, \
   2.234 +-	[ __NR_vserver ] = (syscall_handler_t *) sys_ni_syscall, \
   2.235 + 	[ 251 ] = (syscall_handler_t *) sys_ni_syscall,
   2.236 + 
   2.237 + #define LAST_ARCH_SYSCALL 251
   2.238 +diff -Nru a/arch/um/kernel/skas/uaccess.c b/arch/um/kernel/skas/uaccess.c
   2.239 +--- a/arch/um/kernel/skas/uaccess.c	2005-04-29 18:34:28 -07:00
   2.240 ++++ b/arch/um/kernel/skas/uaccess.c	2005-04-29 18:34:28 -07:00
   2.241 +@@ -61,7 +61,8 @@
   2.242 + 	void *arg;
   2.243 + 	int *res;
   2.244 + 
   2.245 +-	va_copy(args, *(va_list *)arg_ptr);
   2.246 ++	/* Some old gccs recognize __va_copy, but not va_copy */
   2.247 ++	__va_copy(args, *(va_list *)arg_ptr);
   2.248 + 	addr = va_arg(args, unsigned long);
   2.249 + 	len = va_arg(args, int);
   2.250 + 	is_write = va_arg(args, int);
   2.251 +diff -Nru a/arch/um/kernel/sys_call_table.c b/arch/um/kernel/sys_call_table.c
   2.252 +--- a/arch/um/kernel/sys_call_table.c	2005-04-29 18:34:28 -07:00
   2.253 ++++ b/arch/um/kernel/sys_call_table.c	2005-04-29 18:34:28 -07:00
   2.254 +@@ -48,7 +48,6 @@
   2.255 + extern syscall_handler_t old_select;
   2.256 + extern syscall_handler_t sys_modify_ldt;
   2.257 + extern syscall_handler_t sys_rt_sigsuspend;
   2.258 +-extern syscall_handler_t sys_vserver;
   2.259 + extern syscall_handler_t sys_mbind;
   2.260 + extern syscall_handler_t sys_get_mempolicy;
   2.261 + extern syscall_handler_t sys_set_mempolicy;
   2.262 +@@ -242,6 +241,7 @@
   2.263 + 	[ __NR_epoll_create ] = (syscall_handler_t *) sys_epoll_create,
   2.264 + 	[ __NR_epoll_ctl ] = (syscall_handler_t *) sys_epoll_ctl,
   2.265 + 	[ __NR_epoll_wait ] = (syscall_handler_t *) sys_epoll_wait,
   2.266 ++	[ __NR_remap_file_pages ] = (syscall_handler_t *) sys_remap_file_pages,
   2.267 +         [ __NR_set_tid_address ] = (syscall_handler_t *) sys_set_tid_address,
   2.268 + 	[ __NR_timer_create ] = (syscall_handler_t *) sys_timer_create,
   2.269 + 	[ __NR_timer_settime ] = (syscall_handler_t *) sys_timer_settime,
   2.270 +@@ -252,12 +252,10 @@
   2.271 + 	[ __NR_clock_gettime ] = (syscall_handler_t *) sys_clock_gettime,
   2.272 + 	[ __NR_clock_getres ] = (syscall_handler_t *) sys_clock_getres,
   2.273 + 	[ __NR_clock_nanosleep ] = (syscall_handler_t *) sys_clock_nanosleep,
   2.274 +-	[ __NR_statfs64 ] = (syscall_handler_t *) sys_statfs64,
   2.275 +-	[ __NR_fstatfs64 ] = (syscall_handler_t *) sys_fstatfs64,
   2.276 + 	[ __NR_tgkill ] = (syscall_handler_t *) sys_tgkill,
   2.277 + 	[ __NR_utimes ] = (syscall_handler_t *) sys_utimes,
   2.278 +-	[ __NR_fadvise64_64 ] = (syscall_handler_t *) sys_fadvise64_64,
   2.279 +-	[ __NR_vserver ] = (syscall_handler_t *) sys_vserver,
   2.280 ++	[ __NR_fadvise64 ] = (syscall_handler_t *) sys_fadvise64,
   2.281 ++	[ __NR_vserver ] = (syscall_handler_t *) sys_ni_syscall,
   2.282 + 	[ __NR_mbind ] = (syscall_handler_t *) sys_mbind,
   2.283 + 	[ __NR_get_mempolicy ] = (syscall_handler_t *) sys_get_mempolicy,
   2.284 + 	[ __NR_set_mempolicy ] = (syscall_handler_t *) sys_set_mempolicy,
   2.285 +@@ -267,9 +265,8 @@
   2.286 + 	[ __NR_mq_timedreceive ] = (syscall_handler_t *) sys_mq_timedreceive,
   2.287 + 	[ __NR_mq_notify ] = (syscall_handler_t *) sys_mq_notify,
   2.288 + 	[ __NR_mq_getsetattr ] = (syscall_handler_t *) sys_mq_getsetattr,
   2.289 +-	[ __NR_sys_kexec_load ] = (syscall_handler_t *) sys_ni_syscall,
   2.290 ++	[ __NR_kexec_load ] = (syscall_handler_t *) sys_ni_syscall,
   2.291 + 	[ __NR_waitid ] = (syscall_handler_t *) sys_waitid,
   2.292 +-	[ 285 ] = (syscall_handler_t *) sys_ni_syscall,
   2.293 + 	[ __NR_add_key ] = (syscall_handler_t *) sys_add_key,
   2.294 + 	[ __NR_request_key ] = (syscall_handler_t *) sys_request_key,
   2.295 + 	[ __NR_keyctl ] = (syscall_handler_t *) sys_keyctl,
   2.296 +diff -Nru a/drivers/char/drm/drm_ioctl.c b/drivers/char/drm/drm_ioctl.c
   2.297 +--- a/drivers/char/drm/drm_ioctl.c	2005-04-29 18:34:27 -07:00
   2.298 ++++ b/drivers/char/drm/drm_ioctl.c	2005-04-29 18:34:27 -07:00
   2.299 +@@ -326,6 +326,8 @@
   2.300 + 
   2.301 + 	DRM_COPY_FROM_USER_IOCTL(sv, argp, sizeof(sv));
   2.302 + 
   2.303 ++	memset(&version, 0, sizeof(version));
   2.304 ++
   2.305 + 	dev->driver->version(&version);
   2.306 + 	retv.drm_di_major = DRM_IF_MAJOR;
   2.307 + 	retv.drm_di_minor = DRM_IF_MINOR;
   2.308 +diff -Nru a/drivers/i2c/chips/eeprom.c b/drivers/i2c/chips/eeprom.c
   2.309 +--- a/drivers/i2c/chips/eeprom.c	2005-04-29 18:34:27 -07:00
   2.310 ++++ b/drivers/i2c/chips/eeprom.c	2005-04-29 18:34:27 -07:00
   2.311 +@@ -130,7 +130,8 @@
   2.312 + 
   2.313 + 	/* Hide Vaio security settings to regular users (16 first bytes) */
   2.314 + 	if (data->nature == VAIO && off < 16 && !capable(CAP_SYS_ADMIN)) {
   2.315 +-		int in_row1 = 16 - off;
   2.316 ++		size_t in_row1 = 16 - off;
   2.317 ++		in_row1 = min(in_row1, count);
   2.318 + 		memset(buf, 0, in_row1);
   2.319 + 		if (count - in_row1 > 0)
   2.320 + 			memcpy(buf + in_row1, &data->data[16], count - in_row1);
   2.321 +diff -Nru a/drivers/i2c/chips/it87.c b/drivers/i2c/chips/it87.c
   2.322 +--- a/drivers/i2c/chips/it87.c	2005-04-29 18:34:28 -07:00
   2.323 ++++ b/drivers/i2c/chips/it87.c	2005-04-29 18:34:28 -07:00
   2.324 +@@ -631,7 +631,7 @@
   2.325 + 	struct it87_data *data = it87_update_device(dev);
   2.326 + 	return sprintf(buf,"%d\n", ALARMS_FROM_REG(data->alarms));
   2.327 + }
   2.328 +-static DEVICE_ATTR(alarms, S_IRUGO | S_IWUSR, show_alarms, NULL);
   2.329 ++static DEVICE_ATTR(alarms, S_IRUGO, show_alarms, NULL);
   2.330 + 
   2.331 + static ssize_t
   2.332 + show_vrm_reg(struct device *dev, char *buf)
   2.333 +diff -Nru a/drivers/i2c/chips/via686a.c b/drivers/i2c/chips/via686a.c
   2.334 +--- a/drivers/i2c/chips/via686a.c	2005-04-29 18:34:27 -07:00
   2.335 ++++ b/drivers/i2c/chips/via686a.c	2005-04-29 18:34:27 -07:00
   2.336 +@@ -554,7 +554,7 @@
   2.337 + 	struct via686a_data *data = via686a_update_device(dev);
   2.338 + 	return sprintf(buf,"%d\n", ALARMS_FROM_REG(data->alarms));
   2.339 + }
   2.340 +-static DEVICE_ATTR(alarms, S_IRUGO | S_IWUSR, show_alarms, NULL);
   2.341 ++static DEVICE_ATTR(alarms, S_IRUGO, show_alarms, NULL);
   2.342 + 
   2.343 + /* The driver. I choose to use type i2c_driver, as at is identical to both
   2.344 +    smbus_driver and isa_driver, and clients could be of either kind */
   2.345 +diff -Nru a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
   2.346 +--- a/drivers/input/serio/i8042-x86ia64io.h	2005-04-29 18:34:28 -07:00
   2.347 ++++ b/drivers/input/serio/i8042-x86ia64io.h	2005-04-29 18:34:28 -07:00
   2.348 +@@ -88,7 +88,7 @@
   2.349 + };
   2.350 + #endif
   2.351 + 
   2.352 +-#ifdef CONFIG_ACPI
   2.353 ++#if defined(__ia64__) && defined(CONFIG_ACPI)
   2.354 + #include <linux/acpi.h>
   2.355 + #include <acpi/acpi_bus.h>
   2.356 + 
   2.357 +@@ -281,7 +281,7 @@
   2.358 + 	i8042_kbd_irq = I8042_MAP_IRQ(1);
   2.359 + 	i8042_aux_irq = I8042_MAP_IRQ(12);
   2.360 + 
   2.361 +-#ifdef CONFIG_ACPI
   2.362 ++#if defined(__ia64__) && defined(CONFIG_ACPI)
   2.363 + 	if (i8042_acpi_init())
   2.364 + 		return -1;
   2.365 + #endif
   2.366 +@@ -300,7 +300,7 @@
   2.367 + 
   2.368 + static inline void i8042_platform_exit(void)
   2.369 + {
   2.370 +-#ifdef CONFIG_ACPI
