vcs.maemo.org Git - kernel-bfs/blob - kernel-bfs-2.6.28/debian/patches/2.6.28.10.diff

   1 --- kernel-power-2.6.28.orig/Documentation/filesystems/sysfs-pci.txt
   2 +++ kernel-power-2.6.28/Documentation/filesystems/sysfs-pci.txt
   3 @@ -9,6 +9,7 @@
   4       |   |-- class
   5       |   |-- config
   6       |   |-- device
   7 +     |   |-- enable
   8       |   |-- irq
   9       |   |-- local_cpus
  10       |   |-- resource
  11 @@ -32,6 +33,7 @@
  12         class              PCI class (ascii, ro)
  13         config             PCI config space (binary, rw)
  14         device             PCI device (ascii, ro)
  15 +       enable             Whether the device is enabled (ascii, rw)
  16         irq                IRQ number (ascii, ro)
  17         local_cpus         nearby CPU mask (cpumask, ro)
  18         resource                   PCI resource host addresses (ascii, ro)
  19 @@ -57,10 +59,19 @@
  20  don't support mmapping of certain resources, so be sure to check the return
  21  value from any attempted mmap.
  22
  23 +The 'enable' file provides a counter that indicates how many times the device
  24 +has been enabled.  If the 'enable' file currently returns '4', and a '1' is
  25 +echoed into it, it will then return '5'.  Echoing a '0' into it will decrease
  26 +the count.  Even when it returns to 0, though, some of the initialisation
  27 +may not be reversed.
  28 +
  29  The 'rom' file is special in that it provides read-only access to the device's
  30  ROM file, if available.  It's disabled by default, however, so applications
  31  should write the string "1" to the file to enable it before attempting a read
  32 -call, and disable it following the access by writing "0" to the file.
  33 +call, and disable it following the access by writing "0" to the file.  Note
  34 +that the device must be enabled for a rom read to return data succesfully.
  35 +In the event a driver is not bound to the device, it can be enabled using the
  36 +'enable' file, documented above.
  37
  38  Accessing legacy resources through sysfs
  39  ----------------------------------------
  40 --- kernel-power-2.6.28.orig/Documentation/sound/alsa/ALSA-Configuration.txt
  41 +++ kernel-power-2.6.28/Documentation/sound/alsa/ALSA-Configuration.txt
  42 @@ -979,9 +979,10 @@
  43           6stack        6-jack, separate surrounds (default)
  44           3stack        3-stack, shared surrounds
  45           laptop        2-channel only (FSC V2060, Samsung M50)
  46 -         laptop-eapd   2-channel with EAPD (Samsung R65, ASUS A6J)
  47 +         laptop-eapd   2-channel with EAPD (ASUS A6J)
  48           laptop-automute 2-channel with EAPD and HP-automute (Lenovo N100)
  49           ultra         2-channel with EAPD (Samsung Ultra tablet PC)
  50 +         samsung       2-channel with EAPD (Samsung R65)
  51
  52         AD1988/AD1988B/AD1989A/AD1989B
  53           6stack        6-jack
  54 --- kernel-power-2.6.28.orig/Makefile
  55 +++ kernel-power-2.6.28/Makefile
  56 @@ -1,7 +1,7 @@
  57  VERSION = 2
  58  PATCHLEVEL = 6
  59  SUBLEVEL = 28
  60 -EXTRAVERSION = power-bfs
  61 +EXTRAVERSION = .10power-bfs
  62  NAME = Erotic Pickled Herring
  63
  64  # *DOCUMENTATION*
  65 @@ -560,6 +560,9 @@
  66  # disable pointer signed / unsigned warnings in gcc 4.0
  67  KBUILD_CFLAGS += $(call cc-option,-Wno-pointer-sign,)
  68
  69 +# disable invalid "can't wrap" optimzations for signed / pointers
  70 +KBUILD_CFLAGS  += $(call cc-option,-fwrapv)
  71 +
  72  # Add user supplied CPPFLAGS, AFLAGS and CFLAGS as the last assignments
  73  # But warn user when we do so
  74  warn-assign = \
  75 --- kernel-power-2.6.28.orig/arch/Kconfig
  76 +++ kernel-power-2.6.28/arch/Kconfig
  77 @@ -60,6 +60,9 @@
  78           See Documentation/unaligned-memory-access.txt for more
  79           information on the topic of unaligned memory accesses.
  80
  81 +config HAVE_SYSCALL_WRAPPERS
  82 +       bool
  83 +
  84  config KRETPROBES
  85         def_bool y
  86         depends on KPROBES && HAVE_KRETPROBES
  87 --- kernel-power-2.6.28.orig/arch/alpha/kernel/entry.S
  88 +++ kernel-power-2.6.28/arch/alpha/kernel/entry.S
  89 @@ -894,9 +894,9 @@
  90  .end sys_getxpid
  91
  92         .align  4
  93 -       .globl  sys_pipe
  94 -       .ent    sys_pipe
  95 -sys_pipe:
  96 +       .globl  sys_alpha_pipe
  97 +       .ent    sys_alpha_pipe
  98 +sys_alpha_pipe:
  99         lda     $sp, -16($sp)
 100         stq     $26, 0($sp)
 101         .prologue 0
 102 @@ -914,7 +914,7 @@
 103         stq     $1, 80+16($sp)
 104  1:     lda     $sp, 16($sp)
 105         ret
 106 -.end sys_pipe
 107 +.end sys_alpha_pipe
 108
 109         .align  4
 110         .globl  sys_execve
 111 --- kernel-power-2.6.28.orig/arch/alpha/kernel/irq_srm.c
 112 +++ kernel-power-2.6.28/arch/alpha/kernel/irq_srm.c
 113 @@ -63,6 +63,8 @@
 114  {
 115         long i;
 116
 117 +       if (NR_IRQS <= 16)
 118 +               return;
 119         for (i = 16; i < max; ++i) {
 120                 if (i < 64 && ((ignore_mask >> i) & 1))
 121                         continue;
 122 --- kernel-power-2.6.28.orig/arch/alpha/kernel/systbls.S
 123 +++ kernel-power-2.6.28/arch/alpha/kernel/systbls.S
 124 @@ -52,7 +52,7 @@
 125         .quad sys_setpgid
 126         .quad alpha_ni_syscall                  /* 40 */
 127         .quad sys_dup
 128 -       .quad sys_pipe
 129 +       .quad sys_alpha_pipe
 130         .quad osf_set_program_attributes
 131         .quad alpha_ni_syscall
 132         .quad sys_open                          /* 45 */
 133 --- kernel-power-2.6.28.orig/arch/arm/kernel/calls.S
 134 +++ kernel-power-2.6.28/arch/arm/kernel/calls.S
 135 @@ -98,7 +98,7 @@
 136                 CALL(sys_uselib)
 137                 CALL(sys_swapon)
 138                 CALL(sys_reboot)
 139 -               CALL(OBSOLETE(old_readdir))     /* used by libc4 */
 140 +               CALL(OBSOLETE(sys_old_readdir)) /* used by libc4 */
 141  /* 90 */       CALL(OBSOLETE(old_mmap))        /* used by libc4 */
 142                 CALL(sys_munmap)
 143                 CALL(sys_truncate)
 144 --- kernel-power-2.6.28.orig/arch/arm/mach-rpc/riscpc.c
 145 +++ kernel-power-2.6.28/arch/arm/mach-rpc/riscpc.c
 146 @@ -19,6 +19,7 @@
 147  #include <linux/serial_8250.h>
 148  #include <linux/ata_platform.h>
 149  #include <linux/io.h>
 150 +#include <linux/i2c.h>
 151
 152  #include <asm/elf.h>
 153  #include <asm/mach-types.h>
 154 @@ -201,8 +202,13 @@
 155         &pata_device,
 156  };
 157
 158 +static struct i2c_board_info i2c_rtc = {
 159 +       I2C_BOARD_INFO("pcf8583", 0x50)
 160 +};
 161 +
 162  static int __init rpc_init(void)
 163  {
 164 +       i2c_register_board_info(0, &i2c_rtc, 1);
 165         return platform_add_devices(devs, ARRAY_SIZE(devs));
 166  }
 167
 168 --- kernel-power-2.6.28.orig/arch/cris/arch-v10/kernel/entry.S
 169 +++ kernel-power-2.6.28/arch/cris/arch-v10/kernel/entry.S
 170 @@ -691,7 +691,7 @@
 171         .long sys_uselib
 172         .long sys_swapon
 173         .long sys_reboot
 174 -       .long old_readdir
 175 +       .long sys_old_readdir
 176         .long old_mmap          /* 90 */
 177         .long sys_munmap
 178         .long sys_truncate
 179 --- kernel-power-2.6.28.orig/arch/cris/arch-v32/kernel/entry.S
 180 +++ kernel-power-2.6.28/arch/cris/arch-v32/kernel/entry.S
 181 @@ -614,7 +614,7 @@
 182         .long sys_uselib
 183         .long sys_swapon
 184         .long sys_reboot
 185 -       .long old_readdir
 186 +       .long sys_old_readdir
 187         .long old_mmap          /* 90 */
 188         .long sys_munmap
 189         .long sys_truncate
 190 --- kernel-power-2.6.28.orig/arch/h8300/kernel/syscalls.S
 191 +++ kernel-power-2.6.28/arch/h8300/kernel/syscalls.S
 192 @@ -103,7 +103,7 @@
 193         .long SYMBOL_NAME(sys_uselib)
 194         .long SYMBOL_NAME(sys_swapon)
 195         .long SYMBOL_NAME(sys_reboot)
 196 -       .long SYMBOL_NAME(old_readdir)
 197 +       .long SYMBOL_NAME(sys_old_readdir)
 198         .long SYMBOL_NAME(old_mmap)             /* 90 */
 199         .long SYMBOL_NAME(sys_munmap)
 200         .long SYMBOL_NAME(sys_truncate)
 201 --- kernel-power-2.6.28.orig/arch/ia64/Kconfig
 202 +++ kernel-power-2.6.28/arch/ia64/Kconfig
 203 @@ -17,6 +17,7 @@
 204         select ACPI if (!IA64_HP_SIM)
 205         select PM if (!IA64_HP_SIM)
 206         select ARCH_SUPPORTS_MSI
 207 +       select HAVE_UNSTABLE_SCHED_CLOCK
 208         select HAVE_IDE
 209         select HAVE_OPROFILE
 210         select HAVE_KPROBES
 211 @@ -478,8 +479,7 @@
 212         default y if VIRTUAL_MEM_MAP
 213
 214  config HAVE_ARCH_EARLY_PFN_TO_NID
 215 -       def_bool y
 216 -       depends on NEED_MULTIPLE_NODES
 217 +       def_bool NUMA && SPARSEMEM
 218
 219  config HAVE_ARCH_NODEDATA_EXTENSION
 220         def_bool y
 221 --- kernel-power-2.6.28.orig/arch/ia64/ia32/ia32_entry.S
 222 +++ kernel-power-2.6.28/arch/ia64/ia32/ia32_entry.S
 223 @@ -220,7 +220,7 @@
 224         data8 sys_mkdir
 225         data8 sys_rmdir           /* 40 */
 226         data8 sys_dup
 227 -       data8 sys_pipe
 228 +       data8 sys_ia64_pipe
 229         data8 compat_sys_times
 230         data8 sys_ni_syscall      /* old prof syscall holder */
 231         data8 sys32_brk           /* 45 */
 232 --- kernel-power-2.6.28.orig/arch/ia64/include/asm/mmzone.h
 233 +++ kernel-power-2.6.28/arch/ia64/include/asm/mmzone.h
 234 @@ -31,10 +31,6 @@
 235  #endif
 236  }
 237
 238 -#ifdef CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID
 239 -extern int early_pfn_to_nid(unsigned long pfn);
 240 -#endif
 241 -
 242  #ifdef CONFIG_IA64_DIG /* DIG systems are small */
 243  # define MAX_PHYSNODE_ID       8
 244  # define NR_NODE_MEMBLKS       (MAX_NUMNODES * 8)
 245 --- kernel-power-2.6.28.orig/arch/ia64/include/asm/unistd.h
 246 +++ kernel-power-2.6.28/arch/ia64/include/asm/unistd.h
 247 @@ -364,7 +364,7 @@
 248  struct sigaction;
 249  long sys_execve(char __user *filename, char __user * __user *argv,
 250                            char __user * __user *envp, struct pt_regs *regs);
 251 -asmlinkage long sys_pipe(void);
 252 +asmlinkage long sys_ia64_pipe(void);
 253  asmlinkage long sys_rt_sigaction(int sig,
 254                                  const struct sigaction __user *act,
 255                                  struct sigaction __user *oact,
 256 --- kernel-power-2.6.28.orig/arch/ia64/kernel/entry.S
 257 +++ kernel-power-2.6.28/arch/ia64/kernel/entry.S
 258 @@ -1442,7 +1442,7 @@
 259         data8 sys_mkdir                         // 1055
 260         data8 sys_rmdir
 261         data8 sys_dup
 262 -       data8 sys_pipe
 263 +       data8 sys_ia64_pipe
 264         data8 sys_times
 265         data8 ia64_brk                          // 1060
 266         data8 sys_setgid
 267 --- kernel-power-2.6.28.orig/arch/ia64/kernel/sys_ia64.c
 268 +++ kernel-power-2.6.28/arch/ia64/kernel/sys_ia64.c
 269 @@ -154,7 +154,7 @@
 270   * and r9) as this is faster than doing a copy_to_user().
 271   */
 272  asmlinkage long
 273 -sys_pipe (void)
 274 +sys_ia64_pipe (void)
 275  {
 276         struct pt_regs *regs = task_pt_regs(current);
 277         int fd[2];
 278 --- kernel-power-2.6.28.orig/arch/ia64/mm/numa.c
 279 +++ kernel-power-2.6.28/arch/ia64/mm/numa.c
 280 @@ -58,7 +58,7 @@
 281   * SPARSEMEM to allocate the SPARSEMEM sectionmap on the NUMA node where
 282   * the section resides.
 283   */
 284 -int early_pfn_to_nid(unsigned long pfn)
 285 +int __meminit __early_pfn_to_nid(unsigned long pfn)
 286  {
 287         int i, section = pfn >> PFN_SECTION_SHIFT, ssec, esec;
 288
 289 @@ -70,7 +70,7 @@
 290                         return node_memblk[i].nid;
 291         }
 292
 293 -       return 0;
 294 +       return -1;
 295  }
 296
 297  #ifdef CONFIG_MEMORY_HOTPLUG
 298 --- kernel-power-2.6.28.orig/arch/ia64/sn/kernel/io_acpi_init.c
 299 +++ kernel-power-2.6.28/arch/ia64/sn/kernel/io_acpi_init.c
 300 @@ -434,7 +434,7 @@
 301                 size = pci_resource_len(dev, PCI_ROM_RESOURCE);
 302                 addr = ioremap(pcidev_info->pdi_pio_mapped_addr[PCI_ROM_RESOURCE],
 303                                size);
 304 -               image_size = pci_get_rom_size(addr, size);
 305 +               image_size = pci_get_rom_size(dev, addr, size);
 306                 dev->resource[PCI_ROM_RESOURCE].start = (unsigned long) addr;
 307                 dev->resource[PCI_ROM_RESOURCE].end =
 308                                         (unsigned long) addr + image_size - 1;
 309 --- kernel-power-2.6.28.orig/arch/ia64/sn/kernel/io_init.c
 310 +++ kernel-power-2.6.28/arch/ia64/sn/kernel/io_init.c
 311 @@ -269,7 +269,7 @@
 312
 313                         rom = ioremap(pci_resource_start(dev, PCI_ROM_RESOURCE),
 314                                       size + 1);
 315 -                       image_size = pci_get_rom_size(rom, size + 1);
 316 +                       image_size = pci_get_rom_size(dev, rom, size + 1);
 317                         dev->resource[PCI_ROM_RESOURCE].end =
 318                                 dev->resource[PCI_ROM_RESOURCE].start +
 319                                 image_size - 1;
 320 --- kernel-power-2.6.28.orig/arch/m68k/kernel/entry.S
 321 +++ kernel-power-2.6.28/arch/m68k/kernel/entry.S
 322 @@ -513,7 +513,7 @@
 323         .long sys_uselib
 324         .long sys_swapon
 325         .long sys_reboot
 326 -       .long old_readdir
 327 +       .long sys_old_readdir
 328         .long old_mmap          /* 90 */
 329         .long sys_munmap
 330         .long sys_truncate
 331 --- kernel-power-2.6.28.orig/arch/m68knommu/Kconfig
 332 +++ kernel-power-2.6.28/arch/m68knommu/Kconfig
 333 @@ -14,6 +14,10 @@
 334         bool
 335         default n
 336
 337 +config NO_DMA
 338 +       bool
 339 +       default y
 340 +
 341  config FPU
 342         bool
 343         default n
 344 --- kernel-power-2.6.28.orig/arch/m68knommu/kernel/syscalltable.S
 345 +++ kernel-power-2.6.28/arch/m68knommu/kernel/syscalltable.S
 346 @@ -107,7 +107,7 @@
 347         .long sys_uselib
 348         .long sys_ni_syscall    /* sys_swapon */
 349         .long sys_reboot
 350 -       .long old_readdir
 351 +       .long sys_old_readdir
 352         .long old_mmap          /* 90 */
 353         .long sys_munmap
 354         .long sys_truncate
 355 --- kernel-power-2.6.28.orig/arch/mips/include/asm/compat.h
 356 +++ kernel-power-2.6.28/arch/mips/include/asm/compat.h
 357 @@ -3,6 +3,8 @@
 358  /*
 359   * Architecture specific compatibility types
 360   */
 361 +#include <linux/seccomp.h>
 362 +#include <linux/thread_info.h>
 363  #include <linux/types.h>
 364  #include <asm/page.h>
 365  #include <asm/ptrace.h>
 366 @@ -218,4 +220,9 @@
 367         compat_ulong_t  __unused2;
 368  };
 369
 370 +static inline int is_compat_task(void)
 371 +{
 372 +       return test_thread_flag(TIF_32BIT);
 373 +}
 374 +
 375  #endif /* _ASM_COMPAT_H */
 376 --- kernel-power-2.6.28.orig/arch/mips/include/asm/seccomp.h
 377 +++ kernel-power-2.6.28/arch/mips/include/asm/seccomp.h
 378 @@ -1,6 +1,5 @@
 379  #ifndef __ASM_SECCOMP_H
 380
 381 -#include <linux/thread_info.h>
 382  #include <linux/unistd.h>
 383
 384  #define __NR_seccomp_read __NR_read
 385 --- kernel-power-2.6.28.orig/arch/mips/kernel/scall32-o32.S
 386 +++ kernel-power-2.6.28/arch/mips/kernel/scall32-o32.S
 387 @@ -398,7 +398,7 @@
 388         sys     sys_uselib              1
 389         sys     sys_swapon              2
 390         sys     sys_reboot              3
 391 -       sys     old_readdir             3
 392 +       sys     sys_old_readdir         3
 393         sys     old_mmap                6       /* 4090 */
 394         sys     sys_munmap              2
 395         sys     sys_truncate            2
 396 --- kernel-power-2.6.28.orig/arch/mn10300/kernel/entry.S
 397 +++ kernel-power-2.6.28/arch/mn10300/kernel/entry.S
 398 @@ -478,7 +478,7 @@
 399         .long sys_uselib
 400         .long sys_swapon
 401         .long sys_reboot
 402 -       .long old_readdir
 403 +       .long sys_old_readdir
 404         .long old_mmap          /* 90 */
 405         .long sys_munmap
 406         .long sys_truncate
 407 --- kernel-power-2.6.28.orig/arch/powerpc/Kconfig
 408 +++ kernel-power-2.6.28/arch/powerpc/Kconfig
 409 @@ -121,6 +121,7 @@
 410         select HAVE_DMA_ATTRS if PPC64
 411         select USE_GENERIC_SMP_HELPERS if SMP
 412         select HAVE_OPROFILE
 413 +       select HAVE_SYSCALL_WRAPPERS if PPC64
 414
 415  config EARLY_PRINTK
 416         bool
 417 --- kernel-power-2.6.28.orig/arch/powerpc/include/asm/compat.h
 418 +++ kernel-power-2.6.28/arch/powerpc/include/asm/compat.h
 419 @@ -210,5 +210,10 @@
 420         compat_ulong_t __unused6;
 421  };
 422
 423 +static inline int is_compat_task(void)
 424 +{
 425 +       return test_thread_flag(TIF_32BIT);
 426 +}
 427 +
 428  #endif /* __KERNEL__ */
 429  #endif /* _ASM_POWERPC_COMPAT_H */
 430 --- kernel-power-2.6.28.orig/arch/powerpc/include/asm/futex.h
 431 +++ kernel-power-2.6.28/arch/powerpc/include/asm/futex.h
 432 @@ -27,7 +27,7 @@
 433         PPC_LONG "1b,4b,2b,4b\n" \
 434         ".previous" \
 435         : "=&r" (oldval), "=&r" (ret) \
 436 -       : "b" (uaddr), "i" (-EFAULT), "1" (oparg) \
 437 +       : "b" (uaddr), "i" (-EFAULT), "r" (oparg) \
 438         : "cr0", "memory")
 439
 440  static inline int futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
 441 @@ -47,19 +47,19 @@
 442
 443         switch (op) {
 444         case FUTEX_OP_SET:
 445 -               __futex_atomic_op("", ret, oldval, uaddr, oparg);
 446 +               __futex_atomic_op("mr %1,%4\n", ret, oldval, uaddr, oparg);
 447                 break;
 448         case FUTEX_OP_ADD:
 449 -               __futex_atomic_op("add %1,%0,%1\n", ret, oldval, uaddr, oparg);
 450 +               __futex_atomic_op("add %1,%0,%4\n", ret, oldval, uaddr, oparg);
 451                 break;
 452         case FUTEX_OP_OR:
 453 -               __futex_atomic_op("or %1,%0,%1\n", ret, oldval, uaddr, oparg);
 454 +               __futex_atomic_op("or %1,%0,%4\n", ret, oldval, uaddr, oparg);
 455                 break;
 456         case FUTEX_OP_ANDN:
 457 -               __futex_atomic_op("andc %1,%0,%1\n", ret, oldval, uaddr, oparg);
 458 +               __futex_atomic_op("andc %1,%0,%4\n", ret, oldval, uaddr, oparg);
 459                 break;
 460         case FUTEX_OP_XOR:
 461 -               __futex_atomic_op("xor %1,%0,%1\n", ret, oldval, uaddr, oparg);
 462 +               __futex_atomic_op("xor %1,%0,%4\n", ret, oldval, uaddr, oparg);
 463                 break;
 464         default:
 465                 ret = -ENOSYS;
 466 --- kernel-power-2.6.28.orig/arch/powerpc/include/asm/processor.h
 467 +++ kernel-power-2.6.28/arch/powerpc/include/asm/processor.h
 468 @@ -309,6 +309,25 @@
 469  #define HAVE_ARCH_PICK_MMAP_LAYOUT
 470  #endif
 471
 472 +#ifdef CONFIG_PPC64
 473 +static inline unsigned long get_clean_sp(struct pt_regs *regs, int is_32)
 474 +{
 475 +       unsigned long sp;
 476 +
 477 +       if (is_32)
 478 +               sp = regs->gpr[1] & 0x0ffffffffUL;
 479 +       else
 480 +               sp = regs->gpr[1];
 481 +
 482 +       return sp;
 483 +}
 484 +#else
 485 +static inline unsigned long get_clean_sp(struct pt_regs *regs, int is_32)
 486 +{
 487 +       return regs->gpr[1];
 488 +}
 489 +#endif
 490 +
 491  #endif /* __KERNEL__ */
 492  #endif /* __ASSEMBLY__ */
 493  #endif /* _ASM_POWERPC_PROCESSOR_H */
 494 --- kernel-power-2.6.28.orig/arch/powerpc/include/asm/seccomp.h
 495 +++ kernel-power-2.6.28/arch/powerpc/include/asm/seccomp.h
 496 @@ -1,10 +1,6 @@
 497  #ifndef _ASM_POWERPC_SECCOMP_H
 498  #define _ASM_POWERPC_SECCOMP_H
 499
 500 -#ifdef __KERNEL__
 501 -#include <linux/thread_info.h>
 502 -#endif
 503 -
 504  #include <linux/unistd.h>
 505
 506  #define __NR_seccomp_read __NR_read
 507 --- kernel-power-2.6.28.orig/arch/powerpc/include/asm/systbl.h
 508 +++ kernel-power-2.6.28/arch/powerpc/include/asm/systbl.h
 509 @@ -92,7 +92,7 @@
 510  SYSCALL(uselib)
 511  SYSCALL(swapon)
 512  SYSCALL(reboot)
 513 -SYSX(sys_ni_syscall,compat_sys_old_readdir,old_readdir)
 514 +SYSX(sys_ni_syscall,compat_sys_old_readdir,sys_old_readdir)
 515  SYSCALL_SPU(mmap)
 516  SYSCALL_SPU(munmap)
 517  SYSCALL_SPU(truncate)
 518 --- kernel-power-2.6.28.orig/arch/powerpc/kernel/align.c
 519 +++ kernel-power-2.6.28/arch/powerpc/kernel/align.c
 520 @@ -367,27 +367,24 @@
 521  static int emulate_fp_pair(unsigned char __user *addr, unsigned int reg,
 522                            unsigned int flags)
 523  {
 524 -       char *ptr = (char *) &current->thread.TS_FPR(reg);
 525 -       int i, ret;
 526 +       char *ptr0 = (char *) &current->thread.TS_FPR(reg);
 527 +       char *ptr1 = (char *) &current->thread.TS_FPR(reg+1);
 528 +       int i, ret, sw = 0;
 529
 530         if (!(flags & F))
 531                 return 0;
 532         if (reg & 1)
 533                 return 0;       /* invalid form: FRS/FRT must be even */
 534 -       if (!(flags & SW)) {
 535 -               /* not byte-swapped - easy */
 536 -               if (!(flags & ST))
 537 -                       ret = __copy_from_user(ptr, addr, 16);
 538 -               else
 539 -                       ret = __copy_to_user(addr, ptr, 16);
 540 -       } else {
 541 -               /* each FPR value is byte-swapped separately */
 542 -               ret = 0;
 543 -               for (i = 0; i < 16; ++i) {
 544 -                       if (!(flags & ST))
 545 -                               ret |= __get_user(ptr[i^7], addr + i);
 546 -                       else
 547 -                               ret |= __put_user(ptr[i^7], addr + i);
 548 +       if (flags & SW)
 549 +               sw = 7;
 550 +       ret = 0;
 551 +       for (i = 0; i < 8; ++i) {
 552 +               if (!(flags & ST)) {
 553 +                       ret |= __get_user(ptr0[i^sw], addr + i);
 554 +                       ret |= __get_user(ptr1[i^sw], addr + i + 8);
 555 +               } else {
 556 +                       ret |= __put_user(ptr0[i^sw], addr + i);
 557 +                       ret |= __put_user(ptr1[i^sw], addr + i + 8);
 558                 }
 559         }
 560         if (ret)
 561 @@ -646,11 +643,16 @@
 562                        unsigned int areg, struct pt_regs *regs,
 563                        unsigned int flags, unsigned int length)
 564  {
 565 -       char *ptr = (char *) &current->thread.TS_FPR(reg);
 566 +       char *ptr;
 567         int ret = 0;
 568
 569         flush_vsx_to_thread(current);
 570
 571 +       if (reg < 32)
 572 +               ptr = (char *) &current->thread.TS_FPR(reg);
 573 +       else
 574 +               ptr = (char *) &current->thread.vr[reg - 32];
 575 +
 576         if (flags & ST)
 577                 ret = __copy_to_user(addr, ptr, length);
 578          else {
 579 --- kernel-power-2.6.28.orig/arch/powerpc/kernel/signal.c
 580 +++ kernel-power-2.6.28/arch/powerpc/kernel/signal.c
 581 @@ -26,12 +26,12 @@
 582   * Allocate space for the signal frame
 583   */
 584  void __user * get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
 585 -                          size_t frame_size)
 586 +                          size_t frame_size, int is_32)
 587  {
 588          unsigned long oldsp, newsp;
 589
 590          /* Default to using normal stack */
 591 -        oldsp = regs->gpr[1];
 592 +        oldsp = get_clean_sp(regs, is_32);
 593
 594         /* Check for alt stack */
 595         if ((ka->sa.sa_flags & SA_ONSTACK) &&
 596 --- kernel-power-2.6.28.orig/arch/powerpc/kernel/signal.h
 597 +++ kernel-power-2.6.28/arch/powerpc/kernel/signal.h
 598 @@ -15,7 +15,7 @@
 599  extern void do_signal(struct pt_regs *regs, unsigned long thread_info_flags);
 600
 601  extern void __user * get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
 602 -                                 size_t frame_size);
 603 +                                 size_t frame_size, int is_32);
 604  extern void restore_sigmask(sigset_t *set);
 605
 606  extern int handle_signal32(unsigned long sig, struct k_sigaction *ka,
 607 --- kernel-power-2.6.28.orig/arch/powerpc/kernel/signal_32.c
 608 +++ kernel-power-2.6.28/arch/powerpc/kernel/signal_32.c
 609 @@ -836,7 +836,7 @@
 610
 611         /* Set up Signal Frame */
 612         /* Put a Real Time Context onto stack */
 613 -       rt_sf = get_sigframe(ka, regs, sizeof(*rt_sf));
 614 +       rt_sf = get_sigframe(ka, regs, sizeof(*rt_sf), 1);
 615         addr = rt_sf;
 616         if (unlikely(rt_sf == NULL))
 617                 goto badframe;
 618 @@ -1182,7 +1182,7 @@
 619         unsigned long newsp = 0;
 620
 621         /* Set up Signal Frame */
 622 -       frame = get_sigframe(ka, regs, sizeof(*frame));
 623 +       frame = get_sigframe(ka, regs, sizeof(*frame), 1);
 624         if (unlikely(frame == NULL))
 625                 goto badframe;
 626         sc = (struct sigcontext __user *) &frame->sctx;
 627 --- kernel-power-2.6.28.orig/arch/powerpc/kernel/signal_64.c
 628 +++ kernel-power-2.6.28/arch/powerpc/kernel/signal_64.c
 629 @@ -402,7 +402,7 @@
 630         unsigned long newsp = 0;
 631         long err = 0;
 632
 633 -       frame = get_sigframe(ka, regs, sizeof(*frame));
 634 +       frame = get_sigframe(ka, regs, sizeof(*frame), 0);
 635         if (unlikely(frame == NULL))
 636                 goto badframe;
 637
 638 --- kernel-power-2.6.28.orig/arch/powerpc/mm/fsl_booke_mmu.c
 639 +++ kernel-power-2.6.28/arch/powerpc/mm/fsl_booke_mmu.c
 640 @@ -80,7 +80,7 @@
 641  /*
 642   * Return PA for this VA if it is mapped by a CAM, or 0
 643   */
 644 -unsigned long v_mapped_by_tlbcam(unsigned long va)
 645 +phys_addr_t v_mapped_by_tlbcam(unsigned long va)
 646  {
 647         int b;
 648         for (b = 0; b < tlbcam_index; ++b)
 649 @@ -92,7 +92,7 @@
 650  /*
 651   * Return VA for a given PA or 0 if not mapped
 652   */
 653 -unsigned long p_mapped_by_tlbcam(unsigned long pa)
 654 +unsigned long p_mapped_by_tlbcam(phys_addr_t pa)
 655  {
 656         int b;
 657         for (b = 0; b < tlbcam_index; ++b)
 658 --- kernel-power-2.6.28.orig/arch/powerpc/mm/pgtable_32.c
 659 +++ kernel-power-2.6.28/arch/powerpc/mm/pgtable_32.c
 660 @@ -65,8 +65,8 @@
 661
 662  #ifdef HAVE_TLBCAM
 663  extern unsigned int tlbcam_index;
 664 -extern unsigned long v_mapped_by_tlbcam(unsigned long va);
 665 -extern unsigned long p_mapped_by_tlbcam(unsigned long pa);
 666 +extern phys_addr_t v_mapped_by_tlbcam(unsigned long va);
 667 +extern unsigned long p_mapped_by_tlbcam(phys_addr_t pa);
 668  #else /* !HAVE_TLBCAM */
 669  #define v_mapped_by_tlbcam(x)  (0UL)
 670  #define p_mapped_by_tlbcam(x)  (0UL)
 671 --- kernel-power-2.6.28.orig/arch/powerpc/mm/slice.c
 672 +++ kernel-power-2.6.28/arch/powerpc/mm/slice.c
 673 @@ -710,9 +710,18 @@
 674                            unsigned long len)
 675  {
 676         struct slice_mask mask, available;
 677 +       unsigned int psize = mm->context.user_psize;
 678
 679         mask = slice_range_to_mask(addr, len);
 680 -       available = slice_mask_for_size(mm, mm->context.user_psize);
 681 +       available = slice_mask_for_size(mm, psize);
 682 +#ifdef CONFIG_PPC_64K_PAGES
 683 +       /* We need to account for 4k slices too */
 684 +       if (psize == MMU_PAGE_64K) {
 685 +               struct slice_mask compat_mask;
 686 +               compat_mask = slice_mask_for_size(mm, MMU_PAGE_4K);
 687 +               or_mask(available, compat_mask);
 688 +       }
 689 +#endif
 690
 691  #if 0 /* too verbose */
 692         slice_dbg("is_hugepage_only_range(mm=%p, addr=%lx, len=%lx)\n",
 693 --- kernel-power-2.6.28.orig/arch/powerpc/platforms/pseries/Kconfig
 694 +++ kernel-power-2.6.28/arch/powerpc/platforms/pseries/Kconfig
 695 @@ -54,7 +54,7 @@
 696
 697  config CMM
 698         tristate "Collaborative memory management"
 699 -       depends on PPC_SMLPAR
 700 +       depends on PPC_SMLPAR && !CRASH_DUMP
 701         default y
 702         help
 703           Select this option, if you want to enable the kernel interface
 704 --- kernel-power-2.6.28.orig/arch/powerpc/sysdev/fsl_soc.c
 705 +++ kernel-power-2.6.28/arch/powerpc/sysdev/fsl_soc.c
 706 @@ -257,7 +257,7 @@
 707                 gfar_mdio_of_init_one(np);
 708
 709         /* try the deprecated version */
 710 -       for_each_compatible_node(np, "mdio", "gianfar");
 711 +       for_each_compatible_node(np, "mdio", "gianfar")
 712                 gfar_mdio_of_init_one(np);
 713
 714         return 0;
 715 --- kernel-power-2.6.28.orig/arch/s390/Kconfig
 716 +++ kernel-power-2.6.28/arch/s390/Kconfig
 717 @@ -70,6 +70,7 @@
 718
 719  config S390
 720         def_bool y
 721 +       select HAVE_SYSCALL_WRAPPERS
 722         select HAVE_OPROFILE
 723         select HAVE_KPROBES
 724         select HAVE_KRETPROBES
 725 --- kernel-power-2.6.28.orig/arch/s390/kernel/compat_wrapper.S
 726 +++ kernel-power-2.6.28/arch/s390/kernel/compat_wrapper.S
 727 @@ -547,7 +547,7 @@
 728         .globl  sys32_newuname_wrapper
 729  sys32_newuname_wrapper:
 730         llgtr   %r2,%r2                 # struct new_utsname *
 731 -       jg      s390x_newuname          # branch to system call
 732 +       jg      sys_s390_newuname       # branch to system call
 733
 734         .globl  compat_sys_adjtimex_wrapper
 735  compat_sys_adjtimex_wrapper:
 736 @@ -615,7 +615,7 @@
 737         .globl  sys32_personality_wrapper
 738  sys32_personality_wrapper:
 739         llgfr   %r2,%r2                 # unsigned long
 740 -       jg      s390x_personality       # branch to system call
 741 +       jg      sys_s390_personality    # branch to system call
 742
 743         .globl  sys32_setfsuid16_wrapper
 744  sys32_setfsuid16_wrapper:
 745 --- kernel-power-2.6.28.orig/arch/s390/kernel/entry.h
 746 +++ kernel-power-2.6.28/arch/s390/kernel/entry.h
 747 @@ -30,23 +30,23 @@
 748  struct old_sigaction;
 749  struct sel_arg_struct;
 750
 751 -long sys_pipe(unsigned long __user *fildes);
 752  long sys_mmap2(struct mmap_arg_struct __user  *arg);
 753 -long old_mmap(struct mmap_arg_struct __user *arg);
 754 +long sys_s390_old_mmap(struct mmap_arg_struct __user *arg);
 755  long sys_ipc(uint call, int first, unsigned long second,
 756              unsigned long third, void __user *ptr);
 757 -long s390x_newuname(struct new_utsname __user *name);
 758 -long s390x_personality(unsigned long personality);
 759 -long s390_fadvise64(int fd, u32 offset_high, u32 offset_low,
 760 +long sys_s390_newuname(struct new_utsname __user *name);
 761 +long sys_s390_personality(unsigned long personality);
 762 +long sys_s390_fadvise64(int fd, u32 offset_high, u32 offset_low,
 763                     size_t len, int advice);
 764 -long s390_fadvise64_64(struct fadvise64_64_args __user *args);
 765 -long s390_fallocate(int fd, int mode, loff_t offset, u32 len_high, u32 len_low);
 766 +long sys_s390_fadvise64_64(struct fadvise64_64_args __user *args);
 767 +long sys_s390_fallocate(int fd, int mode, loff_t offset, u32 len_high,
 768 +                       u32 len_low);
 769  long sys_fork(void);
 770  long sys_clone(void);
 771  long sys_vfork(void);
 772  void execve_tail(void);
 773  long sys_execve(void);
 774 -int sys_sigsuspend(int history0, int history1, old_sigset_t mask);
 775 +long sys_sigsuspend(int history0, int history1, old_sigset_t mask);
 776  long sys_sigaction(int sig, const struct old_sigaction __user *act,
 777                    struct old_sigaction __user *oact);
 778  long sys_sigaltstack(const stack_t __user *uss, stack_t __user *uoss);
 779 --- kernel-power-2.6.28.orig/arch/s390/kernel/process.c
 780 +++ kernel-power-2.6.28/arch/s390/kernel/process.c
 781 @@ -38,6 +38,7 @@
 782  #include <linux/utsname.h>
 783  #include <linux/tick.h>
 784  #include <linux/elfcore.h>
 785 +#include <linux/syscalls.h>
 786  #include <asm/uaccess.h>
 787  #include <asm/pgtable.h>
 788  #include <asm/system.h>
 789 @@ -260,13 +261,13 @@
 790          return 0;
 791  }
 792
 793 -asmlinkage long sys_fork(void)
 794 +SYSCALL_DEFINE0(fork)
 795  {
 796         struct pt_regs *regs = task_pt_regs(current);
 797         return do_fork(SIGCHLD, regs->gprs[15], regs, 0, NULL, NULL);
 798  }
 799
 800 -asmlinkage long sys_clone(void)
 801 +SYSCALL_DEFINE0(clone)
 802  {
 803         struct pt_regs *regs = task_pt_regs(current);
 804         unsigned long clone_flags;
 805 @@ -293,7 +294,7 @@
 806   * do not have enough call-clobbered registers to hold all
 807   * the information you need.
 808   */
 809 -asmlinkage long sys_vfork(void)
 810 +SYSCALL_DEFINE0(vfork)
 811  {
 812         struct pt_regs *regs = task_pt_regs(current);
 813         return do_fork(CLONE_VFORK | CLONE_VM | SIGCHLD,
 814 @@ -313,7 +314,7 @@
 815  /*
 816   * sys_execve() executes a new program.
 817   */
 818 -asmlinkage long sys_execve(void)
 819 +SYSCALL_DEFINE0(execve)
 820  {
 821         struct pt_regs *regs = task_pt_regs(current);
 822         char *filename;
 823 --- kernel-power-2.6.28.orig/arch/s390/kernel/signal.c
 824 +++ kernel-power-2.6.28/arch/s390/kernel/signal.c
 825 @@ -25,6 +25,7 @@
 826  #include <linux/personality.h>
 827  #include <linux/binfmts.h>
 828  #include <linux/tracehook.h>
 829 +#include <linux/syscalls.h>
 830  #include <asm/ucontext.h>
 831  #include <asm/uaccess.h>
 832  #include <asm/lowcore.h>
 833 @@ -53,8 +54,7 @@
 834  /*
 835   * Atomically swap in the new signal mask, and wait for a signal.
 836   */
 837 -asmlinkage int
 838 -sys_sigsuspend(int history0, int history1, old_sigset_t mask)
 839 +SYSCALL_DEFINE3(sigsuspend, int, history0, int, history1, old_sigset_t, mask)
 840  {
 841         mask &= _BLOCKABLE;
 842         spin_lock_irq(&current->sighand->siglock);
 843 @@ -70,9 +70,8 @@
 844         return -ERESTARTNOHAND;
 845  }
 846
 847 -asmlinkage long
 848 -sys_sigaction(int sig, const struct old_sigaction __user *act,
 849 -             struct old_sigaction __user *oact)
 850 +SYSCALL_DEFINE3(sigaction, int, sig, const struct old_sigaction __user *, act,
 851 +               struct old_sigaction __user *, oact)
 852  {
 853         struct k_sigaction new_ka, old_ka;
 854         int ret;
 855 @@ -102,15 +101,13 @@
 856         return ret;
 857  }
 858
 859 -asmlinkage long
 860 -sys_sigaltstack(const stack_t __user *uss, stack_t __user *uoss)
 861 +SYSCALL_DEFINE2(sigaltstack, const stack_t __user *, uss,
 862 +               stack_t __user *, uoss)
 863  {
 864         struct pt_regs *regs = task_pt_regs(current);
 865         return do_sigaltstack(uss, uoss, regs->gprs[15]);
 866  }
 867
 868 -
 869 -
 870  /* Returns non-zero on fault. */
 871  static int save_sigregs(struct pt_regs *regs, _sigregs __user *sregs)
 872  {
 873 @@ -164,7 +161,7 @@
 874         return 0;
 875  }
 876
 877 -asmlinkage long sys_sigreturn(void)
 878 +SYSCALL_DEFINE0(sigreturn)
 879  {
 880         struct pt_regs *regs = task_pt_regs(current);
 881         sigframe __user *frame = (sigframe __user *)regs->gprs[15];
 882 @@ -191,7 +188,7 @@
 883         return 0;
 884  }
 885
 886 -asmlinkage long sys_rt_sigreturn(void)
 887 +SYSCALL_DEFINE0(rt_sigreturn)
 888  {
 889         struct pt_regs *regs = task_pt_regs(current);
 890         rt_sigframe __user *frame = (rt_sigframe __user *)regs->gprs[15];
 891 --- kernel-power-2.6.28.orig/arch/s390/kernel/sys_s390.c
 892 +++ kernel-power-2.6.28/arch/s390/kernel/sys_s390.c
 893 @@ -29,6 +29,7 @@
 894  #include <linux/personality.h>
 895  #include <linux/unistd.h>
 896  #include <linux/ipc.h>
 897 +#include <linux/syscalls.h>
 898  #include <asm/uaccess.h>
 899  #include "entry.h"
 900
 901 @@ -74,7 +75,7 @@
 902         unsigned long offset;
 903  };
 904
 905 -asmlinkage long sys_mmap2(struct mmap_arg_struct __user  *arg)
 906 +SYSCALL_DEFINE1(mmap2, struct mmap_arg_struct __user *, arg)
 907  {
 908         struct mmap_arg_struct a;
 909         int error = -EFAULT;
 910 @@ -86,7 +87,7 @@
 911         return error;
 912  }
 913
 914 -asmlinkage long old_mmap(struct mmap_arg_struct __user *arg)
 915 +SYSCALL_DEFINE1(s390_old_mmap, struct mmap_arg_struct __user *, arg)
 916  {
 917         struct mmap_arg_struct a;
 918         long error = -EFAULT;
 919 @@ -127,8 +128,8 @@
 920   *
 921   * This is really horribly ugly.
 922   */
 923 -asmlinkage long sys_ipc(uint call, int first, unsigned long second,
 924 -                                 unsigned long third, void __user *ptr)
 925 +SYSCALL_DEFINE5(ipc, uint, call, int, first, unsigned long, second,
 926 +               unsigned long, third, void __user *, ptr)
 927  {
 928          struct ipc_kludge tmp;
 929         int ret;
 930 @@ -194,7 +195,7 @@
 931  }
 932
 933  #ifdef CONFIG_64BIT
 934 -asmlinkage long s390x_newuname(struct new_utsname __user *name)
 935 +SYSCALL_DEFINE1(s390_newuname, struct new_utsname __user *, name)
 936  {
 937         int ret = sys_newuname(name);
 938
 939 @@ -205,7 +206,7 @@
 940         return ret;
 941  }
 942
 943 -asmlinkage long s390x_personality(unsigned long personality)
 944 +SYSCALL_DEFINE1(s390_personality, unsigned long, personality)
 945  {
 946         int ret;
 947
 948 @@ -224,15 +225,13 @@
 949   */
 950  #ifndef CONFIG_64BIT
 951
 952 -asmlinkage long
 953 -s390_fadvise64(int fd, u32 offset_high, u32 offset_low, size_t len, int advice)
 954 +SYSCALL_DEFINE5(s390_fadvise64, int, fd, u32, offset_high, u32, offset_low,
 955 +               size_t, len, int, advice)
 956  {
 957         return sys_fadvise64(fd, (u64) offset_high << 32 | offset_low,
 958                         len, advice);
 959  }
 960
 961 -#endif
 962 -
 963  struct fadvise64_64_args {
 964         int fd;
 965         long long offset;
 966 @@ -240,8 +239,7 @@
 967         int advice;
 968  };
 969
 970 -asmlinkage long
 971 -s390_fadvise64_64(struct fadvise64_64_args __user *args)
 972 +SYSCALL_DEFINE1(s390_fadvise64_64, struct fadvise64_64_args __user *, args)
 973  {
 974         struct fadvise64_64_args a;
 975
 976 @@ -250,7 +248,6 @@
 977         return sys_fadvise64_64(a.fd, a.offset, a.len, a.advice);
 978  }
 979
 980 -#ifndef CONFIG_64BIT
 981  /*
 982   * This is a wrapper to call sys_fallocate(). For 31 bit s390 the last
 983   * 64 bit argument "len" is split into the upper and lower 32 bits. The
 984 @@ -263,9 +260,19 @@
 985   * to
 986   *   %r2: fd, %r3: mode, %r4/%r5: offset, 96(%r15)-103(%r15): len
 987   */
 988 -asmlinkage long s390_fallocate(int fd, int mode, loff_t offset,
 989 +SYSCALL_DEFINE(s390_fallocate)(int fd, int mode, loff_t offset,
 990                                u32 len_high, u32 len_low)
 991  {
 992         return sys_fallocate(fd, mode, offset, ((u64)len_high << 32) | len_low);
 993  }
 994 +#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
 995 +asmlinkage long SyS_s390_fallocate(long fd, long mode, loff_t offset,
 996 +                                  long len_high, long len_low)
 997 +{
 998 +       return SYSC_s390_fallocate((int) fd, (int) mode, offset,
 999 +                                  (u32) len_high, (u32) len_low);
1000 +}
1001 +SYSCALL_ALIAS(sys_s390_fallocate, SyS_s390_fallocate);
1002 +#endif
1003 +
1004  #endif
1005 --- kernel-power-2.6.28.orig/arch/s390/kernel/syscalls.S
1006 +++ kernel-power-2.6.28/arch/s390/kernel/syscalls.S
1007 @@ -98,7 +98,7 @@
1008  SYSCALL(sys_swapon,sys_swapon,sys32_swapon_wrapper)
1009  SYSCALL(sys_reboot,sys_reboot,sys32_reboot_wrapper)
1010  SYSCALL(sys_ni_syscall,sys_ni_syscall,old32_readdir_wrapper)   /* old readdir syscall */
1011 -SYSCALL(old_mmap,old_mmap,old32_mmap_wrapper)                  /* 90 */
1012 +SYSCALL(sys_s390_old_mmap,sys_s390_old_mmap,old32_mmap_wrapper)        /* 90 */
1013  SYSCALL(sys_munmap,sys_munmap,sys32_munmap_wrapper)
1014  SYSCALL(sys_truncate,sys_truncate,sys32_truncate_wrapper)
1015  SYSCALL(sys_ftruncate,sys_ftruncate,sys32_ftruncate_wrapper)
1016 @@ -130,7 +130,7 @@
1017  SYSCALL(sys_sigreturn,sys_sigreturn,sys32_sigreturn)
1018  SYSCALL(sys_clone,sys_clone,sys32_clone)                       /* 120 */
1019  SYSCALL(sys_setdomainname,sys_setdomainname,sys32_setdomainname_wrapper)
1020 -SYSCALL(sys_newuname,s390x_newuname,sys32_newuname_wrapper)
1021 +SYSCALL(sys_newuname,sys_s390_newuname,sys32_newuname_wrapper)
1022  NI_SYSCALL                                                     /* modify_ldt for i386 */
1023  SYSCALL(sys_adjtimex,sys_adjtimex,compat_sys_adjtimex_wrapper)
1024  SYSCALL(sys_mprotect,sys_mprotect,sys32_mprotect_wrapper)      /* 125 */
1025 @@ -144,7 +144,7 @@
1026  SYSCALL(sys_fchdir,sys_fchdir,sys32_fchdir_wrapper)
1027  SYSCALL(sys_bdflush,sys_bdflush,sys32_bdflush_wrapper)
1028  SYSCALL(sys_sysfs,sys_sysfs,sys32_sysfs_wrapper)               /* 135 */
1029 -SYSCALL(sys_personality,s390x_personality,sys32_personality_wrapper)
1030 +SYSCALL(sys_personality,sys_s390_personality,sys32_personality_wrapper)
1031  NI_SYSCALL                                                     /* for afs_syscall */
1032  SYSCALL(sys_setfsuid16,sys_ni_syscall,sys32_setfsuid16_wrapper)        /* old setfsuid16 syscall */
1033  SYSCALL(sys_setfsgid16,sys_ni_syscall,sys32_setfsgid16_wrapper)        /* old setfsgid16 syscall */
1034 @@ -261,7 +261,7 @@
1035  SYSCALL(sys_epoll_ctl,sys_epoll_ctl,sys_epoll_ctl_wrapper)     /* 250 */
1036  SYSCALL(sys_epoll_wait,sys_epoll_wait,sys_epoll_wait_wrapper)
1037  SYSCALL(sys_set_tid_address,sys_set_tid_address,sys32_set_tid_address_wrapper)
1038 -SYSCALL(s390_fadvise64,sys_fadvise64_64,sys32_fadvise64_wrapper)
1039 +SYSCALL(sys_s390_fadvise64,sys_fadvise64_64,sys32_fadvise64_wrapper)
1040  SYSCALL(sys_timer_create,sys_timer_create,sys32_timer_create_wrapper)
1041  SYSCALL(sys_timer_settime,sys_timer_settime,sys32_timer_settime_wrapper)       /* 255 */
1042  SYSCALL(sys_timer_gettime,sys_timer_gettime,sys32_timer_gettime_wrapper)
1043 @@ -272,7 +272,7 @@
1044  SYSCALL(sys_clock_getres,sys_clock_getres,sys32_clock_getres_wrapper)
1045  SYSCALL(sys_clock_nanosleep,sys_clock_nanosleep,sys32_clock_nanosleep_wrapper)
1046  NI_SYSCALL                                                     /* reserved for vserver */
1047 -SYSCALL(s390_fadvise64_64,sys_ni_syscall,sys32_fadvise64_64_wrapper)
1048 +SYSCALL(sys_s390_fadvise64_64,sys_ni_syscall,sys32_fadvise64_64_wrapper)
1049  SYSCALL(sys_statfs64,sys_statfs64,compat_sys_statfs64_wrapper)
1050  SYSCALL(sys_fstatfs64,sys_fstatfs64,compat_sys_fstatfs64_wrapper)
1051  SYSCALL(sys_remap_file_pages,sys_remap_file_pages,sys32_remap_file_pages_wrapper)
1052 @@ -322,7 +322,7 @@
1053  SYSCALL(sys_getcpu,sys_getcpu,sys_getcpu_wrapper)
1054  SYSCALL(sys_epoll_pwait,sys_epoll_pwait,compat_sys_epoll_pwait_wrapper)
1055  SYSCALL(sys_utimes,sys_utimes,compat_sys_utimes_wrapper)
1056 -SYSCALL(s390_fallocate,sys_fallocate,sys_fallocate_wrapper)
1057 +SYSCALL(sys_s390_fallocate,sys_fallocate,sys_fallocate_wrapper)
1058  SYSCALL(sys_utimensat,sys_utimensat,compat_sys_utimensat_wrapper)      /* 315 */
1059  SYSCALL(sys_signalfd,sys_signalfd,compat_sys_signalfd_wrapper)
1060  NI_SYSCALL                                             /* 317 old sys_timer_fd */
1061 --- kernel-power-2.6.28.orig/arch/s390/lib/div64.c
1062 +++ kernel-power-2.6.28/arch/s390/lib/div64.c
1063 @@ -61,7 +61,7 @@
1064                 "       clr     %0,%3\n"
1065                 "       jl      0f\n"
1066                 "       slr     %0,%3\n"
1067 -               "       alr     %1,%2\n"
1068 +               "       ahi     %1,1\n"
1069                 "0:\n"
1070                 : "+d" (reg2), "+d" (reg3), "=d" (tmp)
1071                 : "d" (base), "2" (1UL) : "cc" );
1072 --- kernel-power-2.6.28.orig/arch/sh/include/asm/syscalls_32.h
1073 +++ kernel-power-2.6.28/arch/sh/include/asm/syscalls_32.h
1074 @@ -36,9 +36,9 @@
1075  asmlinkage int sys_rt_sigreturn(unsigned long r4, unsigned long r5,
1076                                 unsigned long r6, unsigned long r7,
1077                                 struct pt_regs __regs);
1078 -asmlinkage int sys_pipe(unsigned long r4, unsigned long r5,
1079 -                       unsigned long r6, unsigned long r7,
1080 -                       struct pt_regs __regs);
1081 +asmlinkage int sys_sh_pipe(unsigned long r4, unsigned long r5,
1082 +                          unsigned long r6, unsigned long r7,
1083 +                          struct pt_regs __regs);
1084  asmlinkage ssize_t sys_pread_wrapper(unsigned int fd, char __user *buf,
1085                                      size_t count, long dummy, loff_t pos);
1086  asmlinkage ssize_t sys_pwrite_wrapper(unsigned int fd, const char __user *buf,
1087 --- kernel-power-2.6.28.orig/arch/sh/kernel/sys_sh32.c
1088 +++ kernel-power-2.6.28/arch/sh/kernel/sys_sh32.c
1089 @@ -22,7 +22,7 @@
1090   * sys_pipe() is the normal C calling standard for creating
1091   * a pipe. It's not the way Unix traditionally does this, though.
1092   */
1093 -asmlinkage int sys_pipe(unsigned long r4, unsigned long r5,
1094 +asmlinkage int sys_sh_pipe(unsigned long r4, unsigned long r5,
1095         unsigned long r6, unsigned long r7,
1096         struct pt_regs __regs)
1097  {
1098 --- kernel-power-2.6.28.orig/arch/sh/kernel/syscalls_32.S
1099 +++ kernel-power-2.6.28/arch/sh/kernel/syscalls_32.S
1100 @@ -58,7 +58,7 @@
1101         .long sys_mkdir
1102         .long sys_rmdir         /* 40 */
1103         .long sys_dup
1104 -       .long sys_pipe
1105 +       .long sys_sh_pipe
1106         .long sys_times
1107         .long sys_ni_syscall    /* old prof syscall holder */
1108         .long sys_brk           /* 45 */
1109 @@ -105,7 +105,7 @@
1110         .long sys_uselib
1111         .long sys_swapon
1112         .long sys_reboot
1113 -       .long old_readdir
1114 +       .long sys_old_readdir
1115         .long old_mmap          /* 90 */
1116         .long sys_munmap
1117         .long sys_truncate
1118 --- kernel-power-2.6.28.orig/arch/sh/kernel/syscalls_64.S
1119 +++ kernel-power-2.6.28/arch/sh/kernel/syscalls_64.S
1120 @@ -109,7 +109,7 @@
1121         .long sys_uselib
1122         .long sys_swapon
1123         .long sys_reboot
1124 -       .long old_readdir
1125 +       .long sys_old_readdir
1126         .long old_mmap                  /* 90 */
1127         .long sys_munmap
1128         .long sys_truncate
1129 --- kernel-power-2.6.28.orig/arch/sparc/include/asm/compat.h
1130 +++ kernel-power-2.6.28/arch/sparc/include/asm/compat.h
1131 @@ -240,4 +240,9 @@
1132         unsigned int    __unused2;
1133  };
1134
1135 +static inline int is_compat_task(void)
1136 +{
1137 +       return test_thread_flag(TIF_32BIT);
1138 +}
1139 +
1140  #endif /* _ASM_SPARC64_COMPAT_H */
1141 --- kernel-power-2.6.28.orig/arch/sparc/include/asm/seccomp.h
1142 +++ kernel-power-2.6.28/arch/sparc/include/asm/seccomp.h
1143 @@ -1,11 +1,5 @@
1144  #ifndef _ASM_SECCOMP_H
1145
1146 -#include <linux/thread_info.h> /* already defines TIF_32BIT */
1147 -
1148 -#ifndef TIF_32BIT
1149 -#error "unexpected TIF_32BIT on sparc64"
1150 -#endif
1151 -
1152  #include <linux/unistd.h>
1153
1154  #define __NR_seccomp_read __NR_read
1155 --- kernel-power-2.6.28.orig/arch/sparc/kernel/entry.S
1156 +++ kernel-power-2.6.28/arch/sparc/kernel/entry.S
1157 @@ -1088,8 +1088,8 @@
1158          ld     [%sp + STACKFRAME_SZ + PT_I0], %o0
1159
1160         .align  4
1161 -       .globl  sys_pipe
1162 -sys_pipe:
1163 +       .globl  sys_sparc_pipe
1164 +sys_sparc_pipe:
1165         mov     %o7, %l5
1166         add     %sp, STACKFRAME_SZ, %o0         ! pt_regs *regs arg
1167         call    sparc_pipe
1168 --- kernel-power-2.6.28.orig/arch/sparc/kernel/systbls.S
1169 +++ kernel-power-2.6.28/arch/sparc/kernel/systbls.S
1170 @@ -24,7 +24,7 @@
1171  /*25*/ .long sys_vmsplice, sys_ptrace, sys_alarm, sys_sigaltstack, sys_pause
1172  /*30*/ .long sys_utime, sys_lchown, sys_fchown, sys_access, sys_nice
1173  /*35*/ .long sys_chown, sys_sync, sys_kill, sys_newstat, sys_sendfile
1174 -/*40*/ .long sys_newlstat, sys_dup, sys_pipe, sys_times, sys_getuid
1175 +/*40*/ .long sys_newlstat, sys_dup, sys_sparc_pipe, sys_times, sys_getuid
1176  /*45*/ .long sys_umount, sys_setgid16, sys_getgid16, sys_signal, sys_geteuid16
1177  /*50*/ .long sys_getegid16, sys_acct, sys_nis_syscall, sys_getgid, sys_ioctl
1178  /*55*/ .long sys_reboot, sys_mmap2, sys_symlink, sys_readlink, sys_execve
1179 @@ -56,7 +56,7 @@
1180  /*185*/        .long sys_setpgid, sys_fremovexattr, sys_tkill, sys_exit_group, sys_newuname
1181  /*190*/        .long sys_init_module, sys_personality, sparc_remap_file_pages, sys_epoll_create, sys_epoll_ctl
1182  /*195*/        .long sys_epoll_wait, sys_ioprio_set, sys_getppid, sparc_sigaction, sys_sgetmask
1183 -/*200*/        .long sys_ssetmask, sys_sigsuspend, sys_newlstat, sys_uselib, old_readdir
1184 +/*200*/        .long sys_ssetmask, sys_sigsuspend, sys_newlstat, sys_uselib, sys_old_readdir
1185  /*205*/        .long sys_readahead, sys_socketcall, sys_syslog, sys_lookup_dcookie, sys_fadvise64
1186  /*210*/        .long sys_fadvise64_64, sys_tgkill, sys_waitpid, sys_swapoff, sys_sysinfo
1187  /*215*/        .long sys_ipc, sys_sigreturn, sys_clone, sys_ioprio_get, sys_adjtimex
1188 --- kernel-power-2.6.28.orig/arch/sparc64/Kconfig
1189 +++ kernel-power-2.6.28/arch/sparc64/Kconfig
1190 @@ -14,6 +14,7 @@
1191         select HAVE_FUNCTION_TRACER
1192         select HAVE_IDE
1193         select HAVE_LMB
1194 +       select HAVE_SYSCALL_WRAPPERS
1195         select HAVE_ARCH_KGDB
1196         select USE_GENERIC_SMP_HELPERS if SMP
1197         select HAVE_ARCH_TRACEHOOK
1198 --- kernel-power-2.6.28.orig/arch/sparc64/kernel/chmc.c
1199 +++ kernel-power-2.6.28/arch/sparc64/kernel/chmc.c
1200 @@ -306,6 +306,7 @@
1201                 buf[1] = '?';
1202                 buf[2] = '?';
1203                 buf[3] = '\0';
1204 +               return 0;
1205         }
1206         p = dp->controller;
1207         prop = &p->layout;
1208 --- kernel-power-2.6.28.orig/arch/sparc64/kernel/sys_sparc.c
1209 +++ kernel-power-2.6.28/arch/sparc64/kernel/sys_sparc.c
1210 @@ -397,7 +397,7 @@
1211         }
1212  }
1213
1214 -asmlinkage unsigned long sparc_brk(unsigned long brk)
1215 +SYSCALL_DEFINE1(sparc_brk, unsigned long, brk)
1216  {
1217         /* People could try to be nasty and use ta 0x6d in 32bit programs */
1218         if (test_thread_flag(TIF_32BIT) && brk >= STACK_TOP32)
1219 @@ -413,7 +413,7 @@
1220   * sys_pipe() is the normal C calling standard for creating
1221   * a pipe. It's not the way unix traditionally does this, though.
1222   */
1223 -asmlinkage long sparc_pipe(struct pt_regs *regs)
1224 +SYSCALL_DEFINE1(sparc_pipe_real, struct pt_regs *, regs)
1225  {
1226         int fd[2];
1227         int error;
1228 @@ -433,8 +433,8 @@
1229   * This is really horribly ugly.
1230   */
1231
1232 -asmlinkage long sys_ipc(unsigned int call, int first, unsigned long second,
1233 -                       unsigned long third, void __user *ptr, long fifth)
1234 +SYSCALL_DEFINE6(ipc, unsigned int, call, int, first, unsigned long, second,
1235 +               unsigned long, third, void __user *, ptr, long, fifth)
1236  {
1237         long err;
1238
1239 @@ -517,7 +517,7 @@
1240         return err;
1241  }
1242
1243 -asmlinkage long sparc64_newuname(struct new_utsname __user *name)
1244 +SYSCALL_DEFINE1(sparc64_newuname, struct new_utsname __user *, name)
1245  {
1246         int ret = sys_newuname(name);
1247
1248 @@ -528,7 +528,7 @@
1249         return ret;
1250  }
1251
1252 -asmlinkage long sparc64_personality(unsigned long personality)
1253 +SYSCALL_DEFINE1(sparc64_personality, unsigned long, personality)
1254  {
1255         int ret;
1256
1257 @@ -562,9 +562,9 @@
1258  }
1259
1260  /* Linux version of mmap */
1261 -asmlinkage unsigned long sys_mmap(unsigned long addr, unsigned long len,
1262 -       unsigned long prot, unsigned long flags, unsigned long fd,
1263 -       unsigned long off)
1264 +SYSCALL_DEFINE6(mmap, unsigned long, addr, unsigned long, len,
1265 +               unsigned long, prot, unsigned long, flags, unsigned long, fd,
1266 +               unsigned long, off)
1267  {
1268         struct file * file = NULL;
1269         unsigned long retval = -EBADF;
1270 @@ -587,7 +587,7 @@
1271         return retval;
1272  }
1273
1274 -asmlinkage long sys64_munmap(unsigned long addr, size_t len)
1275 +SYSCALL_DEFINE2(64_munmap, unsigned long, addr, size_t, len)
1276  {
1277         long ret;
1278
1279 @@ -604,9 +604,9 @@
1280         unsigned long old_len, unsigned long new_len,
1281         unsigned long flags, unsigned long new_addr);
1282
1283 -asmlinkage unsigned long sys64_mremap(unsigned long addr,
1284 -       unsigned long old_len, unsigned long new_len,
1285 -       unsigned long flags, unsigned long new_addr)
1286 +SYSCALL_DEFINE5(64_mremap, unsigned long, addr,        unsigned long, old_len,
1287 +               unsigned long, new_len, unsigned long, flags,
1288 +               unsigned long, new_addr)
1289  {
1290         unsigned long ret = -EINVAL;
1291
1292 @@ -669,7 +669,7 @@
1293
1294  extern void check_pending(int signum);
1295
1296 -asmlinkage long sys_getdomainname(char __user *name, int len)
1297 +SYSCALL_DEFINE2(getdomainname, char __user *, name, int, len)
1298  {
1299          int nlen, err;
1300
1301 @@ -692,11 +692,10 @@
1302         return err;
1303  }
1304
1305 -asmlinkage long sys_utrap_install(utrap_entry_t type,
1306 -                                 utrap_handler_t new_p,
1307 -                                 utrap_handler_t new_d,
1308 -                                 utrap_handler_t __user *old_p,
1309 -                                 utrap_handler_t __user *old_d)
1310 +SYSCALL_DEFINE5(utrap_install, utrap_entry_t, type,
1311 +               utrap_handler_t, new_p, utrap_handler_t, new_d,
1312 +               utrap_handler_t __user *, old_p,
1313 +               utrap_handler_t __user *, old_d)
1314  {
1315         if (type < UT_INSTRUCTION_EXCEPTION || type > UT_TRAP_INSTRUCTION_31)
1316                 return -EINVAL;
1317 @@ -762,11 +761,9 @@
1318         return 0;
1319  }
1320
1321 -asmlinkage long sys_rt_sigaction(int sig,
1322 -                                const struct sigaction __user *act,
1323 -                                struct sigaction __user *oact,
1324 -                                void __user *restorer,
1325 -                                size_t sigsetsize)
1326 +SYSCALL_DEFINE5(rt_sigaction, int, sig, const struct sigaction __user *, act,
1327 +               struct sigaction __user *, oact, void __user *, restorer,
1328 +               size_t, sigsetsize)
1329  {
1330         struct k_sigaction new_ka, old_ka;
1331         int ret;
1332 @@ -806,7 +803,8 @@
1333         reset_pic();
1334  }
1335
1336 -asmlinkage long sys_perfctr(int opcode, unsigned long arg0, unsigned long arg1, unsigned long arg2)
1337 +SYSCALL_DEFINE4(perfctr, int, opcode, unsigned long, arg0,
1338 +               unsigned long, arg1, unsigned long, arg2)
1339  {
1340         int err = 0;
1341
1342 --- kernel-power-2.6.28.orig/arch/sparc64/kernel/syscalls.S
1343 +++ kernel-power-2.6.28/arch/sparc64/kernel/syscalls.S
1344 @@ -20,8 +20,8 @@
1345          add    %sp, PTREGS_OFF, %o0
1346
1347         .align  32
1348 -sys_pipe:
1349 -       ba,pt   %xcc, sparc_pipe
1350 +sys_sparc_pipe:
1351 +       ba,pt   %xcc, sys_sparc_pipe_real
1352          add    %sp, PTREGS_OFF, %o0
1353  sys_nis_syscall:
1354         ba,pt   %xcc, c_sys_nis_syscall
1355 --- kernel-power-2.6.28.orig/arch/sparc64/kernel/systbls.S
1356 +++ kernel-power-2.6.28/arch/sparc64/kernel/systbls.S
1357 @@ -21,12 +21,12 @@
1358  /*0*/  .word sys_restart_syscall, sys32_exit, sys_fork, sys_read, sys_write
1359  /*5*/  .word sys32_open, sys_close, sys32_wait4, sys32_creat, sys_link
1360  /*10*/  .word sys_unlink, sunos_execv, sys_chdir, sys_chown16, sys32_mknod
1361 -/*15*/ .word sys_chmod, sys_lchown16, sparc_brk, sys32_perfctr, sys32_lseek
1362 +/*15*/ .word sys_chmod, sys_lchown16, sys_sparc_brk, sys32_perfctr, sys32_lseek
1363  /*20*/ .word sys_getpid, sys_capget, sys_capset, sys_setuid16, sys_getuid16
1364  /*25*/ .word sys32_vmsplice, compat_sys_ptrace, sys_alarm, sys32_sigaltstack, sys_pause
1365  /*30*/ .word compat_sys_utime, sys_lchown, sys_fchown, sys32_access, sys32_nice
1366         .word sys_chown, sys_sync, sys32_kill, compat_sys_newstat, sys32_sendfile
1367 -/*40*/ .word compat_sys_newlstat, sys_dup, sys_pipe, compat_sys_times, sys_getuid
1368 +/*40*/ .word compat_sys_newlstat, sys_dup, sys_sparc_pipe, compat_sys_times, sys_getuid
1369         .word sys32_umount, sys_setgid16, sys_getgid16, sys32_signal, sys_geteuid16
1370  /*50*/ .word sys_getegid16, sys_acct, sys_nis_syscall, sys_getgid, compat_sys_ioctl
1371         .word sys32_reboot, sys32_mmap2, sys_symlink, sys32_readlink, sys32_execve
1372 @@ -55,8 +55,8 @@
1373  /*170*/        .word sys32_lsetxattr, sys32_fsetxattr, sys_getxattr, sys_lgetxattr, compat_sys_getdents
1374         .word sys_setsid, sys_fchdir, sys32_fgetxattr, sys_listxattr, sys_llistxattr
1375  /*180*/        .word sys32_flistxattr, sys_removexattr, sys_lremovexattr, compat_sys_sigpending, sys_ni_syscall
1376 -       .word sys32_setpgid, sys32_fremovexattr, sys32_tkill, sys32_exit_group, sparc64_newuname
1377 -/*190*/        .word sys32_init_module, sparc64_personality, sys_remap_file_pages, sys32_epoll_create, sys32_epoll_ctl
1378 +       .word sys32_setpgid, sys32_fremovexattr, sys32_tkill, sys32_exit_group, sys_sparc64_newuname
1379 +/*190*/        .word sys32_init_module, sys_sparc64_personality, sys_remap_file_pages, sys32_epoll_create, sys32_epoll_ctl
1380         .word sys32_epoll_wait, sys32_ioprio_set, sys_getppid, sys32_sigaction, sys_sgetmask
1381  /*200*/        .word sys32_ssetmask, sys_sigsuspend, compat_sys_newlstat, sys_uselib, compat_sys_old_readdir
1382         .word sys32_readahead, sys32_socketcall, sys32_syslog, sys32_lookup_dcookie, sys32_fadvise64
1383 @@ -95,18 +95,18 @@
1384  /*0*/  .word sys_restart_syscall, sparc_exit, sys_fork, sys_read, sys_write
1385  /*5*/  .word sys_open, sys_close, sys_wait4, sys_creat, sys_link
1386  /*10*/  .word sys_unlink, sys_nis_syscall, sys_chdir, sys_chown, sys_mknod
1387 -/*15*/ .word sys_chmod, sys_lchown, sparc_brk, sys_perfctr, sys_lseek
1388 +/*15*/ .word sys_chmod, sys_lchown, sys_sparc_brk, sys_perfctr, sys_lseek
1389  /*20*/ .word sys_getpid, sys_capget, sys_capset, sys_setuid, sys_getuid
1390  /*25*/ .word sys_vmsplice, sys_ptrace, sys_alarm, sys_sigaltstack, sys_nis_syscall
1391  /*30*/ .word sys_utime, sys_nis_syscall, sys_nis_syscall, sys_access, sys_nice
1392         .word sys_nis_syscall, sys_sync, sys_kill, sys_newstat, sys_sendfile64
1393 -/*40*/ .word sys_newlstat, sys_dup, sys_pipe, sys_times, sys_nis_syscall
1394 +/*40*/ .word sys_newlstat, sys_dup, sys_sparc_pipe, sys_times, sys_nis_syscall
1395         .word sys_umount, sys_setgid, sys_getgid, sys_signal, sys_geteuid
1396  /*50*/ .word sys_getegid, sys_acct, sys_memory_ordering, sys_nis_syscall, sys_ioctl
1397         .word sys_reboot, sys_nis_syscall, sys_symlink, sys_readlink, sys_execve
1398  /*60*/ .word sys_umask, sys_chroot, sys_newfstat, sys_fstat64, sys_getpagesize
1399         .word sys_msync, sys_vfork, sys_pread64, sys_pwrite64, sys_nis_syscall
1400 -/*70*/ .word sys_nis_syscall, sys_mmap, sys_nis_syscall, sys64_munmap, sys_mprotect
1401 +/*70*/ .word sys_nis_syscall, sys_mmap, sys_nis_syscall, sys_64_munmap, sys_mprotect
1402         .word sys_madvise, sys_vhangup, sys_nis_syscall, sys_mincore, sys_getgroups
1403  /*80*/ .word sys_setgroups, sys_getpgrp, sys_nis_syscall, sys_setitimer, sys_nis_syscall
1404         .word sys_swapon, sys_getitimer, sys_nis_syscall, sys_sethostname, sys_nis_syscall
1405 @@ -129,8 +129,8 @@
1406  /*170*/        .word sys_lsetxattr, sys_fsetxattr, sys_getxattr, sys_lgetxattr, sys_getdents
1407         .word sys_setsid, sys_fchdir, sys_fgetxattr, sys_listxattr, sys_llistxattr
1408  /*180*/        .word sys_flistxattr, sys_removexattr, sys_lremovexattr, sys_nis_syscall, sys_ni_syscall
1409 -       .word sys_setpgid, sys_fremovexattr, sys_tkill, sys_exit_group, sparc64_newuname
1410 -/*190*/        .word sys_init_module, sparc64_personality, sys_remap_file_pages, sys_epoll_create, sys_epoll_ctl
1411 +       .word sys_setpgid, sys_fremovexattr, sys_tkill, sys_exit_group, sys_sparc64_newuname
1412 +/*190*/        .word sys_init_module, sys_sparc64_personality, sys_remap_file_pages, sys_epoll_create, sys_epoll_ctl
1413         .word sys_epoll_wait, sys_ioprio_set, sys_getppid, sys_nis_syscall, sys_sgetmask
1414  /*200*/        .word sys_ssetmask, sys_nis_syscall, sys_newlstat, sys_uselib, sys_nis_syscall
1415         .word sys_readahead, sys_socketcall, sys_syslog, sys_lookup_dcookie, sys_fadvise64
1416 @@ -142,7 +142,7 @@
1417         .word sys_fstatfs64, sys_llseek, sys_mlock, sys_munlock, sys_mlockall
1418  /*240*/        .word sys_munlockall, sys_sched_setparam, sys_sched_getparam, sys_sched_setscheduler, sys_sched_getscheduler
1419         .word sys_sched_yield, sys_sched_get_priority_max, sys_sched_get_priority_min, sys_sched_rr_get_interval, sys_nanosleep
1420 -/*250*/        .word sys64_mremap, sys_sysctl, sys_getsid, sys_fdatasync, sys_nfsservctl
1421 +/*250*/        .word sys_64_mremap, sys_sysctl, sys_getsid, sys_fdatasync, sys_nfsservctl
1422         .word sys_sync_file_range, sys_clock_settime, sys_clock_gettime, sys_clock_getres, sys_clock_nanosleep
1423  /*260*/        .word sys_sched_getaffinity, sys_sched_setaffinity, sys_timer_settime, sys_timer_gettime, sys_timer_getoverrun
1424         .word sys_timer_delete, sys_timer_create, sys_ni_syscall, sys_io_setup, sys_io_destroy
1425 --- kernel-power-2.6.28.orig/arch/sparc64/kernel/systbls.h
1426 +++ kernel-power-2.6.28/arch/sparc64/kernel/systbls.h
1427 @@ -16,9 +16,6 @@
1428                                void __user *ptr, long fifth);
1429  extern asmlinkage long sparc64_newuname(struct new_utsname __user *name);
1430  extern asmlinkage long sparc64_personality(unsigned long personality);
1431 -extern asmlinkage unsigned long sys_mmap(unsigned long addr, unsigned long len,
1432 -                                        unsigned long prot, unsigned long flags,
1433 -                                        unsigned long fd, unsigned long off);
1434  extern asmlinkage long sys64_munmap(unsigned long addr, size_t len);
1435  extern asmlinkage unsigned long sys64_mremap(unsigned long addr,
1436                                              unsigned long old_len,
1437 --- kernel-power-2.6.28.orig/arch/sparc64/kernel/traps.c
1438 +++ kernel-power-2.6.28/arch/sparc64/kernel/traps.c
1439 @@ -1,6 +1,6 @@
1440  /* arch/sparc64/kernel/traps.c
1441   *
1442 - * Copyright (C) 1995,1997,2008 David S. Miller (davem@davemloft.net)
1443 + * Copyright (C) 1995,1997,2008,2009 David S. Miller (davem@davemloft.net)
1444   * Copyright (C) 1997,1999,2000 Jakub Jelinek (jakub@redhat.com)
1445   */
1446
1447 @@ -313,6 +313,21 @@
1448                 return;
1449
1450         if (regs->tstate & TSTATE_PRIV) {
1451 +               /* Test if this comes from uaccess places. */
1452 +               const struct exception_table_entry *entry;
1453 +
1454 +               entry = search_exception_tables(regs->tpc);
1455 +               if (entry) {
1456 +                       /* Ouch, somebody is trying VM hole tricks on us... */
1457 +#ifdef DEBUG_EXCEPTIONS
1458 +                       printk("Exception: PC<%016lx> faddr<UNKNOWN>\n", regs->tpc);
1459 +                       printk("EX_TABLE: insn<%016lx> fixup<%016lx>\n",
1460 +                              regs->tpc, entry->fixup);
1461 +#endif
1462 +                       regs->tpc = entry->fixup;
1463 +                       regs->tnpc = regs->tpc + 4;
1464 +                       return;
1465 +               }
1466                 printk("sun4v_data_access_exception: ADDR[%016lx] "
1467                        "CTX[%04x] TYPE[%04x], going.\n",
1468                        addr, ctx, type);
1469 --- kernel-power-2.6.28.orig/arch/x86/Kconfig
1470 +++ kernel-power-2.6.28/arch/x86/Kconfig
1471 @@ -569,7 +569,7 @@
1472
1473  # need this always selected by IOMMU for the VIA workaround
1474  config SWIOTLB
1475 -       bool
1476 +       def_bool y if X86_64
1477         help
1478           Support for software bounce buffers used on x86-64 systems
1479           which don't have a hardware IOMMU (e.g. the current generation
1480 --- kernel-power-2.6.28.orig/arch/x86/boot/memory.c
1481 +++ kernel-power-2.6.28/arch/x86/boot/memory.c
1482 @@ -27,13 +27,14 @@
1483         do {
1484                 size = sizeof(struct e820entry);
1485
1486 -               /* Important: %edx is clobbered by some BIOSes,
1487 -                  so it must be either used for the error output
1488 +               /* Important: %edx and %esi are clobbered by some BIOSes,
1489 +                  so they must be either used for the error output
1490                    or explicitly marked clobbered. */
1491                 asm("int $0x15; setc %0"
1492                     : "=d" (err), "+b" (next), "=a" (id), "+c" (size),
1493                       "=m" (*desc)
1494 -                   : "D" (desc), "d" (SMAP), "a" (0xe820));
1495 +                   : "D" (desc), "d" (SMAP), "a" (0xe820)
1496 +                   : "esi");
1497
1498                 /* BIOSes which terminate the chain with CF = 1 as opposed
1499                    to %ebx = 0 don't always report the SMAP signature on
1500 --- kernel-power-2.6.28.orig/arch/x86/ia32/ia32entry.S
1501 +++ kernel-power-2.6.28/arch/x86/ia32/ia32entry.S
1502 @@ -418,9 +418,9 @@
1503         orl   $TS_COMPAT,TI_status(%r10)
1504         testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
1505         jnz ia32_tracesys
1506 -ia32_do_syscall:
1507         cmpl $(IA32_NR_syscalls-1),%eax
1508 -       ja  int_ret_from_sys_call       /* ia32_tracesys has set RAX(%rsp) */
1509 +       ja ia32_badsys
1510 +ia32_do_call:
1511         IA32_ARG_FIXUP
1512         call *ia32_sys_call_table(,%rax,8) # xxx: rip relative
1513  ia32_sysret:
1514 @@ -435,7 +435,9 @@
1515         call syscall_trace_enter
1516         LOAD_ARGS32 ARGOFFSET  /* reload args from stack in case ptrace changed it */
1517         RESTORE_REST
1518 -       jmp ia32_do_syscall
1519 +       cmpl $(IA32_NR_syscalls-1),%eax
1520 +       ja  int_ret_from_sys_call       /* ia32_tracesys has set RAX(%rsp) */
1521 +       jmp ia32_do_call
1522  END(ia32_syscall)
1523
1524  ia32_badsys:
1525 --- kernel-power-2.6.28.orig/arch/x86/include/asm/kvm_host.h
1526 +++ kernel-power-2.6.28/arch/x86/include/asm/kvm_host.h
1527 @@ -190,9 +190,11 @@
1528         u64 *spt;
1529         /* hold the gfn of each spte inside spt */
1530         gfn_t *gfns;
1531 -       unsigned long slot_bitmap; /* One bit set per slot which has memory
1532 -                                   * in this shadow page.