   2.371 ++#if defined(__ia64__) && defined(CONFIG_ACPI)
   2.372 + 	i8042_acpi_exit();
   2.373 + #endif
   2.374 + }
   2.375 +diff -Nru a/drivers/md/raid6altivec.uc b/drivers/md/raid6altivec.uc
   2.376 +--- a/drivers/md/raid6altivec.uc	2005-04-29 18:34:28 -07:00
   2.377 ++++ b/drivers/md/raid6altivec.uc	2005-04-29 18:34:28 -07:00
   2.378 +@@ -108,7 +108,11 @@
   2.379 + int raid6_have_altivec(void)
   2.380 + {
   2.381 + 	/* This assumes either all CPUs have Altivec or none does */
   2.382 ++#ifdef CONFIG_PPC64
   2.383 + 	return cur_cpu_spec->cpu_features & CPU_FTR_ALTIVEC;
   2.384 ++#else
   2.385 ++	return cur_cpu_spec[0]->cpu_features & CPU_FTR_ALTIVEC;
   2.386 ++#endif
   2.387 + }
   2.388 + #endif
   2.389 + 
   2.390 +diff -Nru a/drivers/media/video/adv7170.c b/drivers/media/video/adv7170.c
   2.391 +--- a/drivers/media/video/adv7170.c	2005-04-29 18:34:28 -07:00
   2.392 ++++ b/drivers/media/video/adv7170.c	2005-04-29 18:34:28 -07:00
   2.393 +@@ -130,7 +130,7 @@
   2.394 + 		u8 block_data[32];
   2.395 + 
   2.396 + 		msg.addr = client->addr;
   2.397 +-		msg.flags = client->flags;
   2.398 ++		msg.flags = 0;
   2.399 + 		while (len >= 2) {
   2.400 + 			msg.buf = (char *) block_data;
   2.401 + 			msg.len = 0;
   2.402 +diff -Nru a/drivers/media/video/adv7175.c b/drivers/media/video/adv7175.c
   2.403 +--- a/drivers/media/video/adv7175.c	2005-04-29 18:34:28 -07:00
   2.404 ++++ b/drivers/media/video/adv7175.c	2005-04-29 18:34:28 -07:00
   2.405 +@@ -126,7 +126,7 @@
   2.406 + 		u8 block_data[32];
   2.407 + 
   2.408 + 		msg.addr = client->addr;
   2.409 +-		msg.flags = client->flags;
   2.410 ++		msg.flags = 0;
   2.411 + 		while (len >= 2) {
   2.412 + 			msg.buf = (char *) block_data;
   2.413 + 			msg.len = 0;
   2.414 +diff -Nru a/drivers/media/video/bt819.c b/drivers/media/video/bt819.c
   2.415 +--- a/drivers/media/video/bt819.c	2005-04-29 18:34:27 -07:00
   2.416 ++++ b/drivers/media/video/bt819.c	2005-04-29 18:34:27 -07:00
   2.417 +@@ -146,7 +146,7 @@
   2.418 + 		u8 block_data[32];
   2.419 + 
   2.420 + 		msg.addr = client->addr;
   2.421 +-		msg.flags = client->flags;
   2.422 ++		msg.flags = 0;
   2.423 + 		while (len >= 2) {
   2.424 + 			msg.buf = (char *) block_data;
   2.425 + 			msg.len = 0;
   2.426 +diff -Nru a/drivers/media/video/bttv-cards.c b/drivers/media/video/bttv-cards.c
   2.427 +--- a/drivers/media/video/bttv-cards.c	2005-04-29 18:34:28 -07:00
   2.428 ++++ b/drivers/media/video/bttv-cards.c	2005-04-29 18:34:28 -07:00
   2.429 +@@ -2718,8 +2718,6 @@
   2.430 +         }
   2.431 + 	btv->pll.pll_current = -1;
   2.432 + 
   2.433 +-	bttv_reset_audio(btv);
   2.434 +-
   2.435 + 	/* tuner configuration (from card list / autodetect / insmod option) */
   2.436 +  	if (UNSET != bttv_tvcards[btv->c.type].tuner_type)
   2.437 + 		if(UNSET == btv->tuner_type)
   2.438 +diff -Nru a/drivers/media/video/saa7110.c b/drivers/media/video/saa7110.c
   2.439 +--- a/drivers/media/video/saa7110.c	2005-04-29 18:34:27 -07:00
   2.440 ++++ b/drivers/media/video/saa7110.c	2005-04-29 18:34:27 -07:00
   2.441 +@@ -60,8 +60,10 @@
   2.442 + 
   2.443 + #define	I2C_SAA7110		0x9C	/* or 0x9E */
   2.444 + 
   2.445 ++#define SAA7110_NR_REG		0x35
   2.446 ++
   2.447 + struct saa7110 {
   2.448 +-	unsigned char reg[54];
   2.449 ++	u8 reg[SAA7110_NR_REG];
   2.450 + 
   2.451 + 	int norm;
   2.452 + 	int input;
   2.453 +@@ -95,31 +97,28 @@
   2.454 + 		     unsigned int       len)
   2.455 + {
   2.456 + 	int ret = -1;
   2.457 +-	u8 reg = *data++;
   2.458 ++	u8 reg = *data;		/* first register to write to */
   2.459 + 
   2.460 +-	len--;
   2.461 ++	/* Sanity check */
   2.462 ++	if (reg + (len - 1) > SAA7110_NR_REG)
   2.463 ++		return ret;
   2.464 + 
   2.465 + 	/* the saa7110 has an autoincrement function, use it if
   2.466 + 	 * the adapter understands raw I2C */
   2.467 + 	if (i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
   2.468 + 		struct saa7110 *decoder = i2c_get_clientdata(client);
   2.469 + 		struct i2c_msg msg;
   2.470 +-		u8 block_data[54];
   2.471 + 
   2.472 +-		msg.len = 0;
   2.473 +-		msg.buf = (char *) block_data;
   2.474 ++		msg.len = len;
   2.475 ++		msg.buf = (char *) data;
   2.476 + 		msg.addr = client->addr;
   2.477 +-		msg.flags = client->flags;
   2.478 +-		while (len >= 1) {
   2.479 +-			msg.len = 0;
   2.480 +-			block_data[msg.len++] = reg;
   2.481 +-			while (len-- >= 1 && msg.len < 54)
   2.482 +-				block_data[msg.len++] =
   2.483 +-				    decoder->reg[reg++] = *data++;
   2.484 +-			ret = i2c_transfer(client->adapter, &msg, 1);
   2.485 +-		}
   2.486 ++		msg.flags = 0;
   2.487 ++		ret = i2c_transfer(client->adapter, &msg, 1);
   2.488 ++
   2.489 ++		/* Cache the written data */
   2.490 ++		memcpy(decoder->reg + reg, data + 1, len - 1);
   2.491 + 	} else {
   2.492 +-		while (len-- >= 1) {
   2.493 ++		for (++data, --len; len; len--) {
   2.494 + 			if ((ret = saa7110_write(client, reg++,
   2.495 + 						 *data++)) < 0)
   2.496 + 				break;
   2.497 +@@ -192,7 +191,7 @@
   2.498 + 	return 0;
   2.499 + }
   2.500 + 
   2.501 +-static const unsigned char initseq[] = {
   2.502 ++static const unsigned char initseq[1 + SAA7110_NR_REG] = {
   2.503 + 	0, 0x4C, 0x3C, 0x0D, 0xEF, 0xBD, 0xF2, 0x03, 0x00,
   2.504 + 	/* 0x08 */ 0xF8, 0xF8, 0x60, 0x60, 0x00, 0x86, 0x18, 0x90,
   2.505 + 	/* 0x10 */ 0x00, 0x59, 0x40, 0x46, 0x42, 0x1A, 0xFF, 0xDA,
   2.506 +diff -Nru a/drivers/media/video/saa7114.c b/drivers/media/video/saa7114.c
   2.507 +--- a/drivers/media/video/saa7114.c	2005-04-29 18:34:28 -07:00
   2.508 ++++ b/drivers/media/video/saa7114.c	2005-04-29 18:34:28 -07:00
   2.509 +@@ -163,7 +163,7 @@
   2.510 + 		u8 block_data[32];
   2.511 + 
   2.512 + 		msg.addr = client->addr;
   2.513 +-		msg.flags = client->flags;
   2.514 ++		msg.flags = 0;
   2.515 + 		while (len >= 2) {
   2.516 + 			msg.buf = (char *) block_data;
   2.517 + 			msg.len = 0;
   2.518 +diff -Nru a/drivers/media/video/saa7185.c b/drivers/media/video/saa7185.c
   2.519 +--- a/drivers/media/video/saa7185.c	2005-04-29 18:34:28 -07:00
   2.520 ++++ b/drivers/media/video/saa7185.c	2005-04-29 18:34:28 -07:00
   2.521 +@@ -118,7 +118,7 @@
   2.522 + 		u8 block_data[32];
   2.523 + 
   2.524 + 		msg.addr = client->addr;
   2.525 +-		msg.flags = client->flags;
   2.526 ++		msg.flags = 0;
   2.527 + 		while (len >= 2) {
   2.528 + 			msg.buf = (char *) block_data;
   2.529 + 			msg.len = 0;
   2.530 +diff -Nru a/drivers/net/amd8111e.c b/drivers/net/amd8111e.c
   2.531 +--- a/drivers/net/amd8111e.c	2005-04-29 18:34:28 -07:00
   2.532 ++++ b/drivers/net/amd8111e.c	2005-04-29 18:34:28 -07:00
   2.533 +@@ -1381,6 +1381,8 @@
   2.534 + 
   2.535 + 	if(amd8111e_restart(dev)){
   2.536 + 		spin_unlock_irq(&lp->lock);
   2.537 ++		if (dev->irq)
   2.538 ++			free_irq(dev->irq, dev);
   2.539 + 		return -ENOMEM;
   2.540 + 	}
   2.541 + 	/* Start ipg timer */
   2.542 +diff -Nru a/drivers/net/ppp_async.c b/drivers/net/ppp_async.c
   2.543 +--- a/drivers/net/ppp_async.c	2005-04-29 18:34:28 -07:00
   2.544 ++++ b/drivers/net/ppp_async.c	2005-04-29 18:34:28 -07:00
   2.545 +@@ -1000,7 +1000,7 @@
   2.546 + 	data += 4;
   2.547 + 	dlen -= 4;
   2.548 + 	/* data[0] is code, data[1] is length */