1533 -                                   */
1534 +       /*
1535 +        * One bit set per slot which has memory
1536 +        * in this shadow page.
1537 +        */
1538 +       DECLARE_BITMAP(slot_bitmap, KVM_MEMORY_SLOTS + KVM_PRIVATE_MEM_SLOTS);
1539         int multimapped;         /* More than one parent_pte? */
1540         int root_count;          /* Currently serving as active root */
1541         bool unsync;
1542 @@ -607,6 +609,8 @@
1543  int load_pdptrs(struct kvm_vcpu *vcpu, unsigned long cr3);
1544  int complete_pio(struct kvm_vcpu *vcpu);
1545
1546 +struct kvm_memory_slot *gfn_to_memslot_unaliased(struct kvm *kvm, gfn_t gfn);
1547 +
1548  static inline struct kvm_mmu_page *page_header(hpa_t shadow_page)
1549  {
1550         struct page *page = pfn_to_page(shadow_page >> PAGE_SHIFT);
1551 --- kernel-power-2.6.28.orig/arch/x86/include/asm/math_emu.h
1552 +++ kernel-power-2.6.28/arch/x86/include/asm/math_emu.h
1553 @@ -1,31 +1,18 @@
1554  #ifndef _ASM_X86_MATH_EMU_H
1555  #define _ASM_X86_MATH_EMU_H
1556
1557 +#include <asm/ptrace.h>
1558 +#include <asm/vm86.h>
1559 +
1560  /* This structure matches the layout of the data saved to the stack
1561     following a device-not-present interrupt, part of it saved
1562     automatically by the 80386/80486.
1563     */
1564 -struct info {
1565 +struct math_emu_info {
1566         long ___orig_eip;
1567 -       long ___ebx;
1568 -       long ___ecx;
1569 -       long ___edx;
1570 -       long ___esi;
1571 -       long ___edi;
1572 -       long ___ebp;
1573 -       long ___eax;
1574 -       long ___ds;
1575 -       long ___es;
1576 -       long ___fs;
1577 -       long ___orig_eax;
1578 -       long ___eip;
1579 -       long ___cs;
1580 -       long ___eflags;
1581 -       long ___esp;
1582 -       long ___ss;
1583 -       long ___vm86_es; /* This and the following only in vm86 mode */
1584 -       long ___vm86_ds;
1585 -       long ___vm86_fs;
1586 -       long ___vm86_gs;
1587 +       union {
1588 +               struct pt_regs *regs;
1589 +               struct kernel_vm86_regs *vm86;
1590 +       };
1591  };
1592  #endif /* _ASM_X86_MATH_EMU_H */
1593 --- kernel-power-2.6.28.orig/arch/x86/include/asm/mmzone_32.h
1594 +++ kernel-power-2.6.28/arch/x86/include/asm/mmzone_32.h
1595 @@ -32,8 +32,6 @@
1596         get_memcfg_numa_flat();
1597  }
1598
1599 -extern int early_pfn_to_nid(unsigned long pfn);
1600 -
1601  extern void resume_map_numa_kva(pgd_t *pgd);
1602
1603  #else /* !CONFIG_NUMA */
1604 --- kernel-power-2.6.28.orig/arch/x86/include/asm/mmzone_64.h
1605 +++ kernel-power-2.6.28/arch/x86/include/asm/mmzone_64.h
1606 @@ -40,8 +40,6 @@
1607  #define node_end_pfn(nid)       (NODE_DATA(nid)->node_start_pfn +      \
1608                                  NODE_DATA(nid)->node_spanned_pages)
1609
1610 -extern int early_pfn_to_nid(unsigned long pfn);
1611 -
1612  #ifdef CONFIG_NUMA_EMU
1613  #define FAKE_NODE_MIN_SIZE     (64 * 1024 * 1024)
1614  #define FAKE_NODE_MIN_HASH_MASK        (~(FAKE_NODE_MIN_SIZE - 1UL))
1615 --- kernel-power-2.6.28.orig/arch/x86/include/asm/msr-index.h
1616 +++ kernel-power-2.6.28/arch/x86/include/asm/msr-index.h
1617 @@ -200,6 +200,35 @@
1618  #define MSR_IA32_THERM_STATUS          0x0000019c
1619  #define MSR_IA32_MISC_ENABLE           0x000001a0
1620
1621 +/* MISC_ENABLE bits: architectural */
1622 +#define MSR_IA32_MISC_ENABLE_FAST_STRING       (1ULL << 0)
1623 +#define MSR_IA32_MISC_ENABLE_TCC               (1ULL << 1)
1624 +#define MSR_IA32_MISC_ENABLE_EMON              (1ULL << 7)
1625 +#define MSR_IA32_MISC_ENABLE_BTS_UNAVAIL       (1ULL << 11)
1626 +#define MSR_IA32_MISC_ENABLE_PEBS_UNAVAIL      (1ULL << 12)
1627 +#define MSR_IA32_MISC_ENABLE_ENHANCED_SPEEDSTEP        (1ULL << 16)
1628 +#define MSR_IA32_MISC_ENABLE_MWAIT             (1ULL << 18)
1629 +#define MSR_IA32_MISC_ENABLE_LIMIT_CPUID       (1ULL << 22)
1630 +#define MSR_IA32_MISC_ENABLE_XTPR_DISABLE      (1ULL << 23)
1631 +#define MSR_IA32_MISC_ENABLE_XD_DISABLE                (1ULL << 34)
1632 +
1633 +/* MISC_ENABLE bits: model-specific, meaning may vary from core to core */
1634 +#define MSR_IA32_MISC_ENABLE_X87_COMPAT                (1ULL << 2)
1635 +#define MSR_IA32_MISC_ENABLE_TM1               (1ULL << 3)
1636 +#define MSR_IA32_MISC_ENABLE_SPLIT_LOCK_DISABLE        (1ULL << 4)
1637 +#define MSR_IA32_MISC_ENABLE_L3CACHE_DISABLE   (1ULL << 6)
1638 +#define MSR_IA32_MISC_ENABLE_SUPPRESS_LOCK     (1ULL << 8)
1639 +#define MSR_IA32_MISC_ENABLE_PREFETCH_DISABLE  (1ULL << 9)
1640 +#define MSR_IA32_MISC_ENABLE_FERR              (1ULL << 10)
1641 +#define MSR_IA32_MISC_ENABLE_FERR_MULTIPLEX    (1ULL << 10)
1642 +#define MSR_IA32_MISC_ENABLE_TM2               (1ULL << 13)
1643 +#define MSR_IA32_MISC_ENABLE_ADJ_PREF_DISABLE  (1ULL << 19)
1644 +#define MSR_IA32_MISC_ENABLE_SPEEDSTEP_LOCK    (1ULL << 20)
1645 +#define MSR_IA32_MISC_ENABLE_L1D_CONTEXT       (1ULL << 24)
1646 +#define MSR_IA32_MISC_ENABLE_DCU_PREF_DISABLE  (1ULL << 37)
1647 +#define MSR_IA32_MISC_ENABLE_TURBO_DISABLE     (1ULL << 38)
1648 +#define MSR_IA32_MISC_ENABLE_IP_PREF_DISABLE   (1ULL << 39)
1649 +
1650  /* Intel Model 6 */
1651  #define MSR_P6_EVNTSEL0                        0x00000186
1652  #define MSR_P6_EVNTSEL1                        0x00000187
1653 --- kernel-power-2.6.28.orig/arch/x86/include/asm/paravirt.h
1654 +++ kernel-power-2.6.28/arch/x86/include/asm/paravirt.h
1655 @@ -1352,14 +1352,7 @@
1656         PVOP_VCALL0(pv_cpu_ops.lazy_mode.leave);
1657  }
1658
1659 -static inline void arch_flush_lazy_cpu_mode(void)
1660 -{
1661 -       if (unlikely(paravirt_get_lazy_mode() == PARAVIRT_LAZY_CPU)) {
1662 -               arch_leave_lazy_cpu_mode();
1663 -               arch_enter_lazy_cpu_mode();
1664 -       }
1665 -}
1666 -
1667 +void arch_flush_lazy_cpu_mode(void);
1668
1669  #define  __HAVE_ARCH_ENTER_LAZY_MMU_MODE
1670  static inline void arch_enter_lazy_mmu_mode(void)
1671 @@ -1372,13 +1365,7 @@
1672         PVOP_VCALL0(pv_mmu_ops.lazy_mode.leave);
1673  }
1674
1675 -static inline void arch_flush_lazy_mmu_mode(void)
1676 -{
1677 -       if (unlikely(paravirt_get_lazy_mode() == PARAVIRT_LAZY_MMU)) {
1678 -               arch_leave_lazy_mmu_mode();
1679 -               arch_enter_lazy_mmu_mode();
1680 -       }
1681 -}
1682 +void arch_flush_lazy_mmu_mode(void);
1683
1684  static inline void __set_fixmap(unsigned /* enum fixed_addresses */ idx,
1685                                 unsigned long phys, pgprot_t flags)
1686 --- kernel-power-2.6.28.orig/arch/x86/include/asm/pgalloc.h
1687 +++ kernel-power-2.6.28/arch/x86/include/asm/pgalloc.h
1688 @@ -42,6 +42,7 @@
1689
1690  static inline void pte_free(struct mm_struct *mm, struct page *pte)
1691  {
1692 +       pgtable_page_dtor(pte);
1693         __free_page(pte);
1694  }
1695
1696 --- kernel-power-2.6.28.orig/arch/x86/include/asm/processor.h
1697 +++ kernel-power-2.6.28/arch/x86/include/asm/processor.h
1698 @@ -349,7 +349,7 @@
1699         u8                      no_update;
1700         u8                      rm;
1701         u8                      alimit;
1702 -       struct info             *info;
1703 +       struct math_emu_info    *info;
1704         u32                     entry_eip;
1705  };
1706
1707 --- kernel-power-2.6.28.orig/arch/x86/include/asm/seccomp_32.h
1708 +++ kernel-power-2.6.28/arch/x86/include/asm/seccomp_32.h
1709 @@ -1,12 +1,6 @@
1710  #ifndef _ASM_X86_SECCOMP_32_H
1711  #define _ASM_X86_SECCOMP_32_H
1712
1713 -#include <linux/thread_info.h>
1714 -
1715 -#ifdef TIF_32BIT
1716 -#error "unexpected TIF_32BIT on i386"
1717 -#endif
1718 -
1719  #include <linux/unistd.h>
1720
1721  #define __NR_seccomp_read __NR_read
1722 --- kernel-power-2.6.28.orig/arch/x86/include/asm/seccomp_64.h
1723 +++ kernel-power-2.6.28/arch/x86/include/asm/seccomp_64.h
1724 @@ -1,14 +1,6 @@
1725  #ifndef _ASM_X86_SECCOMP_64_H
1726  #define _ASM_X86_SECCOMP_64_H
1727
1728 -#include <linux/thread_info.h>
1729 -
1730 -#ifdef TIF_32BIT
1731 -#error "unexpected TIF_32BIT on x86_64"
1732 -#else
1733 -#define TIF_32BIT TIF_IA32
1734 -#endif
1735 -
1736  #include <linux/unistd.h>
1737  #include <asm/ia32_unistd.h>
1738
1739 --- kernel-power-2.6.28.orig/arch/x86/include/asm/traps.h
1740 +++ kernel-power-2.6.28/arch/x86/include/asm/traps.h
1741 @@ -41,7 +41,7 @@
1742  dotraplinkage void do_overflow(struct pt_regs *, long);
1743  dotraplinkage void do_bounds(struct pt_regs *, long);
1744  dotraplinkage void do_invalid_op(struct pt_regs *, long);
1745 -dotraplinkage void do_device_not_available(struct pt_regs *, long);
1746 +dotraplinkage void do_device_not_available(struct pt_regs);
1747  dotraplinkage void do_coprocessor_segment_overrun(struct pt_regs *, long);
1748  dotraplinkage void do_invalid_TSS(struct pt_regs *, long);
1749  dotraplinkage void do_segment_not_present(struct pt_regs *, long);
1750 @@ -74,8 +74,8 @@
1751
1752  #ifdef CONFIG_X86_32
1753  void math_error(void __user *);
1754 +void math_emulate(struct math_emu_info *);
1755  unsigned long patch_espfix_desc(unsigned long, unsigned long);
1756 -asmlinkage void math_emulate(long);
1757  #endif
1758
1759  #endif /* _ASM_X86_TRAPS_H */
1760 --- kernel-power-2.6.28.orig/arch/x86/kernel/acpi/cstate.c
1761 +++ kernel-power-2.6.28/arch/x86/kernel/acpi/cstate.c
1762 @@ -56,6 +56,7 @@
1763  static short mwait_supported[ACPI_PROCESSOR_MAX_POWER];
1764
1765  #define MWAIT_SUBSTATE_MASK    (0xf)
1766 +#define MWAIT_CSTATE_MASK      (0xf)
1767  #define MWAIT_SUBSTATE_SIZE    (4)
1768
1769  #define CPUID_MWAIT_LEAF (5)
1770 @@ -98,7 +99,8 @@
1771         cpuid(CPUID_MWAIT_LEAF, &eax, &ebx, &ecx, &edx);
1772
1773         /* Check whether this particular cx_type (in CST) is supported or not */
1774 -       cstate_type = (cx->address >> MWAIT_SUBSTATE_SIZE) + 1;
1775 +       cstate_type = ((cx->address >> MWAIT_SUBSTATE_SIZE) &
1776 +                       MWAIT_CSTATE_MASK) + 1;
1777         edx_part = edx >> (cstate_type * MWAIT_SUBSTATE_SIZE);
1778         num_cstate_subtype = edx_part & MWAIT_SUBSTATE_MASK;
1779
1780 --- kernel-power-2.6.28.orig/arch/x86/kernel/apic.c
1781 +++ kernel-power-2.6.28/arch/x86/kernel/apic.c
1782 @@ -1451,7 +1451,7 @@
1783         switch (boot_cpu_data.x86_vendor) {
1784         case X86_VENDOR_AMD:
1785                 if ((boot_cpu_data.x86 == 6 && boot_cpu_data.x86_model > 1) ||
1786 -                   (boot_cpu_data.x86 == 15))
1787 +                   (boot_cpu_data.x86 >= 15))
1788                         break;
1789                 goto no_apic;
1790         case X86_VENDOR_INTEL:
1791 --- kernel-power-2.6.28.orig/arch/x86/kernel/cpu/addon_cpuid_features.c
1792 +++ kernel-power-2.6.28/arch/x86/kernel/cpu/addon_cpuid_features.c
1793 @@ -120,9 +120,17 @@
1794         c->cpu_core_id = phys_pkg_id(c->initial_apicid, ht_mask_width)
1795                                                  & core_select_mask;
1796         c->phys_proc_id = phys_pkg_id(c->initial_apicid, core_plus_mask_width);
1797 +       /*
1798 +        * Reinit the apicid, now that we have extended initial_apicid.
1799 +        */
1800 +       c->apicid = phys_pkg_id(c->initial_apicid, 0);
1801  #else
1802         c->cpu_core_id = phys_pkg_id(ht_mask_width) & core_select_mask;
1803         c->phys_proc_id = phys_pkg_id(core_plus_mask_width);
1804 +       /*
1805 +        * Reinit the apicid, now that we have extended initial_apicid.
1806 +        */
1807 +       c->apicid = phys_pkg_id(0);
1808  #endif
1809         c->x86_max_cores = (core_level_siblings / smp_num_siblings);
1810
1811 --- kernel-power-2.6.28.orig/arch/x86/kernel/cpu/intel.c
1812 +++ kernel-power-2.6.28/arch/x86/kernel/cpu/intel.c
1813 @@ -30,6 +30,19 @@
1814
1815  static void __cpuinit early_init_intel(struct cpuinfo_x86 *c)
1816  {
1817 +       /* Unmask CPUID levels if masked: */
1818 +       if (c->x86 == 6 && c->x86_model >= 15) {
1819 +               u64 misc_enable;
1820 +
1821 +               rdmsrl(MSR_IA32_MISC_ENABLE, misc_enable);
1822 +
1823 +               if (misc_enable & MSR_IA32_MISC_ENABLE_LIMIT_CPUID) {
1824 +                       misc_enable &= ~MSR_IA32_MISC_ENABLE_LIMIT_CPUID;
1825 +                       wrmsrl(MSR_IA32_MISC_ENABLE, misc_enable);
1826 +                       c->cpuid_level = cpuid_eax(0);
1827 +               }
1828 +       }
1829 +
1830         if ((c->x86 == 0xf && c->x86_model >= 0x03) ||
1831                 (c->x86 == 0x6 && c->x86_model >= 0x0e))
1832                 set_cpu_cap(c, X86_FEATURE_CONSTANT_TSC);
1833 @@ -242,6 +255,13 @@
1834
1835         intel_workarounds(c);
1836
1837 +       /*
1838 +        * Detect the extended topology information if available. This
1839 +        * will reinitialise the initial_apicid which will be used
1840 +        * in init_intel_cacheinfo()
1841 +        */
1842 +       detect_extended_topology(c);
1843 +
1844         l2 = init_intel_cacheinfo(c);
1845         if (c->cpuid_level > 9) {
1846                 unsigned eax = cpuid_eax(10);
1847 @@ -313,7 +333,6 @@
1848
1849  #endif
1850
1851 -       detect_extended_topology(c);
1852         if (!cpu_has(c, X86_FEATURE_XTOPOLOGY)) {
1853                 /*
1854                  * let's use the legacy cpuid vector 0x1 and 0x4 for topology
1855 --- kernel-power-2.6.28.orig/arch/x86/kernel/cpu/mtrr/generic.c
1856 +++ kernel-power-2.6.28/arch/x86/kernel/cpu/mtrr/generic.c
1857 @@ -45,6 +45,32 @@
1858  static int mtrr_show;
1859  module_param_named(show, mtrr_show, bool, 0);
1860
1861 +/**
1862 + * BIOS is expected to clear MtrrFixDramModEn bit, see for example
1863 + * "BIOS and Kernel Developer's Guide for the AMD Athlon 64 and AMD
1864 + * Opteron Processors" (26094 Rev. 3.30 February 2006), section
1865 + * "13.2.1.2 SYSCFG Register": "The MtrrFixDramModEn bit should be set
1866 + * to 1 during BIOS initalization of the fixed MTRRs, then cleared to
1867 + * 0 for operation."
1868 + */
1869 +static inline void k8_check_syscfg_dram_mod_en(void)
1870 +{
1871 +       u32 lo, hi;
1872 +
1873 +       if (!((boot_cpu_data.x86_vendor == X86_VENDOR_AMD) &&
1874 +             (boot_cpu_data.x86 >= 0x0f)))
1875 +               return;
1876 +
1877 +       rdmsr(MSR_K8_SYSCFG, lo, hi);
1878 +       if (lo & K8_MTRRFIXRANGE_DRAM_MODIFY) {
1879 +               printk(KERN_ERR FW_WARN "MTRR: CPU %u: SYSCFG[MtrrFixDramModEn]"
1880 +                      " not cleared by BIOS, clearing this bit\n",
1881 +                      smp_processor_id());
1882 +               lo &= ~K8_MTRRFIXRANGE_DRAM_MODIFY;
1883 +               mtrr_wrmsr(MSR_K8_SYSCFG, lo, hi);
1884 +       }
1885 +}
1886 +
1887  /*
1888   * Returns the effective MTRR type for the region
1889   * Error returns:
1890 @@ -178,6 +204,8 @@
1891         unsigned int *p = (unsigned int *) frs;
1892         int i;
1893
1894 +       k8_check_syscfg_dram_mod_en();
1895 +
1896         rdmsr(MTRRfix64K_00000_MSR, p[0], p[1]);
1897
1898         for (i = 0; i < 2; i++)
1899 @@ -312,27 +340,10 @@
1900  }
1901
1902  /**
1903 - * Enable and allow read/write of extended fixed-range MTRR bits on K8 CPUs
1904 - * see AMD publication no. 24593, chapter 3.2.1 for more information
1905 - */
1906 -static inline void k8_enable_fixed_iorrs(void)
1907 -{
1908 -       unsigned lo, hi;
1909 -
1910 -       rdmsr(MSR_K8_SYSCFG, lo, hi);
1911 -       mtrr_wrmsr(MSR_K8_SYSCFG, lo
1912 -                               | K8_MTRRFIXRANGE_DRAM_ENABLE
1913 -                               | K8_MTRRFIXRANGE_DRAM_MODIFY, hi);
1914 -}
1915 -
1916 -/**
1917   * set_fixed_range - checks & updates a fixed-range MTRR if it differs from the value it should have
1918   * @msr: MSR address of the MTTR which should be checked and updated
1919   * @changed: pointer which indicates whether the MTRR needed to be changed
1920   * @msrwords: pointer to the MSR values which the MSR should have
1921 - *
1922 - * If K8 extentions are wanted, update the K8 SYSCFG MSR also.
1923 - * See AMD publication no. 24593, chapter 7.8.1, page 233 for more information.
1924   */
1925  static void set_fixed_range(int msr, bool *changed, unsigned int *msrwords)
1926  {
1927 @@ -341,10 +352,6 @@
1928         rdmsr(msr, lo, hi);
1929
1930         if (lo != msrwords[0] || hi != msrwords[1]) {
1931 -               if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD &&
1932 -                   (boot_cpu_data.x86 >= 0x0f && boot_cpu_data.x86 <= 0x11) &&
1933 -                   ((msrwords[0] | msrwords[1]) & K8_MTRR_RDMEM_WRMEM_MASK))
1934 -                       k8_enable_fixed_iorrs();
1935                 mtrr_wrmsr(msr, msrwords[0], msrwords[1]);
1936                 *changed = true;
1937         }
1938 @@ -423,6 +430,8 @@
1939         bool changed = false;
1940         int block=-1, range;
1941
1942 +       k8_check_syscfg_dram_mod_en();
1943 +
1944         while (fixed_range_blocks[++block].ranges)
1945             for (range=0; range < fixed_range_blocks[block].ranges; range++)
1946                 set_fixed_range(fixed_range_blocks[block].base_msr + range,
1947 --- kernel-power-2.6.28.orig/arch/x86/kernel/cpu/mtrr/main.c
1948 +++ kernel-power-2.6.28/arch/x86/kernel/cpu/mtrr/main.c
1949 @@ -1600,8 +1600,7 @@
1950
1951         /* kvm/qemu doesn't have mtrr set right, don't trim them all */
1952         if (!highest_pfn) {
1953 -               WARN(!kvm_para_available(), KERN_WARNING
1954 -                               "WARNING: strange, CPU MTRRs all blank?\n");
1955 +               printk(KERN_INFO "CPU MTRRs all blank - virtualized system.\n");
1956                 return 0;
1957         }
1958
1959 --- kernel-power-2.6.28.orig/arch/x86/kernel/head64.c
1960 +++ kernel-power-2.6.28/arch/x86/kernel/head64.c
1961 @@ -26,7 +26,7 @@
1962  #include <asm/bios_ebda.h>
1963
1964  /* boot cpu pda */
1965 -static struct x8664_pda _boot_cpu_pda __read_mostly;
1966 +static struct x8664_pda _boot_cpu_pda;
1967
1968  #ifdef CONFIG_SMP
1969  /*
1970 --- kernel-power-2.6.28.orig/arch/x86/kernel/head_64.S
1971 +++ kernel-power-2.6.28/arch/x86/kernel/head_64.S
1972 @@ -305,7 +305,7 @@
1973         call dump_stack
1974  #ifdef CONFIG_KALLSYMS
1975         leaq early_idt_ripmsg(%rip),%rdi
1976 -       movq 8(%rsp),%rsi       # get rip again
1977 +       movq 0(%rsp),%rsi       # get rip again
1978         call __print_symbol
1979  #endif
1980  #endif /* EARLY_PRINTK */
1981 --- kernel-power-2.6.28.orig/arch/x86/kernel/hpet.c
1982 +++ kernel-power-2.6.28/arch/x86/kernel/hpet.c
1983 @@ -267,6 +267,8 @@
1984                 now = hpet_readl(HPET_COUNTER);
1985                 cmp = now + (unsigned long) delta;
1986                 cfg = hpet_readl(HPET_Tn_CFG(timer));
1987 +               /* Make sure we use edge triggered interrupts */
1988 +               cfg &= ~HPET_TN_LEVEL;
1989                 cfg |= HPET_TN_ENABLE | HPET_TN_PERIODIC |
1990                        HPET_TN_SETVAL | HPET_TN_32BIT;
1991                 hpet_writel(cfg, HPET_Tn_CFG(timer));
1992 --- kernel-power-2.6.28.orig/arch/x86/kernel/microcode_amd.c
1993 +++ kernel-power-2.6.28/arch/x86/kernel/microcode_amd.c
1994 @@ -62,7 +62,7 @@
1995         unsigned int  mc_patch_data_checksum;
1996         unsigned int  nb_dev_id;
1997         unsigned int  sb_dev_id;
1998 -       unsigned char processor_rev_id[2];
1999 +       u16 processor_rev_id;
2000         unsigned char nb_rev_id;
2001         unsigned char sb_rev_id;
2002         unsigned char bios_api_rev;
2003 @@ -125,7 +125,7 @@
2004
2005         while (equiv_cpu_table[i].installed_cpu != 0) {
2006                 if (current_cpu_id == equiv_cpu_table[i].installed_cpu) {
2007 -                       equiv_cpu_id = equiv_cpu_table[i].equiv_cpu;
2008 +                       equiv_cpu_id = equiv_cpu_table[i].equiv_cpu & 0xffff;
2009                         break;
2010                 }
2011                 i++;
2012 @@ -137,21 +137,10 @@
2013                 return 0;
2014         }
2015
2016 -       if ((mc_header->processor_rev_id[0]) != (equiv_cpu_id & 0xff)) {
2017 -               printk(KERN_ERR
2018 -                       "microcode: CPU%d patch does not match "
2019 -                       "(patch is %x, cpu extended is %x) \n",
2020 -                       cpu, mc_header->processor_rev_id[0],
2021 -                       (equiv_cpu_id & 0xff));
2022 -               return 0;
2023 -       }
2024 -
2025 -       if ((mc_header->processor_rev_id[1]) != ((equiv_cpu_id >> 16) & 0xff)) {
2026 -               printk(KERN_ERR "microcode: CPU%d patch does not match "
2027 -                       "(patch is %x, cpu base id is %x) \n",
2028 -                       cpu, mc_header->processor_rev_id[1],
2029 -                       ((equiv_cpu_id >> 16) & 0xff));
2030 -
2031 +       if (mc_header->processor_rev_id != equiv_cpu_id) {
2032 +               printk(KERN_ERR "microcode: CPU%d patch does not match "
2033 +                      "(processor_rev_id: %x, eqiv_cpu_id: %x)\n",
2034 +                      cpu, mc_header->processor_rev_id, equiv_cpu_id);
2035                 return 0;
2036         }
2037
2038 --- kernel-power-2.6.28.orig/arch/x86/kernel/paravirt.c
2039 +++ kernel-power-2.6.28/arch/x86/kernel/paravirt.c
2040 @@ -268,6 +268,30 @@
2041         return __get_cpu_var(paravirt_lazy_mode);
2042  }
2043
2044 +void arch_flush_lazy_mmu_mode(void)
2045 +{
2046 +       preempt_disable();
2047 +
2048 +       if (paravirt_get_lazy_mode() == PARAVIRT_LAZY_MMU) {
2049 +               arch_leave_lazy_mmu_mode();
2050 +               arch_enter_lazy_mmu_mode();
2051 +       }
2052 +
2053 +       preempt_enable();
2054 +}
2055 +
2056 +void arch_flush_lazy_cpu_mode(void)
2057 +{
2058 +       preempt_disable();
2059 +
2060 +       if (paravirt_get_lazy_mode() == PARAVIRT_LAZY_CPU) {
2061 +               arch_leave_lazy_cpu_mode();
2062 +               arch_enter_lazy_cpu_mode();
2063 +       }
2064 +
2065 +       preempt_enable();
2066 +}
2067 +
2068  struct pv_info pv_info = {
2069         .name = "bare hardware",
2070         .paravirt_enabled = 0,
2071 --- kernel-power-2.6.28.orig/arch/x86/kernel/ptrace.c
2072 +++ kernel-power-2.6.28/arch/x86/kernel/ptrace.c
2073 @@ -1512,7 +1512,7 @@
2074  #ifdef CONFIG_X86_32
2075  # define IS_IA32       1
2076  #elif defined CONFIG_IA32_EMULATION
2077 -# define IS_IA32       test_thread_flag(TIF_IA32)
2078 +# define IS_IA32       is_compat_task()
2079  #else
2080  # define IS_IA32       0
2081  #endif
2082 --- kernel-power-2.6.28.orig/arch/x86/kernel/reboot.c
2083 +++ kernel-power-2.6.28/arch/x86/kernel/reboot.c
2084 @@ -202,6 +202,14 @@
2085                         DMI_MATCH(DMI_PRODUCT_NAME, "HP Compaq"),
2086                 },
2087         },
2088 +       {       /* Handle problems with rebooting on Dell XPS710 */
2089 +               .callback = set_bios_reboot,
2090 +               .ident = "Dell XPS710",
2091 +               .matches = {
2092 +                       DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
2093 +                       DMI_MATCH(DMI_PRODUCT_NAME, "Dell XPS710"),
2094 +               },
2095 +       },
2096         { }
2097  };
2098
2099 --- kernel-power-2.6.28.orig/arch/x86/kernel/syscall_table_32.S
2100 +++ kernel-power-2.6.28/arch/x86/kernel/syscall_table_32.S
2101 @@ -88,7 +88,7 @@
2102         .long sys_uselib
2103         .long sys_swapon
2104         .long sys_reboot
2105 -       .long old_readdir
2106 +       .long sys_old_readdir
2107         .long old_mmap          /* 90 */
2108         .long sys_munmap
2109         .long sys_truncate
2110 --- kernel-power-2.6.28.orig/arch/x86/kernel/tlb_uv.c
2111 +++ kernel-power-2.6.28/arch/x86/kernel/tlb_uv.c
2112 @@ -586,7 +586,6 @@
2113  static struct bau_control * __init uv_table_bases_init(int blade, int node)
2114  {
2115         int i;
2116 -       int *ip;
2117         struct bau_msg_status *msp;
2118         struct bau_control *bau_tabp;
2119
2120 @@ -603,13 +602,6 @@
2121                 bau_cpubits_clear(&msp->seen_by, (int)
2122                                   uv_blade_nr_possible_cpus(blade));
2123
2124 -       bau_tabp->watching =
2125 -           kmalloc_node(sizeof(int) * DEST_NUM_RESOURCES, GFP_KERNEL, node);
2126 -       BUG_ON(!bau_tabp->watching);
2127 -
2128 -       for (i = 0, ip = bau_tabp->watching; i < DEST_Q_SIZE; i++, ip++)
2129 -               *ip = 0;
2130 -
2131         uv_bau_table_bases[blade] = bau_tabp;
2132
2133         return bau_tabp;
2134 @@ -632,7 +624,6 @@
2135                 bcp->bau_msg_head       = bau_tablesp->va_queue_first;
2136                 bcp->va_queue_first     = bau_tablesp->va_queue_first;
2137                 bcp->va_queue_last      = bau_tablesp->va_queue_last;
2138 -               bcp->watching           = bau_tablesp->watching;
2139                 bcp->msg_statuses       = bau_tablesp->msg_statuses;
2140                 bcp->descriptor_base    = adp;
2141         }
2142 --- kernel-power-2.6.28.orig/arch/x86/kernel/traps.c
2143 +++ kernel-power-2.6.28/arch/x86/kernel/traps.c
2144 @@ -104,6 +104,12 @@
2145                 local_irq_enable();
2146  }
2147
2148 +static inline void conditional_cli(struct pt_regs *regs)
2149 +{
2150 +       if (regs->flags & X86_EFLAGS_IF)
2151 +               local_irq_disable();
2152 +}
2153 +
2154  static inline void preempt_conditional_cli(struct pt_regs *regs)
2155  {
2156         if (regs->flags & X86_EFLAGS_IF)
2157 @@ -629,8 +635,10 @@
2158
2159  #ifdef CONFIG_X86_32
2160  debug_vm86:
2161 +       /* reenable preemption: handle_vm86_trap() might sleep */
2162 +       dec_preempt_count();
2163         handle_vm86_trap((struct kernel_vm86_regs *) regs, error_code, 1);
2164 -       preempt_conditional_cli(regs);
2165 +       conditional_cli(regs);
2166         return;
2167  #endif
2168
2169 @@ -904,7 +912,7 @@
2170  EXPORT_SYMBOL_GPL(math_state_restore);
2171
2172  #ifndef CONFIG_MATH_EMULATION
2173 -asmlinkage void math_emulate(long arg)
2174 +void math_emulate(struct math_emu_info *info)
2175  {
2176         printk(KERN_EMERG
2177                 "math-emulation not enabled and no coprocessor found.\n");
2178 @@ -914,16 +922,19 @@
2179  }
2180  #endif /* CONFIG_MATH_EMULATION */
2181
2182 -dotraplinkage void __kprobes
2183 -do_device_not_available(struct pt_regs *regs, long error)
2184 +dotraplinkage void __kprobes do_device_not_available(struct pt_regs regs)
2185  {
2186  #ifdef CONFIG_X86_32
2187         if (read_cr0() & X86_CR0_EM) {
2188 -               conditional_sti(regs);
2189 -               math_emulate(0);
2190 +               struct math_emu_info info = { };
2191 +
2192 +               conditional_sti(&regs);
2193 +
2194 +               info.regs = &regs;
2195 +               math_emulate(&info);
2196         } else {
2197                 math_state_restore(); /* interrupts still off */
2198 -               conditional_sti(regs);
2199 +               conditional_sti(&regs);
2200         }
2201  #else
2202         math_state_restore();
2203 --- kernel-power-2.6.28.orig/arch/x86/kernel/vmi_32.c
2204 +++ kernel-power-2.6.28/arch/x86/kernel/vmi_32.c
2205 @@ -430,6 +430,16 @@
2206  }
2207
2208  /*
2209 + * We use the pgd_free hook for releasing the pgd page:
2210 + */
2211 +static void vmi_pgd_free(struct mm_struct *mm, pgd_t *pgd)
2212 +{
2213 +       unsigned long pfn = __pa(pgd) >> PAGE_SHIFT;
2214 +
2215 +       vmi_ops.release_page(pfn, VMI_PAGE_L2);
2216 +}
2217 +
2218 +/*
2219   * Helper macros for MMU update flags.  We can defer updates until a flush
2220   * or page invalidation only if the update is to the current address space
2221   * (otherwise, there is no flush).  We must check against init_mm, since
2222 @@ -881,6 +891,7 @@
2223         if (vmi_ops.release_page) {
2224                 pv_mmu_ops.release_pte = vmi_release_pte;
2225                 pv_mmu_ops.release_pmd = vmi_release_pmd;
2226 +               pv_mmu_ops.pgd_free = vmi_pgd_free;
2227         }
2228
2229         /* Set linear is needed in all cases */
2230 --- kernel-power-2.6.28.orig/arch/x86/kernel/vmiclock_32.c
2231 +++ kernel-power-2.6.28/arch/x86/kernel/vmiclock_32.c
2232 @@ -283,10 +283,13 @@
2233  #endif
2234
2235  /** vmi clocksource */
2236 +static struct clocksource clocksource_vmi;
2237
2238  static cycle_t read_real_cycles(void)
2239  {
2240 -       return vmi_timer_ops.get_cycle_counter(VMI_CYCLES_REAL);
2241 +       cycle_t ret = (cycle_t)vmi_timer_ops.get_cycle_counter(VMI_CYCLES_REAL);
2242 +       return ret >= clocksource_vmi.cycle_last ?