   2.549 +-	while (dlen >= 2 && dlen >= data[1]) {
   2.550 ++	while (dlen >= 2 && dlen >= data[1] && data[1] >= 2) {
   2.551 + 		switch (data[0]) {
   2.552 + 		case LCP_MRU:
   2.553 + 			val = (data[2] << 8) + data[3];
   2.554 +diff -Nru a/drivers/net/r8169.c b/drivers/net/r8169.c
   2.555 +--- a/drivers/net/r8169.c	2005-04-29 18:34:28 -07:00
   2.556 ++++ b/drivers/net/r8169.c	2005-04-29 18:34:28 -07:00
   2.557 +@@ -1683,16 +1683,19 @@
   2.558 + 	rtl8169_make_unusable_by_asic(desc);
   2.559 + }
   2.560 + 
   2.561 +-static inline void rtl8169_return_to_asic(struct RxDesc *desc, int rx_buf_sz)
   2.562 ++static inline void rtl8169_mark_to_asic(struct RxDesc *desc, u32 rx_buf_sz)
   2.563 + {
   2.564 +-	desc->opts1 |= cpu_to_le32(DescOwn + rx_buf_sz);
   2.565 ++	u32 eor = le32_to_cpu(desc->opts1) & RingEnd;
   2.566 ++
   2.567 ++	desc->opts1 = cpu_to_le32(DescOwn | eor | rx_buf_sz);
   2.568 + }
   2.569 + 
   2.570 +-static inline void rtl8169_give_to_asic(struct RxDesc *desc, dma_addr_t mapping,
   2.571 +-					int rx_buf_sz)
   2.572 ++static inline void rtl8169_map_to_asic(struct RxDesc *desc, dma_addr_t mapping,
   2.573 ++				       u32 rx_buf_sz)
   2.574 + {
   2.575 + 	desc->addr = cpu_to_le64(mapping);
   2.576 +-	desc->opts1 |= cpu_to_le32(DescOwn + rx_buf_sz);
   2.577 ++	wmb();
   2.578 ++	rtl8169_mark_to_asic(desc, rx_buf_sz);
   2.579 + }
   2.580 + 
   2.581 + static int rtl8169_alloc_rx_skb(struct pci_dev *pdev, struct sk_buff **sk_buff,
   2.582 +@@ -1712,7 +1715,7 @@
   2.583 + 	mapping = pci_map_single(pdev, skb->tail, rx_buf_sz,
   2.584 + 				 PCI_DMA_FROMDEVICE);
   2.585 + 
   2.586 +-	rtl8169_give_to_asic(desc, mapping, rx_buf_sz);
   2.587 ++	rtl8169_map_to_asic(desc, mapping, rx_buf_sz);
   2.588 + 
   2.589 + out:
   2.590 + 	return ret;
   2.591 +@@ -2150,7 +2153,7 @@
   2.592 + 			skb_reserve(skb, NET_IP_ALIGN);
   2.593 + 			eth_copy_and_sum(skb, sk_buff[0]->tail, pkt_size, 0);
   2.594 + 			*sk_buff = skb;
   2.595 +-			rtl8169_return_to_asic(desc, rx_buf_sz);
   2.596 ++			rtl8169_mark_to_asic(desc, rx_buf_sz);
   2.597 + 			ret = 0;
   2.598 + 		}
   2.599 + 	}
   2.600 +diff -Nru a/drivers/net/sis900.c b/drivers/net/sis900.c
   2.601 +--- a/drivers/net/sis900.c	2005-04-29 18:34:27 -07:00
   2.602 ++++ b/drivers/net/sis900.c	2005-04-29 18:34:27 -07:00
   2.603 +@@ -236,7 +236,7 @@
   2.604 + 	signature = (u16) read_eeprom(ioaddr, EEPROMSignature);    
   2.605 + 	if (signature == 0xffff || signature == 0x0000) {
   2.606 + 		printk (KERN_INFO "%s: Error EERPOM read %x\n", 
   2.607 +-			net_dev->name, signature);
   2.608 ++			pci_name(pci_dev), signature);
   2.609 + 		return 0;
   2.610 + 	}
   2.611 + 
   2.612 +@@ -268,7 +268,7 @@
   2.613 + 	if (!isa_bridge)
   2.614 + 		isa_bridge = pci_get_device(PCI_VENDOR_ID_SI, 0x0018, isa_bridge);
   2.615 + 	if (!isa_bridge) {
   2.616 +-		printk("%s: Can not find ISA bridge\n", net_dev->name);
   2.617 ++		printk("%s: Can not find ISA bridge\n", pci_name(pci_dev));
   2.618 + 		return 0;
   2.619 + 	}
   2.620 + 	pci_read_config_byte(isa_bridge, 0x48, &reg);
   2.621 +@@ -456,10 +456,6 @@
   2.622 + 	net_dev->tx_timeout = sis900_tx_timeout;
   2.623 + 	net_dev->watchdog_timeo = TX_TIMEOUT;
   2.624 + 	net_dev->ethtool_ops = &sis900_ethtool_ops;
   2.625 +-	
   2.626 +-	ret = register_netdev(net_dev);
   2.627 +-	if (ret)
   2.628 +-		goto err_unmap_rx;
   2.629 + 		
   2.630 + 	/* Get Mac address according to the chip revision */
   2.631 + 	pci_read_config_byte(pci_dev, PCI_CLASS_REVISION, &revision);
   2.632 +@@ -476,7 +472,7 @@
   2.633 + 
   2.634 + 	if (ret == 0) {
   2.635 + 		ret = -ENODEV;
   2.636 +-		goto err_out_unregister;
   2.637 ++		goto err_unmap_rx;
   2.638 + 	}
   2.639 + 	
   2.640 + 	/* 630ET : set the mii access mode as software-mode */
   2.641 +@@ -486,7 +482,7 @@
   2.642 + 	/* probe for mii transceiver */
   2.643 + 	if (sis900_mii_probe(net_dev) == 0) {
   2.644 + 		ret = -ENODEV;
   2.645 +-		goto err_out_unregister;
   2.646 ++		goto err_unmap_rx;
   2.647 + 	}
   2.648 + 
   2.649 + 	/* save our host bridge revision */
   2.650 +@@ -496,6 +492,10 @@
   2.651 + 		pci_dev_put(dev);
   2.652 + 	}
   2.653 + 
   2.654 ++	ret = register_netdev(net_dev);
   2.655 ++	if (ret)
   2.656 ++		goto err_unmap_rx;
   2.657 ++
   2.658 + 	/* print some information about our NIC */
   2.659 + 	printk(KERN_INFO "%s: %s at %#lx, IRQ %d, ", net_dev->name,
   2.660 + 	       card_name, ioaddr, net_dev->irq);
   2.661 +@@ -505,8 +505,6 @@
   2.662 + 
   2.663 + 	return 0;
   2.664 + 
   2.665 +- err_out_unregister:
   2.666 +- 	unregister_netdev(net_dev);
   2.667 +  err_unmap_rx:
   2.668 + 	pci_free_consistent(pci_dev, RX_TOTAL_SIZE, sis_priv->rx_ring,
   2.669 + 		sis_priv->rx_ring_dma);
   2.670 +@@ -533,6 +531,7 @@
   2.671 + static int __init sis900_mii_probe(struct net_device * net_dev)
   2.672 + {
   2.673 + 	struct sis900_private * sis_priv = net_dev->priv;
   2.674 ++	const char *dev_name = pci_name(sis_priv->pci_dev);
   2.675 + 	u16 poll_bit = MII_STAT_LINK, status = 0;
   2.676 + 	unsigned long timeout = jiffies + 5 * HZ;
   2.677 + 	int phy_addr;
   2.678 +@@ -582,21 +581,20 @@
   2.679 + 					mii_phy->phy_types =
   2.680 + 					    (mii_status & (MII_STAT_CAN_TX_FDX | MII_STAT_CAN_TX)) ? LAN : HOME;
   2.681 + 				printk(KERN_INFO "%s: %s transceiver found at address %d.\n",
   2.682 +-				       net_dev->name, mii_chip_table[i].name,
   2.683 ++				       dev_name, mii_chip_table[i].name,
   2.684 + 				       phy_addr);
   2.685 + 				break;
   2.686 + 			}
   2.687 + 			
   2.688 + 		if( !mii_chip_table[i].phy_id1 ) {
   2.689 + 			printk(KERN_INFO "%s: Unknown PHY transceiver found at address %d.\n",
   2.690 +-			       net_dev->name, phy_addr);
   2.691 ++			       dev_name, phy_addr);
   2.692 + 			mii_phy->phy_types = UNKNOWN;
   2.693 + 		}
   2.694 + 	}
   2.695 + 	
   2.696 + 	if (sis_priv->mii == NULL) {
   2.697 +-		printk(KERN_INFO "%s: No MII transceivers found!\n",
   2.698 +-			net_dev->name);
   2.699 ++		printk(KERN_INFO "%s: No MII transceivers found!\n", dev_name);
   2.700 + 		return 0;
   2.701 + 	}
   2.702 + 
   2.703 +@@ -621,7 +619,7 @@
   2.704 + 			poll_bit ^= (mdio_read(net_dev, sis_priv->cur_phy, MII_STATUS) & poll_bit);
   2.705 + 			if (time_after_eq(jiffies, timeout)) {
   2.706 + 				printk(KERN_WARNING "%s: reset phy and link down now\n",
   2.707 +-					net_dev->name);
   2.708 ++				       dev_name);
   2.709 + 				return -ETIME;
   2.710 + 			}
   2.711 + 		}
   2.712 +@@ -691,7 +689,7 @@
   2.713 + 		sis_priv->mii = default_phy;
   2.714 + 		sis_priv->cur_phy = default_phy->phy_addr;
   2.715 + 		printk(KERN_INFO "%s: Using transceiver found at address %d as default\n",
   2.716 +-					net_dev->name,sis_priv->cur_phy);
   2.717 ++		       pci_name(sis_priv->pci_dev), sis_priv->cur_phy);
   2.718 + 	}
   2.719 + 	
   2.720 + 	status = mdio_read(net_dev, sis_priv->cur_phy, MII_CONTROL);
   2.721 +diff -Nru a/drivers/net/tun.c b/drivers/net/tun.c
   2.722 +--- a/drivers/net/tun.c	2005-04-29 18:34:27 -07:00
   2.723 ++++ b/drivers/net/tun.c	2005-04-29 18:34:27 -07:00
   2.724 +@@ -229,7 +229,7 @@
   2.725 + 	size_t len = count;
   2.726 + 
   2.727 + 	if (!(tun->flags & TUN_NO_PI)) {
   2.728 +-		if ((len -= sizeof(pi)) > len)
   2.729 ++		if ((len -= sizeof(pi)) > count)
   2.730 + 			return -EINVAL;
   2.731 + 
   2.732 + 		if(memcpy_fromiovec((void *)&pi, iv, sizeof(pi)))
   2.733 +diff -Nru a/drivers/net/via-rhine.c b/drivers/net/via-rhine.c
   2.734 +--- a/drivers/net/via-rhine.c	2005-04-29 18:34:28 -07:00
   2.735 ++++ b/drivers/net/via-rhine.c	2005-04-29 18:34:28 -07:00
   2.736 +@@ -1197,8 +1197,10 @@
   2.737 + 		       dev->name, rp->pdev->irq);
   2.738 + 
   2.739 + 	rc = alloc_ring(dev);
   2.740 +-	if (rc)
   2.741 ++	if (rc) {
   2.742 ++		free_irq(rp->pdev->irq, dev);
   2.743 + 		return rc;
   2.744 ++	}
   2.745 + 	alloc_rbufs(dev);
   2.746 + 	alloc_tbufs(dev);
   2.747 + 	rhine_chip_reset(dev);
   2.748 +@@ -1898,6 +1900,9 @@
   2.749 + 	struct net_device *dev = pci_get_drvdata(pdev);
   2.750 + 	struct rhine_private *rp = netdev_priv(dev);
   2.751 + 	void __iomem *ioaddr = rp->base;
   2.752 ++
   2.753 ++	if (!(rp->quirks & rqWOL))
   2.754 ++		return; /* Nothing to do for non-WOL adapters */
   2.755 + 
   2.756 + 	rhine_power_init(dev);
   2.757 + 
   2.758 +diff -Nru a/drivers/net/wan/hd6457x.c b/drivers/net/wan/hd6457x.c
   2.759 +--- a/drivers/net/wan/hd6457x.c	2005-04-29 18:34:27 -07:00
   2.760 ++++ b/drivers/net/wan/hd6457x.c	2005-04-29 18:34:27 -07:00
   2.761 +@@ -315,7 +315,7 @@
   2.762 + #endif
   2.763 + 	stats->rx_packets++;
   2.764 + 	stats->rx_bytes += skb->len;
   2.765 +-	skb->dev->last_rx = jiffies;
   2.766 ++	dev->last_rx = jiffies;
   2.767 + 	skb->protocol = hdlc_type_trans(skb, dev);
   2.768 + 	netif_rx(skb);
   2.769 + }
   2.770 +diff -Nru a/drivers/pci/hotplug/pciehp_ctrl.c b/drivers/pci/hotplug/pciehp_ctrl.c
   2.771 +--- a/drivers/pci/hotplug/pciehp_ctrl.c	2005-04-29 18:34:27 -07:00
   2.772 ++++ b/drivers/pci/hotplug/pciehp_ctrl.c	2005-04-29 18:34:27 -07:00
   2.773 +@@ -1354,10 +1354,11 @@
   2.774 + 				dbg("PCI Bridge Hot-Remove s:b:d:f(%02x:%02x:%02x:%02x)\n", 
   2.775 + 					ctrl->seg, func->bus, func->device, func->function);
   2.776 + 				bridge_slot_remove(func);
   2.777 +-			} else
   2.778 ++			} else {
   2.779 + 				dbg("PCI Function Hot-Remove s:b:d:f(%02x:%02x:%02x:%02x)\n", 
   2.780 + 					ctrl->seg, func->bus, func->device, func->function);
   2.781 + 				slot_remove(func);
   2.782 ++			}
   2.783 + 
   2.784 + 			func = pciehp_slot_find(ctrl->slot_bus, device, 0);
   2.785 + 		}
   2.786 +diff -Nru a/fs/binfmt_elf.c b/fs/binfmt_elf.c
   2.787 +--- a/fs/binfmt_elf.c	2005-04-29 18:34:28 -07:00
   2.788 ++++ b/fs/binfmt_elf.c	2005-04-29 18:34:28 -07:00
   2.789 +@@ -1008,6 +1008,7 @@
   2.790 + static int load_elf_library(struct file *file)
   2.791 + {
   2.792 + 	struct elf_phdr *elf_phdata;
   2.793 ++	struct elf_phdr *eppnt;
   2.794 + 	unsigned long elf_bss, bss, len;
   2.795 + 	int retval, error, i, j;
   2.796 + 	struct elfhdr elf_ex;
   2.797 +@@ -1031,44 +1032,47 @@
   2.798 + 	/* j < ELF_MIN_ALIGN because elf_ex.e_phnum <= 2 */
   2.799 + 
   2.800 + 	error = -ENOMEM;
   2.801 +-	elf_phdata = (struct elf_phdr *) kmalloc(j, GFP_KERNEL);
   2.802 ++	elf_phdata = kmalloc(j, GFP_KERNEL);
   2.803 + 	if (!elf_phdata)
   2.804 + 		goto out;
   2.805 + 
   2.806 ++	eppnt = elf_phdata;
   2.807 + 	error = -ENOEXEC;
   2.808 +-	retval = kernel_read(file, elf_ex.e_phoff, (char *) elf_phdata, j);
   2.809 ++	retval = kernel_read(file, elf_ex.e_phoff, (char *)eppnt, j);
   2.810 + 	if (retval != j)
   2.811 + 		goto out_free_ph;
   2.812 + 
   2.813 + 	for (j = 0, i = 0; i<elf_ex.e_phnum; i++)
   2.814 +-		if ((elf_phdata + i)->p_type == PT_LOAD) j++;
   2.815 ++		if ((eppnt + i)->p_type == PT_LOAD)
   2.816 ++			j++;
   2.817 + 	if (j != 1)
   2.818 + 		goto out_free_ph;
   2.819 + 
   2.820 +-	while (elf_phdata->p_type != PT_LOAD) elf_phdata++;
   2.821 ++	while (eppnt->p_type != PT_LOAD)
   2.822 ++		eppnt++;
   2.823 + 
   2.824 + 	/* Now use mmap to map the library into memory. */
   2.825 + 	down_write(&current->mm->mmap_sem);
   2.826 + 	error = do_mmap(file,
   2.827 +-			ELF_PAGESTART(elf_phdata->p_vaddr),
   2.828 +-			(elf_phdata->p_filesz +
   2.829 +-			 ELF_PAGEOFFSET(elf_phdata->p_vaddr)),
   2.830 ++			ELF_PAGESTART(eppnt->p_vaddr),
   2.831 ++			(eppnt->p_filesz +
   2.832 ++			 ELF_PAGEOFFSET(eppnt->p_vaddr)),
   2.833 + 			PROT_READ | PROT_WRITE | PROT_EXEC,
   2.834 + 			MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE,
   2.835 +-			(elf_phdata->p_offset -
   2.836 +-			 ELF_PAGEOFFSET(elf_phdata->p_vaddr)));
   2.837 ++			(eppnt->p_offset -
   2.838 ++			 ELF_PAGEOFFSET(eppnt->p_vaddr)));
   2.839 + 	up_write(&current->mm->mmap_sem);
   2.840 +-	if (error != ELF_PAGESTART(elf_phdata->p_vaddr))
   2.841 ++	if (error != ELF_PAGESTART(eppnt->p_vaddr))
   2.842 + 		goto out_free_ph;
   2.843 + 
   2.844 +-	elf_bss = elf_phdata->p_vaddr + elf_phdata->p_filesz;
   2.845 ++	elf_bss = eppnt->p_vaddr + eppnt->p_filesz;
   2.846 + 	if (padzero(elf_bss)) {
   2.847 + 		error = -EFAULT;
   2.848 + 		goto out_free_ph;
   2.849 + 	}
   2.850 + 
   2.851 +-	len = ELF_PAGESTART(elf_phdata->p_filesz + elf_phdata->p_vaddr + ELF_MIN_ALIGN - 1);
   2.852 +-	bss = elf_phdata->p_memsz + elf_phdata->p_vaddr;
   2.853 ++	len = ELF_PAGESTART(eppnt->p_filesz + eppnt->p_vaddr + ELF_MIN_ALIGN - 1);
   2.854 ++	bss = eppnt->p_memsz + eppnt->p_vaddr;
   2.855 + 	if (bss > len) {
   2.856 + 		down_write(&current->mm->mmap_sem);
   2.857 + 		do_brk(len, bss - len);
   2.858 +diff -Nru a/fs/cramfs/inode.c b/fs/cramfs/inode.c
   2.859 +--- a/fs/cramfs/inode.c	2005-04-29 18:34:27 -07:00
   2.860 ++++ b/fs/cramfs/inode.c	2005-04-29 18:34:27 -07:00
   2.861 +@@ -70,6 +70,7 @@
   2.862 + 			inode->i_data.a_ops = &cramfs_aops;
   2.863 + 		} else {
   2.864 + 			inode->i_size = 0;
   2.865 ++			inode->i_blocks = 0;
   2.866 + 			init_special_inode(inode, inode->i_mode,
   2.867 + 				old_decode_dev(cramfs_inode->size));
   2.868 + 		}
   2.869 +diff -Nru a/fs/eventpoll.c b/fs/eventpoll.c
   2.870 +--- a/fs/eventpoll.c	2005-04-29 18:34:27 -07:00
   2.871 ++++ b/fs/eventpoll.c	2005-04-29 18:34:27 -07:00
   2.872 +@@ -619,6 +619,7 @@
   2.873 + 	return error;
   2.874 + }
   2.875 + 
   2.876 ++#define MAX_EVENTS (INT_MAX / sizeof(struct epoll_event))
   2.877 + 
   2.878 + /*
   2.879 +  * Implement the event wait interface for the eventpoll file. It is the kernel
   2.880 +@@ -635,7 +636,7 @@
   2.881 + 		     current, epfd, events, maxevents, timeout));
   2.882 + 
   2.883 + 	/* The maximum number of event must be greater than zero */
   2.884 +-	if (maxevents <= 0)
   2.885 ++	if (maxevents <= 0 || maxevents > MAX_EVENTS)
   2.886 + 		return -EINVAL;
   2.887 + 
   2.888 + 	/* Verify that the area passed by the user is writeable */
   2.889 +diff -Nru a/fs/exec.c b/fs/exec.c
   2.890 +--- a/fs/exec.c	2005-04-29 18:34:27 -07:00
   2.891 ++++ b/fs/exec.c	2005-04-29 18:34:27 -07:00
   2.892 +@@ -814,7 +814,7 @@
   2.893 + {
   2.894 + 	/* buf must be at least sizeof(tsk->comm) in size */
   2.895 + 	task_lock(tsk);
   2.896 +-	memcpy(buf, tsk->comm, sizeof(tsk->comm));
   2.897 ++	strncpy(buf, tsk->comm, sizeof(tsk->comm));
   2.898 + 	task_unlock(tsk);
   2.899 + }
   2.900 + 
   2.901 +diff -Nru a/fs/ext2/dir.c b/fs/ext2/dir.c
   2.902 +--- a/fs/ext2/dir.c	2005-04-29 18:34:28 -07:00