2243 +               ret : clocksource_vmi.cycle_last;
2244  }
2245
2246  static struct clocksource clocksource_vmi = {
2247 --- kernel-power-2.6.28.orig/arch/x86/kvm/i8254.c
2248 +++ kernel-power-2.6.28/arch/x86/kvm/i8254.c
2249 @@ -207,7 +207,7 @@
2250         hrtimer_add_expires_ns(&pt->timer, pt->period);
2251         pt->scheduled = hrtimer_get_expires_ns(&pt->timer);
2252         if (pt->period)
2253 -               ps->channels[0].count_load_time = hrtimer_get_expires(&pt->timer);
2254 +               ps->channels[0].count_load_time = ktime_get();
2255
2256         return (pt->period == 0 ? 0 : 1);
2257  }
2258 --- kernel-power-2.6.28.orig/arch/x86/kvm/irq.c
2259 +++ kernel-power-2.6.28/arch/x86/kvm/irq.c
2260 @@ -87,13 +87,6 @@
2261  }
2262  EXPORT_SYMBOL_GPL(kvm_inject_pending_timer_irqs);
2263
2264 -void kvm_timer_intr_post(struct kvm_vcpu *vcpu, int vec)
2265 -{
2266 -       kvm_apic_timer_intr_post(vcpu, vec);
2267 -       /* TODO: PIT, RTC etc. */
2268 -}
2269 -EXPORT_SYMBOL_GPL(kvm_timer_intr_post);
2270 -
2271  void __kvm_migrate_timers(struct kvm_vcpu *vcpu)
2272  {
2273         __kvm_migrate_apic_timer(vcpu);
2274 --- kernel-power-2.6.28.orig/arch/x86/kvm/irq.h
2275 +++ kernel-power-2.6.28/arch/x86/kvm/irq.h
2276 @@ -84,7 +84,6 @@
2277
2278  void kvm_pic_reset(struct kvm_kpic_state *s);
2279
2280 -void kvm_timer_intr_post(struct kvm_vcpu *vcpu, int vec);
2281  void kvm_inject_pending_timer_irqs(struct kvm_vcpu *vcpu);
2282  void kvm_inject_apic_timer_irqs(struct kvm_vcpu *vcpu);
2283  void __kvm_migrate_apic_timer(struct kvm_vcpu *vcpu);
2284 --- kernel-power-2.6.28.orig/arch/x86/kvm/lapic.c
2285 +++ kernel-power-2.6.28/arch/x86/kvm/lapic.c
2286 @@ -35,6 +35,12 @@
2287  #include "kvm_cache_regs.h"
2288  #include "irq.h"
2289
2290 +#ifndef CONFIG_X86_64
2291 +#define mod_64(x, y) ((x) - (y) * div64_u64(x, y))
2292 +#else
2293 +#define mod_64(x, y) ((x) % (y))
2294 +#endif
2295 +
2296  #define PRId64 "d"
2297  #define PRIx64 "llx"
2298  #define PRIu64 "u"
2299 @@ -497,52 +503,22 @@
2300
2301  static u32 apic_get_tmcct(struct kvm_lapic *apic)
2302  {
2303 -       u64 counter_passed;
2304 -       ktime_t passed, now;
2305 +       ktime_t remaining;
2306 +       s64 ns;
2307         u32 tmcct;
2308
2309         ASSERT(apic != NULL);
2310
2311 -       now = apic->timer.dev.base->get_time();
2312 -       tmcct = apic_get_reg(apic, APIC_TMICT);
2313 -
2314         /* if initial count is 0, current count should also be 0 */
2315 -       if (tmcct == 0)
2316 +       if (apic_get_reg(apic, APIC_TMICT) == 0)
2317                 return 0;
2318
2319 -       if (unlikely(ktime_to_ns(now) <=
2320 -               ktime_to_ns(apic->timer.last_update))) {
2321 -               /* Wrap around */
2322 -               passed = ktime_add(( {
2323 -                                   (ktime_t) {
2324 -                                   .tv64 = KTIME_MAX -
2325 -                                   (apic->timer.last_update).tv64}; }
2326 -                                  ), now);
2327 -               apic_debug("time elapsed\n");
2328 -       } else
2329 -               passed = ktime_sub(now, apic->timer.last_update);
2330 -
2331 -       counter_passed = div64_u64(ktime_to_ns(passed),
2332 -                                  (APIC_BUS_CYCLE_NS * apic->timer.divide_count));
2333 -
2334 -       if (counter_passed > tmcct) {
2335 -               if (unlikely(!apic_lvtt_period(apic))) {
2336 -                       /* one-shot timers stick at 0 until reset */
2337 -                       tmcct = 0;
2338 -               } else {
2339 -                       /*
2340 -                        * periodic timers reset to APIC_TMICT when they
2341 -                        * hit 0. The while loop simulates this happening N
2342 -                        * times. (counter_passed %= tmcct) would also work,
2343 -                        * but might be slower or not work on 32-bit??
2344 -                        */
2345 -                       while (counter_passed > tmcct)
2346 -                               counter_passed -= tmcct;
2347 -                       tmcct -= counter_passed;
2348 -               }
2349 -       } else {
2350 -               tmcct -= counter_passed;
2351 -       }
2352 +       remaining = hrtimer_expires_remaining(&apic->timer.dev);
2353 +       if (ktime_to_ns(remaining) < 0)
2354 +               remaining = ktime_set(0, 0);
2355 +
2356 +       ns = mod_64(ktime_to_ns(remaining), apic->timer.period);
2357 +       tmcct = div64_u64(ns, (APIC_BUS_CYCLE_NS * apic->timer.divide_count));
2358
2359         return tmcct;
2360  }
2361 @@ -639,8 +615,6 @@
2362  {
2363         ktime_t now = apic->timer.dev.base->get_time();
2364
2365 -       apic->timer.last_update = now;
2366 -
2367         apic->timer.period = apic_get_reg(apic, APIC_TMICT) *
2368                     APIC_BUS_CYCLE_NS * apic->timer.divide_count;
2369         atomic_set(&apic->timer.pending, 0);
2370 @@ -1068,16 +1042,6 @@
2371         }
2372  }
2373
2374 -void kvm_apic_timer_intr_post(struct kvm_vcpu *vcpu, int vec)
2375 -{
2376 -       struct kvm_lapic *apic = vcpu->arch.apic;
2377 -
2378 -       if (apic && apic_lvt_vector(apic, APIC_LVTT) == vec)
2379 -               apic->timer.last_update = ktime_add_ns(
2380 -                               apic->timer.last_update,
2381 -                               apic->timer.period);
2382 -}
2383 -
2384  int kvm_get_apic_interrupt(struct kvm_vcpu *vcpu)
2385  {
2386         int vector = kvm_apic_has_interrupt(vcpu);
2387 --- kernel-power-2.6.28.orig/arch/x86/kvm/lapic.h
2388 +++ kernel-power-2.6.28/arch/x86/kvm/lapic.h
2389 @@ -12,7 +12,6 @@
2390                 atomic_t pending;
2391                 s64 period;     /* unit: ns */
2392                 u32 divide_count;
2393 -               ktime_t last_update;
2394                 struct hrtimer dev;
2395         } timer;
2396         struct kvm_vcpu *vcpu;
2397 @@ -42,7 +41,6 @@
2398  void kvm_apic_post_state_restore(struct kvm_vcpu *vcpu);
2399  int kvm_lapic_enabled(struct kvm_vcpu *vcpu);
2400  int kvm_lapic_find_highest_irr(struct kvm_vcpu *vcpu);
2401 -void kvm_apic_timer_intr_post(struct kvm_vcpu *vcpu, int vec);
2402
2403  void kvm_lapic_set_vapic_addr(struct kvm_vcpu *vcpu, gpa_t vapic_addr);
2404  void kvm_lapic_sync_from_vapic(struct kvm_vcpu *vcpu);
2405 --- kernel-power-2.6.28.orig/arch/x86/kvm/mmu.c
2406 +++ kernel-power-2.6.28/arch/x86/kvm/mmu.c
2407 @@ -384,7 +384,9 @@
2408  {
2409         int *write_count;
2410
2411 -       write_count = slot_largepage_idx(gfn, gfn_to_memslot(kvm, gfn));
2412 +       gfn = unalias_gfn(kvm, gfn);
2413 +       write_count = slot_largepage_idx(gfn,
2414 +                                        gfn_to_memslot_unaliased(kvm, gfn));
2415         *write_count += 1;
2416  }
2417
2418 @@ -392,16 +394,20 @@
2419  {
2420         int *write_count;
2421
2422 -       write_count = slot_largepage_idx(gfn, gfn_to_memslot(kvm, gfn));
2423 +       gfn = unalias_gfn(kvm, gfn);
2424 +       write_count = slot_largepage_idx(gfn,
2425 +                                        gfn_to_memslot_unaliased(kvm, gfn));
2426         *write_count -= 1;
2427         WARN_ON(*write_count < 0);
2428  }
2429
2430  static int has_wrprotected_page(struct kvm *kvm, gfn_t gfn)
2431  {
2432 -       struct kvm_memory_slot *slot = gfn_to_memslot(kvm, gfn);
2433 +       struct kvm_memory_slot *slot;
2434         int *largepage_idx;
2435
2436 +       gfn = unalias_gfn(kvm, gfn);
2437 +       slot = gfn_to_memslot_unaliased(kvm, gfn);
2438         if (slot) {
2439                 largepage_idx = slot_largepage_idx(gfn, slot);
2440                 return *largepage_idx;
2441 @@ -787,7 +793,7 @@
2442         set_page_private(virt_to_page(sp->spt), (unsigned long)sp);
2443         list_add(&sp->link, &vcpu->kvm->arch.active_mmu_pages);
2444         ASSERT(is_empty_shadow_page(sp->spt));
2445 -       sp->slot_bitmap = 0;
2446 +       bitmap_zero(sp->slot_bitmap, KVM_MEMORY_SLOTS + KVM_PRIVATE_MEM_SLOTS);
2447         sp->multimapped = 0;
2448         sp->parent_pte = parent_pte;
2449         --vcpu->kvm->arch.n_free_mmu_pages;
2450 @@ -975,7 +981,7 @@
2451         for_each_unsync_children(sp->unsync_child_bitmap, i) {
2452                 u64 ent = sp->spt[i];
2453
2454 -               if (is_shadow_present_pte(ent)) {
2455 +               if (is_shadow_present_pte(ent) && !is_large_pte(ent)) {
2456                         struct kvm_mmu_page *child;
2457                         child = page_header(ent & PT64_BASE_ADDR_MASK);
2458
2459 @@ -1153,6 +1159,8 @@
2460         if (level == PT32E_ROOT_LEVEL) {
2461                 shadow_addr = vcpu->arch.mmu.pae_root[(addr >> 30) & 3];
2462                 shadow_addr &= PT64_BASE_ADDR_MASK;
2463 +               if (!shadow_addr)
2464 +                       return 1;
2465                 --level;
2466         }
2467
2468 @@ -1362,7 +1370,7 @@
2469         int slot = memslot_id(kvm, gfn_to_memslot(kvm, gfn));
2470         struct kvm_mmu_page *sp = page_header(__pa(pte));
2471
2472 -       __set_bit(slot, &sp->slot_bitmap);
2473 +       __set_bit(slot, sp->slot_bitmap);
2474  }
2475
2476  static void mmu_convert_notrap(struct kvm_mmu_page *sp)
2477 @@ -2451,7 +2459,7 @@
2478                 int i;
2479                 u64 *pt;
2480
2481 -               if (!test_bit(slot, &sp->slot_bitmap))
2482 +               if (!test_bit(slot, sp->slot_bitmap))
2483                         continue;
2484
2485                 pt = sp->spt;
2486 @@ -2860,8 +2868,8 @@
2487                 if (sp->role.metaphysical)
2488                         continue;
2489
2490 -               slot = gfn_to_memslot(vcpu->kvm, sp->gfn);
2491                 gfn = unalias_gfn(vcpu->kvm, sp->gfn);
2492 +               slot = gfn_to_memslot_unaliased(vcpu->kvm, sp->gfn);
2493                 rmapp = &slot->rmap[gfn - slot->base_gfn];
2494                 if (*rmapp)
2495                         printk(KERN_ERR "%s: (%s) shadow page has writable"
2496 --- kernel-power-2.6.28.orig/arch/x86/kvm/paging_tmpl.h
2497 +++ kernel-power-2.6.28/arch/x86/kvm/paging_tmpl.h
2498 @@ -467,9 +467,13 @@
2499                                       u64 *sptep, int level)
2500  {
2501
2502 -       if (level == PT_PAGE_TABLE_LEVEL) {
2503 -               if (is_shadow_present_pte(*sptep))
2504 +       if (level == PT_PAGE_TABLE_LEVEL ||
2505 +           ((level == PT_DIRECTORY_LEVEL) && is_large_pte(*sptep))) {
2506 +               if (is_shadow_present_pte(*sptep)) {
2507                         rmap_remove(vcpu->kvm, sptep);
2508 +                       if (is_large_pte(*sptep))
2509 +                               --vcpu->kvm->stat.lpages;
2510 +               }
2511                 set_shadow_pte(sptep, shadow_trap_nonpresent_pte);
2512                 return 1;
2513         }
2514 --- kernel-power-2.6.28.orig/arch/x86/kvm/svm.c
2515 +++ kernel-power-2.6.28/arch/x86/kvm/svm.c
2516 @@ -772,6 +772,22 @@
2517         var->l = (s->attrib >> SVM_SELECTOR_L_SHIFT) & 1;
2518         var->db = (s->attrib >> SVM_SELECTOR_DB_SHIFT) & 1;
2519         var->g = (s->attrib >> SVM_SELECTOR_G_SHIFT) & 1;
2520 +
2521 +       /*
2522 +        * SVM always stores 0 for the 'G' bit in the CS selector in
2523 +        * the VMCB on a VMEXIT. This hurts cross-vendor migration:
2524 +        * Intel's VMENTRY has a check on the 'G' bit.
2525 +        */
2526 +       if (seg == VCPU_SREG_CS)
2527 +               var->g = s->limit > 0xfffff;
2528 +
2529 +       /*
2530 +        * Work around a bug where the busy flag in the tr selector
2531 +        * isn't exposed
2532 +        */
2533 +       if (seg == VCPU_SREG_TR)
2534 +               var->type |= 0x2;
2535 +
2536         var->unusable = !var->present;
2537  }
2538
2539 @@ -1596,7 +1612,6 @@
2540         /* Okay, we can deliver the interrupt: grab it and update PIC state. */
2541         intr_vector = kvm_cpu_get_interrupt(vcpu);
2542         svm_inject_irq(svm, intr_vector);
2543 -       kvm_timer_intr_post(vcpu, intr_vector);
2544  out:
2545         update_cr8_intercept(vcpu);
2546  }
2547 --- kernel-power-2.6.28.orig/arch/x86/kvm/vmx.c
2548 +++ kernel-power-2.6.28/arch/x86/kvm/vmx.c
2549 @@ -897,6 +897,7 @@
2550                 data = vmcs_readl(GUEST_SYSENTER_ESP);
2551                 break;
2552         default:
2553 +               vmx_load_host_state(to_vmx(vcpu));
2554                 msr = find_msr_entry(to_vmx(vcpu), msr_index);
2555                 if (msr) {
2556                         data = msr->data;
2557 @@ -2407,7 +2408,7 @@
2558  {
2559         int ret;
2560         struct kvm_userspace_memory_region tss_mem = {
2561 -               .slot = 8,
2562 +               .slot = TSS_PRIVATE_MEMSLOT,
2563                 .guest_phys_addr = addr,
2564                 .memory_size = PAGE_SIZE * 3,
2565                 .flags = 0,
2566 @@ -3171,10 +3172,8 @@
2567                 else
2568                         enable_irq_window(vcpu);
2569         }
2570 -       if (vcpu->arch.interrupt.pending) {
2571 +       if (vcpu->arch.interrupt.pending)
2572                 vmx_inject_irq(vcpu, vcpu->arch.interrupt.nr);
2573 -               kvm_timer_intr_post(vcpu, vcpu->arch.interrupt.nr);
2574 -       }
2575  }
2576
2577  /*
2578 --- kernel-power-2.6.28.orig/arch/x86/kvm/vmx.h
2579 +++ kernel-power-2.6.28/arch/x86/kvm/vmx.h
2580 @@ -331,8 +331,9 @@
2581
2582  #define AR_RESERVD_MASK 0xfffe0f00
2583
2584 -#define APIC_ACCESS_PAGE_PRIVATE_MEMSLOT       9
2585 -#define IDENTITY_PAGETABLE_PRIVATE_MEMSLOT     10
2586 +#define TSS_PRIVATE_MEMSLOT                    (KVM_MEMORY_SLOTS + 0)
2587 +#define APIC_ACCESS_PAGE_PRIVATE_MEMSLOT       (KVM_MEMORY_SLOTS + 1)
2588 +#define IDENTITY_PAGETABLE_PRIVATE_MEMSLOT     (KVM_MEMORY_SLOTS + 2)
2589
2590  #define VMX_NR_VPIDS                           (1 << 16)
2591  #define VMX_VPID_EXTENT_SINGLE_CONTEXT         1
2592 --- kernel-power-2.6.28.orig/arch/x86/kvm/x86.c
2593 +++ kernel-power-2.6.28/arch/x86/kvm/x86.c
2594 @@ -906,7 +906,6 @@
2595         case KVM_CAP_USER_MEMORY:
2596         case KVM_CAP_SET_TSS_ADDR:
2597         case KVM_CAP_EXT_CPUID:
2598 -       case KVM_CAP_CLOCKSOURCE:
2599         case KVM_CAP_PIT:
2600         case KVM_CAP_NOP_IO_DELAY:
2601         case KVM_CAP_MP_STATE:
2602 @@ -931,6 +930,9 @@
2603         case KVM_CAP_IOMMU:
2604                 r = intel_iommu_found();
2605                 break;
2606 +       case KVM_CAP_CLOCKSOURCE:
2607 +               r = boot_cpu_has(X86_FEATURE_CONSTANT_TSC);
2608 +               break;
2609         default:
2610                 r = 0;
2611                 break;
2612 @@ -1188,6 +1190,7 @@
2613                 int t, times = entry->eax & 0xff;
2614
2615                 entry->flags |= KVM_CPUID_FLAG_STATEFUL_FUNC;
2616 +               entry->flags |= KVM_CPUID_FLAG_STATE_READ_NEXT;
2617                 for (t = 1; t < times && *nent < maxnent; ++t) {
2618                         do_cpuid_1_ent(&entry[t], function, 0);
2619                         entry[t].flags |= KVM_CPUID_FLAG_STATEFUL_FUNC;
2620 @@ -1218,7 +1221,7 @@
2621                 entry->flags |= KVM_CPUID_FLAG_SIGNIFCANT_INDEX;
2622                 /* read more entries until level_type is zero */
2623                 for (i = 1; *nent < maxnent; ++i) {
2624 -                       level_type = entry[i - 1].ecx & 0xff;
2625 +                       level_type = entry[i - 1].ecx & 0xff00;
2626                         if (!level_type)
2627                                 break;
2628                         do_cpuid_1_ent(&entry[i], function, i);
2629 @@ -2729,7 +2732,7 @@
2630
2631         e->flags &= ~KVM_CPUID_FLAG_STATE_READ_NEXT;
2632         /* when no next entry is found, the current entry[i] is reselected */
2633 -       for (j = i + 1; j == i; j = (j + 1) % nent) {
2634 +       for (j = i + 1; ; j = (j + 1) % nent) {
2635                 struct kvm_cpuid_entry2 *ej = &vcpu->arch.cpuid_entries[j];
2636                 if (ej->function == e->function) {
2637                         ej->flags |= KVM_CPUID_FLAG_STATE_READ_NEXT;
2638 @@ -2973,7 +2976,7 @@
2639                 pr_debug("vcpu %d received sipi with vector # %x\n",
2640                          vcpu->vcpu_id, vcpu->arch.sipi_vector);
2641                 kvm_lapic_reset(vcpu);
2642 -               r = kvm_x86_ops->vcpu_reset(vcpu);
2643 +               r = kvm_arch_vcpu_reset(vcpu);
2644                 if (r)
2645                         return r;
2646                 vcpu->arch.mp_state = KVM_MP_STATE_RUNNABLE;
2647 @@ -3925,6 +3928,9 @@
2648
2649  int kvm_arch_vcpu_reset(struct kvm_vcpu *vcpu)
2650  {
2651 +       vcpu->arch.nmi_pending = false;
2652 +       vcpu->arch.nmi_injected = false;
2653 +
2654         return kvm_x86_ops->vcpu_reset(vcpu);
2655  }
2656
2657 --- kernel-power-2.6.28.orig/arch/x86/kvm/x86_emulate.c
2658 +++ kernel-power-2.6.28/arch/x86/kvm/x86_emulate.c
2659 @@ -299,7 +299,7 @@
2660
2661  static u16 group2_table[] = {
2662         [Group7*8] =
2663 -       SrcNone | ModRM, 0, 0, 0,
2664 +       SrcNone | ModRM, 0, 0, SrcNone | ModRM,
2665         SrcNone | ModRM | DstMem | Mov, 0,
2666         SrcMem16 | ModRM | Mov, 0,
2667  };
2668 --- kernel-power-2.6.28.orig/arch/x86/lib/usercopy_32.c
2669 +++ kernel-power-2.6.28/arch/x86/lib/usercopy_32.c
2670 @@ -56,7 +56,7 @@
2671                 "       jmp 2b\n"                                          \
2672                 ".previous\n"                                              \
2673                 _ASM_EXTABLE(0b,3b)                                        \
2674 -               : "=d"(res), "=c"(count), "=&a" (__d0), "=&S" (__d1),      \
2675 +               : "=&d"(res), "=&c"(count), "=&a" (__d0), "=&S" (__d1),    \
2676                   "=&D" (__d2)                                             \
2677                 : "i"(-EFAULT), "0"(count), "1"(count), "3"(src), "4"(dst) \
2678                 : "memory");                                               \
2679 @@ -218,7 +218,7 @@
2680                 "       .align 4\n"
2681                 "       .long 0b,2b\n"
2682                 ".previous"
2683 -               :"=r" (n), "=D" (s), "=a" (res), "=c" (tmp)
2684 +               :"=&r" (n), "=&D" (s), "=&a" (res), "=&c" (tmp)
2685                 :"0" (n), "1" (s), "2" (0), "3" (mask)
2686                 :"cc");
2687         return res & mask;
2688 --- kernel-power-2.6.28.orig/arch/x86/lib/usercopy_64.c
2689 +++ kernel-power-2.6.28/arch/x86/lib/usercopy_64.c
2690 @@ -32,7 +32,7 @@
2691                 "       jmp 2b\n"                                          \
2692                 ".previous\n"                                              \
2693                 _ASM_EXTABLE(0b,3b)                                        \
2694 -               : "=r"(res), "=c"(count), "=&a" (__d0), "=&S" (__d1),      \
2695 +               : "=&r"(res), "=&c"(count), "=&a" (__d0), "=&S" (__d1),    \
2696                   "=&D" (__d2)                                             \
2697                 : "i"(-EFAULT), "0"(count), "1"(count), "3"(src), "4"(dst) \
2698                 : "memory");                                               \
2699 @@ -86,7 +86,7 @@
2700                 ".previous\n"
2701                 _ASM_EXTABLE(0b,3b)
2702                 _ASM_EXTABLE(1b,2b)
2703 -               : [size8] "=c"(size), [dst] "=&D" (__d0)
2704 +               : [size8] "=&c"(size), [dst] "=&D" (__d0)
2705                 : [size1] "r"(size & 7), "[size8]" (size / 8), "[dst]"(addr),
2706                   [zero] "r" (0UL), [eight] "r" (8UL));
2707         return size;
2708 --- kernel-power-2.6.28.orig/arch/x86/math-emu/fpu_entry.c
2709 +++ kernel-power-2.6.28/arch/x86/math-emu/fpu_entry.c
2710 @@ -131,7 +131,7 @@
2711  static int valid_prefix(u_char *Byte, u_char __user ** fpu_eip,
2712                         overrides * override);
2713
2714 -asmlinkage void math_emulate(long arg)
2715 +void math_emulate(struct math_emu_info *info)
2716  {
2717         u_char FPU_modrm, byte1;
2718         unsigned short code;
2719 @@ -161,7 +161,7 @@
2720         RE_ENTRANT_CHECK_ON;
2721  #endif /* RE_ENTRANT_CHECKING */
2722
2723 -       SETUP_DATA_AREA(arg);
2724 +       FPU_info = info;
2725
2726         FPU_ORIG_EIP = FPU_EIP;
2727
2728 @@ -659,7 +659,7 @@
2729         }
2730  }
2731
2732 -void math_abort(struct info *info, unsigned int signal)
2733 +void math_abort(struct math_emu_info *info, unsigned int signal)
2734  {
2735         FPU_EIP = FPU_ORIG_EIP;
2736         current->thread.trap_no = 16;
2737 --- kernel-power-2.6.28.orig/arch/x86/math-emu/fpu_proto.h
2738 +++ kernel-power-2.6.28/arch/x86/math-emu/fpu_proto.h
2739 @@ -51,8 +51,8 @@
2740  extern void fst_i_(void);
2741  extern void fstp_i(void);
2742  /* fpu_entry.c */
2743 -asmlinkage extern void math_emulate(long arg);
2744 -extern void math_abort(struct info *info, unsigned int signal);
2745 +extern void math_emulate(struct math_emu_info *info);
2746 +extern void math_abort(struct math_emu_info *info, unsigned int signal);
2747  /* fpu_etc.c */
2748  extern void FPU_etc(void);
2749  /* fpu_tags.c */
2750 --- kernel-power-2.6.28.orig/arch/x86/math-emu/fpu_system.h
2751 +++ kernel-power-2.6.28/arch/x86/math-emu/fpu_system.h
2752 @@ -16,10 +16,6 @@
2753  #include <linux/kernel.h>
2754  #include <linux/mm.h>
2755
2756 -/* This sets the pointer FPU_info to point to the argument part
2757 -   of the stack frame of math_emulate() */
2758 -#define SETUP_DATA_AREA(arg)   FPU_info = (struct info *) &arg
2759 -
2760  /* s is always from a cpu register, and the cpu does bounds checking
2761   * during register load --> no further bounds checks needed */
2762  #define LDT_DESCRIPTOR(s)      (((struct desc_struct *)current->mm->context.ldt)[(s) >> 3])
2763 @@ -38,12 +34,12 @@
2764  #define I387                   (current->thread.xstate)
2765  #define FPU_info               (I387->soft.info)
2766
2767 -#define FPU_CS                 (*(unsigned short *) &(FPU_info->___cs))
2768 -#define FPU_SS                 (*(unsigned short *) &(FPU_info->___ss))
2769 -#define FPU_DS                 (*(unsigned short *) &(FPU_info->___ds))
2770 -#define FPU_EAX                        (FPU_info->___eax)
2771 -#define FPU_EFLAGS             (FPU_info->___eflags)
2772 -#define FPU_EIP                        (FPU_info->___eip)
2773 +#define FPU_CS                 (*(unsigned short *) &(FPU_info->regs->cs))
2774 +#define FPU_SS                 (*(unsigned short *) &(FPU_info->regs->ss))
2775 +#define FPU_DS                 (*(unsigned short *) &(FPU_info->regs->ds))
2776 +#define FPU_EAX                        (FPU_info->regs->ax)
2777 +#define FPU_EFLAGS             (FPU_info->regs->flags)
2778 +#define FPU_EIP                        (FPU_info->regs->ip)
2779  #define FPU_ORIG_EIP           (FPU_info->___orig_eip)
2780
2781  #define FPU_lookahead           (I387->soft.lookahead)
2782 --- kernel-power-2.6.28.orig/arch/x86/math-emu/get_address.c
2783 +++ kernel-power-2.6.28/arch/x86/math-emu/get_address.c
2784 @@ -29,46 +29,43 @@
2785  #define FPU_WRITE_BIT 0x10
2786
2787  static int reg_offset[] = {
2788 -       offsetof(struct info, ___eax),
2789 -       offsetof(struct info, ___ecx),
2790 -       offsetof(struct info, ___edx),
2791 -       offsetof(struct info, ___ebx),
2792 -       offsetof(struct info, ___esp),
2793 -       offsetof(struct info, ___ebp),
2794 -       offsetof(struct info, ___esi),
2795 -       offsetof(struct info, ___edi)
2796 +       offsetof(struct pt_regs, ax),
2797 +       offsetof(struct pt_regs, cx),
2798 +       offsetof(struct pt_regs, dx),
2799 +       offsetof(struct pt_regs, bx),
2800 +       offsetof(struct pt_regs, sp),
2801 +       offsetof(struct pt_regs, bp),
2802 +       offsetof(struct pt_regs, si),
2803 +       offsetof(struct pt_regs, di)
2804  };
2805
2806 -#define REG_(x) (*(long *)(reg_offset[(x)]+(u_char *) FPU_info))
2807 +#define REG_(x) (*(long *)(reg_offset[(x)] + (u_char *)FPU_info->regs))
2808
2809  static int reg_offset_vm86[] = {
2810 -       offsetof(struct info, ___cs),
2811 -       offsetof(struct info, ___vm86_ds),
2812 -       offsetof(struct info, ___vm86_es),
2813 -       offsetof(struct info, ___vm86_fs),
2814 -       offsetof(struct info, ___vm86_gs),
2815 -       offsetof(struct info, ___ss),
2816 -       offsetof(struct info, ___vm86_ds)
2817 +       offsetof(struct pt_regs, cs),
2818 +       offsetof(struct kernel_vm86_regs, ds),
2819 +       offsetof(struct kernel_vm86_regs, es),
2820 +       offsetof(struct kernel_vm86_regs, fs),
2821 +       offsetof(struct kernel_vm86_regs, gs),
2822 +       offsetof(struct pt_regs, ss),
2823 +       offsetof(struct kernel_vm86_regs, ds)
2824  };
2825
2826  #define VM86_REG_(x) (*(unsigned short *) \
2827 -                     (reg_offset_vm86[((unsigned)x)]+(u_char *) FPU_info))
2828 -
2829 -/* This dummy, gs is not saved on the stack. */
2830 -#define ___GS ___ds
2831 +               (reg_offset_vm86[((unsigned)x)] + (u_char *)FPU_info->regs))
2832
2833  static int reg_offset_pm[] = {
2834 -       offsetof(struct info, ___cs),
2835 -       offsetof(struct info, ___ds),
2836 -       offsetof(struct info, ___es),
2837 -       offsetof(struct info, ___fs),
2838 -       offsetof(struct info, ___GS),
2839 -       offsetof(struct info, ___ss),
2840 -       offsetof(struct info, ___ds)
2841 +       offsetof(struct pt_regs, cs),
2842 +       offsetof(struct pt_regs, ds),
2843 +       offsetof(struct pt_regs, es),
2844 +       offsetof(struct pt_regs, fs),
2845 +       offsetof(struct pt_regs, ds),   /* dummy, not saved on stack */
2846 +       offsetof(struct pt_regs, ss),
2847 +       offsetof(struct pt_regs, ds)
2848  };
2849
2850  #define PM_REG_(x) (*(unsigned short *) \
2851 -                     (reg_offset_pm[((unsigned)x)]+(u_char *) FPU_info))
2852 +               (reg_offset_pm[((unsigned)x)] + (u_char *)FPU_info->regs))
2853
2854  /* Decode the SIB byte. This function assumes mod != 0 */
2855  static int sib(int mod, unsigned long *fpu_eip)
2856 @@ -349,34 +346,34 @@
2857         }
2858         switch (rm) {
2859         case 0:
2860 -               address += FPU_info->___ebx + FPU_info->___esi;
2861 +               address += FPU_info->regs->bx + FPU_info->regs->si;
2862                 break;
2863         case 1:
2864 -               address += FPU_info->___ebx + FPU_info->___edi;
2865 +               address += FPU_info->regs->bx + FPU_info->regs->di;
2866                 break;
2867         case 2:
2868 -               address += FPU_info->___ebp + FPU_info->___esi;
2869 +               address += FPU_info->regs->bp + FPU_info->regs->si;
2870                 if (addr_modes.override.segment == PREFIX_DEFAULT)
2871                         addr_modes.override.segment = PREFIX_SS_;
2872                 break;
2873         case 3:
2874 -               address += FPU_info->___ebp + FPU_info->___edi;
2875 +               address += FPU_info->regs->bp + FPU_info->regs->di;
2876                 if (addr_modes.override.segment == PREFIX_DEFAULT)
2877                         addr_modes.override.segment = PREFIX_SS_;
2878                 break;
2879         case 4:
2880 -               address += FPU_info->___esi;
2881 +               address += FPU_info->regs->si;
2882                 break;
2883         case 5:
2884 -               address += FPU_info->___edi;
2885 +               address += FPU_info->regs->di;
2886                 break;
2887         case 6:
2888 -               address += FPU_info->___ebp;
2889 +               address += FPU_info->regs->bp;
2890                 if (addr_modes.override.segment == PREFIX_DEFAULT)
2891                         addr_modes.override.segment = PREFIX_SS_;
2892                 break;
2893         case 7:
2894 -               address += FPU_info->___ebx;
2895 +               address += FPU_info->regs->bx;
2896                 break;
2897         }
2898
2899 --- kernel-power-2.6.28.orig/arch/x86/mm/fault.c
2900 +++ kernel-power-2.6.28/arch/x86/mm/fault.c
2901 @@ -533,7 +533,7 @@
2902            happen within a race in page table update. In the later
2903            case just flush. */
2904
2905 -       pgd = pgd_offset(current->mm ?: &init_mm, address);
2906 +       pgd = pgd_offset(current->active_mm, address);
2907         pgd_ref = pgd_offset_k(address);
2908         if (pgd_none(*pgd_ref))
2909                 return -1;
2910 @@ -601,8 +601,6 @@
2911
2912         si_code = SEGV_MAPERR;
2913
2914 -       if (notify_page_fault(regs))
2915 -               return;
2916         if (unlikely(kmmio_fault(regs, address)))
2917                 return;
2918
2919 @@ -632,6 +630,9 @@
2920                 if (spurious_fault(address, error_code))
2921                         return;
2922
2923 +               /* kprobes don't want to hook the spurious faults. */
2924 +               if (notify_page_fault(regs))
2925 +                       return;
2926                 /*
2927                  * Don't take the mm semaphore here. If we fixup a prefetch
2928                  * fault we could otherwise deadlock.
2929 @@ -639,6 +640,9 @@
2930                 goto bad_area_nosemaphore;
2931         }
2932
2933 +       /* kprobes don't want to hook the spurious faults. */
2934 +       if (notify_page_fault(regs))
2935 +               return;
2936
2937         /*
2938          * It's safe to allow irq's after cr2 has been saved and the
2939 --- kernel-power-2.6.28.orig/arch/x86/mm/numa_64.c
2940 +++ kernel-power-2.6.28/arch/x86/mm/numa_64.c
2941 @@ -145,7 +145,7 @@
2942         return shift;
2943  }
2944
2945 -int early_pfn_to_nid(unsigned long pfn)
2946 +int __meminit  __early_pfn_to_nid(unsigned long pfn)
2947  {
2948         return phys_to_nid(pfn << PAGE_SHIFT);
2949  }
2950 --- kernel-power-2.6.28.orig/arch/x86/mm/pageattr.c
2951 +++ kernel-power-2.6.28/arch/x86/mm/pageattr.c
2952 @@ -534,6 +534,36 @@
2953         return 0;
2954  }
2955
2956 +static int __cpa_process_fault(struct cpa_data *cpa, unsigned long vaddr,
2957 +                              int primary)
2958 +{
2959 +       /*
2960 +        * Ignore all non primary paths.
2961 +        */
2962 +       if (!primary)
2963 +               return 0;
2964 +
2965 +       /*
2966 +        * Ignore the NULL PTE for kernel identity mapping, as it is expected
2967 +        * to have holes.
2968 +        * Also set numpages to '1' indicating that we processed cpa req for
2969 +        * one virtual address page and its pfn. TBD: numpages can be set based
2970 +        * on the initial value and the level returned by lookup_address().
2971 +        */
2972 +       if (within(vaddr, PAGE_OFFSET,
2973 +                  PAGE_OFFSET + (max_pfn_mapped << PAGE_SHIFT))) {
2974 +               cpa->numpages = 1;
2975 +               cpa->pfn = __pa(vaddr) >> PAGE_SHIFT;
2976 +               return 0;
2977 +       } else {
2978 +               WARN(1, KERN_WARNING "CPA: called for zero pte. "
2979 +                       "vaddr = %lx cpa->vaddr = %lx\n", vaddr,
2980 +                       *cpa->vaddr);
2981 +
2982 +               return -EFAULT;
2983 +       }
2984 +}
2985 +
2986  static int __change_page_attr(struct cpa_data *cpa, int primary)
2987  {
2988         unsigned long address;
2989 @@ -546,20 +576,21 @@
2990         else
2991                 address = *cpa->vaddr;
2992
2993 +       /*
2994 +        * If we're called with lazy mmu updates enabled, the
2995 +        * in-memory pte state may be stale.  Flush pending updates to
2996 +        * bring them up to date.