   2.903 ++++ b/fs/ext2/dir.c	2005-04-29 18:34:28 -07:00
   2.904 +@@ -592,6 +592,7 @@
   2.905 + 		goto fail;
   2.906 + 	}
   2.907 + 	kaddr = kmap_atomic(page, KM_USER0);
   2.908 ++       memset(kaddr, 0, chunk_size);
   2.909 + 	de = (struct ext2_dir_entry_2 *)kaddr;
   2.910 + 	de->name_len = 1;
   2.911 + 	de->rec_len = cpu_to_le16(EXT2_DIR_REC_LEN(1));
   2.912 +diff -Nru a/fs/isofs/inode.c b/fs/isofs/inode.c
   2.913 +--- a/fs/isofs/inode.c	2005-04-29 18:34:28 -07:00
   2.914 ++++ b/fs/isofs/inode.c	2005-04-29 18:34:28 -07:00
   2.915 +@@ -685,6 +685,8 @@
   2.916 + 	  sbi->s_log_zone_size = isonum_723 (h_pri->logical_block_size);
   2.917 + 	  sbi->s_max_size = isonum_733(h_pri->volume_space_size);
   2.918 + 	} else {
   2.919 ++	  if (!pri)
   2.920 ++	    goto out_freebh;
   2.921 + 	  rootp = (struct iso_directory_record *) pri->root_directory_record;
   2.922 + 	  sbi->s_nzones = isonum_733 (pri->volume_space_size);
   2.923 + 	  sbi->s_log_zone_size = isonum_723 (pri->logical_block_size);
   2.924 +@@ -1394,6 +1396,9 @@
   2.925 + 	unsigned long hashval;
   2.926 + 	struct inode *inode;
   2.927 + 	struct isofs_iget5_callback_data data;
   2.928 ++
   2.929 ++	if (offset >= 1ul << sb->s_blocksize_bits)
   2.930 ++		return NULL;
   2.931 + 
   2.932 + 	data.block = block;
   2.933 + 	data.offset = offset;
   2.934 +diff -Nru a/fs/isofs/rock.c b/fs/isofs/rock.c
   2.935 +--- a/fs/isofs/rock.c	2005-04-29 18:34:28 -07:00
   2.936 ++++ b/fs/isofs/rock.c	2005-04-29 18:34:28 -07:00
   2.937 +@@ -53,6 +53,7 @@
   2.938 +   if(LEN & 1) LEN++;						\
   2.939 +   CHR = ((unsigned char *) DE) + LEN;				\
   2.940 +   LEN = *((unsigned char *) DE) - LEN;                          \
   2.941 ++  if (LEN<0) LEN=0;                                             \
   2.942 +   if (ISOFS_SB(inode->i_sb)->s_rock_offset!=-1)                \
   2.943 +   {                                                             \
   2.944 +      LEN-=ISOFS_SB(inode->i_sb)->s_rock_offset;                \
   2.945 +@@ -73,6 +74,10 @@
   2.946 +     offset1 = 0; \
   2.947 +     pbh = sb_bread(DEV->i_sb, block); \
   2.948 +     if(pbh){       \
   2.949 ++      if (offset > pbh->b_size || offset + cont_size > pbh->b_size){	\
   2.950 ++	brelse(pbh); \
   2.951 ++	goto out; \
   2.952 ++      } \
   2.953 +       memcpy(buffer + offset1, pbh->b_data + offset, cont_size - offset1); \
   2.954 +       brelse(pbh); \
   2.955 +       chr = (unsigned char *) buffer; \
   2.956 +@@ -103,12 +108,13 @@
   2.957 +     struct rock_ridge * rr;
   2.958 +     int sig;
   2.959 +     
   2.960 +-    while (len > 1){ /* There may be one byte for padding somewhere */
   2.961 ++    while (len > 2){ /* There may be one byte for padding somewhere */
   2.962 +       rr = (struct rock_ridge *) chr;
   2.963 +-      if (rr->len == 0) goto out; /* Something got screwed up here */
   2.964 ++      if (rr->len < 3) goto out; /* Something got screwed up here */
   2.965 +       sig = isonum_721(chr);
   2.966 +       chr += rr->len; 
   2.967 +       len -= rr->len;
   2.968 ++      if (len < 0) goto out;	/* corrupted isofs */
   2.969 + 
   2.970 +       switch(sig){
   2.971 +       case SIG('R','R'):
   2.972 +@@ -122,6 +128,7 @@
   2.973 + 	break;
   2.974 +       case SIG('N','M'):
   2.975 + 	if (truncate) break;
   2.976 ++	if (rr->len < 5) break;
   2.977 +         /*
   2.978 + 	 * If the flags are 2 or 4, this indicates '.' or '..'.
   2.979 + 	 * We don't want to do anything with this, because it
   2.980 +@@ -186,12 +193,13 @@
   2.981 +     struct rock_ridge * rr;
   2.982 +     int rootflag;
   2.983 +     
   2.984 +-    while (len > 1){ /* There may be one byte for padding somewhere */
   2.985 ++    while (len > 2){ /* There may be one byte for padding somewhere */
   2.986 +       rr = (struct rock_ridge *) chr;
   2.987 +-      if (rr->len == 0) goto out; /* Something got screwed up here */
   2.988 ++      if (rr->len < 3) goto out; /* Something got screwed up here */
   2.989 +       sig = isonum_721(chr);
   2.990 +       chr += rr->len; 
   2.991 +       len -= rr->len;
   2.992 ++      if (len < 0) goto out;	/* corrupted isofs */
   2.993 +       
   2.994 +       switch(sig){
   2.995 + #ifndef CONFIG_ZISOFS		/* No flag for SF or ZF */
   2.996 +@@ -462,7 +470,7 @@
   2.997 + 	struct rock_ridge *rr;
   2.998 + 
   2.999 + 	if (!ISOFS_SB(inode->i_sb)->s_rock)
  2.1000 +-		panic ("Cannot have symlink with high sierra variant of iso filesystem\n");
  2.1001 ++		goto error;
  2.1002 + 
  2.1003 + 	block = ei->i_iget5_block;
  2.1004 + 	lock_kernel();
  2.1005 +@@ -487,13 +495,15 @@
  2.1006 + 	SETUP_ROCK_RIDGE(raw_inode, chr, len);
  2.1007 + 
  2.1008 +       repeat:
  2.1009 +-	while (len > 1) { /* There may be one byte for padding somewhere */
  2.1010 ++	while (len > 2) { /* There may be one byte for padding somewhere */
  2.1011 + 		rr = (struct rock_ridge *) chr;
  2.1012 +-		if (rr->len == 0)
  2.1013 ++		if (rr->len < 3)
  2.1014 + 			goto out;	/* Something got screwed up here */
  2.1015 + 		sig = isonum_721(chr);
  2.1016 + 		chr += rr->len;
  2.1017 + 		len -= rr->len;
  2.1018 ++		if (len < 0)
  2.1019 ++			goto out;	/* corrupted isofs */
  2.1020 + 
  2.1021 + 		switch (sig) {
  2.1022 + 		case SIG('R', 'R'):
  2.1023 +@@ -543,6 +553,7 @@
  2.1024 +       fail:
  2.1025 + 	brelse(bh);
  2.1026 + 	unlock_kernel();
  2.1027 ++      error:
  2.1028 + 	SetPageError(page);
  2.1029 + 	kunmap(page);
  2.1030 + 	unlock_page(page);
  2.1031 +diff -Nru a/fs/jbd/transaction.c b/fs/jbd/transaction.c
  2.1032 +--- a/fs/jbd/transaction.c	2005-04-29 18:34:27 -07:00
  2.1033 ++++ b/fs/jbd/transaction.c	2005-04-29 18:34:27 -07:00
  2.1034 +@@ -1775,10 +1775,10 @@
  2.1035 + 			JBUFFER_TRACE(jh, "checkpointed: add to BJ_Forget");
  2.1036 + 			ret = __dispose_buffer(jh,
  2.1037 + 					journal->j_running_transaction);
  2.1038 ++			journal_put_journal_head(jh);
  2.1039 + 			spin_unlock(&journal->j_list_lock);
  2.1040 + 			jbd_unlock_bh_state(bh);
  2.1041 + 			spin_unlock(&journal->j_state_lock);
  2.1042 +-			journal_put_journal_head(jh);
  2.1043 + 			return ret;
  2.1044 + 		} else {
  2.1045 + 			/* There is no currently-running transaction. So the
  2.1046 +@@ -1789,10 +1789,10 @@
  2.1047 + 				JBUFFER_TRACE(jh, "give to committing trans");
  2.1048 + 				ret = __dispose_buffer(jh,
  2.1049 + 					journal->j_committing_transaction);
  2.1050 ++				journal_put_journal_head(jh);
  2.1051 + 				spin_unlock(&journal->j_list_lock);
  2.1052 + 				jbd_unlock_bh_state(bh);
  2.1053 + 				spin_unlock(&journal->j_state_lock);
  2.1054 +-				journal_put_journal_head(jh);
  2.1055 + 				return ret;
  2.1056 + 			} else {
  2.1057 + 				/* The orphan record's transaction has
  2.1058 +@@ -1813,10 +1813,10 @@
  2.1059 + 					journal->j_running_transaction);
  2.1060 + 			jh->b_next_transaction = NULL;
  2.1061 + 		}
  2.1062 ++		journal_put_journal_head(jh);
  2.1063 + 		spin_unlock(&journal->j_list_lock);
  2.1064 + 		jbd_unlock_bh_state(bh);
  2.1065 + 		spin_unlock(&journal->j_state_lock);
  2.1066 +-		journal_put_journal_head(jh);
  2.1067 + 		return 0;
  2.1068 + 	} else {
  2.1069 + 		/* Good, the buffer belongs to the running transaction.
  2.1070 +diff -Nru a/fs/partitions/msdos.c b/fs/partitions/msdos.c
  2.1071 +--- a/fs/partitions/msdos.c	2005-04-29 18:34:28 -07:00
  2.1072 ++++ b/fs/partitions/msdos.c	2005-04-29 18:34:28 -07:00
  2.1073 +@@ -114,6 +114,9 @@
  2.1074 + 		 */
  2.1075 + 		for (i=0; i<4; i++, p++) {
  2.1076 + 			u32 offs, size, next;
  2.1077 ++
  2.1078 ++			if (SYS_IND(p) == 0)
  2.1079 ++				continue;
  2.1080 + 			if (!NR_SECTS(p) || is_extended_partition(p))
  2.1081 + 				continue;
  2.1082 + 
  2.1083 +@@ -430,6 +433,8 @@
  2.1084 + 	for (slot = 1 ; slot <= 4 ; slot++, p++) {
  2.1085 + 		u32 start = START_SECT(p)*sector_size;
  2.1086 + 		u32 size = NR_SECTS(p)*sector_size;
  2.1087 ++		if (SYS_IND(p) == 0)
  2.1088 ++			continue;
  2.1089 + 		if (!size)
  2.1090 + 			continue;
  2.1091 + 		if (is_extended_partition(p)) {
  2.1092 +diff -Nru a/kernel/signal.c b/kernel/signal.c
  2.1093 +--- a/kernel/signal.c	2005-04-29 18:34:27 -07:00
  2.1094 ++++ b/kernel/signal.c	2005-04-29 18:34:27 -07:00
  2.1095 +@@ -1728,6 +1728,7 @@
  2.1096 + 			 * with another processor delivering a stop signal,
  2.1097 + 			 * then the SIGCONT that wakes us up should clear it.
  2.1098 + 			 */
  2.1099 ++			read_unlock(&tasklist_lock);
  2.1100 + 			return 0;
  2.1101 + 		}
  2.1102 + 
  2.1103 +diff -Nru a/lib/rwsem-spinlock.c b/lib/rwsem-spinlock.c
  2.1104 +--- a/lib/rwsem-spinlock.c	2005-04-29 18:34:28 -07:00
  2.1105 ++++ b/lib/rwsem-spinlock.c	2005-04-29 18:34:28 -07:00
  2.1106 +@@ -140,12 +140,12 @@
  2.1107 + 
  2.1108 + 	rwsemtrace(sem, "Entering __down_read");
  2.1109 + 
  2.1110 +-	spin_lock(&sem->wait_lock);
  2.1111 ++	spin_lock_irq(&sem->wait_lock);
  2.1112 + 
  2.1113 + 	if (sem->activity >= 0 && list_empty(&sem->wait_list)) {
  2.1114 + 		/* granted */
  2.1115 + 		sem->activity++;
  2.1116 +-		spin_unlock(&sem->wait_lock);
  2.1117 ++		spin_unlock_irq(&sem->wait_lock);
  2.1118 + 		goto out;
  2.1119 + 	}
  2.1120 + 
  2.1121 +@@ -160,7 +160,7 @@
  2.1122 + 	list_add_tail(&waiter.list, &sem->wait_list);
  2.1123 + 
  2.1124 + 	/* we don't need to touch the semaphore struct anymore */
  2.1125 +-	spin_unlock(&sem->wait_lock);
  2.1126 ++	spin_unlock_irq(&sem->wait_lock);
  2.1127 + 
  2.1128 + 	/* wait to be given the lock */
  2.1129 + 	for (;;) {
  2.1130 +@@ -181,10 +181,12 @@
  2.1131 +  */
  2.1132 + int fastcall __down_read_trylock(struct rw_semaphore *sem)
  2.1133 + {
  2.1134 ++	unsigned long flags;
  2.1135 + 	int ret = 0;
  2.1136 ++
  2.1137 + 	rwsemtrace(sem, "Entering __down_read_trylock");
  2.1138 + 
  2.1139 +-	spin_lock(&sem->wait_lock);
  2.1140 ++	spin_lock_irqsave(&sem->wait_lock, flags);
  2.1141 + 
  2.1142 + 	if (sem->activity >= 0 && list_empty(&sem->wait_list)) {
  2.1143 + 		/* granted */
  2.1144 +@@ -192,7 +194,7 @@
  2.1145 + 		ret = 1;
  2.1146 + 	}
  2.1147 + 
  2.1148 +-	spin_unlock(&sem->wait_lock);
  2.1149 ++	spin_unlock_irqrestore(&sem->wait_lock, flags);
  2.1150 + 
  2.1151 + 	rwsemtrace(sem, "Leaving __down_read_trylock");
  2.1152 + 	return ret;
  2.1153 +@@ -209,12 +211,12 @@
  2.1154 + 
  2.1155 + 	rwsemtrace(sem, "Entering __down_write");
  2.1156 + 
  2.1157 +-	spin_lock(&sem->wait_lock);
  2.1158 ++	spin_lock_irq(&sem->wait_lock);
  2.1159 + 
  2.1160 + 	if (sem->activity == 0 && list_empty(&sem->wait_list)) {
  2.1161 + 		/* granted */
  2.1162 + 		sem->activity = -1;
  2.1163 +-		spin_unlock(&sem->wait_lock);
  2.1164 ++		spin_unlock_irq(&sem->wait_lock);
  2.1165 + 		goto out;
  2.1166 + 	}
  2.1167 + 
  2.1168 +@@ -229,7 +231,7 @@
  2.1169 + 	list_add_tail(&waiter.list, &sem->wait_list);
  2.1170 + 
  2.1171 + 	/* we don't need to touch the semaphore struct anymore */
  2.1172 +-	spin_unlock(&sem->wait_lock);
  2.1173 ++	spin_unlock_irq(&sem->wait_lock);
  2.1174 + 
  2.1175 + 	/* wait to be given the lock */
  2.1176 + 	for (;;) {
  2.1177 +@@ -250,10 +252,12 @@
  2.1178 +  */
  2.1179 + int fastcall __down_write_trylock(struct rw_semaphore *sem)
  2.1180 + {
  2.1181 ++	unsigned long flags;
  2.1182 + 	int ret = 0;
  2.1183 ++
  2.1184 + 	rwsemtrace(sem, "Entering __down_write_trylock");
  2.1185 + 
  2.1186 +-	spin_lock(&sem->wait_lock);
  2.1187 ++	spin_lock_irqsave(&sem->wait_lock, flags);
  2.1188 + 
  2.1189 + 	if (sem->activity == 0 && list_empty(&sem->wait_list)) {
  2.1190 + 		/* granted */
  2.1191 +@@ -261,7 +265,7 @@
  2.1192 + 		ret = 1;
  2.1193 + 	}
  2.1194 + 
  2.1195 +-	spin_unlock(&sem->wait_lock);
  2.1196 ++	spin_unlock_irqrestore(&sem->wait_lock, flags);
  2.1197 + 
  2.1198 + 	rwsemtrace(sem, "Leaving __down_write_trylock");
  2.1199 + 	return ret;
  2.1200 +@@ -272,14 +276,16 @@
  2.1201 +  */
  2.1202 + void fastcall __up_read(struct rw_semaphore *sem)
  2.1203 + {
  2.1204 ++	unsigned long flags;
  2.1205 ++
  2.1206 + 	rwsemtrace(sem, "Entering __up_read");
  2.1207 + 
  2.1208 +-	spin_lock(&sem->wait_lock);
  2.1209 ++	spin_lock_irqsave(&sem->wait_lock, flags);
  2.1210 + 
  2.1211 + 	if (--sem->activity == 0 && !list_empty(&sem->wait_list))
  2.1212 + 		sem = __rwsem_wake_one_writer(sem);
  2.1213 + 
  2.1214 +-	spin_unlock(&sem->wait_lock);
  2.1215 ++	spin_unlock_irqrestore(&sem->wait_lock, flags);
  2.1216 + 
  2.1217 + 	rwsemtrace(sem, "Leaving __up_read");
  2.1218 + }
  2.1219 +@@ -289,15 +295,17 @@
  2.1220 +  */
  2.1221 + void fastcall __up_write(struct rw_semaphore *sem)
  2.1222 + {
  2.1223 ++	unsigned long flags;
  2.1224 ++
  2.1225 + 	rwsemtrace(sem, "Entering __up_write");
  2.1226 + 
  2.1227 +-	spin_lock(&sem->wait_lock);
  2.1228 ++	spin_lock_irqsave(&sem->wait_lock, flags);
  2.1229 + 
  2.1230 + 	sem->activity = 0;
  2.1231 + 	if (!list_empty(&sem->wait_list))
  2.1232 + 		sem = __rwsem_do_wake(sem, 1);
  2.1233 + 
  2.1234 +-	spin_unlock(&sem->wait_lock);
  2.1235 ++	spin_unlock_irqrestore(&sem->wait_lock, flags);
  2.1236 + 
  2.1237 + 	rwsemtrace(sem, "Leaving __up_write");
  2.1238 + }
  2.1239 +@@ -308,15 +316,17 @@
  2.1240 +  */
  2.1241 + void fastcall __downgrade_write(struct rw_semaphore *sem)
  2.1242 + {
  2.1243 ++	unsigned long flags;
  2.1244 ++
  2.1245 + 	rwsemtrace(sem, "Entering __downgrade_write");
  2.1246 + 
  2.1247 +-	spin_lock(&sem->wait_lock);
  2.1248 ++	spin_lock_irqsave(&sem->wait_lock, flags);
  2.1249 + 
  2.1250 + 	sem->activity = 1;
  2.1251 + 	if (!list_empty(&sem->wait_list))
  2.1252 + 		sem = __rwsem_do_wake(sem, 0);
  2.1253 + 
  2.1254 +-	spin_unlock(&sem->wait_lock);
  2.1255 ++	spin_unlock_irqrestore(&sem->wait_lock, flags);
  2.1256 + 
  2.1257 + 	rwsemtrace(sem, "Leaving __downgrade_write");
  2.1258 + }
  2.1259 +diff -Nru a/lib/rwsem.c b/lib/rwsem.c