2997 +        */
2998 +       arch_flush_lazy_mmu_mode();
2999 +
3000  repeat:
3001         kpte = lookup_address(address, &level);
3002         if (!kpte)
3003 -               return 0;
3004 +               return __cpa_process_fault(cpa, address, primary);
3005
3006         old_pte = *kpte;
3007 -       if (!pte_val(old_pte)) {
3008 -               if (!primary)
3009 -                       return 0;
3010 -               WARN(1, KERN_WARNING "CPA: called for zero pte. "
3011 -                      "vaddr = %lx cpa->vaddr = %lx\n", address,
3012 -                      *cpa->vaddr);
3013 -               return -EINVAL;
3014 -       }
3015 +       if (!pte_val(old_pte))
3016 +               return __cpa_process_fault(cpa, address, primary);
3017
3018         if (level == PG_LEVEL_4K) {
3019                 pte_t new_pte;
3020 @@ -657,12 +688,7 @@
3021                 vaddr = *cpa->vaddr;
3022
3023         if (!(within(vaddr, PAGE_OFFSET,
3024 -                   PAGE_OFFSET + (max_low_pfn_mapped << PAGE_SHIFT))
3025 -#ifdef CONFIG_X86_64
3026 -               || within(vaddr, PAGE_OFFSET + (1UL<<32),
3027 -                   PAGE_OFFSET + (max_pfn_mapped << PAGE_SHIFT))
3028 -#endif
3029 -       )) {
3030 +                   PAGE_OFFSET + (max_pfn_mapped << PAGE_SHIFT)))) {
3031
3032                 alias_cpa = *cpa;
3033                 temp_cpa_vaddr = (unsigned long) __va(cpa->pfn << PAGE_SHIFT);
3034 @@ -835,6 +861,13 @@
3035         } else
3036                 cpa_flush_all(cache);
3037
3038 +       /*
3039 +        * If we've been called with lazy mmu updates enabled, then
3040 +        * make sure that everything gets flushed out before we
3041 +        * return.
3042 +        */
3043 +       arch_flush_lazy_mmu_mode();
3044 +
3045  out:
3046         return ret;
3047  }
3048 --- kernel-power-2.6.28.orig/arch/x86/mm/pat.c
3049 +++ kernel-power-2.6.28/arch/x86/mm/pat.c
3050 @@ -333,11 +333,23 @@
3051                                               req_type & _PAGE_CACHE_MASK);
3052         }
3053
3054 -       is_range_ram = pagerange_is_ram(start, end);
3055 -       if (is_range_ram == 1)
3056 -               return reserve_ram_pages_type(start, end, req_type, new_type);
3057 -       else if (is_range_ram < 0)
3058 -               return -EINVAL;
3059 +       if (new_type)
3060 +               *new_type = actual_type;
3061 +
3062 +       /*
3063 +        * For legacy reasons, some parts of the physical address range in the
3064 +        * legacy 1MB region is treated as non-RAM (even when listed as RAM in
3065 +        * the e820 tables).  So we will track the memory attributes of this
3066 +        * legacy 1MB region using the linear memtype_list always.
3067 +        */
3068 +       if (end >= ISA_END_ADDRESS) {
3069 +               is_range_ram = pagerange_is_ram(start, end);
3070 +               if (is_range_ram == 1)
3071 +                       return reserve_ram_pages_type(start, end, req_type,
3072 +                                                     new_type);
3073 +               else if (is_range_ram < 0)
3074 +                       return -EINVAL;
3075 +       }
3076
3077         new  = kmalloc(sizeof(struct memtype), GFP_KERNEL);
3078         if (!new)
3079 @@ -347,9 +359,6 @@
3080         new->end        = end;
3081         new->type       = actual_type;
3082
3083 -       if (new_type)
3084 -               *new_type = actual_type;
3085 -
3086         spin_lock(&memtype_lock);
3087
3088         if (cached_entry && start >= cached_start)
3089 @@ -437,11 +446,19 @@
3090         if (is_ISA_range(start, end - 1))
3091                 return 0;
3092
3093 -       is_range_ram = pagerange_is_ram(start, end);
3094 -       if (is_range_ram == 1)
3095 -               return free_ram_pages_type(start, end);
3096 -       else if (is_range_ram < 0)
3097 -               return -EINVAL;
3098 +       /*
3099 +        * For legacy reasons, some parts of the physical address range in the
3100 +        * legacy 1MB region is treated as non-RAM (even when listed as RAM in
3101 +        * the e820 tables).  So we will track the memory attributes of this
3102 +        * legacy 1MB region using the linear memtype_list always.
3103 +        */
3104 +       if (end >= ISA_END_ADDRESS) {
3105 +               is_range_ram = pagerange_is_ram(start, end);
3106 +               if (is_range_ram == 1)
3107 +                       return free_ram_pages_type(start, end);
3108 +               else if (is_range_ram < 0)
3109 +                       return -EINVAL;
3110 +       }
3111
3112         spin_lock(&memtype_lock);
3113         list_for_each_entry(entry, &memtype_list, nd) {
3114 --- kernel-power-2.6.28.orig/arch/x86/oprofile/op_model_ppro.c
3115 +++ kernel-power-2.6.28/arch/x86/oprofile/op_model_ppro.c
3116 @@ -78,8 +78,18 @@
3117         if (cpu_has_arch_perfmon) {
3118                 union cpuid10_eax eax;
3119                 eax.full = cpuid_eax(0xa);
3120 -               if (counter_width < eax.split.bit_width)
3121 -                       counter_width = eax.split.bit_width;
3122 +
3123 +               /*
3124 +                * For Core2 (family 6, model 15), don't reset the
3125 +                * counter width:
3126 +                */
3127 +               if (!(eax.split.version_id == 0 &&
3128 +                       current_cpu_data.x86 == 6 &&
3129 +                               current_cpu_data.x86_model == 15)) {
3130 +
3131 +                       if (counter_width < eax.split.bit_width)
3132 +                               counter_width = eax.split.bit_width;
3133 +               }
3134         }
3135
3136         /* clear all counters */
3137 --- kernel-power-2.6.28.orig/arch/x86/pci/i386.c
3138 +++ kernel-power-2.6.28/arch/x86/pci/i386.c
3139 @@ -329,6 +329,9 @@
3140                         return -EINVAL;
3141                 }
3142                 flags = new_flags;
3143 +               vma->vm_page_prot = __pgprot(
3144 +                       (pgprot_val(vma->vm_page_prot) & ~_PAGE_CACHE_MASK) |
3145 +                       flags);
3146         }
3147
3148         if (((vma->vm_pgoff < max_low_pfn_mapped) ||
3149 --- kernel-power-2.6.28.orig/arch/x86/pci/irq.c
3150 +++ kernel-power-2.6.28/arch/x86/pci/irq.c
3151 @@ -573,6 +573,7 @@
3152         case PCI_DEVICE_ID_INTEL_ICH7_1:
3153         case PCI_DEVICE_ID_INTEL_ICH7_30:
3154         case PCI_DEVICE_ID_INTEL_ICH7_31:
3155 +       case PCI_DEVICE_ID_INTEL_TGP_LPC:
3156         case PCI_DEVICE_ID_INTEL_ESB2_0:
3157         case PCI_DEVICE_ID_INTEL_ICH8_0:
3158         case PCI_DEVICE_ID_INTEL_ICH8_1:
3159 --- kernel-power-2.6.28.orig/arch/x86/xen/enlighten.c
3160 +++ kernel-power-2.6.28/arch/x86/xen/enlighten.c
3161 @@ -1669,6 +1669,9 @@
3162            possible map and a non-dummy shared_info. */
3163         per_cpu(xen_vcpu, 0) = &HYPERVISOR_shared_info->vcpu_info[0];
3164
3165 +       local_irq_disable();
3166 +       early_boot_irqs_off();
3167 +
3168         xen_raw_console_write("mapping kernel into physical memory\n");
3169         pgd = xen_setup_kernel_pagetable(pgd, xen_start_info->nr_pages);
3170
3171 --- kernel-power-2.6.28.orig/block/genhd.c
3172 +++ kernel-power-2.6.28/block/genhd.c
3173 @@ -98,7 +98,7 @@
3174
3175         if (flags & DISK_PITER_REVERSE)
3176                 piter->idx = ptbl->len - 1;
3177 -       else if (flags & DISK_PITER_INCL_PART0)
3178 +       else if (flags & (DISK_PITER_INCL_PART0 | DISK_PITER_INCL_EMPTY_PART0))
3179                 piter->idx = 0;
3180         else
3181                 piter->idx = 1;
3182 @@ -134,7 +134,8 @@
3183         /* determine iteration parameters */
3184         if (piter->flags & DISK_PITER_REVERSE) {
3185                 inc = -1;
3186 -               if (piter->flags & DISK_PITER_INCL_PART0)
3187 +               if (piter->flags & (DISK_PITER_INCL_PART0 |
3188 +                                   DISK_PITER_INCL_EMPTY_PART0))
3189                         end = -1;
3190                 else
3191                         end = 0;
3192 @@ -150,7 +151,10 @@
3193                 part = rcu_dereference(ptbl->part[piter->idx]);
3194                 if (!part)
3195                         continue;
3196 -               if (!(piter->flags & DISK_PITER_INCL_EMPTY) && !part->nr_sects)
3197 +               if (!part->nr_sects &&
3198 +                   !(piter->flags & DISK_PITER_INCL_EMPTY) &&
3199 +                   !(piter->flags & DISK_PITER_INCL_EMPTY_PART0 &&
3200 +                     piter->idx == 0))
3201                         continue;
3202
3203                 get_device(part_to_dev(part));
3204 @@ -994,7 +998,7 @@
3205                                 "\n\n");
3206         */
3207
3208 -       disk_part_iter_init(&piter, gp, DISK_PITER_INCL_PART0);
3209 +       disk_part_iter_init(&piter, gp, DISK_PITER_INCL_EMPTY_PART0);
3210         while ((hd = disk_part_iter_next(&piter))) {
3211                 cpu = part_stat_lock();
3212                 part_round_stats(cpu, hd);
3213 --- kernel-power-2.6.28.orig/crypto/algapi.c
3214 +++ kernel-power-2.6.28/crypto/algapi.c
3215 @@ -149,6 +149,9 @@
3216                 if (q == alg)
3217                         goto err;
3218
3219 +               if (crypto_is_moribund(q))
3220 +                       continue;
3221 +
3222                 if (crypto_is_larval(q)) {
3223                         if (!strcmp(alg->cra_driver_name, q->cra_driver_name))
3224                                 goto err;
3225 @@ -197,7 +200,7 @@
3226
3227         down_write(&crypto_alg_sem);
3228         list_for_each_entry(q, &crypto_alg_list, cra_list) {
3229 -               if (!crypto_is_larval(q))
3230 +               if (crypto_is_moribund(q) || !crypto_is_larval(q))
3231                         continue;
3232
3233                 test = (struct crypto_larval *)q;
3234 @@ -210,6 +213,7 @@
3235         goto unlock;
3236
3237  found:
3238 +       q->cra_flags |= CRYPTO_ALG_DEAD;
3239         alg = test->adult;
3240         if (err || list_empty(&alg->cra_list))
3241                 goto complete;
3242 --- kernel-power-2.6.28.orig/crypto/async_tx/async_tx.c
3243 +++ kernel-power-2.6.28/crypto/async_tx/async_tx.c
3244 @@ -124,6 +124,8 @@
3245         if (!dep)
3246                 return;
3247
3248 +       /* we'll submit tx->next now, so clear the link */
3249 +       tx->next = NULL;
3250         chan = dep->chan;
3251
3252         /* keep submitting up until a channel switch is detected
3253 --- kernel-power-2.6.28.orig/crypto/authenc.c
3254 +++ kernel-power-2.6.28/crypto/authenc.c
3255 @@ -157,16 +157,19 @@
3256         dstp = sg_page(dst);
3257         vdst = PageHighMem(dstp) ? NULL : page_address(dstp) + dst->offset;
3258
3259 -       sg_init_table(cipher, 2);
3260 -       sg_set_buf(cipher, iv, ivsize);
3261 -       authenc_chain(cipher, dst, vdst == iv + ivsize);
3262 +       if (ivsize) {
3263 +               sg_init_table(cipher, 2);
3264 +               sg_set_buf(cipher, iv, ivsize);
3265 +               authenc_chain(cipher, dst, vdst == iv + ivsize);
3266 +               dst = cipher;
3267 +       }
3268
3269         cryptlen = req->cryptlen + ivsize;
3270 -       hash = crypto_authenc_hash(req, flags, cipher, cryptlen);
3271 +       hash = crypto_authenc_hash(req, flags, dst, cryptlen);
3272         if (IS_ERR(hash))
3273                 return PTR_ERR(hash);
3274
3275 -       scatterwalk_map_and_copy(hash, cipher, cryptlen,
3276 +       scatterwalk_map_and_copy(hash, dst, cryptlen,
3277                                  crypto_aead_authsize(authenc), 1);
3278         return 0;
3279  }
3280 @@ -284,11 +287,14 @@
3281         srcp = sg_page(src);
3282         vsrc = PageHighMem(srcp) ? NULL : page_address(srcp) + src->offset;
3283
3284 -       sg_init_table(cipher, 2);
3285 -       sg_set_buf(cipher, iv, ivsize);
3286 -       authenc_chain(cipher, src, vsrc == iv + ivsize);
3287 +       if (ivsize) {
3288 +               sg_init_table(cipher, 2);
3289 +               sg_set_buf(cipher, iv, ivsize);
3290 +               authenc_chain(cipher, src, vsrc == iv + ivsize);
3291 +               src = cipher;
3292 +       }
3293
3294 -       return crypto_authenc_verify(req, cipher, cryptlen + ivsize);
3295 +       return crypto_authenc_verify(req, src, cryptlen + ivsize);
3296  }
3297
3298  static int crypto_authenc_decrypt(struct aead_request *req)
3299 --- kernel-power-2.6.28.orig/crypto/ccm.c
3300 +++ kernel-power-2.6.28/crypto/ccm.c
3301 @@ -266,6 +266,8 @@
3302         if (assoclen) {
3303                 pctx->ilen = format_adata(idata, assoclen);
3304                 get_data_to_compute(cipher, pctx, req->assoc, req->assoclen);
3305 +       } else {
3306 +               pctx->ilen = 0;
3307         }
3308
3309         /* compute plaintext into mac */
3310 --- kernel-power-2.6.28.orig/drivers/acpi/asus_acpi.c
3311 +++ kernel-power-2.6.28/drivers/acpi/asus_acpi.c
3312 @@ -143,6 +143,7 @@
3313                                                          S1300N, S5200N*/
3314                 A4S,            /* Z81sp */
3315                 F3Sa,           /* (Centrino) */
3316 +               R1F,
3317                 END_MODEL
3318         } model;                /* Models currently supported */
3319         u16 event_count[128];   /* Count for each event TODO make this better */
3320 @@ -420,7 +421,18 @@
3321                 .display_get    = "\\ADVG",
3322                 .display_set    = "SDSP",
3323         },
3324 -
3325 +       {
3326 +               .name = "R1F",
3327 +               .mt_bt_switch = "BLED",
3328 +               .mt_mled = "MLED",
3329 +               .mt_wled = "WLED",
3330 +               .mt_lcd_switch = "\\Q10",
3331 +               .lcd_status = "\\GP06",
3332 +               .brightness_set = "SPLV",
3333 +               .brightness_get = "GPLV",
3334 +               .display_set = "SDSP",
3335 +               .display_get = "\\INFB"
3336 +       }
3337  };
3338
3339  /* procdir we use */
3340 @@ -1165,6 +1177,8 @@
3341                 return W3V;
3342         else if (strncmp(model, "W5A", 3) == 0)
3343                 return W5A;
3344 +       else if (strncmp(model, "R1F", 3) == 0)
3345 +               return R1F;
3346         else if (strncmp(model, "A4S", 3) == 0)
3347                 return A4S;
3348         else if (strncmp(model, "F3Sa", 4) == 0)
3349 --- kernel-power-2.6.28.orig/drivers/acpi/battery.c
3350 +++ kernel-power-2.6.28/drivers/acpi/battery.c
3351 @@ -471,7 +471,7 @@
3352
3353  static int acpi_battery_update(struct acpi_battery *battery)
3354  {
3355 -       int result;
3356 +       int result, old_present = acpi_battery_present(battery);
3357         result = acpi_battery_get_status(battery);
3358         if (result)
3359                 return result;
3360 @@ -482,7 +482,8 @@
3361                 return 0;
3362         }
3363  #endif
3364 -       if (!battery->update_time) {
3365 +       if (!battery->update_time ||
3366 +           old_present != acpi_battery_present(battery)) {
3367                 result = acpi_battery_get_info(battery);
3368                 if (result)
3369                         return result;
3370 --- kernel-power-2.6.28.orig/drivers/acpi/dock.c
3371 +++ kernel-power-2.6.28/drivers/acpi/dock.c
3372 @@ -855,10 +855,14 @@
3373  static ssize_t show_docked(struct device *dev,
3374                            struct device_attribute *attr, char *buf)
3375  {
3376 +       struct acpi_device *tmp;
3377 +
3378         struct dock_station *dock_station = *((struct dock_station **)
3379                 dev->platform_data);
3380 -       return snprintf(buf, PAGE_SIZE, "%d\n", dock_present(dock_station));
3381
3382 +       if (ACPI_SUCCESS(acpi_bus_get_device(dock_station->handle, &tmp)))
3383 +               return snprintf(buf, PAGE_SIZE, "1\n");
3384 +       return snprintf(buf, PAGE_SIZE, "0\n");
3385  }
3386  static DEVICE_ATTR(docked, S_IRUGO, show_docked, NULL);
3387
3388 @@ -1142,9 +1146,10 @@
3389  static void __exit dock_exit(void)
3390  {
3391         struct dock_station *dock_station;
3392 +       struct dock_station *tmp;
3393
3394         unregister_acpi_bus_notifier(&dock_acpi_notifier);
3395 -       list_for_each_entry(dock_station, &dock_stations, sibiling)
3396 +       list_for_each_entry_safe(dock_station, tmp, &dock_stations, sibiling)
3397                 dock_remove(dock_station);
3398  }
3399
3400 --- kernel-power-2.6.28.orig/drivers/acpi/ec.c
3401 +++ kernel-power-2.6.28/drivers/acpi/ec.c
3402 @@ -759,9 +759,10 @@
3403         struct acpi_namespace_node *node = handle;
3404         struct acpi_ec *ec = context;
3405         int value = 0;
3406 -       if (sscanf(node->name.ascii, "_Q%x", &value) == 1) {
3407 +
3408 +       if (sscanf(node->name.ascii, "_Q%2x", &value) == 1)
3409                 acpi_ec_add_query_handler(ec, value, handle, NULL, NULL);
3410 -       }
3411 +
3412         return AE_OK;
3413  }
3414
3415 --- kernel-power-2.6.28.orig/drivers/acpi/namespace/nsutils.c
3416 +++ kernel-power-2.6.28/drivers/acpi/namespace/nsutils.c
3417 @@ -314,9 +314,15 @@
3418          *
3419          * strlen() + 1 covers the first name_seg, which has no path separator
3420          */
3421 -       if (acpi_ns_valid_root_prefix(next_external_char[0])) {
3422 +       if (acpi_ns_valid_root_prefix(*next_external_char)) {
3423                 info->fully_qualified = TRUE;
3424                 next_external_char++;
3425 +
3426 +               /* Skip redundant root_prefix, like \\_SB.PCI0.SBRG.EC0 */
3427 +
3428 +               while (acpi_ns_valid_root_prefix(*next_external_char)) {
3429 +                       next_external_char++;
3430 +               }
3431         } else {
3432                 /*
3433                  * Handle Carat prefixes
3434 --- kernel-power-2.6.28.orig/drivers/acpi/pci_link.c
3435 +++ kernel-power-2.6.28/drivers/acpi/pci_link.c
3436 @@ -796,10 +796,6 @@
3437         struct list_head *node = NULL;
3438         struct acpi_pci_link *link = NULL;
3439
3440 -
3441 -       /* Make sure SCI is enabled again (Apple firmware bug?) */
3442 -       acpi_set_register(ACPI_BITREG_SCI_ENABLE, 1);
3443 -
3444         list_for_each(node, &acpi_link.entries) {
3445                 link = list_entry(node, struct acpi_pci_link, node);
3446                 if (!link) {
3447 --- kernel-power-2.6.28.orig/drivers/acpi/power.c
3448 +++ kernel-power-2.6.28/drivers/acpi/power.c
3449 @@ -151,7 +151,7 @@
3450         *state = (sta & 0x01)?ACPI_POWER_RESOURCE_STATE_ON:
3451                               ACPI_POWER_RESOURCE_STATE_OFF;
3452
3453 -       ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Resource [%s] is %s\n",
3454 +       ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Resource [%4.4s] is %s\n",
3455                           acpi_ut_get_node_name(handle),
3456                                 *state ? "on" : "off"));
3457
3458 --- kernel-power-2.6.28.orig/drivers/acpi/tables.c
3459 +++ kernel-power-2.6.28/drivers/acpi/tables.c
3460 @@ -293,7 +293,12 @@
3461
3462  int __init acpi_table_init(void)
3463  {
3464 -       acpi_initialize_tables(initial_tables, ACPI_MAX_TABLES, 0);
3465 +       acpi_status status;
3466 +
3467 +       status = acpi_initialize_tables(initial_tables, ACPI_MAX_TABLES, 0);
3468 +       if (ACPI_FAILURE(status))
3469 +               return 1;
3470 +
3471         check_multiple_madt();
3472         return 0;
3473  }
3474 --- kernel-power-2.6.28.orig/drivers/acpi/tables/tbutils.c
3475 +++ kernel-power-2.6.28/drivers/acpi/tables/tbutils.c
3476 @@ -512,10 +512,9 @@
3477                         if (ACPI_FAILURE(status)) {
3478                                 ACPI_WARNING((AE_INFO,
3479                                               "Truncating %u table entries!",
3480 -                                             (unsigned)
3481 -                                             (acpi_gbl_root_table_list.size -
3482 -                                              acpi_gbl_root_table_list.
3483 -                                              count)));
3484 +                                             (unsigned) (table_count -
3485 +                                              (acpi_gbl_root_table_list.
3486 +                                              count - 2))));
3487                                 break;
3488                         }
3489                 }
3490 --- kernel-power-2.6.28.orig/drivers/acpi/video.c
3491 +++ kernel-power-2.6.28/drivers/acpi/video.c
3492 @@ -36,6 +36,7 @@
3493  #include <linux/backlight.h>
3494  #include <linux/thermal.h>
3495  #include <linux/video_output.h>
3496 +#include <linux/sort.h>
3497  #include <asm/uaccess.h>
3498
3499  #include <acpi/acpi_bus.h>
3500 @@ -481,6 +482,7 @@
3501         int status = AE_OK;
3502         union acpi_object arg0 = { ACPI_TYPE_INTEGER };
3503         struct acpi_object_list args = { 1, &arg0 };
3504 +       int state;
3505
3506
3507         arg0.integer.value = level;
3508 @@ -489,6 +491,10 @@
3509                 status = acpi_evaluate_object(device->dev->handle, "_BCM",
3510                                               &args, NULL);
3511         device->brightness->curr = level;
3512 +       for (state = 2; state < device->brightness->count; state++)
3513 +               if (level == device->brightness->levels[state])
3514 +                       device->backlight->props.brightness = state - 2;
3515 +
3516         return status;
3517  }
3518
3519 @@ -626,6 +632,16 @@
3520  }
3521
3522  /*
3523 + * Simple comparison function used to sort backlight levels.
3524 + */
3525 +
3526 +static int
3527 +acpi_video_cmp_level(const void *a, const void *b)
3528 +{
3529 +       return *(int *)a - *(int *)b;
3530 +}
3531 +
3532 +/*
3533   *  Arg:
3534   *     device  : video output device (LCD, CRT, ..)
3535   *
3536 @@ -676,6 +692,10 @@
3537                 count++;
3538         }
3539
3540 +       /* don't sort the first two brightness levels */
3541 +       sort(&br->levels[2], count - 2, sizeof(br->levels[2]),
3542 +               acpi_video_cmp_level, NULL);
3543 +
3544         if (count < 2)
3545                 goto out_free_levels;
3546
3547 @@ -1000,7 +1020,7 @@
3548         }
3549
3550         seq_printf(seq, "levels: ");
3551 -       for (i = 0; i < dev->brightness->count; i++)
3552 +       for (i = 2; i < dev->brightness->count; i++)
3553                 seq_printf(seq, " %d", dev->brightness->levels[i]);
3554         seq_printf(seq, "\ncurrent: %d\n", dev->brightness->curr);
3555
3556 @@ -1039,7 +1059,7 @@
3557                 return -EFAULT;
3558
3559         /* validate through the list of available levels */
3560 -       for (i = 0; i < dev->brightness->count; i++)
3561 +       for (i = 2; i < dev->brightness->count; i++)
3562                 if (level == dev->brightness->levels[i]) {
3563                         if (ACPI_SUCCESS
3564                             (acpi_video_device_lcd_set_level(dev, level)))
3565 @@ -1692,7 +1712,7 @@
3566         max = max_below = 0;
3567         min = min_above = 255;
3568         /* Find closest level to level_current */
3569 -       for (i = 0; i < device->brightness->count; i++) {
3570 +       for (i = 2; i < device->brightness->count; i++) {
3571                 l = device->brightness->levels[i];
3572                 if (abs(l - level_current) < abs(delta)) {
3573                         delta = l - level_current;
3574 @@ -1702,7 +1722,7 @@
3575         }
3576         /* Ajust level_current to closest available level */
3577         level_current += delta;
3578 -       for (i = 0; i < device->brightness->count; i++) {
3579 +       for (i = 2; i < device->brightness->count; i++) {
3580                 l = device->brightness->levels[i];
3581                 if (l < min)
3582                         min = l;
3583 @@ -1986,6 +2006,12 @@
3584                         device->pnp.bus_id[3] = '0' + instance;
3585                 instance ++;
3586         }
3587 +       /* a hack to fix the duplicate name "VGA" problem on Pa 3553 */
3588 +       if (!strcmp(device->pnp.bus_id, "VGA")) {
3589 +               if (instance)
3590 +                       device->pnp.bus_id[3] = '0' + instance;
3591 +               instance++;
3592 +       }
3593
3594         video->device = device;
3595         strcpy(acpi_device_name(device), ACPI_VIDEO_BUS_NAME);
3596 --- kernel-power-2.6.28.orig/drivers/ata/ata_piix.c
3597 +++ kernel-power-2.6.28/drivers/ata/ata_piix.c
3598 @@ -1294,6 +1294,39 @@
3599         return map;
3600  }
3601
3602 +static bool piix_no_sidpr(struct ata_host *host)
3603 +{
3604 +       struct pci_dev *pdev = to_pci_dev(host->dev);
3605 +
3606 +       /*
3607 +        * Samsung DB-P70 only has three ATA ports exposed and
3608 +        * curiously the unconnected first port reports link online
3609 +        * while not responding to SRST protocol causing excessive
3610 +        * detection delay.
3611 +        *
3612 +        * Unfortunately, the system doesn't carry enough DMI
3613 +        * information to identify the machine but does have subsystem
3614 +        * vendor and device set.  As it's unclear whether the
3615 +        * subsystem vendor/device is used only for this specific
3616 +        * board, the port can't be disabled solely with the
3617 +        * information; however, turning off SIDPR access works around
3618 +        * the problem.  Turn it off.
3619 +        *
3620 +        * This problem is reported in bnc#441240.
3621 +        *
3622 +        * https://bugzilla.novell.com/show_bug.cgi?id=441420
3623 +        */
3624 +       if (pdev->vendor == PCI_VENDOR_ID_INTEL && pdev->device == 0x2920 &&
3625 +           pdev->subsystem_vendor == PCI_VENDOR_ID_SAMSUNG &&
3626 +           pdev->subsystem_device == 0xb049) {
3627 +               dev_printk(KERN_WARNING, host->dev,
3628 +                          "Samsung DB-P70 detected, disabling SIDPR\n");
3629 +               return true;
3630 +       }
3631 +
3632 +       return false;
3633 +}
3634 +
3635  static int __devinit piix_init_sidpr(struct ata_host *host)
3636  {
3637         struct pci_dev *pdev = to_pci_dev(host->dev);
3638 @@ -1307,6 +1340,10 @@
3639                 if (hpriv->map[i] == IDE)
3640                         return 0;
3641
3642 +       /* is it blacklisted? */
3643 +       if (piix_no_sidpr(host))
3644 +               return 0;
3645 +
3646         if (!(host->ports[0]->flags & PIIX_FLAG_SIDPR))
3647                 return 0;
3648
3649 --- kernel-power-2.6.28.orig/drivers/ata/libata-core.c
3650 +++ kernel-power-2.6.28/drivers/ata/libata-core.c
3651 @@ -1251,14 +1251,16 @@
3652  {
3653         if (ata_id_has_lba(id)) {
3654                 if (ata_id_has_lba48(id))
3655 -                       return ata_id_u64(id, 100);
3656 +                       return ata_id_u64(id, ATA_ID_LBA_CAPACITY_2);
3657                 else
3658 -                       return ata_id_u32(id, 60);
3659 +                       return ata_id_u32(id, ATA_ID_LBA_CAPACITY);
3660         } else {
3661                 if (ata_id_current_chs_valid(id))
3662 -                       return ata_id_u32(id, 57);
3663 +                       return id[ATA_ID_CUR_CYLS] * id[ATA_ID_CUR_HEADS] *
3664 +                              id[ATA_ID_CUR_SECTORS];
3665                 else
3666 -                       return id[1] * id[3] * id[6];
3667 +                       return id[ATA_ID_CYLS] * id[ATA_ID_HEADS] *
3668 +                              id[ATA_ID_SECTORS];
3669         }
3670  }
3671
3672 --- kernel-power-2.6.28.orig/drivers/ata/libata-eh.c
3673 +++ kernel-power-2.6.28/drivers/ata/libata-eh.c
3674 @@ -2366,11 +2366,14 @@
3675                 }
3676
3677                 /* prereset() might have cleared ATA_EH_RESET.  If so,
3678 -                * bang classes and return.
3679 +                * bang classes, thaw and return.
3680                  */
3681                 if (reset && !(ehc->i.action & ATA_EH_RESET)) {
3682                         ata_link_for_each_dev(dev, link)
3683                                 classes[dev->devno] = ATA_DEV_NONE;
3684 +                       if ((ap->pflags & ATA_PFLAG_FROZEN) &&
3685 +                           ata_is_host_link(link))
3686 +                               ata_eh_thaw_port(ap);
3687                         rc = 0;
3688                         goto out;
3689                 }
3690 @@ -2959,12 +2962,13 @@
3691                 /* give it just one more chance */
3692                 ehc->tries[dev->devno] = min(ehc->tries[dev->devno], 1);
3693         case -EIO:
3694 -               if (ehc->tries[dev->devno] == 1 && dev->pio_mode > XFER_PIO_0) {
3695 +               if (ehc->tries[dev->devno] == 1) {
3696                         /* This is the last chance, better to slow
3697                          * down than lose it.
3698                          */
3699                         sata_down_spd_limit(ata_dev_phys_link(dev));
3700 -                       ata_down_xfermask_limit(dev, ATA_DNXFER_PIO);
3701 +                       if (dev->pio_mode > XFER_PIO_0)
3702 +                               ata_down_xfermask_limit(dev, ATA_DNXFER_PIO);
3703                 }
3704         }
3705
3706 --- kernel-power-2.6.28.orig/drivers/ata/pata_hpt37x.c
3707 +++ kernel-power-2.6.28/drivers/ata/pata_hpt37x.c
3708 @@ -8,7 +8,7 @@
3709   * Copyright (C) 1999-2003             Andre Hedrick <andre@linux-ide.org>
3710   * Portions Copyright (C) 2001         Sun Microsystems, Inc.
3711   * Portions Copyright (C) 2003         Red Hat Inc
3712 - * Portions Copyright (C) 2005-2007    MontaVista Software, Inc.
3713 + * Portions Copyright (C) 2005-2009    MontaVista Software, Inc.
3714   *
3715   * TODO
3716   *     Look into engine reset on timeout errors. Should not be required.
3717 @@ -24,7 +24,7 @@
3718  #include <linux/libata.h>
3719
3720  #define DRV_NAME       "pata_hpt37x"
3721 -#define DRV_VERSION    "0.6.11"
3722 +#define DRV_VERSION    "0.6.12"
3723
3724  struct hpt_clock {
3725         u8      xfer_speed;
3726 @@ -445,23 +445,6 @@
3727  }
3728
3729  /**
3730 - *     hpt370_bmdma_start              -       DMA engine begin
3731 - *     @qc: ATA command
3732 - *
3733 - *     The 370 and 370A want us to reset the DMA engine each time we
3734 - *     use it. The 372 and later are fine.
3735 - */
3736 -
3737 -static void hpt370_bmdma_start(struct ata_queued_cmd *qc)
3738 -{
3739 -       struct ata_port *ap = qc->ap;
3740 -       struct pci_dev *pdev = to_pci_dev(ap->host->dev);
3741 -       pci_write_config_byte(pdev, 0x50 + 4 * ap->port_no, 0x37);
3742 -       udelay(10);
3743 -       ata_bmdma_start(qc);
3744 -}
3745 -
3746 -/**
3747   *     hpt370_bmdma_end                -       DMA engine stop
3748   *     @qc: ATA command
3749   *
3750 @@ -598,7 +581,6 @@
3751  static struct ata_port_operations hpt370_port_ops = {
3752         .inherits       = &ata_bmdma_port_ops,
3753
3754 -       .bmdma_start    = hpt370_bmdma_start,
3755         .bmdma_stop     = hpt370_bmdma_stop,
3756
3757         .mode_filter    = hpt370_filter,
3758 --- kernel-power-2.6.28.orig/drivers/ata/pata_via.c
3759 +++ kernel-power-2.6.28/drivers/ata/pata_via.c
3760 @@ -86,6 +86,10 @@
3761         VIA_SATA_PATA   = 0x800, /* SATA/PATA combined configuration */
3762  };
3763
3764 +enum {
3765 +       VIA_IDFLAG_SINGLE = (1 << 0), /* single channel controller) */
3766 +};
3767 +
3768  /*
3769   * VIA SouthBridge chips.
3770   */
3771 @@ -97,12 +101,17 @@
3772         u8 rev_max;
3773         u16 flags;
3774  } via_isa_bridges[] = {
3775 +       { "vx855",      PCI_DEVICE_ID_VIA_VX855,    0x00, 0x2f,
3776 +         VIA_UDMA_133 | VIA_BAD_AST | VIA_SATA_PATA },
3777         { "vx800",      PCI_DEVICE_ID_VIA_VX800,    0x00, 0x2f, VIA_UDMA_133 |
3778         VIA_BAD_AST | VIA_SATA_PATA },
3779 +       { "vt8261",     PCI_DEVICE_ID_VIA_8261,     0x00, 0x2f,
3780 +         VIA_UDMA_133 | VIA_BAD_AST },
3781         { "vt8237s",    PCI_DEVICE_ID_VIA_8237S,    0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
3782         { "vt8251",     PCI_DEVICE_ID_VIA_8251,     0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
3783         { "cx700",      PCI_DEVICE_ID_VIA_CX700,    0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST | VIA_SATA_PATA },
3784 -       { "vt6410",     PCI_DEVICE_ID_VIA_6410,     0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST | VIA_NO_ENABLES},
3785 +       { "vt6410",     PCI_DEVICE_ID_VIA_6410,     0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST | VIA_NO_ENABLES },
3786 +       { "vt6415",     PCI_DEVICE_ID_VIA_6415,     0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST | VIA_NO_ENABLES },
3787         { "vt8237a",    PCI_DEVICE_ID_VIA_8237A,    0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
3788         { "vt8237",     PCI_DEVICE_ID_VIA_8237,     0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
3789         { "vt8235",     PCI_DEVICE_ID_VIA_8235,     0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
3790 @@ -122,6 +131,8 @@
3791         { "vt82c586",   PCI_DEVICE_ID_VIA_82C586_0, 0x00, 0x0f, VIA_UDMA_NONE | VIA_SET_FIFO },
3792         { "vt82c576",   PCI_DEVICE_ID_VIA_82C576,   0x00, 0x2f, VIA_UDMA_NONE | VIA_SET_FIFO | VIA_NO_UNMASK },
3793         { "vt82c576",   PCI_DEVICE_ID_VIA_82C576,   0x00, 0x2f, VIA_UDMA_NONE | VIA_SET_FIFO | VIA_NO_UNMASK | VIA_BAD_ID },
3794 +       { "vtxxxx",     PCI_DEVICE_ID_VIA_ANON,    0x00, 0x2f,
3795 +         VIA_UDMA_133 | VIA_BAD_AST },
3796         { NULL }
3797  };
3798
3799 @@ -460,6 +471,7 @@
3800         static int printed_version;
3801         u8 enable;
3802         u32 timing;
3803 +       unsigned long flags = id->driver_data;
3804         int rc;
3805
3806         if (!printed_version++)
3807 @@ -469,9 +481,13 @@
3808         if (rc)
3809                 return rc;
3810
3811 +       if (flags & VIA_IDFLAG_SINGLE)
3812 +               ppi[1] = &ata_dummy_port_info;
3813 +
3814         /* To find out how the IDE will behave and what features we
3815            actually have to look at the bridge not the IDE controller */
3816 -       for (config = via_isa_bridges; config->id; config++)
3817 +       for (config = via_isa_bridges; config->id != PCI_DEVICE_ID_VIA_ANON;
3818 +            config++)
3819                 if ((isa = pci_get_device(PCI_VENDOR_ID_VIA +
3820                         !!(config->flags & VIA_BAD_ID),
3821                         config->id, NULL))) {
3822 @@ -482,10 +498,6 @@
3823                         pci_dev_put(isa);
3824                 }
3825
3826 -       if (!config->id) {
3827 -               printk(KERN_WARNING "via: Unknown VIA SouthBridge, disabling.\n");
3828 -               return -ENODEV;
3829 -       }
3830         pci_dev_put(isa);
3831
3832         if (!(config->flags & VIA_NO_ENABLES)) {
3833 @@ -582,11 +594,13 @@
3834  #endif
3835
3836  static const struct pci_device_id via[] = {
3837 +       { PCI_VDEVICE(VIA, 0x0415), },
3838         { PCI_VDEVICE(VIA, 0x0571), },
3839         { PCI_VDEVICE(VIA, 0x0581), },
3840         { PCI_VDEVICE(VIA, 0x1571), },
3841         { PCI_VDEVICE(VIA, 0x3164), },
3842         { PCI_VDEVICE(VIA, 0x5324), },
3843 +       { PCI_VDEVICE(VIA, 0xC409), VIA_IDFLAG_SINGLE },
3844
3845         { },
3846  };
3847 --- kernel-power-2.6.28.orig/drivers/ata/sata_mv.c
3848 +++ kernel-power-2.6.28/drivers/ata/sata_mv.c
3849 @@ -669,8 +669,8 @@
3850         { PCI_VDEVICE(MARVELL, 0x5081), chip_508x },
3851         /* RocketRAID 1720/174x have different identifiers */
3852         { PCI_VDEVICE(TTI, 0x1720), chip_6042 },
3853 -       { PCI_VDEVICE(TTI, 0x1740), chip_508x },
3854 -       { PCI_VDEVICE(TTI, 0x1742), chip_508x },
3855 +       { PCI_VDEVICE(TTI, 0x1740), chip_6042 },
3856 +       { PCI_VDEVICE(TTI, 0x1742), chip_6042 },
3857
3858         { PCI_VDEVICE(MARVELL, 0x6040), chip_604x },
3859         { PCI_VDEVICE(MARVELL, 0x6041), chip_604x },
3860 @@ -883,7 +883,7 @@
3861                 struct mv_host_priv *hpriv = ap->host->private_data;
3862                 int hardport = mv_hardport_from_port(ap->port_no);
3863                 void __iomem *hc_mmio = mv_hc_base_from_port(
3864 -                                       mv_host_base(ap->host), hardport);
3865 +                                       mv_host_base(ap->host), ap->port_no);
3866                 u32 hc_irq_cause, ipending;
3867
3868                 /* clear EDMA event indicators, if any */
3869 --- kernel-power-2.6.28.orig/drivers/ata/sata_nv.c
3870 +++ kernel-power-2.6.28/drivers/ata/sata_nv.c
3871 @@ -305,10 +305,10 @@
3872  static int nv_scr_read(struct ata_link *link, unsigned int sc_reg, u32 *val);
3873  static int nv_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val);
3874
3875 +static int nv_noclassify_hardreset(struct ata_link *link, unsigned int *class,
3876 +                                  unsigned long deadline);
3877  static void nv_nf2_freeze(struct ata_port *ap);
3878  static void nv_nf2_thaw(struct ata_port *ap);
3879 -static int nv_nf2_hardreset(struct ata_link *link, unsigned int *class,
3880 -                           unsigned long deadline);
3881  static void nv_ck804_freeze(struct ata_port *ap);
3882  static void nv_ck804_thaw(struct ata_port *ap);
3883  static int nv_adma_slave_config(struct scsi_device *sdev);
3884 @@ -352,6 +352,7 @@
3885         NFORCE3 = NFORCE2,      /* NF2 == NF3 as far as sata_nv is concerned */
3886         CK804,
3887         ADMA,
3888 +       MCP5x,
3889         SWNCQ,
3890  };
3891
3892 @@ -363,10 +364,10 @@
3893         { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_CK804_SATA2), CK804 },
3894         { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP04_SATA), CK804 },
3895         { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP04_SATA2), CK804 },
3896 -       { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_SATA), SWNCQ },
3897 -       { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_SATA2), SWNCQ },
3898 -       { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA), SWNCQ },
3899 -       { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA2), SWNCQ },
3900 +       { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_SATA), MCP5x },
3901 +       { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_SATA2), MCP5x },
3902 +       { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA), MCP5x },
3903 +       { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA2), MCP5x },
3904         { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA), GENERIC },
3905         { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA2), GENERIC },
3906         { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA3), GENERIC },
3907 @@ -420,26 +421,33 @@
3908         .hardreset              = ATA_OP_NULL,
3909  };
3910
3911 -/* OSDL bz3352 reports that nf2/3 controllers can't determine device
3912 - * signature reliably.  Also, the following thread reports detection
3913 - * failure on cold boot with the standard debouncing timing.