  2.1260 +--- a/lib/rwsem.c	2005-04-29 18:34:28 -07:00
  2.1261 ++++ b/lib/rwsem.c	2005-04-29 18:34:28 -07:00
  2.1262 +@@ -150,7 +150,7 @@
  2.1263 + 	set_task_state(tsk, TASK_UNINTERRUPTIBLE);
  2.1264 + 
  2.1265 + 	/* set up my own style of waitqueue */
  2.1266 +-	spin_lock(&sem->wait_lock);
  2.1267 ++	spin_lock_irq(&sem->wait_lock);
  2.1268 + 	waiter->task = tsk;
  2.1269 + 	get_task_struct(tsk);
  2.1270 + 
  2.1271 +@@ -163,7 +163,7 @@
  2.1272 + 	if (!(count & RWSEM_ACTIVE_MASK))
  2.1273 + 		sem = __rwsem_do_wake(sem, 0);
  2.1274 + 
  2.1275 +-	spin_unlock(&sem->wait_lock);
  2.1276 ++	spin_unlock_irq(&sem->wait_lock);
  2.1277 + 
  2.1278 + 	/* wait to be given the lock */
  2.1279 + 	for (;;) {
  2.1280 +@@ -219,15 +219,17 @@
  2.1281 +  */
  2.1282 + struct rw_semaphore fastcall *rwsem_wake(struct rw_semaphore *sem)
  2.1283 + {
  2.1284 ++	unsigned long flags;
  2.1285 ++
  2.1286 + 	rwsemtrace(sem, "Entering rwsem_wake");
  2.1287 + 
  2.1288 +-	spin_lock(&sem->wait_lock);
  2.1289 ++	spin_lock_irqsave(&sem->wait_lock, flags);
  2.1290 + 
  2.1291 + 	/* do nothing if list empty */
  2.1292 + 	if (!list_empty(&sem->wait_list))
  2.1293 + 		sem = __rwsem_do_wake(sem, 0);
  2.1294 + 
  2.1295 +-	spin_unlock(&sem->wait_lock);
  2.1296 ++	spin_unlock_irqrestore(&sem->wait_lock, flags);
  2.1297 + 
  2.1298 + 	rwsemtrace(sem, "Leaving rwsem_wake");
  2.1299 + 
  2.1300 +@@ -241,15 +243,17 @@
  2.1301 +  */
  2.1302 + struct rw_semaphore fastcall *rwsem_downgrade_wake(struct rw_semaphore *sem)
  2.1303 + {
  2.1304 ++	unsigned long flags;
  2.1305 ++
  2.1306 + 	rwsemtrace(sem, "Entering rwsem_downgrade_wake");
  2.1307 + 
  2.1308 +-	spin_lock(&sem->wait_lock);
  2.1309 ++	spin_lock_irqsave(&sem->wait_lock, flags);
  2.1310 + 
  2.1311 + 	/* do nothing if list empty */
  2.1312 + 	if (!list_empty(&sem->wait_list))
  2.1313 + 		sem = __rwsem_do_wake(sem, 1);
  2.1314 + 
  2.1315 +-	spin_unlock(&sem->wait_lock);
  2.1316 ++	spin_unlock_irqrestore(&sem->wait_lock, flags);
  2.1317 + 
  2.1318 + 	rwsemtrace(sem, "Leaving rwsem_downgrade_wake");
  2.1319 + 	return sem;
  2.1320 +diff -Nru a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
  2.1321 +--- a/net/bluetooth/af_bluetooth.c	2005-04-29 18:34:27 -07:00
  2.1322 ++++ b/net/bluetooth/af_bluetooth.c	2005-04-29 18:34:27 -07:00
  2.1323 +@@ -64,7 +64,7 @@
  2.1324 + 
  2.1325 + int bt_sock_register(int proto, struct net_proto_family *ops)
  2.1326 + {
  2.1327 +-	if (proto >= BT_MAX_PROTO)
  2.1328 ++	if (proto < 0 || proto >= BT_MAX_PROTO)
  2.1329 + 		return -EINVAL;
  2.1330 + 
  2.1331 + 	if (bt_proto[proto])
  2.1332 +@@ -77,7 +77,7 @@
  2.1333 + 
  2.1334 + int bt_sock_unregister(int proto)
  2.1335 + {
  2.1336 +-	if (proto >= BT_MAX_PROTO)
  2.1337 ++	if (proto < 0 || proto >= BT_MAX_PROTO)
  2.1338 + 		return -EINVAL;
  2.1339 + 
  2.1340 + 	if (!bt_proto[proto])
  2.1341 +@@ -92,7 +92,7 @@
  2.1342 + {
  2.1343 + 	int err = 0;
  2.1344 + 
  2.1345 +-	if (proto >= BT_MAX_PROTO)
  2.1346 ++	if (proto < 0 || proto >= BT_MAX_PROTO)
  2.1347 + 		return -EINVAL;
  2.1348 + 
  2.1349 + #if defined(CONFIG_KMOD)
  2.1350 +diff -Nru a/net/ipv4/fib_hash.c b/net/ipv4/fib_hash.c
  2.1351 +--- a/net/ipv4/fib_hash.c	2005-04-29 18:34:28 -07:00
  2.1352 ++++ b/net/ipv4/fib_hash.c	2005-04-29 18:34:28 -07:00
  2.1353 +@@ -919,13 +919,23 @@
  2.1354 + 	return fa;
  2.1355 + }
  2.1356 + 
  2.1357 ++static struct fib_alias *fib_get_idx(struct seq_file *seq, loff_t pos)
  2.1358 ++{
  2.1359 ++	struct fib_alias *fa = fib_get_first(seq);
  2.1360 ++
  2.1361 ++	if (fa)
  2.1362 ++		while (pos && (fa = fib_get_next(seq)))
  2.1363 ++			--pos;
  2.1364 ++	return pos ? NULL : fa;
  2.1365 ++}
  2.1366 ++
  2.1367 + static void *fib_seq_start(struct seq_file *seq, loff_t *pos)
  2.1368 + {
  2.1369 + 	void *v = NULL;
  2.1370 + 
  2.1371 + 	read_lock(&fib_hash_lock);
  2.1372 + 	if (ip_fib_main_table)
  2.1373 +-		v = *pos ? fib_get_next(seq) : SEQ_START_TOKEN;
  2.1374 ++		v = *pos ? fib_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
  2.1375 + 	return v;
  2.1376 + }
  2.1377 + 
  2.1378 +diff -Nru a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
  2.1379 +--- a/net/ipv4/tcp_input.c	2005-04-29 18:34:28 -07:00
  2.1380 ++++ b/net/ipv4/tcp_input.c	2005-04-29 18:34:28 -07:00
  2.1381 +@@ -1653,7 +1653,10 @@
  2.1382 + static void tcp_undo_cwr(struct tcp_sock *tp, int undo)
  2.1383 + {
  2.1384 + 	if (tp->prior_ssthresh) {
  2.1385 +-		tp->snd_cwnd = max(tp->snd_cwnd, tp->snd_ssthresh<<1);
  2.1386 ++		if (tcp_is_bic(tp))
  2.1387 ++			tp->snd_cwnd = max(tp->snd_cwnd, tp->bictcp.last_max_cwnd);
  2.1388 ++		else
  2.1389 ++			tp->snd_cwnd = max(tp->snd_cwnd, tp->snd_ssthresh<<1);
  2.1390 + 
  2.1391 + 		if (undo && tp->prior_ssthresh > tp->snd_ssthresh) {
  2.1392 + 			tp->snd_ssthresh = tp->prior_ssthresh;
  2.1393 +diff -Nru a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
  2.1394 +--- a/net/ipv4/tcp_timer.c	2005-04-29 18:34:28 -07:00
  2.1395 ++++ b/net/ipv4/tcp_timer.c	2005-04-29 18:34:28 -07:00
  2.1396 +@@ -38,6 +38,7 @@
  2.1397 + 
  2.1398 + #ifdef TCP_DEBUG
  2.1399 + const char tcp_timer_bug_msg[] = KERN_DEBUG "tcpbug: unknown timer value\n";
  2.1400 ++EXPORT_SYMBOL(tcp_timer_bug_msg);
  2.1401 + #endif
  2.1402 + 
  2.1403 + /*
  2.1404 +diff -Nru a/net/ipv4/xfrm4_output.c b/net/ipv4/xfrm4_output.c
  2.1405 +--- a/net/ipv4/xfrm4_output.c	2005-04-29 18:34:27 -07:00
  2.1406 ++++ b/net/ipv4/xfrm4_output.c	2005-04-29 18:34:27 -07:00
  2.1407 +@@ -103,16 +103,16 @@
  2.1408 + 			goto error_nolock;
  2.1409 + 	}
  2.1410 + 
  2.1411 +-	spin_lock_bh(&x->lock);
  2.1412 +-	err = xfrm_state_check(x, skb);
  2.1413 +-	if (err)
  2.1414 +-		goto error;
  2.1415 +-
  2.1416 + 	if (x->props.mode) {
  2.1417 + 		err = xfrm4_tunnel_check_size(skb);
  2.1418 + 		if (err)
  2.1419 +-			goto error;
  2.1420 ++			goto error_nolock;
  2.1421 + 	}
  2.1422 ++
  2.1423 ++	spin_lock_bh(&x->lock);
  2.1424 ++	err = xfrm_state_check(x, skb);
  2.1425 ++	if (err)
  2.1426 ++		goto error;
  2.1427 + 
  2.1428 + 	xfrm4_encap(skb);
  2.1429 + 
  2.1430 +diff -Nru a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
  2.1431 +--- a/net/ipv6/xfrm6_output.c	2005-04-29 18:34:28 -07:00
  2.1432 ++++ b/net/ipv6/xfrm6_output.c	2005-04-29 18:34:28 -07:00
  2.1433 +@@ -103,16 +103,16 @@
  2.1434 + 			goto error_nolock;
  2.1435 + 	}
  2.1436 + 
  2.1437 +-	spin_lock_bh(&x->lock);
  2.1438 +-	err = xfrm_state_check(x, skb);
  2.1439 +-	if (err)
  2.1440 +-		goto error;
  2.1441 +-
  2.1442 + 	if (x->props.mode) {
  2.1443 + 		err = xfrm6_tunnel_check_size(skb);
  2.1444 + 		if (err)
  2.1445 +-			goto error;
  2.1446 ++			goto error_nolock;
  2.1447 + 	}
  2.1448 ++
  2.1449 ++	spin_lock_bh(&x->lock);
  2.1450 ++	err = xfrm_state_check(x, skb);
  2.1451 ++	if (err)
  2.1452 ++		goto error;
  2.1453 + 
  2.1454 + 	xfrm6_encap(skb);
  2.1455 + 
  2.1456 +diff -Nru a/net/netrom/nr_in.c b/net/netrom/nr_in.c
  2.1457 +--- a/net/netrom/nr_in.c	2005-04-29 18:34:27 -07:00
  2.1458 ++++ b/net/netrom/nr_in.c	2005-04-29 18:34:27 -07:00
  2.1459 +@@ -74,7 +74,6 @@
  2.1460 + static int nr_state1_machine(struct sock *sk, struct sk_buff *skb,
  2.1461 + 	int frametype)
  2.1462 + {
  2.1463 +-	bh_lock_sock(sk);
  2.1464 + 	switch (frametype) {
  2.1465 + 	case NR_CONNACK: {
  2.1466 + 		nr_cb *nr = nr_sk(sk);
  2.1467 +@@ -103,8 +102,6 @@
  2.1468 + 	default:
  2.1469 + 		break;
  2.1470 + 	}
  2.1471 +-	bh_unlock_sock(sk);
  2.1472 +-
  2.1473 + 	return 0;
  2.1474 + }
  2.1475 + 
  2.1476 +@@ -116,7 +113,6 @@
  2.1477 + static int nr_state2_machine(struct sock *sk, struct sk_buff *skb,
  2.1478 + 	int frametype)
  2.1479 + {
  2.1480 +-	bh_lock_sock(sk);
  2.1481 + 	switch (frametype) {
  2.1482 + 	case NR_CONNACK | NR_CHOKE_FLAG:
  2.1483 + 		nr_disconnect(sk, ECONNRESET);
  2.1484 +@@ -132,8 +128,6 @@
  2.1485 + 	default:
  2.1486 + 		break;
  2.1487 + 	}
  2.1488 +-	bh_unlock_sock(sk);
  2.1489 +-
  2.1490 + 	return 0;
  2.1491 + }
  2.1492 + 
  2.1493 +@@ -154,7 +148,6 @@
  2.1494 + 	nr = skb->data[18];
  2.1495 + 	ns = skb->data[17];
  2.1496 + 
  2.1497 +-	bh_lock_sock(sk);
  2.1498 + 	switch (frametype) {
  2.1499 + 	case NR_CONNREQ:
  2.1500 + 		nr_write_internal(sk, NR_CONNACK);
  2.1501 +@@ -265,8 +258,6 @@
  2.1502 + 	default:
  2.1503 + 		break;
  2.1504 + 	}
  2.1505 +-	bh_unlock_sock(sk);
  2.1506 +-
  2.1507 + 	return queued;
  2.1508 + }
  2.1509 + 
  2.1510 +diff -Nru a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
  2.1511 +--- a/net/xfrm/xfrm_state.c	2005-04-29 18:34:28 -07:00
  2.1512 ++++ b/net/xfrm/xfrm_state.c	2005-04-29 18:34:28 -07:00
  2.1513 +@@ -609,7 +609,7 @@
  2.1514 + 
  2.1515 + 	for (i = 0; i < XFRM_DST_HSIZE; i++) {
  2.1516 + 		list_for_each_entry(x, xfrm_state_bydst+i, bydst) {
  2.1517 +-			if (x->km.seq == seq) {
  2.1518 ++			if (x->km.seq == seq && x->km.state == XFRM_STATE_ACQ) {
  2.1519 + 				xfrm_state_hold(x);
  2.1520 + 				return x;
  2.1521 + 			}
  2.1522 +diff -Nru a/security/keys/key.c b/security/keys/key.c
  2.1523 +--- a/security/keys/key.c	2005-04-29 18:34:28 -07:00
  2.1524 ++++ b/security/keys/key.c	2005-04-29 18:34:28 -07:00
  2.1525 +@@ -57,9 +57,10 @@
  2.1526 + {
  2.1527 + 	struct key_user *candidate = NULL, *user;
  2.1528 + 	struct rb_node *parent = NULL;
  2.1529 +-	struct rb_node **p = &key_user_tree.rb_node;
  2.1530 ++	struct rb_node **p;
  2.1531 + 
  2.1532 +  try_again:
  2.1533 ++	p = &key_user_tree.rb_node;
  2.1534 + 	spin_lock(&key_user_lock);
  2.1535 + 
  2.1536 + 	/* search the tree for a user record with a matching UID */
  2.1537 +diff -Nru a/sound/core/timer.c b/sound/core/timer.c
  2.1538 +--- a/sound/core/timer.c	2005-04-29 18:34:28 -07:00
  2.1539 ++++ b/sound/core/timer.c	2005-04-29 18:34:28 -07:00
  2.1540 +@@ -1117,7 +1117,8 @@
  2.1541 + 	if (tu->qused >= tu->queue_size) {
  2.1542 + 		tu->overrun++;
  2.1543 + 	} else {
  2.1544 +-		memcpy(&tu->queue[tu->qtail++], tread, sizeof(*tread));
  2.1545 ++		memcpy(&tu->tqueue[tu->qtail++], tread, sizeof(*tread));
  2.1546 ++		tu->qtail %= tu->queue_size;
  2.1547 + 		tu->qused++;
  2.1548 + 	}
  2.1549 + }
  2.1550 +@@ -1140,6 +1141,8 @@
  2.1551 + 	spin_lock(&tu->qlock);
  2.1552 + 	snd_timer_user_append_to_tqueue(tu, &r1);
  2.1553 + 	spin_unlock(&tu->qlock);
  2.1554 ++	kill_fasync(&tu->fasync, SIGIO, POLL_IN);
  2.1555 ++	wake_up(&tu->qchange_sleep);
  2.1556 + }
  2.1557 + 
  2.1558 + static void snd_timer_user_tinterrupt(snd_timer_instance_t *timeri,
  2.1559 +diff -Nru a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c
  2.1560 +--- a/sound/pci/ac97/ac97_codec.c	2005-04-29 18:34:28 -07:00
  2.1561 ++++ b/sound/pci/ac97/ac97_codec.c	2005-04-29 18:34:28 -07:00
  2.1562 +@@ -1185,7 +1185,7 @@
  2.1563 + /*
  2.1564 +  * create mute switch(es) for normal stereo controls
  2.1565 +  */
  2.1566 +-static int snd_ac97_cmute_new(snd_card_t *card, char *name, int reg, ac97_t *ac97)
  2.1567 ++static int snd_ac97_cmute_new_stereo(snd_card_t *card, char *name, int reg, int check_stereo, ac97_t *ac97)
  2.1568 + {
  2.1569 + 	snd_kcontrol_t *kctl;
  2.1570 + 	int err;
  2.1571 +@@ -1196,7 +1196,7 @@
  2.1572 + 
  2.1573 + 	mute_mask = 0x8000;
  2.1574 + 	val = snd_ac97_read(ac97, reg);
  2.1575 +-	if (ac97->flags & AC97_STEREO_MUTES) {
  2.1576 ++	if (check_stereo || (ac97->flags & AC97_STEREO_MUTES)) {
  2.1577 + 		/* check whether both mute bits work */
  2.1578 + 		val1 = val | 0x8080;
  2.1579 + 		snd_ac97_write(ac97, reg, val1);
  2.1580 +@@ -1254,7 +1254,7 @@
  2.1581 + /*
  2.1582 +  * create a mute-switch and a volume for normal stereo/mono controls
  2.1583 +  */
  2.1584 +-static int snd_ac97_cmix_new(snd_card_t *card, const char *pfx, int reg, ac97_t *ac97)
  2.1585 ++static int snd_ac97_cmix_new_stereo(snd_card_t *card, const char *pfx, int reg, int check_stereo, ac97_t *ac97)
  2.1586 + {
  2.1587 + 	int err;
  2.1588 + 	char name[44];
  2.1589 +@@ -1265,7 +1265,7 @@
  2.1590 + 
  2.1591 + 	if (snd_ac97_try_bit(ac97, reg, 15)) {
  2.1592 + 		sprintf(name, "%s Switch", pfx);
  2.1593 +-		if ((err = snd_ac97_cmute_new(card, name, reg, ac97)) < 0)
  2.1594 ++		if ((err = snd_ac97_cmute_new_stereo(card, name, reg, check_stereo, ac97)) < 0)
  2.1595 + 			return err;
  2.1596 + 	}
  2.1597 + 	check_volume_resolution(ac97, reg, &lo_max, &hi_max);
  2.1598 +@@ -1277,6 +1277,8 @@
  2.1599 + 	return 0;
  2.1600 + }
  2.1601 + 
  2.1602 ++#define snd_ac97_cmix_new(card, pfx, reg, ac97)	snd_ac97_cmix_new_stereo(card, pfx, reg, 0, ac97)
  2.1603 ++#define snd_ac97_cmute_new(card, name, reg, ac97)	snd_ac97_cmute_new_stereo(card, name, reg, 0, ac97)
  2.1604 + 
  2.1605 + static unsigned int snd_ac97_determine_spdif_rates(ac97_t *ac97);
  2.1606 + 
  2.1607 +@@ -1327,7 +1329,8 @@
  2.1608 + 
  2.1609 + 	/* build surround controls */
  2.1610 + 	if (snd_ac97_try_volume_mix(ac97, AC97_SURROUND_MASTER)) {
  2.1611 +-		if ((err = snd_ac97_cmix_new(card, "Surround Playback", AC97_SURROUND_MASTER, ac97)) < 0)
  2.1612 ++		/* Surround Master (0x38) is with stereo mutes */
  2.1613 ++		if ((err = snd_ac97_cmix_new_stereo(card, "Surround Playback", AC97_SURROUND_MASTER, 1, ac97)) < 0)
  2.1614 + 			return err;
  2.1615 + 	}
  2.1616 +