3914 +/* nf2 is ripe with hardreset related problems.
3915 + *
3916 + * kernel bz#3352 reports nf2/3 controllers can't determine device
3917 + * signature reliably.  The following thread reports detection failure
3918 + * on cold boot with the standard debouncing timing.
3919   *
3920   * http://thread.gmane.org/gmane.linux.ide/34098
3921   *
3922 - * Debounce with hotplug timing and request follow-up SRST.
3923 + * And bz#12176 reports that hardreset simply doesn't work on nf2.
3924 + * Give up on it and just don't do hardreset.
3925   */
3926  static struct ata_port_operations nv_nf2_ops = {
3927 -       .inherits               = &nv_common_ops,
3928 +       .inherits               = &nv_generic_ops,
3929         .freeze                 = nv_nf2_freeze,
3930         .thaw                   = nv_nf2_thaw,
3931 -       .hardreset              = nv_nf2_hardreset,
3932  };
3933
3934 -/* CK804 finally gets hardreset right */
3935 +/* For initial probing after boot and hot plugging, hardreset mostly
3936 + * works fine on CK804 but curiously, reprobing on the initial port by
3937 + * rescanning or rmmod/insmod fails to acquire the initial D2H Reg FIS
3938 + * in somewhat undeterministic way.  Use noclassify hardreset.
3939 + */
3940  static struct ata_port_operations nv_ck804_ops = {
3941         .inherits               = &nv_common_ops,
3942         .freeze                 = nv_ck804_freeze,
3943         .thaw                   = nv_ck804_thaw,
3944 +       .hardreset              = nv_noclassify_hardreset,
3945         .host_stop              = nv_ck804_host_stop,
3946  };
3947
3948 @@ -467,8 +475,19 @@
3949         .host_stop              = nv_adma_host_stop,
3950  };
3951
3952 +/* Kernel bz#12351 reports that when SWNCQ is enabled, for hotplug to
3953 + * work, hardreset should be used and hardreset can't report proper
3954 + * signature, which suggests that mcp5x is closer to nf2 as long as
3955 + * reset quirkiness is concerned.  Define separate ops for mcp5x with
3956 + * nv_noclassify_hardreset().
3957 + */
3958 +static struct ata_port_operations nv_mcp5x_ops = {
3959 +       .inherits               = &nv_common_ops,
3960 +       .hardreset              = nv_noclassify_hardreset,
3961 +};
3962 +
3963  static struct ata_port_operations nv_swncq_ops = {
3964 -       .inherits               = &nv_generic_ops,
3965 +       .inherits               = &nv_mcp5x_ops,
3966
3967         .qc_defer               = ata_std_qc_defer,
3968         .qc_prep                = nv_swncq_qc_prep,
3969 @@ -531,6 +550,15 @@
3970                 .port_ops       = &nv_adma_ops,
3971                 .private_data   = NV_PI_PRIV(nv_adma_interrupt, &nv_adma_sht),
3972         },
3973 +       /* MCP5x */
3974 +       {
3975 +               .flags          = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY,
3976 +               .pio_mask       = NV_PIO_MASK,
3977 +               .mwdma_mask     = NV_MWDMA_MASK,
3978 +               .udma_mask      = NV_UDMA_MASK,
3979 +               .port_ops       = &nv_mcp5x_ops,
3980 +               .private_data   = NV_PI_PRIV(nv_generic_interrupt, &nv_sht),
3981 +       },
3982         /* SWNCQ */
3983         {
3984                 .flags          = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY |
3985 @@ -1530,6 +1558,17 @@
3986         return 0;
3987  }
3988
3989 +static int nv_noclassify_hardreset(struct ata_link *link, unsigned int *class,
3990 +                                  unsigned long deadline)
3991 +{
3992 +       bool online;
3993 +       int rc;
3994 +
3995 +       rc = sata_link_hardreset(link, sata_deb_timing_hotplug, deadline,
3996 +                                &online, NULL);
3997 +       return online ? -EAGAIN : rc;
3998 +}
3999 +
4000  static void nv_nf2_freeze(struct ata_port *ap)
4001  {
4002         void __iomem *scr_addr = ap->host->ports[0]->ioaddr.scr_addr;
4003 @@ -1554,17 +1593,6 @@
4004         iowrite8(mask, scr_addr + NV_INT_ENABLE);
4005  }
4006
4007 -static int nv_nf2_hardreset(struct ata_link *link, unsigned int *class,
4008 -                           unsigned long deadline)
4009 -{
4010 -       bool online;
4011 -       int rc;
4012 -
4013 -       rc = sata_link_hardreset(link, sata_deb_timing_hotplug, deadline,
4014 -                                &online, NULL);
4015 -       return online ? -EAGAIN : rc;
4016 -}
4017 -
4018  static void nv_ck804_freeze(struct ata_port *ap)
4019  {
4020         void __iomem *mmio_base = ap->host->iomap[NV_MMIO_BAR];
4021 @@ -2355,14 +2383,9 @@
4022         if (type == CK804 && adma_enabled) {
4023                 dev_printk(KERN_NOTICE, &pdev->dev, "Using ADMA mode\n");
4024                 type = ADMA;
4025 -       }
4026 -
4027 -       if (type == SWNCQ) {
4028 -               if (swncq_enabled)
4029 -                       dev_printk(KERN_NOTICE, &pdev->dev,
4030 -                                  "Using SWNCQ mode\n");
4031 -               else
4032 -                       type = GENERIC;
4033 +       } else if (type == MCP5x && swncq_enabled) {
4034 +               dev_printk(KERN_NOTICE, &pdev->dev, "Using SWNCQ mode\n");
4035 +               type = SWNCQ;
4036         }
4037
4038         ppi[0] = &nv_port_info[type];
4039 --- kernel-power-2.6.28.orig/drivers/ata/sata_via.c
4040 +++ kernel-power-2.6.28/drivers/ata/sata_via.c
4041 @@ -92,6 +92,8 @@
4042         { PCI_VDEVICE(VIA, 0x5372), vt6420 },
4043         { PCI_VDEVICE(VIA, 0x7372), vt6420 },
4044         { PCI_VDEVICE(VIA, 0x5287), vt8251 }, /* 2 sata chnls (Master/Slave) */
4045 +       { PCI_VDEVICE(VIA, 0x9000), vt8251 },
4046 +       { PCI_VDEVICE(VIA, 0x9040), vt8251 },
4047
4048         { }     /* terminate list */
4049  };
4050 --- kernel-power-2.6.28.orig/drivers/atm/fore200e.c
4051 +++ kernel-power-2.6.28/drivers/atm/fore200e.c
4052 @@ -2519,8 +2519,8 @@
4053         return err;
4054
4055      sprintf(buf, "%s%s", fore200e->bus->proc_name, FW_EXT);
4056 -    if (request_firmware(&firmware, buf, device) == 1) {
4057 -       printk(FORE200E "missing %s firmware image\n", fore200e->bus->model_name);
4058 +    if ((err = request_firmware(&firmware, buf, device)) < 0) {
4059 +       printk(FORE200E "problem loading firmware image %s\n", fore200e->bus->model_name);
4060         return err;
4061      }
4062
4063 --- kernel-power-2.6.28.orig/drivers/block/aoe/aoe.h
4064 +++ kernel-power-2.6.28/drivers/block/aoe/aoe.h
4065 @@ -18,6 +18,7 @@
4066  enum {
4067         AOECMD_ATA,
4068         AOECMD_CFG,
4069 +       AOECMD_VEND_MIN = 0xf0,
4070
4071         AOEFL_RSP = (1<<3),
4072         AOEFL_ERR = (1<<2),
4073 --- kernel-power-2.6.28.orig/drivers/block/aoe/aoenet.c
4074 +++ kernel-power-2.6.28/drivers/block/aoe/aoenet.c
4075 @@ -153,6 +153,8 @@
4076                 aoecmd_cfg_rsp(skb);
4077                 break;
4078         default:
4079 +               if (h->cmd >= AOECMD_VEND_MIN)
4080 +                       break;  /* don't complain about vendor commands */
4081                 printk(KERN_INFO "aoe: unknown cmd %d\n", h->cmd);
4082         }
4083  exit:
4084 --- kernel-power-2.6.28.orig/drivers/block/nbd.c
4085 +++ kernel-power-2.6.28/drivers/block/nbd.c
4086 @@ -406,6 +406,7 @@
4087         ret = sysfs_create_file(&disk_to_dev(lo->disk)->kobj, &pid_attr.attr);
4088         if (ret) {
4089                 printk(KERN_ERR "nbd: sysfs_create_file failed!");
4090 +               lo->pid = 0;
4091                 return ret;
4092         }
4093
4094 @@ -413,6 +414,7 @@
4095                 nbd_end_request(req);
4096
4097         sysfs_remove_file(&disk_to_dev(lo->disk)->kobj, &pid_attr.attr);
4098 +       lo->pid = 0;
4099         return 0;
4100  }
4101
4102 @@ -547,6 +549,15 @@
4103
4104                 BUG_ON(lo->magic != LO_MAGIC);
4105
4106 +               if (unlikely(!lo->sock)) {
4107 +                       printk(KERN_ERR "%s: Attempted send on closed socket\n",
4108 +                               lo->disk->disk_name);
4109 +                       req->errors++;
4110 +                       nbd_end_request(req);
4111 +                       spin_lock_irq(q->queue_lock);
4112 +                       continue;
4113 +               }
4114 +
4115                 spin_lock_irq(&lo->queue_lock);
4116                 list_add_tail(&req->queuelist, &lo->waiting_queue);
4117                 spin_unlock_irq(&lo->queue_lock);
4118 @@ -648,6 +659,8 @@
4119                 set_capacity(lo->disk, lo->bytesize >> 9);
4120                 return 0;
4121         case NBD_DO_IT:
4122 +               if (lo->pid)
4123 +                       return -EBUSY;
4124                 if (!lo->file)
4125                         return -EINVAL;
4126                 thread = kthread_create(nbd_thread, lo, lo->disk->disk_name);
4127 --- kernel-power-2.6.28.orig/drivers/block/xen-blkfront.c
4128 +++ kernel-power-2.6.28/drivers/block/xen-blkfront.c
4129 @@ -40,6 +40,7 @@
4130  #include <linux/hdreg.h>
4131  #include <linux/cdrom.h>
4132  #include <linux/module.h>
4133 +#include <linux/scatterlist.h>
4134
4135  #include <xen/xenbus.h>
4136  #include <xen/grant_table.h>
4137 @@ -82,6 +83,7 @@
4138         enum blkif_state connected;
4139         int ring_ref;
4140         struct blkif_front_ring ring;
4141 +       struct scatterlist sg[BLKIF_MAX_SEGMENTS_PER_REQUEST];
4142         unsigned int evtchn, irq;
4143         struct request_queue *rq;
4144         struct work_struct work;
4145 @@ -204,12 +206,11 @@
4146         struct blkfront_info *info = req->rq_disk->private_data;
4147         unsigned long buffer_mfn;
4148         struct blkif_request *ring_req;
4149 -       struct req_iterator iter;
4150 -       struct bio_vec *bvec;
4151         unsigned long id;
4152         unsigned int fsect, lsect;
4153 -       int ref;
4154 +       int i, ref;
4155         grant_ref_t gref_head;
4156 +       struct scatterlist *sg;
4157
4158         if (unlikely(info->connected != BLKIF_STATE_CONNECTED))
4159                 return 1;
4160 @@ -238,12 +239,13 @@
4161         if (blk_barrier_rq(req))
4162                 ring_req->operation = BLKIF_OP_WRITE_BARRIER;
4163
4164 -       ring_req->nr_segments = 0;
4165 -       rq_for_each_segment(bvec, req, iter) {
4166 -               BUG_ON(ring_req->nr_segments == BLKIF_MAX_SEGMENTS_PER_REQUEST);
4167 -               buffer_mfn = pfn_to_mfn(page_to_pfn(bvec->bv_page));
4168 -               fsect = bvec->bv_offset >> 9;
4169 -               lsect = fsect + (bvec->bv_len >> 9) - 1;
4170 +       ring_req->nr_segments = blk_rq_map_sg(req->q, req, info->sg);
4171 +       BUG_ON(ring_req->nr_segments > BLKIF_MAX_SEGMENTS_PER_REQUEST);
4172 +
4173 +       for_each_sg(info->sg, sg, ring_req->nr_segments, i) {
4174 +               buffer_mfn = pfn_to_mfn(page_to_pfn(sg_page(sg)));
4175 +               fsect = sg->offset >> 9;
4176 +               lsect = fsect + (sg->length >> 9) - 1;
4177                 /* install a grant reference. */
4178                 ref = gnttab_claim_grant_reference(&gref_head);
4179                 BUG_ON(ref == -ENOSPC);
4180 @@ -254,16 +256,12 @@
4181                                 buffer_mfn,
4182                                 rq_data_dir(req) );
4183
4184 -               info->shadow[id].frame[ring_req->nr_segments] =
4185 -                               mfn_to_pfn(buffer_mfn);
4186 -
4187 -               ring_req->seg[ring_req->nr_segments] =
4188 +               info->shadow[id].frame[i] = mfn_to_pfn(buffer_mfn);
4189 +               ring_req->seg[i] =
4190                                 (struct blkif_request_segment) {
4191                                         .gref       = ref,
4192                                         .first_sect = fsect,
4193                                         .last_sect  = lsect };
4194 -
4195 -               ring_req->nr_segments++;
4196         }
4197
4198         info->ring.req_prod_pvt++;
4199 @@ -628,6 +626,8 @@
4200         SHARED_RING_INIT(sring);
4201         FRONT_RING_INIT(&info->ring, sring, PAGE_SIZE);
4202
4203 +       sg_init_table(info->sg, BLKIF_MAX_SEGMENTS_PER_REQUEST);
4204 +
4205         err = xenbus_grant_ring(dev, virt_to_mfn(info->ring.sring));
4206         if (err < 0) {
4207                 free_page((unsigned long)sring);
4208 --- kernel-power-2.6.28.orig/drivers/bluetooth/btsdio.c
4209 +++ kernel-power-2.6.28/drivers/bluetooth/btsdio.c
4210 @@ -86,6 +86,7 @@
4211
4212         err = sdio_writesb(data->func, REG_TDAT, skb->data, skb->len);
4213         if (err < 0) {
4214 +               skb_pull(skb, 4);
4215                 sdio_writeb(data->func, 0x01, REG_PC_WRT, NULL);
4216                 return err;
4217         }
4218 --- kernel-power-2.6.28.orig/drivers/char/agp/generic.c
4219 +++ kernel-power-2.6.28/drivers/char/agp/generic.c
4220 @@ -1226,7 +1226,7 @@
4221         int i, ret = -ENOMEM;
4222
4223         for (i = 0; i < num_pages; i++) {
4224 -               page = alloc_page(GFP_KERNEL | GFP_DMA32);
4225 +               page = alloc_page(GFP_KERNEL | GFP_DMA32 | __GFP_ZERO);
4226                 /* agp_free_memory() needs gart address */
4227                 if (page == NULL)
4228                         goto out;
4229 @@ -1257,7 +1257,7 @@
4230  {
4231         struct page * page;
4232
4233 -       page = alloc_page(GFP_KERNEL | GFP_DMA32);
4234 +       page = alloc_page(GFP_KERNEL | GFP_DMA32 | __GFP_ZERO);
4235         if (page == NULL)
4236                 return NULL;
4237
4238 --- kernel-power-2.6.28.orig/drivers/char/agp/intel-agp.c
4239 +++ kernel-power-2.6.28/drivers/char/agp/intel-agp.c
4240 @@ -40,6 +40,8 @@
4241  #define PCI_DEVICE_ID_INTEL_Q45_IG          0x2E12
4242  #define PCI_DEVICE_ID_INTEL_G45_HB          0x2E20
4243  #define PCI_DEVICE_ID_INTEL_G45_IG          0x2E22
4244 +#define PCI_DEVICE_ID_INTEL_G41_HB          0x2E30
4245 +#define PCI_DEVICE_ID_INTEL_G41_IG          0x2E32
4246
4247  /* cover 915 and 945 variants */
4248  #define IS_I915 (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_E7221_HB || \
4249 @@ -63,7 +65,8 @@
4250  #define IS_G4X (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGD_E_HB || \
4251                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_Q45_HB || \
4252                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_G45_HB || \
4253 -               agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_GM45_HB)
4254 +               agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_GM45_HB || \
4255 +               agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_G41_HB)
4256
4257  extern int agp_memory_reserved;
4258
4259 @@ -630,13 +633,15 @@
4260                         break;
4261                 }
4262         }
4263 -       if (gtt_entries > 0)
4264 +       if (gtt_entries > 0) {
4265                 dev_info(&agp_bridge->dev->dev, "detected %dK %s memory\n",
4266                        gtt_entries / KB(1), local ? "local" : "stolen");
4267 -       else
4268 +               gtt_entries /= KB(4);
4269 +       } else {
4270                 dev_info(&agp_bridge->dev->dev,
4271                        "no pre-allocated video memory detected\n");
4272 -       gtt_entries /= KB(4);
4273 +               gtt_entries = 0;
4274 +       }
4275
4276         intel_private.gtt_entries = gtt_entries;
4277  }
4278 @@ -1196,6 +1201,7 @@
4279         case PCI_DEVICE_ID_INTEL_IGD_E_HB:
4280         case PCI_DEVICE_ID_INTEL_Q45_HB:
4281         case PCI_DEVICE_ID_INTEL_G45_HB:
4282 +       case PCI_DEVICE_ID_INTEL_G41_HB:
4283                 *gtt_offset = *gtt_size = MB(2);
4284                 break;
4285         default:
4286 @@ -2156,13 +2162,15 @@
4287         { PCI_DEVICE_ID_INTEL_Q33_HB, PCI_DEVICE_ID_INTEL_Q33_IG, 0, "Q33",
4288                 NULL, &intel_g33_driver },
4289         { PCI_DEVICE_ID_INTEL_GM45_HB, PCI_DEVICE_ID_INTEL_GM45_IG, 0,
4290 -           "Mobile Intel? GM45 Express", NULL, &intel_i965_driver },
4291 +           "Mobile Intel® GM45 Express", NULL, &intel_i965_driver },
4292         { PCI_DEVICE_ID_INTEL_IGD_E_HB, PCI_DEVICE_ID_INTEL_IGD_E_IG, 0,
4293             "Intel Integrated Graphics Device", NULL, &intel_i965_driver },
4294         { PCI_DEVICE_ID_INTEL_Q45_HB, PCI_DEVICE_ID_INTEL_Q45_IG, 0,
4295             "Q45/Q43", NULL, &intel_i965_driver },
4296         { PCI_DEVICE_ID_INTEL_G45_HB, PCI_DEVICE_ID_INTEL_G45_IG, 0,
4297             "G45/G43", NULL, &intel_i965_driver },
4298 +       { PCI_DEVICE_ID_INTEL_G41_HB, PCI_DEVICE_ID_INTEL_G41_IG, 0,
4299 +           "G41", NULL, &intel_i965_driver },
4300         { 0, 0, 0, NULL, NULL, NULL }
4301  };
4302
4303 @@ -2360,6 +2368,7 @@
4304         ID(PCI_DEVICE_ID_INTEL_IGD_E_HB),
4305         ID(PCI_DEVICE_ID_INTEL_Q45_HB),
4306         ID(PCI_DEVICE_ID_INTEL_G45_HB),
4307 +       ID(PCI_DEVICE_ID_INTEL_G41_HB),
4308         { }
4309  };
4310
4311 --- kernel-power-2.6.28.orig/drivers/char/raw.c
4312 +++ kernel-power-2.6.28/drivers/char/raw.c
4313 @@ -90,6 +90,7 @@
4314         blkdev_put(bdev, filp->f_mode);
4315  out:
4316         mutex_unlock(&raw_mutex);
4317 +       unlock_kernel();
4318         return err;
4319  }
4320
4321 --- kernel-power-2.6.28.orig/drivers/char/selection.c
4322 +++ kernel-power-2.6.28/drivers/char/selection.c
4323 @@ -268,7 +268,7 @@
4324
4325         /* Allocate a new buffer before freeing the old one ... */
4326         multiplier = use_unicode ? 3 : 1;  /* chars can take up to 3 bytes */
4327 -       bp = kmalloc((sel_end-sel_start)/2*multiplier+1, GFP_KERNEL);
4328 +       bp = kmalloc(((sel_end-sel_start)/2+1)*multiplier, GFP_KERNEL);
4329         if (!bp) {
4330                 printk(KERN_WARNING "selection: kmalloc() failed\n");
4331                 clear_selection();
4332 --- kernel-power-2.6.28.orig/drivers/cpuidle/governors/menu.c
4333 +++ kernel-power-2.6.28/drivers/cpuidle/governors/menu.c
4334 @@ -16,12 +16,14 @@
4335  #include <mach/pm.h>
4336
4337  #define BREAK_FUZZ     4       /* 4 us */
4338 +#define PRED_HISTORY_PCT       50
4339
4340  struct menu_device {
4341         int             last_state_idx;
4342
4343         unsigned int    expected_us;
4344         unsigned int    predicted_us;
4345 +       unsigned int    current_predicted_us;
4346         unsigned int    last_measured_us;
4347         unsigned int    elapsed_us;
4348  };
4349 @@ -53,6 +55,12 @@
4350
4351         device_not_idle = !pm_check_idle();
4352
4353 +       /* Recalculate predicted_us based on prediction_history_pct */
4354 +       data->predicted_us *= PRED_HISTORY_PCT;
4355 +       data->predicted_us += (100 - PRED_HISTORY_PCT) *
4356 +                               data->current_predicted_us;
4357 +       data->predicted_us /= 100;
4358 +
4359         /* find the deepest idle state that satisfies our constraints */
4360         for (i = CPUIDLE_DRIVER_STATE_START + 1; i < dev->state_count; i++) {
4361                 struct cpuidle_state *s = &dev->states[i];
4362 @@ -104,7 +112,7 @@
4363                 measured_us = -1;
4364
4365         /* Predict time until next break event */
4366 -       data->predicted_us = max(measured_us, data->last_measured_us);
4367 +       data->current_predicted_us = max(measured_us, data->last_measured_us);
4368
4369         if (last_idle_us + BREAK_FUZZ <
4370             data->expected_us - target->exit_latency) {
4371 --- kernel-power-2.6.28.orig/drivers/crypto/ixp4xx_crypto.c
4372 +++ kernel-power-2.6.28/drivers/crypto/ixp4xx_crypto.c
4373 @@ -101,6 +101,7 @@
4374         u32 phys_addr;
4375         u32 __reserved[4];
4376         struct buffer_desc *next;
4377 +       enum dma_data_direction dir;
4378  };
4379
4380  struct crypt_ctl {
4381 @@ -132,14 +133,10 @@
4382  struct ablk_ctx {
4383         struct buffer_desc *src;
4384         struct buffer_desc *dst;
4385 -       unsigned src_nents;
4386 -       unsigned dst_nents;
4387  };
4388
4389  struct aead_ctx {
4390         struct buffer_desc *buffer;
4391 -       unsigned short assoc_nents;
4392 -       unsigned short src_nents;
4393         struct scatterlist ivlist;
4394         /* used when the hmac is not on one sg entry */
4395         u8 *hmac_virt;
4396 @@ -312,7 +309,7 @@
4397         }
4398  }
4399
4400 -static void free_buf_chain(struct buffer_desc *buf, u32 phys)
4401 +static void free_buf_chain(struct device *dev, struct buffer_desc *buf,u32 phys)
4402  {
4403         while (buf) {
4404                 struct buffer_desc *buf1;
4405 @@ -320,6 +317,7 @@
4406
4407                 buf1 = buf->next;
4408                 phys1 = buf->phys_next;
4409 +               dma_unmap_single(dev, buf->phys_next, buf->buf_len, buf->dir);
4410                 dma_pool_free(buffer_pool, buf, phys);
4411                 buf = buf1;
4412                 phys = phys1;
4413 @@ -348,7 +346,6 @@
4414         struct crypt_ctl *crypt;
4415         struct ixp_ctx *ctx;
4416         int failed;
4417 -       enum dma_data_direction src_direction = DMA_BIDIRECTIONAL;
4418
4419         failed = phys & 0x1 ? -EBADMSG : 0;
4420         phys &= ~0x3;
4421 @@ -358,13 +355,8 @@
4422         case CTL_FLAG_PERFORM_AEAD: {
4423                 struct aead_request *req = crypt->data.aead_req;
4424                 struct aead_ctx *req_ctx = aead_request_ctx(req);
4425 -               dma_unmap_sg(dev, req->assoc, req_ctx->assoc_nents,
4426 -                               DMA_TO_DEVICE);
4427 -               dma_unmap_sg(dev, &req_ctx->ivlist, 1, DMA_BIDIRECTIONAL);
4428 -               dma_unmap_sg(dev, req->src, req_ctx->src_nents,
4429 -                               DMA_BIDIRECTIONAL);
4430
4431 -               free_buf_chain(req_ctx->buffer, crypt->src_buf);
4432 +               free_buf_chain(dev, req_ctx->buffer, crypt->src_buf);
4433                 if (req_ctx->hmac_virt) {
4434                         finish_scattered_hmac(crypt);
4435                 }
4436 @@ -374,16 +366,11 @@
4437         case CTL_FLAG_PERFORM_ABLK: {
4438                 struct ablkcipher_request *req = crypt->data.ablk_req;
4439                 struct ablk_ctx *req_ctx = ablkcipher_request_ctx(req);
4440 -               int nents;
4441 +
4442                 if (req_ctx->dst) {
4443 -                       nents = req_ctx->dst_nents;
4444 -                       dma_unmap_sg(dev, req->dst, nents, DMA_FROM_DEVICE);
4445 -                       free_buf_chain(req_ctx->dst, crypt->dst_buf);
4446 -                       src_direction = DMA_TO_DEVICE;
4447 -               }
4448 -               nents = req_ctx->src_nents;
4449 -               dma_unmap_sg(dev, req->src, nents, src_direction);
4450 -               free_buf_chain(req_ctx->src, crypt->src_buf);
4451 +                       free_buf_chain(dev, req_ctx->dst, crypt->dst_buf);
4452 +               }
4453 +               free_buf_chain(dev, req_ctx->src, crypt->src_buf);
4454                 req->base.complete(&req->base, failed);
4455                 break;
4456         }
4457 @@ -748,56 +735,35 @@
4458         return 0;
4459  }
4460
4461 -static int count_sg(struct scatterlist *sg, int nbytes)
4462 -{
4463 -       int i;
4464 -       for (i = 0; nbytes > 0; i++, sg = sg_next(sg))
4465 -               nbytes -= sg->length;
4466 -       return i;
4467 -}
4468 -
4469 -static struct buffer_desc *chainup_buffers(struct scatterlist *sg,
4470 -                       unsigned nbytes, struct buffer_desc *buf, gfp_t flags)
4471 +static struct buffer_desc *chainup_buffers(struct device *dev,
4472 +               struct scatterlist *sg, unsigned nbytes,
4473 +               struct buffer_desc *buf, gfp_t flags,
4474 +               enum dma_data_direction dir)
4475  {
4476 -       int nents = 0;
4477 -
4478 -       while (nbytes > 0) {
4479 +       for (;nbytes > 0; sg = scatterwalk_sg_next(sg)) {
4480 +               unsigned len = min(nbytes, sg->length);
4481                 struct buffer_desc *next_buf;
4482                 u32 next_buf_phys;
4483 -               unsigned len = min(nbytes, sg_dma_len(sg));
4484 +               void *ptr;
4485
4486 -               nents++;
4487                 nbytes -= len;
4488 -               if (!buf->phys_addr) {
4489 -                       buf->phys_addr = sg_dma_address(sg);
4490 -                       buf->buf_len = len;
4491 -                       buf->next = NULL;
4492 -                       buf->phys_next = 0;
4493 -                       goto next;
4494 -               }
4495 -               /* Two consecutive chunks on one page may be handled by the old
4496 -                * buffer descriptor, increased by the length of the new one
4497 -                */
4498 -               if (sg_dma_address(sg) == buf->phys_addr + buf->buf_len) {
4499 -                       buf->buf_len += len;
4500 -                       goto next;
4501 -               }
4502 +               ptr = page_address(sg_page(sg)) + sg->offset;
4503                 next_buf = dma_pool_alloc(buffer_pool, flags, &next_buf_phys);
4504 -               if (!next_buf)
4505 -                       return NULL;
4506 +               if (!next_buf) {
4507 +                       buf = NULL;
4508 +                       break;
4509 +               }
4510 +               sg_dma_address(sg) = dma_map_single(dev, ptr, len, dir);
4511                 buf->next = next_buf;
4512                 buf->phys_next = next_buf_phys;
4513 -
4514                 buf = next_buf;
4515 -               buf->next = NULL;
4516 -               buf->phys_next = 0;
4517 +
4518                 buf->phys_addr = sg_dma_address(sg);
4519                 buf->buf_len = len;
4520 -next:
4521 -               if (nbytes > 0) {
4522 -                       sg = sg_next(sg);
4523 -               }
4524 +               buf->dir = dir;
4525         }
4526 +       buf->next = NULL;
4527 +       buf->phys_next = 0;
4528         return buf;
4529  }
4530
4531 @@ -858,12 +824,12 @@
4532         struct crypto_ablkcipher *tfm = crypto_ablkcipher_reqtfm(req);
4533         struct ixp_ctx *ctx = crypto_ablkcipher_ctx(tfm);
4534         unsigned ivsize = crypto_ablkcipher_ivsize(tfm);
4535 -       int ret = -ENOMEM;
4536         struct ix_sa_dir *dir;
4537         struct crypt_ctl *crypt;
4538 -       unsigned int nbytes = req->nbytes, nents;
4539 +       unsigned int nbytes = req->nbytes;
4540         enum dma_data_direction src_direction = DMA_BIDIRECTIONAL;
4541         struct ablk_ctx *req_ctx = ablkcipher_request_ctx(req);
4542 +       struct buffer_desc src_hook;
4543         gfp_t flags = req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP ?
4544                                 GFP_KERNEL : GFP_ATOMIC;
4545
4546 @@ -876,7 +842,7 @@
4547
4548         crypt = get_crypt_desc();
4549         if (!crypt)
4550 -               return ret;
4551 +               return -ENOMEM;
4552
4553         crypt->data.ablk_req = req;
4554         crypt->crypto_ctx = dir->npe_ctx_phys;
4555 @@ -889,53 +855,41 @@
4556         BUG_ON(ivsize && !req->info);
4557         memcpy(crypt->iv, req->info, ivsize);
4558         if (req->src != req->dst) {
4559 +               struct buffer_desc dst_hook;
4560                 crypt->mode |= NPE_OP_NOT_IN_PLACE;
4561 -               nents = count_sg(req->dst, nbytes);
4562                 /* This was never tested by Intel
4563                  * for more than one dst buffer, I think. */
4564 -               BUG_ON(nents != 1);
4565 -               req_ctx->dst_nents = nents;
4566 -               dma_map_sg(dev, req->dst, nents, DMA_FROM_DEVICE);
4567 -               req_ctx->dst = dma_pool_alloc(buffer_pool, flags,&crypt->dst_buf);
4568 -               if (!req_ctx->dst)
4569 -                       goto unmap_sg_dest;
4570 -               req_ctx->dst->phys_addr = 0;
4571 -               if (!chainup_buffers(req->dst, nbytes, req_ctx->dst, flags))
4572 +               BUG_ON(req->dst->length < nbytes);
4573 +               req_ctx->dst = NULL;
4574 +               if (!chainup_buffers(dev, req->dst, nbytes, &dst_hook,
4575 +                                       flags, DMA_FROM_DEVICE))
4576                         goto free_buf_dest;
4577                 src_direction = DMA_TO_DEVICE;
4578 +               req_ctx->dst = dst_hook.next;
4579 +               crypt->dst_buf = dst_hook.phys_next;
4580         } else {
4581                 req_ctx->dst = NULL;
4582 -               req_ctx->dst_nents = 0;
4583         }
4584 -       nents = count_sg(req->src, nbytes);
4585 -       req_ctx->src_nents = nents;
4586 -       dma_map_sg(dev, req->src, nents, src_direction);
4587 -
4588 -       req_ctx->src = dma_pool_alloc(buffer_pool, flags, &crypt->src_buf);
4589 -       if (!req_ctx->src)
4590 -               goto unmap_sg_src;
4591 -       req_ctx->src->phys_addr = 0;
4592 -       if (!chainup_buffers(req->src, nbytes, req_ctx->src, flags))
4593 +       req_ctx->src = NULL;
4594 +       if (!chainup_buffers(dev, req->src, nbytes, &src_hook,
4595 +                               flags, src_direction))
4596                 goto free_buf_src;
4597
4598 +       req_ctx->src = src_hook.next;
4599 +       crypt->src_buf = src_hook.phys_next;
4600         crypt->ctl_flags |= CTL_FLAG_PERFORM_ABLK;
4601         qmgr_put_entry(SEND_QID, crypt_virt2phys(crypt));
4602         BUG_ON(qmgr_stat_overflow(SEND_QID));
4603         return -EINPROGRESS;
4604
4605  free_buf_src:
4606 -       free_buf_chain(req_ctx->src, crypt->src_buf);
4607 -unmap_sg_src:
4608 -       dma_unmap_sg(dev, req->src, req_ctx->src_nents, src_direction);
4609 +       free_buf_chain(dev, req_ctx->src, crypt->src_buf);
4610  free_buf_dest:
4611         if (req->src != req->dst) {
4612 -               free_buf_chain(req_ctx->dst, crypt->dst_buf);
4613 -unmap_sg_dest:
4614 -               dma_unmap_sg(dev, req->src, req_ctx->dst_nents,
4615 -                       DMA_FROM_DEVICE);
4616 +               free_buf_chain(dev, req_ctx->dst, crypt->dst_buf);
4617         }
4618         crypt->ctl_flags = CTL_FLAG_UNUSED;
4619 -       return ret;
4620 +       return -ENOMEM;
4621  }
4622
4623  static int ablk_encrypt(struct ablkcipher_request *req)
4624 @@ -983,7 +937,7 @@
4625                         break;
4626
4627                 offset += sg->length;
4628 -               sg = sg_next(sg);
4629 +               sg = scatterwalk_sg_next(sg);
4630         }
4631         return (start + nbytes > offset + sg->length);
4632  }
4633 @@ -995,11 +949,10 @@
4634         struct ixp_ctx *ctx = crypto_aead_ctx(tfm);
4635         unsigned ivsize = crypto_aead_ivsize(tfm);
4636         unsigned authsize = crypto_aead_authsize(tfm);
4637 -       int ret = -ENOMEM;
4638         struct ix_sa_dir *dir;
4639         struct crypt_ctl *crypt;
4640 -       unsigned int cryptlen, nents;
4641 -       struct buffer_desc *buf;
4642 +       unsigned int cryptlen;
4643 +       struct buffer_desc *buf, src_hook;
4644         struct aead_ctx *req_ctx = aead_request_ctx(req);
4645         gfp_t flags = req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP ?
4646                                 GFP_KERNEL : GFP_ATOMIC;
4647 @@ -1020,7 +973,7 @@
4648         }
4649         crypt = get_crypt_desc();
4650         if (!crypt)
4651 -               return ret;
4652 +               return -ENOMEM;
4653
4654         crypt->data.aead_req = req;
4655         crypt->crypto_ctx = dir->npe_ctx_phys;
4656 @@ -1039,31 +992,27 @@
4657                 BUG(); /* -ENOTSUP because of my lazyness */
4658         }
4659
4660 -       req_ctx->buffer = dma_pool_alloc(buffer_pool, flags, &crypt->src_buf);
4661 -       if (!req_ctx->buffer)
4662 -               goto out;
4663 -       req_ctx->buffer->phys_addr = 0;
4664         /* ASSOC data */
4665 -       nents = count_sg(req->assoc, req->assoclen);
4666 -       req_ctx->assoc_nents = nents;
4667 -       dma_map_sg(dev, req->assoc, nents, DMA_TO_DEVICE);
4668 -       buf = chainup_buffers(req->assoc, req->assoclen, req_ctx->buffer,flags);
4669 +       buf = chainup_buffers(dev, req->assoc, req->assoclen, &src_hook,
4670 +               flags, DMA_TO_DEVICE);
4671 +       req_ctx->buffer = src_hook.next;
4672 +       crypt->src_buf = src_hook.phys_next;
4673         if (!buf)
4674 -               goto unmap_sg_assoc;
4675 +               goto out;
4676         /* IV */
4677         sg_init_table(&req_ctx->ivlist, 1);
4678         sg_set_buf(&req_ctx->ivlist, iv, ivsize);
4679 -       dma_map_sg(dev, &req_ctx->ivlist, 1, DMA_BIDIRECTIONAL);
4680 -       buf = chainup_buffers(&req_ctx->ivlist, ivsize, buf, flags);
4681 +       buf = chainup_buffers(dev, &req_ctx->ivlist, ivsize, buf, flags,
4682 +                       DMA_BIDIRECTIONAL);
4683         if (!buf)
4684 -               goto unmap_sg_iv;
4685 +               goto free_chain;
4686         if (unlikely(hmac_inconsistent(req->src, cryptlen, authsize))) {
4687                 /* The 12 hmac bytes are scattered,
4688                  * we need to copy them into a safe buffer */
4689                 req_ctx->hmac_virt = dma_pool_alloc(buffer_pool, flags,
4690                                 &crypt->icv_rev_aes);
4691                 if (unlikely(!req_ctx->hmac_virt))
4692 -                       goto unmap_sg_iv;
4693 +                       goto free_chain;
4694                 if (!encrypt) {
4695                         scatterwalk_map_and_copy(req_ctx->hmac_virt,
4696                                 req->src, cryptlen, authsize, 0);
4697 @@ -1073,33 +1022,28 @@
4698                 req_ctx->hmac_virt = NULL;
4699         }
4700         /* Crypt */
4701 -       nents = count_sg(req->src, cryptlen + authsize);
4702 -       req_ctx->src_nents = nents;
4703 -       dma_map_sg(dev, req->src, nents, DMA_BIDIRECTIONAL);
4704 -       buf = chainup_buffers(req->src, cryptlen + authsize, buf, flags);
4705 +       buf = chainup_buffers(dev, req->src, cryptlen + authsize, buf, flags,
4706 +                       DMA_BIDIRECTIONAL);
4707         if (!buf)
4708 -               goto unmap_sg_src;
4709 +               goto free_hmac_virt;
4710         if (!req_ctx->hmac_virt) {
4711                 crypt->icv_rev_aes = buf->phys_addr + buf->buf_len - authsize;
4712         }
4713 +
4714         crypt->ctl_flags |= CTL_FLAG_PERFORM_AEAD;
4715         qmgr_put_entry(SEND_QID, crypt_virt2phys(crypt));
4716         BUG_ON(qmgr_stat_overflow(SEND_QID));
4717         return -EINPROGRESS;
4718 -unmap_sg_src:
4719 -       dma_unmap_sg(dev, req->src, req_ctx->src_nents, DMA_BIDIRECTIONAL);
4720 +free_hmac_virt:
4721         if (req_ctx->hmac_virt) {
4722                 dma_pool_free(buffer_pool, req_ctx->hmac_virt,
4723                                 crypt->icv_rev_aes);
4724         }
4725 -unmap_sg_iv:
4726 -       dma_unmap_sg(dev, &req_ctx->ivlist, 1, DMA_BIDIRECTIONAL);
4727 -unmap_sg_assoc:
4728 -       dma_unmap_sg(dev, req->assoc, req_ctx->assoc_nents, DMA_TO_DEVICE);
4729 -       free_buf_chain(req_ctx->buffer, crypt->src_buf);
4730 +free_chain:
4731 +       free_buf_chain(dev, req_ctx->buffer, crypt->src_buf);
4732  out:
4733         crypt->ctl_flags = CTL_FLAG_UNUSED;
4734 -       return ret;
4735 +       return -ENOMEM;
4736  }
4737
4738  static int aead_setup(struct crypto_aead *tfm, unsigned int authsize)
4739 --- kernel-power-2.6.28.orig/drivers/dma/ioat_dma.c
4740 +++ kernel-power-2.6.28/drivers/dma/ioat_dma.c
4741 @@ -1341,12 +1341,11 @@
4742   */
4743  #define IOAT_TEST_SIZE 2000
4744
4745 -DECLARE_COMPLETION(test_completion);
4746  static void ioat_dma_test_callback(void *dma_async_param)
4747  {
4748 -       printk(KERN_ERR "ioatdma: ioat_dma_test_callback(%p)\n",
4749 -               dma_async_param);
4750 -       complete(&test_completion);
4751 +       struct completion *cmp = dma_async_param;
4752 +
4753 +       complete(cmp);
4754  }
4755
4756  /**
4757 @@ -1363,6 +1362,7 @@
4758         dma_addr_t dma_dest, dma_src;
4759         dma_cookie_t cookie;
4760         int err = 0;
4761 +       struct completion cmp;
4762
4763         src = kzalloc(sizeof(u8) * IOAT_TEST_SIZE, GFP_KERNEL);
4764         if (!src)
4765 @@ -1402,8 +1402,9 @@
4766         }
4767
4768         async_tx_ack(tx);
4769 +       init_completion(&cmp);
4770         tx->callback = ioat_dma_test_callback;
4771 -       tx->callback_param = (void *)0x8086;
4772 +       tx->callback_param = &cmp;
4773         cookie = tx->tx_submit(tx);
4774         if (cookie < 0) {
4775                 dev_err(&device->pdev->dev,
4776 @@ -1413,7 +1414,7 @@
4777         }
4778         device->common.device_issue_pending(dma_chan);
4779
4780 -       wait_for_completion_timeout(&test_completion, msecs_to_jiffies(3000));
4781 +       wait_for_completion_timeout(&cmp, msecs_to_jiffies(3000));
4782
4783         if (device->common.device_is_tx_complete(dma_chan, cookie, NULL, NULL)
4784                                         != DMA_SUCCESS) {
4785 --- kernel-power-2.6.28.orig/drivers/firewire/fw-ohci.c
4786 +++ kernel-power-2.6.28/drivers/firewire/fw-ohci.c
4787 @@ -226,7 +226,7 @@
4788  #define CONTEXT_DEAD   0x0800
4789  #define CONTEXT_ACTIVE 0x0400
4790
4791 -#define OHCI1394_MAX_AT_REQ_RETRIES    0x2
4792 +#define OHCI1394_MAX_AT_REQ_RETRIES    0xf
4793  #define OHCI1394_MAX_AT_RESP_RETRIES   0x2
4794  #define OHCI1394_MAX_PHYS_RESP_RETRIES 0x8
4795
4796 --- kernel-power-2.6.28.orig/drivers/firewire/fw-sbp2.c
4797 +++ kernel-power-2.6.28/drivers/firewire/fw-sbp2.c
4798 @@ -357,15 +357,17 @@
4799                 .model                  = ~0,
4800                 .workarounds            = SBP2_WORKAROUND_128K_MAX_TRANS,
4801         },
4802 -
4803         /*
4804 -        * There are iPods (2nd gen, 3rd gen) with model_id == 0, but
4805 -        * these iPods do not feature the read_capacity bug according
4806 -        * to one report.  Read_capacity behaviour as well as model_id
4807 -        * could change due to Apple-supplied firmware updates though.
4808 +        * iPod 2nd generation: needs 128k max transfer size workaround
4809 +        * iPod 3rd generation: needs fix capacity workaround
4810          */
4811 -
4812 -       /* iPod 4th generation. */ {
4813 +       {
4814 +               .firmware_revision      = 0x0a2700,
4815 +               .model                  = 0x000000,
4816 +               .workarounds            = SBP2_WORKAROUND_128K_MAX_TRANS |
4817 +                                         SBP2_WORKAROUND_FIX_CAPACITY,
4818 +       },
4819 +       /* iPod 4th generation */ {
4820                 .firmware_revision      = 0x0a2700,
4821                 .model                  = 0x000021,
4822                 .workarounds            = SBP2_WORKAROUND_FIX_CAPACITY,
4823 @@ -1282,6 +1284,19 @@
4824         .id_table = sbp2_id_table,
4825  };
4826
4827 +static void sbp2_unmap_scatterlist(struct device *card_device,
4828 +                                  struct sbp2_command_orb *orb)
4829 +{
4830 +       if (scsi_sg_count(orb->cmd))
4831 +               dma_unmap_sg(card_device, scsi_sglist(orb->cmd),
4832 +                            scsi_sg_count(orb->cmd),
4833 +                            orb->cmd->sc_data_direction);
4834 +
4835 +       if (orb->request.misc & cpu_to_be32(COMMAND_ORB_PAGE_TABLE_PRESENT))
4836 +               dma_unmap_single(card_device, orb->page_table_bus,
4837 +                                sizeof(orb->page_table), DMA_TO_DEVICE);
4838 +}
4839 +
4840  static unsigned int
4841  sbp2_status_to_sense_data(u8 *sbp2_status, u8 *sense_data)
4842  {
4843 @@ -1361,15 +1376,7 @@
4844
4845         dma_unmap_single(device->card->device, orb->base.request_bus,
4846                          sizeof(orb->request), DMA_TO_DEVICE);
4847 -
4848 -       if (scsi_sg_count(orb->cmd) > 0)
4849 -               dma_unmap_sg(device->card->device, scsi_sglist(orb->cmd),
4850 -                            scsi_sg_count(orb->cmd),
4851 -                            orb->cmd->sc_data_direction);
4852 -
4853 -       if (orb->page_table_bus != 0)
4854 -               dma_unmap_single(device->card->device, orb->page_table_bus,
4855 -                                sizeof(orb->page_table), DMA_TO_DEVICE);
4856 +       sbp2_unmap_scatterlist(device->card->device, orb);
4857
4858         orb->cmd->result = result;
4859         orb->done(orb->cmd);
4860 @@ -1500,8 +1507,10 @@
4861         orb->base.request_bus =
4862                 dma_map_single(device->card->device, &orb->request,
4863                                sizeof(orb->request), DMA_TO_DEVICE);
4864 -       if (dma_mapping_error(device->card->device, orb->base.request_bus))
4865 +       if (dma_mapping_error(device->card->device, orb->base.request_bus)) {
4866 +               sbp2_unmap_scatterlist(device->card->device, orb);
4867                 goto out;
4868 +       }
4869
4870         sbp2_send_orb(&orb->base, lu, lu->tgt->node_id, generation,
4871                       lu->command_block_agent_address + SBP2_ORB_POINTER);
4872 --- kernel-power-2.6.28.orig/drivers/firmware/dell_rbu.c
4873 +++ kernel-power-2.6.28/drivers/firmware/dell_rbu.c
4874 @@ -576,7 +576,7 @@
4875  {
4876         int size = 0;
4877         if (!pos)
4878 -               size = sprintf(buffer, "%s\n", image_type);
4879 +               size = scnprintf(buffer, count, "%s\n", image_type);
4880         return size;
4881  }
4882
4883 @@ -648,7 +648,7 @@
4884         int size = 0;
4885         if (!pos) {
4886                 spin_lock(&rbu_data.lock);
4887 -               size = sprintf(buffer, "%lu\n", rbu_data.packetsize);
4888 +               size = scnprintf(buffer, count, "%lu\n", rbu_data.packetsize);
4889                 spin_unlock(&rbu_data.lock);
4890         }
4891         return size;
4892 --- kernel-power-2.6.28.orig/drivers/gpu/drm/drm_agpsupport.c
4893 +++ kernel-power-2.6.28/drivers/gpu/drm/drm_agpsupport.c
4894 @@ -33,10 +33,11 @@
4895
4896  #include "drmP.h"
4897  #include <linux/module.h>
4898 -#include <asm/agp.h>
4899
4900  #if __OS_HAS_AGP
4901
4902 +#include <asm/agp.h>
4903 +
4904  /**
4905   * Get AGP information.
4906   *
4907 --- kernel-power-2.6.28.orig/drivers/gpu/drm/drm_irq.c
4908 +++ kernel-power-2.6.28/drivers/gpu/drm/drm_irq.c
4909 @@ -259,7 +259,8 @@
4910   */
4911  int drm_irq_uninstall(struct drm_device * dev)
4912  {
4913 -       int irq_enabled;
4914 +       unsigned long irqflags;
4915 +       int irq_enabled, i;
4916
4917         if (!drm_core_check_feature(dev, DRIVER_HAVE_IRQ))
4918                 return -EINVAL;
4919 @@ -269,6 +270,16 @@
4920         dev->irq_enabled = 0;
4921         mutex_unlock(&dev->struct_mutex);
4922
4923 +       /*
4924 +        * Wake up any waiters so they don't hang.
4925 +        */
4926 +       spin_lock_irqsave(&dev->vbl_lock, irqflags);
4927 +       for (i = 0; i < dev->num_crtcs; i++) {
4928 +               DRM_WAKEUP(&dev->vbl_queue[i]);
4929 +               dev->vblank_enabled[i] = 0;
4930 +       }
4931 +       spin_unlock_irqrestore(&dev->vbl_lock, irqflags);
4932 +
4933         if (!irq_enabled)
4934                 return -EINVAL;
4935
4936 @@ -617,8 +628,9 @@
4937                 DRM_DEBUG("waiting on vblank count %d, crtc %d\n",
4938                           vblwait->request.sequence, crtc);
4939                 DRM_WAIT_ON(ret, dev->vbl_queue[crtc], 3 * DRM_HZ,
4940 -                           ((drm_vblank_count(dev, crtc)
4941 -                             - vblwait->request.sequence) <= (1 << 23)));
4942 +                           (((drm_vblank_count(dev, crtc) -
4943 +                              vblwait->request.sequence) <= (1 << 23)) ||
4944 +                            !dev->irq_enabled));
4945
4946                 if (ret != -EINTR) {
4947                         struct timeval now;
4948 --- kernel-power-2.6.28.orig/drivers/gpu/drm/i915/i915_gem.c
4949 +++ kernel-power-2.6.28/drivers/gpu/drm/i915/i915_gem.c
4950 @@ -1161,6 +1161,8 @@
4951         struct drm_mm_node *free_space;
4952         int page_count, ret;
4953
4954 +       if (dev_priv->mm.suspended)
4955 +               return -EBUSY;
4956         if (alignment == 0)
4957                 alignment = PAGE_SIZE;
4958         if (alignment & (PAGE_SIZE - 1)) {
4959 @@ -2029,13 +2031,15 @@
4960
4961                 /* error other than GTT full, or we've already tried again */
4962                 if (ret != -ENOMEM || pin_tries >= 1) {
4963 -                       DRM_ERROR("Failed to pin buffers %d\n", ret);
4964 +                       if (ret != -ERESTARTSYS)
4965 +                               DRM_ERROR("Failed to pin buffers %d\n", ret);
4966                         goto err;
4967                 }
4968
4969                 /* unpin all of our buffers */
4970                 for (i = 0; i < pinned; i++)
4971                         i915_gem_object_unpin(object_list[i]);
4972 +               pinned = 0;
4973
4974                 /* evict everyone we can from the aperture */
4975                 ret = i915_gem_evict_everything(dev);
4976 @@ -2178,7 +2182,8 @@
4977         if (obj_priv->gtt_space == NULL) {
4978                 ret = i915_gem_object_bind_to_gtt(obj, alignment);
4979                 if (ret != 0) {
4980 -                       DRM_ERROR("Failure to bind: %d", ret);
4981 +                       if (ret != -EBUSY && ret != -ERESTARTSYS)
4982 +                               DRM_ERROR("Failure to bind: %d", ret);
4983                         return ret;
4984                 }
4985         }
4986 @@ -2700,20 +2705,21 @@
4987                 dev_priv->mm.wedged = 0;
4988         }
4989
4990 -       ret = i915_gem_init_ringbuffer(dev);
4991 -       if (ret != 0)
4992 -               return ret;
4993 -
4994         dev_priv->mm.gtt_mapping = io_mapping_create_wc(dev->agp->base,
4995                                                         dev->agp->agp_info.aper_size
4996                                                         * 1024 * 1024);
4997
4998         mutex_lock(&dev->struct_mutex);
4999 +       dev_priv->mm.suspended = 0;
5000 +
5001 +       ret = i915_gem_init_ringbuffer(dev);
5002 +       if (ret != 0)
5003 +               return ret;
5004 +
5005         BUG_ON(!list_empty(&dev_priv->mm.active_list));
5006         BUG_ON(!list_empty(&dev_priv->mm.flushing_list));
5007         BUG_ON(!list_empty(&dev_priv->mm.inactive_list));
5008         BUG_ON(!list_empty(&dev_priv->mm.request_list));
5009 -       dev_priv->mm.suspended = 0;
5010         mutex_unlock(&dev->struct_mutex);
5011
5012         drm_irq_install(dev);
5013 --- kernel-power-2.6.28.orig/drivers/gpu/drm/i915/i915_irq.c
5014 +++ kernel-power-2.6.28/drivers/gpu/drm/i915/i915_irq.c
5015 @@ -400,6 +400,12 @@
5016  {
5017         drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
5018         unsigned long irqflags;
5019 +       int pipeconf_reg = (pipe == 0) ? PIPEACONF : PIPEBCONF;
5020 +       u32 pipeconf;
5021 +
5022 +       pipeconf = I915_READ(pipeconf_reg);
5023 +       if (!(pipeconf & PIPEACONF_ENABLE))
5024 +               return -EINVAL;
5025
5026         spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
5027         if (IS_I965G(dev))
5028 --- kernel-power-2.6.28.orig/drivers/hid/hid-core.c
5029 +++ kernel-power-2.6.28/drivers/hid/hid-core.c
5030 @@ -1302,6 +1302,12 @@
5031         { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS3_CONTROLLER) },
5032         { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_VAIO_VGX_MOUSE) },
5033         { HID_USB_DEVICE(USB_VENDOR_ID_SUNPLUS, USB_DEVICE_ID_SUNPLUS_WDESKTOP) },
5034 +       { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb300) },
5035 +       { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb304) },
5036 +       { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb651) },
5037 +       { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb654) },
5038 +       { HID_USB_DEVICE(USB_VENDOR_ID_ZEROPLUS, 0x0005) },
5039 +       { HID_USB_DEVICE(USB_VENDOR_ID_ZEROPLUS, 0x0030) },
5040
5041         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, 0x030c) },
5042         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_BT) },
5043 @@ -1529,10 +1535,6 @@
5044         { HID_USB_DEVICE(USB_VENDOR_ID_SOUNDGRAPH, USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD3) },
5045         { HID_USB_DEVICE(USB_VENDOR_ID_TENX, USB_DEVICE_ID_TENX_IBUDDY1) },
5046         { HID_USB_DEVICE(USB_VENDOR_ID_TENX, USB_DEVICE_ID_TENX_IBUDDY2) },
5047 -       { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb300) },
5048 -       { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb304) },
5049 -       { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb651) },
5050 -       { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb654) },
5051         { HID_USB_DEVICE(USB_VENDOR_ID_VERNIER, USB_DEVICE_ID_VERNIER_LABPRO) },
5052         { HID_USB_DEVICE(USB_VENDOR_ID_VERNIER, USB_DEVICE_ID_VERNIER_GOTEMP) },
5053         { HID_USB_DEVICE(USB_VENDOR_ID_VERNIER, USB_DEVICE_ID_VERNIER_SKIP) },
5054 @@ -1543,8 +1545,6 @@
5055         { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_1_PHIDGETSERVO_20) },
5056         { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_8_8_4_IF_KIT) },
5057         { HID_USB_DEVICE(USB_VENDOR_ID_YEALINK, USB_DEVICE_ID_YEALINK_P1K_P4K_B2K) },
5058 -       { HID_USB_DEVICE(USB_VENDOR_ID_ZEROPLUS, 0x0005) },
5059 -       { HID_USB_DEVICE(USB_VENDOR_ID_ZEROPLUS, 0x0030) },
5060         { }
5061  };
5062
5063 --- kernel-power-2.6.28.orig/drivers/hid/hid-microsoft.c
5064 +++ kernel-power-2.6.28/drivers/hid/hid-microsoft.c
5065 @@ -30,7 +30,7 @@
5066  #define MS_NOGET       0x10
5067
5068  /*
5069 - * Microsoft Wireless Desktop Receiver (Model 1028) has several
5070 + * Microsoft Wireless Desktop Receiver (Model 1028) has
5071   * 'Usage Min/Max' where it ought to have 'Physical Min/Max'
5072   */
5073  static void ms_report_fixup(struct hid_device *hdev, __u8 *rdesc,
5074 @@ -38,17 +38,12 @@
5075  {
5076         unsigned long quirks = (unsigned long)hid_get_drvdata(hdev);
5077
5078 -       if ((quirks & MS_RDESC) && rsize == 571 && rdesc[284] == 0x19 &&
5079 -                       rdesc[286] == 0x2a && rdesc[304] == 0x19 &&
5080 -                       rdesc[306] == 0x29 && rdesc[352] == 0x1a &&
5081 -                       rdesc[355] == 0x2a && rdesc[557] == 0x19 &&
5082 +       if ((quirks & MS_RDESC) && rsize == 571 && rdesc[557] == 0x19 &&
5083                         rdesc[559] == 0x29) {
5084                 dev_info(&hdev->dev, "fixing up Microsoft Wireless Receiver "
5085                                 "Model 1028 report descriptor\n");
5086 -               rdesc[284] = rdesc[304] = rdesc[557] = 0x35;
5087 -               rdesc[352] = 0x36;
5088 -               rdesc[286] = rdesc[355] = 0x46;
5089 -               rdesc[306] = rdesc[559] = 0x45;
5090 +               rdesc[557] = 0x35;
5091 +               rdesc[559] = 0x45;
5092         }
5093  }
5094
5095 --- kernel-power-2.6.28.orig/drivers/hid/hid-sony.c
5096 +++ kernel-power-2.6.28/drivers/hid/hid-sony.c
5097 @@ -102,7 +102,7 @@
5098         }
5099
5100         ret = sony_set_operational(hdev);
5101 -       if (ret)
5102 +       if (ret < 0)
5103                 goto err_stop;
5104
5105         return 0;
5106 --- kernel-power-2.6.28.orig/drivers/hwmon/abituguru3.c
5107 +++ kernel-power-2.6.28/drivers/hwmon/abituguru3.c
5108 @@ -1153,7 +1153,7 @@
5109
5110  static inline int abituguru3_dmi_detect(void)
5111  {
5112 -       return -ENODEV;
5113 +       return 1;
5114  }
5115
5116  #endif /* CONFIG_DMI */
5117 --- kernel-power-2.6.28.orig/drivers/hwmon/f71882fg.c
5118 +++ kernel-power-2.6.28/drivers/hwmon/f71882fg.c
5119 @@ -837,7 +837,7 @@
5120
5121         devid = superio_inw(sioaddr, SIO_REG_MANID);
5122         if (devid != SIO_FINTEK_ID) {
5123 -               printk(KERN_INFO DRVNAME ": Not a Fintek device\n");
5124 +               pr_debug(DRVNAME ": Not a Fintek device\n");
5125                 goto exit;
5126         }
5127
5128 --- kernel-power-2.6.28.orig/drivers/hwmon/it87.c
5129 +++ kernel-power-2.6.28/drivers/hwmon/it87.c
5130 @@ -207,7 +207,7 @@
5131
5132  #define TEMP_TO_REG(val) (SENSORS_LIMIT(((val)<0?(((val)-500)/1000):\
5133                                         ((val)+500)/1000),-128,127))
5134 -#define TEMP_FROM_REG(val) (((val)>0x80?(val)-0x100:(val))*1000)
5135 +#define TEMP_FROM_REG(val) ((val) * 1000)
5136
5137  #define PWM_TO_REG(val)   ((val) >> 1)
5138  #define PWM_FROM_REG(val) (((val)&0x7f) << 1)
5139 @@ -261,9 +261,9 @@
5140         u8 has_fan;             /* Bitfield, fans enabled */
5141         u16 fan[5];             /* Register values, possibly combined */
5142         u16 fan_min[5];         /* Register values, possibly combined */
5143 -       u8 temp[3];             /* Register value */
5144 -       u8 temp_high[3];        /* Register value */
5145 -       u8 temp_low[3];         /* Register value */
5146 +       s8 temp[3];             /* Register value */
5147 +       s8 temp_high[3];        /* Register value */
5148 +       s8 temp_low[3];         /* Register value */
5149         u8 sensor;              /* Register value */
5150         u8 fan_div[3];          /* Register encoding, shifted right */
5151         u8 vid;                 /* Register encoding, combined */
5152 --- kernel-power-2.6.28.orig/drivers/i2c/busses/i2c-acorn.c
5153 +++ kernel-power-2.6.28/drivers/i2c/busses/i2c-acorn.c
5154 @@ -84,6 +84,7 @@
5155
5156  static struct i2c_adapter ioc_ops = {
5157         .id                     = I2C_HW_B_IOC,
5158 +       .nr                     = 0,
5159         .algo_data              = &ioc_data,
5160  };
5161
5162 @@ -91,7 +92,7 @@
5163  {
5164         force_ones = FORCE_ONES | SCL | SDA;
5165
5166 -       return i2c_bit_add_bus(&ioc_ops);
5167 +       return i2c_bit_add_numbered_bus(&ioc_ops);
5168  }
5169
5170  module_init(i2c_ioc_init);
5171 --- kernel-power-2.6.28.orig/drivers/i2c/busses/i2c-amd8111.c
5172 +++ kernel-power-2.6.28/drivers/i2c/busses/i2c-amd8111.c
5173 @@ -72,7 +72,7 @@
5174  {
5175         int timeout = 500;
5176
5177 -       while (timeout-- && (inb(smbus->base + AMD_EC_SC) & AMD_EC_SC_IBF))
5178 +       while ((inb(smbus->base + AMD_EC_SC) & AMD_EC_SC_IBF) && --timeout)
5179                 udelay(1);
5180
5181         if (!timeout) {
5182 @@ -88,7 +88,7 @@
5183  {
5184         int timeout = 500;
5185
5186 -       while (timeout-- && (~inb(smbus->base + AMD_EC_SC) & AMD_EC_SC_OBF))
5187 +       while ((~inb(smbus->base + AMD_EC_SC) & AMD_EC_SC_OBF) && --timeout)
5188                 udelay(1);
5189
5190         if (!timeout) {
5191 --- kernel-power-2.6.28.orig/drivers/i2c/busses/i2c-pxa.c
5192 +++ kernel-power-2.6.28/drivers/i2c/busses/i2c-pxa.c
5193 @@ -644,7 +644,7 @@
5194
5195         i2c_pxa_start_message(i2c);
5196
5197 -       while (timeout-- && i2c->msg_num > 0) {
5198 +       while (i2c->msg_num > 0 && --timeout) {
5199                 i2c_pxa_handler(0, i2c);
5200                 udelay(10);
5201         }
5202 --- kernel-power-2.6.28.orig/drivers/i2c/i2c-core.c
5203 +++ kernel-power-2.6.28/drivers/i2c/i2c-core.c
5204 @@ -1831,7 +1831,8 @@
5205         case I2C_SMBUS_QUICK:
5206                 msg[0].len = 0;
5207                 /* Special case: The read/write field is used as data */
5208 -               msg[0].flags = flags | (read_write==I2C_SMBUS_READ)?I2C_M_RD:0;
5209 +               msg[0].flags = flags | (read_write == I2C_SMBUS_READ ?
5210 +                                       I2C_M_RD : 0);
5211                 num = 1;
5212                 break;
5213         case I2C_SMBUS_BYTE:
5214 --- kernel-power-2.6.28.orig/drivers/ide/hpt366.c
5215 +++ kernel-power-2.6.28/drivers/ide/hpt366.c
5216 @@ -114,6 +114,8 @@
5217   *   the register setting lists into the table indexed by the clock selected
5218   * - set the correct hwif->ultra_mask for each individual chip
5219   * - add Ultra and MW DMA mode filtering for the HPT37[24] based SATA cards
5220 + * - stop resetting HPT370's state machine before each DMA transfer as that has
5221 + *   caused more harm than good
5222   *     Sergei Shtylyov, <sshtylyov@ru.mvista.com> or <source@mvista.com>
5223   */
5224
5225 @@ -133,7 +135,7 @@
5226  #define DRV_NAME "hpt366"
5227
5228  /* various tuning parameters */
5229 -#define HPT_RESET_STATE_ENGINE
5230 +#undef HPT_RESET_STATE_ENGINE
5231  #undef HPT_DELAY_INTERRUPT
5232  #define HPT_SERIALIZE_IO       0
5233
5234 --- kernel-power-2.6.28.orig/drivers/ide/ide-cd.c
5235 +++ kernel-power-2.6.28/drivers/ide/ide-cd.c
5236 @@ -984,6 +984,9 @@
5237                 if (blk_fs_request(rq)) {
5238                         ide_end_request(drive, 1, rq->nr_sectors);
5239                         return ide_stopped;
5240 +               } else if (rq->cmd_type == REQ_TYPE_ATA_PC && !rq->bio) {
5241 +                       ide_end_request(drive, 1, 1);
5242 +                       return ide_stopped;
5243                 }
5244                 goto end_request;
5245         }
5246 --- kernel-power-2.6.28.orig/drivers/ide/ide-io.c
5247 +++ kernel-power-2.6.28/drivers/ide/ide-io.c
5248 @@ -577,11 +577,14 @@
5249         if (hwif->sg_mapped)    /* needed by ide-scsi */
5250                 return;
5251
5252 -       if (rq->cmd_type != REQ_TYPE_ATA_TASKFILE) {
5253 -               hwif->sg_nents = blk_rq_map_sg(drive->queue, rq, sg);
5254 -       } else {
5255 +       if (rq->cmd_type == REQ_TYPE_ATA_TASKFILE) {
5256                 sg_init_one(sg, rq->buffer, rq->nr_sectors * SECTOR_SIZE);
5257                 hwif->sg_nents = 1;
5258 +       } else if (!rq->bio) {
5259 +               sg_init_one(sg, rq->data, rq->data_len);
5260 +               hwif->sg_nents = 1;
5261 +       } else {
5262 +               hwif->sg_nents = blk_rq_map_sg(drive->queue, rq, sg);
5263         }
5264  }
5265
5266 --- kernel-power-2.6.28.orig/drivers/ide/ide-iops.c
5267 +++ kernel-power-2.6.28/drivers/ide/ide-iops.c
5268 @@ -324,6 +324,8 @@
5269         u8 io_32bit = drive->io_32bit;
5270         u8 mmio = (hwif->host_flags & IDE_HFLAG_MMIO) ? 1 : 0;
5271
5272 +       len++;
5273 +
5274         if (io_32bit) {
5275                 unsigned long uninitialized_var(flags);
5276
5277 --- kernel-power-2.6.28.orig/drivers/ide/it821x.c
5278 +++ kernel-power-2.6.28/drivers/ide/it821x.c
5279 @@ -68,6 +68,8 @@
5280
5281  #define DRV_NAME "it821x"
5282
5283 +#define QUIRK_VORTEX86 1
5284 +
5285  struct it821x_dev
5286  {
5287         unsigned int smart:1,           /* Are we in smart raid mode */
5288 @@ -79,6 +81,7 @@
5289         u16     pio[2];                 /* Cached PIO values */
5290         u16     mwdma[2];               /* Cached MWDMA values */
5291         u16     udma[2];                /* Cached UDMA values (per drive) */
5292 +       u16     quirks;
5293  };
5294
5295  #define ATA_66         0
5296 @@ -580,6 +583,12 @@
5297
5298         hwif->ultra_mask = ATA_UDMA6;
5299         hwif->mwdma_mask = ATA_MWDMA2;
5300 +
5301 +       /* Vortex86SX quirk: prevent Ultra-DMA mode to fix BadCRC issue */
5302 +       if (idev->quirks & QUIRK_VORTEX86) {
5303 +               if (dev->revision == 0x11)
5304 +                       hwif->ultra_mask = 0;
5305 +       }
5306  }
5307
5308  static void it8212_disable_raid(struct pci_dev *dev)
5309 @@ -652,6 +661,8 @@
5310                 return -ENOMEM;
5311         }
5312
5313 +       itdevs->quirks = id->driver_data;
5314 +
5315         rc = ide_pci_init_one(dev, &it821x_chipset, itdevs);
5316         if (rc)
5317                 kfree(itdevs);
5318 @@ -671,6 +682,7 @@
5319  static const struct pci_device_id it821x_pci_tbl[] = {
5320         { PCI_VDEVICE(ITE, PCI_DEVICE_ID_ITE_8211), 0 },
5321         { PCI_VDEVICE(ITE, PCI_DEVICE_ID_ITE_8212), 0 },
5322 +       { PCI_VDEVICE(RDC, PCI_DEVICE_ID_RDC_D1010), QUIRK_VORTEX86 },
5323         { 0, },
5324  };
5325
5326 --- kernel-power-2.6.28.orig/drivers/ide/tx4938ide.c
5327 +++ kernel-power-2.6.28/drivers/ide/tx4938ide.c
5328 @@ -181,7 +181,7 @@
5329
5330         while (count--)
5331                 *ptr++ = cpu_to_le16(__raw_readw((void __iomem *)port));
5332 -       __ide_flush_dcache_range((unsigned long)buf, count * 2);
5333 +       __ide_flush_dcache_range((unsigned long)buf, roundup(len, 2));
5334  }
5335
5336  static void tx4938ide_output_data_swap(ide_drive_t *drive, struct request *rq,
5337 @@ -195,7 +195,7 @@
5338                 __raw_writew(le16_to_cpu(*ptr), (void __iomem *)port);
5339                 ptr++;
5340         }
5341 -       __ide_flush_dcache_range((unsigned long)buf, count * 2);
5342 +       __ide_flush_dcache_range((unsigned long)buf, roundup(len, 2));
5343  }
5344
5345  static const struct ide_tp_ops tx4938ide_tp_ops = {
5346 --- kernel-power-2.6.28.orig/drivers/ide/tx4939ide.c
5347 +++ kernel-power-2.6.28/drivers/ide/tx4939ide.c
5348 @@ -259,6 +259,12 @@
5349                         bcount = 0x10000 - (cur_addr & 0xffff);
5350                         if (bcount > cur_len)
5351                                 bcount = cur_len;
5352 +                       /*
5353 +                        * This workaround for zero count seems required.
5354 +                        * (standard ide_build_dmatable do it too)
5355 +                        */
5356 +                       if ((bcount & 0xffff) == 0x0000)
5357 +                               bcount = 0x8000;
5358                         *table++ = bcount & 0xffff;
5359                         *table++ = cur_addr;
5360                         cur_addr += bcount;
5361 @@ -558,7 +564,7 @@
5362
5363         while (count--)
5364                 *ptr++ = cpu_to_le16(__raw_readw((void __iomem *)port));
5365 -       __ide_flush_dcache_range((unsigned long)buf, count * 2);
5366 +       __ide_flush_dcache_range((unsigned long)buf, roundup(len, 2));
5367  }
5368
5369  static void tx4939ide_output_data_swap(ide_drive_t *drive, struct request *rq,
5370 @@ -572,7 +578,7 @@
5371                 __raw_writew(le16_to_cpu(*ptr), (void __iomem *)port);
5372                 ptr++;
5373         }
5374 -       __ide_flush_dcache_range((unsigned long)buf, count * 2);
5375 +       __ide_flush_dcache_range((unsigned long)buf, roundup(len, 2));
5376  }
5377
5378  static const struct ide_tp_ops tx4939ide_tp_ops = {
5379 --- kernel-power-2.6.28.orig/drivers/ieee1394/ohci1394.h
5380 +++ kernel-power-2.6.28/drivers/ieee1394/ohci1394.h
5381 @@ -26,7 +26,7 @@
5382
5383  #define OHCI1394_DRIVER_NAME      "ohci1394"
5384
5385 -#define OHCI1394_MAX_AT_REQ_RETRIES    0x2
5386 +#define OHCI1394_MAX_AT_REQ_RETRIES    0xf
5387  #define OHCI1394_MAX_AT_RESP_RETRIES   0x2
5388  #define OHCI1394_MAX_PHYS_RESP_RETRIES 0x8
5389  #define OHCI1394_MAX_SELF_ID_ERRORS    16
5390 --- kernel-power-2.6.28.orig/drivers/ieee1394/sbp2.c
5391 +++ kernel-power-2.6.28/drivers/ieee1394/sbp2.c
5392 @@ -395,6 +395,16 @@
5393                 .model_id               = SBP2_ROM_VALUE_WILDCARD,
5394                 .workarounds            = SBP2_WORKAROUND_128K_MAX_TRANS,
5395         },
5396 +       /*
5397 +        * iPod 2nd generation: needs 128k max transfer size workaround
5398 +        * iPod 3rd generation: needs fix capacity workaround
5399 +        */
5400 +       {
5401 +               .firmware_revision      = 0x0a2700,
5402 +               .model_id               = 0x000000,
5403 +               .workarounds            = SBP2_WORKAROUND_128K_MAX_TRANS |
5404 +                                         SBP2_WORKAROUND_FIX_CAPACITY,
5405 +       },
5406         /* iPod 4th generation */ {
5407                 .firmware_revision      = 0x0a2700,
5408                 .model_id               = 0x000021,
5409 --- kernel-power-2.6.28.orig/drivers/infiniband/hw/nes/nes_cm.c
5410 +++ kernel-power-2.6.28/drivers/infiniband/hw/nes/nes_cm.c
5411 @@ -2495,12 +2495,14 @@
5412         int ret = 0;
5413         struct nes_vnic *nesvnic;
5414         struct nes_device *nesdev;
5415 +       struct nes_ib_device *nesibdev;
5416
5417         nesvnic = to_nesvnic(nesqp->ibqp.device);
5418         if (!nesvnic)
5419                 return -EINVAL;
5420
5421         nesdev = nesvnic->nesdev;
5422 +       nesibdev = nesvnic->nesibdev;
5423
5424         nes_debug(NES_DBG_CM, "netdev refcnt = %u.\n",
5425                         atomic_read(&nesvnic->netdev->refcnt));
5426 @@ -2512,6 +2514,8 @@
5427         } else {
5428                 /* Need to free the Last Streaming Mode Message */
5429                 if (nesqp->ietf_frame) {
5430 +                       if (nesqp->lsmm_mr)
5431 +                               nesibdev->ibdev.dereg_mr(nesqp->lsmm_mr);
5432                         pci_free_consistent(nesdev->pcidev,
5433                                         nesqp->private_data_len+sizeof(struct ietf_mpa_frame),
5434                                         nesqp->ietf_frame, nesqp->ietf_frame_pbase);
5435 @@ -2545,6 +2549,10 @@
5436         struct iw_cm_event cm_event;
5437         struct nes_hw_qp_wqe *wqe;
5438         struct nes_v4_quad nes_quad;
5439 +       struct nes_ib_device *nesibdev;
5440 +       struct ib_mr *ibmr = NULL;
5441 +       struct ib_phys_buf ibphysbuf;
5442 +       struct nes_pd *nespd;
5443         u32 crc_value;
5444         int ret;
5445
5446 @@ -2605,6 +2613,26 @@
5447         if (cm_id->remote_addr.sin_addr.s_addr !=
5448                         cm_id->local_addr.sin_addr.s_addr) {
5449                 u64temp = (unsigned long)nesqp;
5450 +               nesibdev = nesvnic->nesibdev;
5451 +               nespd = nesqp->nespd;
5452 +               ibphysbuf.addr = nesqp->ietf_frame_pbase;
5453 +               ibphysbuf.size = conn_param->private_data_len +
5454 +                                       sizeof(struct ietf_mpa_frame);
5455 +               ibmr = nesibdev->ibdev.reg_phys_mr((struct ib_pd *)nespd,
5456 +                                               &ibphysbuf, 1,
5457 +                                               IB_ACCESS_LOCAL_WRITE,
5458 +                                               (u64 *)&nesqp->ietf_frame);
5459 +               if (!ibmr) {
5460 +                       nes_debug(NES_DBG_CM, "Unable to register memory region"
5461 +                                       "for lSMM for cm_node = %p \n",
5462 +                                       cm_node);
5463 +                       return -ENOMEM;
5464 +               }
5465 +
5466 +               ibmr->pd = &nespd->ibpd;
5467 +               ibmr->device = nespd->ibpd.device;
5468 +               nesqp->lsmm_mr = ibmr;
5469 +
5470                 u64temp |= NES_SW_CONTEXT_ALIGN>>1;
5471                 set_wqe_64bit_value(wqe->wqe_words,
5472                         NES_IWARP_SQ_WQE_COMP_CTX_LOW_IDX,
5473 @@ -2615,14 +2643,13 @@
5474                 wqe->wqe_words[NES_IWARP_SQ_WQE_TOTAL_PAYLOAD_IDX] =
5475                         cpu_to_le32(conn_param->private_data_len +
5476                         sizeof(struct ietf_mpa_frame));
5477 -               wqe->wqe_words[NES_IWARP_SQ_WQE_FRAG0_LOW_IDX] =
5478 -                       cpu_to_le32((u32)nesqp->ietf_frame_pbase);
5479 -               wqe->wqe_words[NES_IWARP_SQ_WQE_FRAG0_HIGH_IDX] =
5480 -                       cpu_to_le32((u32)((u64)nesqp->ietf_frame_pbase >> 32));
5481 +               set_wqe_64bit_value(wqe->wqe_words,
5482 +                                       NES_IWARP_SQ_WQE_FRAG0_LOW_IDX,
5483 +                                       (u64)nesqp->ietf_frame);
5484                 wqe->wqe_words[NES_IWARP_SQ_WQE_LENGTH0_IDX] =
5485                         cpu_to_le32(conn_param->private_data_len +
5486                         sizeof(struct ietf_mpa_frame));
5487 -               wqe->wqe_words[NES_IWARP_SQ_WQE_STAG0_IDX] = 0;
5488 +               wqe->wqe_words[NES_IWARP_SQ_WQE_STAG0_IDX] = ibmr->lkey;
5489
5490                 nesqp->nesqp_context->ird_ord_sizes |=
5491                         cpu_to_le32(NES_QPCONTEXT_ORDIRD_LSMM_PRESENT |
5492 --- kernel-power-2.6.28.orig/drivers/infiniband/hw/nes/nes_verbs.c
5493 +++ kernel-power-2.6.28/drivers/infiniband/hw/nes/nes_verbs.c
5494 @@ -1360,8 +1360,10 @@
5495                                         NES_QPCONTEXT_MISC_RQ_SIZE_SHIFT);
5496                         nesqp->nesqp_context->misc |= cpu_to_le32((u32)nesqp->hwqp.sq_encoded_size <<
5497                                         NES_QPCONTEXT_MISC_SQ_SIZE_SHIFT);
5498 +                       if (!udata) {
5499                                 nesqp->nesqp_context->misc |= cpu_to_le32(NES_QPCONTEXT_MISC_PRIV_EN);
5500                                 nesqp->nesqp_context->misc |= cpu_to_le32(NES_QPCONTEXT_MISC_FAST_REGISTER_EN);
5501 +                       }
5502                         nesqp->nesqp_context->cqs = cpu_to_le32(nesqp->nesscq->hw_cq.cq_number +
5503                                         ((u32)nesqp->nesrcq->hw_cq.cq_number << 16));
5504                         u64temp = (u64)nesqp->hwqp.sq_pbase;
5505 --- kernel-power-2.6.28.orig/drivers/infiniband/hw/nes/nes_verbs.h
5506 +++ kernel-power-2.6.28/drivers/infiniband/hw/nes/nes_verbs.h
5507 @@ -134,6 +134,7 @@
5508         struct ietf_mpa_frame *ietf_frame;
5509         dma_addr_t            ietf_frame_pbase;
5510         wait_queue_head_t     state_waitq;
5511 +       struct ib_mr          *lsmm_mr;
5512         unsigned long         socket;
5513         struct nes_hw_qp      hwqp;
5514         struct work_struct    work;
5515 --- kernel-power-2.6.28.orig/drivers/input/gameport/gameport.c
5516 +++ kernel-power-2.6.28/drivers/input/gameport/gameport.c
5517 @@ -50,9 +50,8 @@
5518
5519  static struct bus_type gameport_bus;
5520
5521 -static void gameport_add_driver(struct gameport_driver *drv);
5522  static void gameport_add_port(struct gameport *gameport);
5523 -static void gameport_destroy_port(struct gameport *gameport);
5524 +static void gameport_attach_driver(struct gameport_driver *drv);
5525  static void gameport_reconnect_port(struct gameport *gameport);
5526  static void gameport_disconnect_port(struct gameport *gameport);
5527
5528 @@ -230,7 +229,6 @@
5529
5530  enum gameport_event_type {
5531         GAMEPORT_REGISTER_PORT,
5532 -       GAMEPORT_REGISTER_DRIVER,
5533         GAMEPORT_ATTACH_DRIVER,
5534  };
5535
5536 @@ -374,8 +372,8 @@
5537                                 gameport_add_port(event->object);
5538                                 break;
5539
5540 -                       case GAMEPORT_REGISTER_DRIVER:
5541 -                               gameport_add_driver(event->object);
5542 +                       case GAMEPORT_ATTACH_DRIVER:
5543 +                               gameport_attach_driver(event->object);
5544                                 break;
5545
5546                         default:
5547 @@ -707,14 +705,14 @@
5548         return 0;
5549  }
5550
5551 -static void gameport_add_driver(struct gameport_driver *drv)
5552 +static void gameport_attach_driver(struct gameport_driver *drv)
5553  {
5554         int error;
5555
5556 -       error = driver_register(&drv->driver);
5557 +       error = driver_attach(&drv->driver);
5558         if (error)
5559                 printk(KERN_ERR
5560 -                       "gameport: driver_register() failed for %s, error: %d\n",
5561 +                       "gameport: driver_attach() failed for %s, error: %d\n",
5562                         drv->driver.name, error);
5563  }
5564
5565 --- kernel-power-2.6.28.orig/drivers/input/keyboard/atkbd.c
5566 +++ kernel-power-2.6.28/drivers/input/keyboard/atkbd.c
5567 @@ -884,6 +884,22 @@
5568  }
5569
5570  /*
5571 + * Samsung NC10 with Fn+F? key release not working
5572 + */
5573 +static void atkbd_samsung_keymap_fixup(struct atkbd *atkbd)
5574 +{
5575 +       const unsigned int forced_release_keys[] = {
5576 +               0x82, 0x83, 0x84, 0x86, 0x88, 0x89, 0xb3, 0xf7, 0xf9,
5577 +       };
5578 +       int i;
5579 +
5580 +       if (atkbd->set == 2)
5581 +               for (i = 0; i < ARRAY_SIZE(forced_release_keys); i++)
5582 +                       __set_bit(forced_release_keys[i],
5583 +                                 atkbd->force_release_mask);
5584 +}
5585 +
5586 +/*
5587   * atkbd_set_keycode_table() initializes keyboard's keycode table
5588   * according to the selected scancode set
5589   */
5590 @@ -1493,6 +1509,15 @@
5591                 .callback = atkbd_setup_fixup,
5592                 .driver_data = atkbd_inventec_keymap_fixup,
5593         },
5594 +       {
5595 +               .ident = "Samsung NC10",
5596 +               .matches = {
5597 +                       DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
5598 +                       DMI_MATCH(DMI_PRODUCT_NAME, "NC10"),
5599 +               },
5600 +               .callback = atkbd_setup_fixup,
5601 +               .driver_data = atkbd_samsung_keymap_fixup,
5602 +       },
5603         { }
5604  };
5605
5606 --- kernel-power-2.6.28.orig/drivers/isdn/gigaset/bas-gigaset.c
5607 +++ kernel-power-2.6.28/drivers/isdn/gigaset/bas-gigaset.c
5608 @@ -46,6 +46,9 @@
5609  /* length limit according to Siemens 3070usb-protokoll.doc ch. 2.1 */
5610  #define IF_WRITEBUF 264
5611
5612 +/* interrupt pipe message size according to ibid. ch. 2.2 */
5613 +#define IP_MSGSIZE 3
5614 +
5615  /* Values for the Gigaset 307x */
5616  #define USB_GIGA_VENDOR_ID      0x0681
5617  #define USB_3070_PRODUCT_ID     0x0001
5618 @@ -110,7 +113,7 @@
5619         unsigned char           *rcvbuf;        /* AT reply receive buffer */
5620
5621         struct urb              *urb_int_in;    /* URB for interrupt pipe */
5622 -       unsigned char           int_in_buf[3];
5623 +       unsigned char           *int_in_buf;
5624
5625         spinlock_t              lock;           /* locks all following */
5626         int                     basstate;       /* bitmap (BS_*) */
5627 @@ -657,7 +660,7 @@
5628         }
5629
5630         /* drop incomplete packets even if the missing bytes wouldn't matter */
5631 -       if (unlikely(urb->actual_length < 3)) {
5632 +       if (unlikely(urb->actual_length < IP_MSGSIZE)) {
5633                 dev_warn(cs->dev, "incomplete interrupt packet (%d bytes)\n",
5634                          urb->actual_length);
5635                 goto resubmit;
5636 @@ -2127,6 +2130,7 @@
5637  static void gigaset_freecshw(struct cardstate *cs)
5638  {
5639         /* timers, URBs and rcvbuf are disposed of in disconnect */
5640 +       kfree(cs->hw.bas->int_in_buf);
5641         kfree(cs->hw.bas);
5642         cs->hw.bas = NULL;
5643  }
5644 @@ -2232,6 +2236,12 @@
5645                 }
5646                 hostif = interface->cur_altsetting;
5647         }
5648 +       ucs->int_in_buf = kmalloc(IP_MSGSIZE, GFP_KERNEL);
5649 +       if (!ucs->int_in_buf) {
5650 +               kfree(ucs);
5651 +               pr_err("out of memory\n");
5652 +               return 0;
5653 +       }
5654
5655         /* Reject application specific interfaces
5656          */
5657 @@ -2290,7 +2300,7 @@
5658         usb_fill_int_urb(ucs->urb_int_in, udev,
5659                          usb_rcvintpipe(udev,
5660                                         (endpoint->bEndpointAddress) & 0x0f),
5661 -                        ucs->int_in_buf, 3, read_int_callback, cs,
5662 +                        ucs->int_in_buf, IP_MSGSIZE, read_int_callback, cs,
5663                          endpoint->bInterval);
5664         if ((rc = usb_submit_urb(ucs->urb_int_in, GFP_KERNEL)) != 0) {
5665                 dev_err(cs->dev, "could not submit interrupt URB: %s\n",
5666 --- kernel-power-2.6.28.orig/drivers/md/bitmap.c
5667 +++ kernel-power-2.6.28/drivers/md/bitmap.c
5668 @@ -964,9 +964,11 @@
5669                                  */
5670                                 page = bitmap->sb_page;
5671                                 offset = sizeof(bitmap_super_t);
5672 -                               read_sb_page(bitmap->mddev, bitmap->offset,
5673 -                                            page,
5674 -                                            index, count);
5675 +                               if (!file)
5676 +                                       read_sb_page(bitmap->mddev,
5677 +                                                    bitmap->offset,
5678 +                                                    page,
5679 +                                                    index, count);
5680                         } else if (file) {
5681                                 page = read_page(file, index, bitmap, count);
5682                                 offset = 0;
5683 --- kernel-power-2.6.28.orig/drivers/md/dm-crypt.c
5684 +++ kernel-power-2.6.28/drivers/md/dm-crypt.c
5685 @@ -60,6 +60,7 @@
5686  };
5687
5688  struct dm_crypt_request {
5689 +       struct convert_context *ctx;
5690         struct scatterlist sg_in;
5691         struct scatterlist sg_out;
5692  };
5693 @@ -335,6 +336,18 @@
5694         init_completion(&ctx->restart);
5695  }
5696
5697 +static struct dm_crypt_request *dmreq_of_req(struct crypt_config *cc,
5698 +                                            struct ablkcipher_request *req)
5699 +{
5700 +       return (struct dm_crypt_request *)((char *)req + cc->dmreq_start);
5701 +}
5702 +
5703 +static struct ablkcipher_request *req_of_dmreq(struct crypt_config *cc,
5704 +                                              struct dm_crypt_request *dmreq)
5705 +{
5706 +       return (struct ablkcipher_request *)((char *)dmreq - cc->dmreq_start);
5707 +}
5708 +
5709  static int crypt_convert_block(struct crypt_config *cc,
5710                                struct convert_context *ctx,
5711                                struct ablkcipher_request *req)
5712 @@ -345,10 +358,11 @@
5713         u8 *iv;
5714         int r = 0;
5715
5716 -       dmreq = (struct dm_crypt_request *)((char *)req + cc->dmreq_start);
5717 +       dmreq = dmreq_of_req(cc, req);
5718         iv = (u8 *)ALIGN((unsigned long)(dmreq + 1),
5719                          crypto_ablkcipher_alignmask(cc->tfm) + 1);
5720
5721 +       dmreq->ctx = ctx;
5722         sg_init_table(&dmreq->sg_in, 1);
5723         sg_set_page(&dmreq->sg_in, bv_in->bv_page, 1 << SECTOR_SHIFT,
5724                     bv_in->bv_offset + ctx->offset_in);
5725 @@ -395,8 +409,9 @@
5726                 cc->req = mempool_alloc(cc->req_pool, GFP_NOIO);
5727         ablkcipher_request_set_tfm(cc->req, cc->tfm);
5728         ablkcipher_request_set_callback(cc->req, CRYPTO_TFM_REQ_MAY_BACKLOG |
5729 -                                            CRYPTO_TFM_REQ_MAY_SLEEP,
5730 -                                            kcryptd_async_done, ctx);
5731 +                                       CRYPTO_TFM_REQ_MAY_SLEEP,
5732 +                                       kcryptd_async_done,
5733 +                                       dmreq_of_req(cc, cc->req));
5734  }
5735
5736  /*
5737 @@ -553,19 +568,22 @@
5738  static void crypt_dec_pending(struct dm_crypt_io *io)
5739  {
5740         struct crypt_config *cc = io->target->private;
5741 +       struct bio *base_bio = io->base_bio;
5742 +       struct dm_crypt_io *base_io = io->base_io;
5743 +       int error = io->error;
5744
5745         if (!atomic_dec_and_test(&io->pending))
5746                 return;
5747
5748 -       if (likely(!io->base_io))
5749 -               bio_endio(io->base_bio, io->error);
5750 +       mempool_free(io, cc->io_pool);
5751 +
5752 +       if (likely(!base_io))
5753 +               bio_endio(base_bio, error);
5754         else {
5755 -               if (io->error && !io->base_io->error)
5756 -                       io->base_io->error = io->error;
5757 -               crypt_dec_pending(io->base_io);
5758 +               if (error && !base_io->error)
5759 +                       base_io->error = error;
5760 +               crypt_dec_pending(base_io);
5761         }
5762 -
5763 -       mempool_free(io, cc->io_pool);
5764  }
5765
5766  /*
5767 @@ -821,7 +839,8 @@
5768  static void kcryptd_async_done(struct crypto_async_request *async_req,
5769                                int error)
5770  {
5771 -       struct convert_context *ctx = async_req->data;
5772 +       struct dm_crypt_request *dmreq = async_req->data;
5773 +       struct convert_context *ctx = dmreq->ctx;
5774         struct dm_crypt_io *io = container_of(ctx, struct dm_crypt_io, ctx);
5775         struct crypt_config *cc = io->target->private;
5776
5777 @@ -830,7 +849,7 @@
5778                 return;
5779         }
5780
5781 -       mempool_free(ablkcipher_request_cast(async_req), cc->req_pool);
5782 +       mempool_free(req_of_dmreq(cc, dmreq), cc->req_pool);
5783
5784         if (!atomic_dec_and_test(&ctx->pending))
5785                 return;
5786 --- kernel-power-2.6.28.orig/drivers/md/dm-io.c
5787 +++ kernel-power-2.6.28/drivers/md/dm-io.c
5788 @@ -292,6 +292,8 @@
5789                                              (PAGE_SIZE >> SECTOR_SHIFT));
5790                 num_bvecs = 1 + min_t(int, bio_get_nr_vecs(where->bdev),
5791                                       num_bvecs);
5792 +               if (unlikely(num_bvecs > BIO_MAX_PAGES))
5793 +                       num_bvecs = BIO_MAX_PAGES;
5794                 bio = bio_alloc_bioset(GFP_NOIO, num_bvecs, io->client->bios);
5795                 bio->bi_sector = where->sector + (where->count - remaining);
5796                 bio->bi_bdev = where->bdev;
5797 --- kernel-power-2.6.28.orig/drivers/md/dm-ioctl.c
5798 +++ kernel-power-2.6.28/drivers/md/dm-ioctl.c
5799 @@ -704,7 +704,8 @@
5800         char *new_name = (char *) param + param->data_start;
5801
5802         if (new_name < param->data ||
5803 -           invalid_str(new_name, (void *) param + param_size)) {
5804 +           invalid_str(new_name, (void *) param + param_size) ||
5805 +           strlen(new_name) > DM_NAME_LEN - 1) {
5806                 DMWARN("Invalid new logical volume name supplied.");
5807                 return -EINVAL;
5808         }
5809 --- kernel-power-2.6.28.orig/drivers/md/dm-log.c
5810 +++ kernel-power-2.6.28/drivers/md/dm-log.c
5811 @@ -467,6 +467,7 @@
5812                 lc->disk_header = vmalloc(buf_size);
5813                 if (!lc->disk_header) {
5814                         DMWARN("couldn't allocate disk log buffer");
5815 +                       dm_io_client_destroy(lc->io_req.client);
5816                         kfree(lc);
5817                         return -ENOMEM;
5818                 }
5819 @@ -482,6 +483,8 @@
5820                 DMWARN("couldn't allocate sync bitset");
5821                 if (!dev)
5822                         vfree(lc->clean_bits);
5823 +               else
5824 +                       dm_io_client_destroy(lc->io_req.client);
5825                 vfree(lc->disk_header);
5826                 kfree(lc);
5827                 return -ENOMEM;
5828 @@ -495,6 +498,8 @@
5829                 vfree(lc->sync_bits);
5830                 if (!dev)
5831                         vfree(lc->clean_bits);
5832 +               else
5833 +                       dm_io_client_destroy(lc->io_req.client);
5834                 vfree(lc->disk_header);
5835                 kfree(lc);
5836                 return -ENOMEM;
5837 --- kernel-power-2.6.28.orig/drivers/md/dm-raid1.c
5838 +++ kernel-power-2.6.28/drivers/md/dm-raid1.c
5839 @@ -197,9 +197,6 @@
5840         struct mirror_set *ms = m->ms;
5841         struct mirror *new;
5842
5843 -       if (!errors_handled(ms))
5844 -               return;
5845 -
5846         /*
5847          * error_count is used for nothing more than a
5848          * simple way to tell if a device has encountered
5849 @@ -210,6 +207,9 @@
5850         if (test_and_set_bit(error_type, &m->error_type))
5851                 return;
5852
5853 +       if (!errors_handled(ms))
5854 +               return;
5855 +
5856         if (m != get_default_mirror(ms))
5857                 goto out;
5858
5859 --- kernel-power-2.6.28.orig/drivers/md/dm.c
5860 +++ kernel-power-2.6.28/drivers/md/dm.c
5861 @@ -480,9 +480,12 @@
5862  static void dec_pending(struct dm_io *io, int error)
5863  {
5864         unsigned long flags;
5865 +       int io_error;
5866 +       struct bio *bio;
5867 +       struct mapped_device *md = io->md;
5868
5869         /* Push-back supersedes any I/O errors */
5870 -       if (error && !(io->error > 0 && __noflush_suspending(io->md)))
5871 +       if (error && !(io->error > 0 && __noflush_suspending(md)))
5872                 io->error = error;
5873
5874         if (atomic_dec_and_test(&io->io_count)) {
5875 @@ -492,25 +495,28 @@
5876                          * This must be handled before the sleeper on
5877                          * suspend queue merges the pushback list.
5878                          */
5879 -                       spin_lock_irqsave(&io->md->pushback_lock, flags);
5880 -                       if (__noflush_suspending(io->md))
5881 -                               bio_list_add(&io->md->pushback, io->bio);
5882 +                       spin_lock_irqsave(&md->pushback_lock, flags);
5883 +                       if (__noflush_suspending(md))
5884 +                               bio_list_add(&md->pushback, io->bio);
5885                         else
5886                                 /* noflush suspend was interrupted. */
5887                                 io->error = -EIO;
5888 -                       spin_unlock_irqrestore(&io->md->pushback_lock, flags);
5889 +                       spin_unlock_irqrestore(&md->pushback_lock, flags);
5890                 }
5891
5892                 end_io_acct(io);
5893
5894 -               if (io->error != DM_ENDIO_REQUEUE) {
5895 -                       blk_add_trace_bio(io->md->queue, io->bio,
5896 +               io_error = io->error;
5897 +               bio = io->bio;
5898 +
5899 +               free_io(md, io);
5900 +
5901 +               if (io_error != DM_ENDIO_REQUEUE) {
5902 +                       blk_add_trace_bio(md->queue, io->bio,
5903                                           BLK_TA_COMPLETE);
5904
5905 -                       bio_endio(io->bio, io->error);
5906 +                       bio_endio(bio, io_error);
5907                 }
5908 -
5909 -               free_io(io->md, io);
5910         }
5911  }
5912
5913 @@ -518,6 +524,7 @@
5914  {
5915         int r = 0;
5916         struct dm_target_io *tio = bio->bi_private;
5917 +       struct dm_io *io = tio->io;
5918         struct mapped_device *md = tio->io->md;
5919         dm_endio_fn endio = tio->ti->type->end_io;
5920
5921 @@ -541,15 +548,14 @@
5922                 }
5923         }
5924
5925 -       dec_pending(tio->io, error);
5926 -
5927         /*
5928          * Store md for cleanup instead of tio which is about to get freed.
5929          */
5930         bio->bi_private = md->bs;
5931
5932 -       bio_put(bio);
5933         free_tio(md, tio);
5934 +       bio_put(bio);
5935 +       dec_pending(io, error);
5936  }
5937
5938  static sector_t max_io_len(struct mapped_device *md,
5939 --- kernel-power-2.6.28.orig/drivers/md/linear.c
5940 +++ kernel-power-2.6.28/drivers/md/linear.c
5941 @@ -25,13 +25,13 @@
5942  {
5943         dev_info_t *hash;
5944         linear_conf_t *conf = mddev_to_conf(mddev);
5945 +       sector_t idx = sector >> conf->sector_shift;
5946
5947         /*
5948          * sector_div(a,b) returns the remainer and sets a to a/b
5949          */
5950 -       sector >>= conf->sector_shift;
5951 -       (void)sector_div(sector, conf->spacing);
5952 -       hash = conf->hash_table[sector];
5953 +       (void)sector_div(idx, conf->spacing);
5954 +       hash = conf->hash_table[idx];
5955
5956         while (sector >= hash->num_sectors + hash->start_sector)
5957                 hash++;
5958 --- kernel-power-2.6.28.orig/drivers/md/md.c
5959 +++ kernel-power-2.6.28/drivers/md/md.c
5960 @@ -1447,6 +1447,11 @@
5961                 if (find_rdev_nr(mddev, rdev->desc_nr))
5962                         return -EBUSY;
5963         }
5964 +       if (mddev->max_disks && rdev->desc_nr >= mddev->max_disks) {
5965 +               printk(KERN_WARNING "md: %s: array is limited to %d devices\n",
5966 +                      mdname(mddev), mddev->max_disks);
5967 +               return -EBUSY;
5968 +       }
5969         bdevname(rdev->bdev,b);
5970         while ( (s=strchr(b, '/')) != NULL)
5971                 *s = '!';
5972 @@ -2355,6 +2360,15 @@
5973
5974         i = 0;
5975         rdev_for_each(rdev, tmp, mddev) {
5976 +               if (rdev->desc_nr >= mddev->max_disks ||
5977 +                   i > mddev->max_disks) {
5978 +                       printk(KERN_WARNING
5979 +                              "md: %s: %s: only %d devices permitted\n",
5980 +                              mdname(mddev), bdevname(rdev->bdev, b),
5981 +                              mddev->max_disks);
5982 +                       kick_rdev_from_array(rdev);
5983 +                       continue;
5984 +               }
5985                 if (rdev != freshest)
5986                         if (super_types[mddev->major_version].
5987                             validate_super(mddev, rdev)) {
5988 @@ -3680,6 +3694,10 @@
5989                 return err;
5990         }
5991         if (mddev->pers->sync_request) {
5992 +               /* wait for any previously scheduled redundancy groups
5993 +                * to be removed
5994 +                */
5995 +               flush_scheduled_work();
5996                 if (sysfs_create_group(&mddev->kobj, &md_redundancy_group))
5997                         printk(KERN_WARNING
5998                                "md: cannot register extra attributes for %s\n",
5999 @@ -3810,6 +3828,14 @@
6000         spin_unlock(&inode->i_lock);
6001  }
6002
6003 +
6004 +static void sysfs_delayed_rm(struct work_struct *ws)
6005 +{
6006 +       mddev_t *mddev = container_of(ws, mddev_t, del_work);
6007 +
6008 +       sysfs_remove_group(&mddev->kobj, &md_redundancy_group);
6009 +}
6010 +
6011  /* mode:
6012   *   0 - completely stop and dis-assemble array
6013   *   1 - switch to readonly
6014 @@ -3819,6 +3845,7 @@
6015  {
6016         int err = 0;
6017         struct gendisk *disk = mddev->gendisk;
6018 +       int remove_group = 0;
6019
6020         if (atomic_read(&mddev->openers) > is_open) {
6021                 printk("md: %s still in use.\n",mdname(mddev));
6022 @@ -3854,10 +3881,9 @@
6023                         mddev->queue->merge_bvec_fn = NULL;
6024                         mddev->queue->unplug_fn = NULL;
6025                         mddev->queue->backing_dev_info.congested_fn = NULL;
6026 -                       if (mddev->pers->sync_request)
6027 -                               sysfs_remove_group(&mddev->kobj, &md_redundancy_group);
6028 -
6029                         module_put(mddev->pers->owner);
6030 +                       if (mddev->pers->sync_request)
6031 +                               remove_group = 1;
6032                         mddev->pers = NULL;
6033                         /* tell userspace to handle 'inactive' */
6034                         sysfs_notify_dirent(mddev->sysfs_state);
6035 @@ -3905,6 +3931,15 @@
6036                 /* make sure all md_delayed_delete calls have finished */
6037                 flush_scheduled_work();
6038
6039 +               /* we can't wait for group removal under mddev_lock as
6040 +                * threads holding the group 'active' need to acquire
6041 +                * mddev_lock before going inactive
6042 +                */
6043 +               if (remove_group) {
6044 +                       INIT_WORK(&mddev->del_work, sysfs_delayed_rm);
6045 +                       schedule_work(&mddev->del_work);
6046 +               }
6047 +
6048                 export_array(mddev);
6049
6050                 mddev->array_sectors = 0;
6051 @@ -4448,13 +4483,6 @@
6052          * noticed in interrupt contexts ...
6053          */
6054
6055 -       if (rdev->desc_nr == mddev->max_disks) {
6056 -               printk(KERN_WARNING "%s: can not hot-add to full array!\n",
6057 -                       mdname(mddev));
6058 -               err = -EBUSY;
6059 -               goto abort_unbind_export;
6060 -       }
6061 -
6062         rdev->raid_disk = -1;
6063
6064         md_update_sb(mddev, 1);
6065 @@ -4468,9 +4496,6 @@
6066         md_new_event(mddev);
6067         return 0;
6068
6069 -abort_unbind_export:
6070 -       unbind_rdev_from_array(rdev);
6071 -
6072  abort_export:
6073         export_rdev(rdev);
6074         return err;
6075 --- kernel-power-2.6.28.orig/drivers/md/raid1.c
6076 +++ kernel-power-2.6.28/drivers/md/raid1.c
6077 @@ -1233,8 +1233,9 @@
6078         update_head_pos(mirror, r1_bio);
6079
6080         if (atomic_dec_and_test(&r1_bio->remaining)) {
6081 -               md_done_sync(mddev, r1_bio->sectors, uptodate);
6082 +               sector_t s = r1_bio->sectors;
6083                 put_buf(r1_bio);
6084 +               md_done_sync(mddev, s, uptodate);
6085         }
6086  }
6087
6088 --- kernel-power-2.6.28.orig/drivers/md/raid10.c
6089 +++ kernel-power-2.6.28/drivers/md/raid10.c
6090 @@ -1236,6 +1236,7 @@
6091         /* for reconstruct, we always reschedule after a read.
6092          * for resync, only after all reads
6093          */
6094 +       rdev_dec_pending(conf->mirrors[d].rdev, conf->mddev);
6095         if (test_bit(R10BIO_IsRecover, &r10_bio->state) ||
6096             atomic_dec_and_test(&r10_bio->remaining)) {
6097                 /* we have read all the blocks,
6098 @@ -1243,7 +1244,6 @@
6099                  */
6100                 reschedule_retry(r10_bio);
6101         }
6102 -       rdev_dec_pending(conf->mirrors[d].rdev, conf->mddev);
6103  }
6104
6105  static void end_sync_write(struct bio *bio, int error)
6106 @@ -1264,11 +1264,13 @@
6107
6108         update_head_pos(i, r10_bio);
6109
6110 +       rdev_dec_pending(conf->mirrors[d].rdev, mddev);
6111         while (atomic_dec_and_test(&r10_bio->remaining)) {
6112                 if (r10_bio->master_bio == NULL) {
6113                         /* the primary of several recovery bios */
6114 -                       md_done_sync(mddev, r10_bio->sectors, 1);
6115 +                       sector_t s = r10_bio->sectors;
6116                         put_buf(r10_bio);
6117 +                       md_done_sync(mddev, s, 1);
6118                         break;
6119                 } else {
6120                         r10bio_t *r10_bio2 = (r10bio_t *)r10_bio->master_bio;
6121 @@ -1276,7 +1278,6 @@
6122                         r10_bio = r10_bio2;
6123                 }
6124         }
6125 -       rdev_dec_pending(conf->mirrors[d].rdev, mddev);
6126  }
6127
6128  /*
6129 @@ -1749,8 +1750,6 @@
6130         if (!go_faster && conf->nr_waiting)
6131                 msleep_interruptible(1000);
6132
6133 -       bitmap_cond_end_sync(mddev->bitmap, sector_nr);
6134 -
6135         /* Again, very different code for resync and recovery.
6136          * Both must result in an r10bio with a list of bios that
6137          * have bi_end_io, bi_sector, bi_bdev set,
6138 @@ -1886,6 +1885,8 @@
6139                 /* resync. Schedule a read for every block at this virt offset */
6140                 int count = 0;
6141
6142 +               bitmap_cond_end_sync(mddev->bitmap, sector_nr);
6143 +
6144                 if (!bitmap_start_sync(mddev->bitmap, sector_nr,
6145                                        &sync_blocks, mddev->degraded) &&
6146                     !conf->fullsync && !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery)) {
6147 @@ -2010,13 +2011,13 @@
6148         /* There is nowhere to write, so all non-sync
6149          * drives must be failed, so try the next chunk...
6150          */
6151 -       {
6152 -       sector_t sec = max_sector - sector_nr;
6153 -       sectors_skipped += sec;
6154 +       if (sector_nr + max_sync < max_sector)
6155 +               max_sector = sector_nr + max_sync;
6156 +
6157 +       sectors_skipped += (max_sector - sector_nr);
6158         chunks_skipped ++;
6159         sector_nr = max_sector;
6160         goto skipped;
6161 -       }
6162  }
6163
6164  static int run(mddev_t *mddev)
6165 --- kernel-power-2.6.28.orig/drivers/media/common/tuners/tda8290.c
6166 +++ kernel-power-2.6.28/drivers/media/common/tuners/tda8290.c
6167 @@ -724,7 +724,8 @@
6168         fe->ops.analog_ops.info.name = name;
6169
6170         if (priv->ver & TDA8290) {
6171 -               tda8290_init_tuner(fe);
6172 +               if (priv->ver & (TDA8275 | TDA8275A))
6173 +                       tda8290_init_tuner(fe);
6174                 tda8290_init_if(fe);
6175         } else if (priv->ver & TDA8295)
6176                 tda8295_init_if(fe);
6177 --- kernel-power-2.6.28.orig/drivers/media/dvb/frontends/s5h1409.c
6178 +++ kernel-power-2.6.28/drivers/media/dvb/frontends/s5h1409.c
6179 @@ -545,9 +545,6 @@
6180
6181         s5h1409_enable_modulation(fe, p->u.vsb.modulation);
6182
6183 -       /* Allow the demod to settle */
6184 -       msleep(100);
6185 -
6186         if (fe->ops.tuner_ops.set_params) {
6187                 if (fe->ops.i2c_gate_ctrl)
6188                         fe->ops.i2c_gate_ctrl(fe, 1);
6189 @@ -562,6 +559,10 @@
6190                 s5h1409_set_qam_interleave_mode(fe);
6191         }
6192
6193 +       /* Issue a reset to the demod so it knows to resync against the
6194 +          newly tuned frequency */
6195 +       s5h1409_softreset(fe);
6196 +
6197         return 0;
6198  }
6199
6200 --- kernel-power-2.6.28.orig/drivers/media/video/cx23885/cx23885-417.c
6201 +++ kernel-power-2.6.28/drivers/media/video/cx23885/cx23885-417.c
6202 @@ -1585,7 +1585,8 @@
6203         lock_kernel();
6204         list_for_each(list, &cx23885_devlist) {
6205                 h = list_entry(list, struct cx23885_dev, devlist);
6206 -               if (h->v4l_device->minor == minor) {
6207 +               if (h->v4l_device &&
6208 +                   h->v4l_device->minor == minor) {
6209                         dev = h;
6210                         break;
6211                 }
6212 --- kernel-power-2.6.28.orig/drivers/media/video/cx23885/cx23885-video.c
6213 +++ kernel-power-2.6.28/drivers/media/video/cx23885/cx23885-video.c
6214 @@ -730,12 +730,13 @@
6215         lock_kernel();
6216         list_for_each(list, &cx23885_devlist) {
6217                 h = list_entry(list, struct cx23885_dev, devlist);
6218 -               if (h->video_dev->minor == minor) {
6219 +               if (h->video_dev &&
6220 +                   h->video_dev->minor == minor) {
6221                         dev  = h;
6222                         type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
6223                 }
6224                 if (h->vbi_dev &&
6225 -                  h->vbi_dev->minor == minor) {
6226 +                   h->vbi_dev->minor == minor) {
6227                         dev  = h;
6228                         type = V4L2_BUF_TYPE_VBI_CAPTURE;
6229                 }
6230 --- kernel-power-2.6.28.orig/drivers/media/video/ivtv/ivtv-ioctl.c
6231 +++ kernel-power-2.6.28/drivers/media/video/ivtv/ivtv-ioctl.c
6232 @@ -1750,6 +1750,18 @@
6233                 break;
6234         }
6235
6236 +       case IVTV_IOC_DMA_FRAME:
6237 +       case VIDEO_GET_PTS:
6238 +       case VIDEO_GET_FRAME_COUNT:
6239 +       case VIDEO_GET_EVENT:
6240 +       case VIDEO_PLAY:
6241 +       case VIDEO_STOP:
6242 +       case VIDEO_FREEZE:
6243 +       case VIDEO_CONTINUE:
6244 +       case VIDEO_COMMAND:
6245 +       case VIDEO_TRY_COMMAND:
6246 +               return ivtv_decoder_ioctls(file, cmd, (void *)arg);
6247 +
6248         default:
6249                 return -EINVAL;
6250         }
6251 @@ -1792,18 +1804,6 @@
6252                 ivtv_vapi(itv, CX2341X_DEC_SET_AUDIO_MODE, 2, itv->audio_bilingual_mode, itv->audio_stereo_mode);
6253                 return 0;
6254
6255 -       case IVTV_IOC_DMA_FRAME:
6256 -       case VIDEO_GET_PTS:
6257 -       case VIDEO_GET_FRAME_COUNT:
6258 -       case VIDEO_GET_EVENT:
6259 -       case VIDEO_PLAY:
6260 -       case VIDEO_STOP:
6261 -       case VIDEO_FREEZE:
6262 -       case VIDEO_CONTINUE:
6263 -       case VIDEO_COMMAND:
6264 -       case VIDEO_TRY_COMMAND:
6265 -               return ivtv_decoder_ioctls(filp, cmd, (void *)arg);
6266 -
6267         default:
6268                 break;
6269         }
6270 --- kernel-power-2.6.28.orig/drivers/media/video/saa7127.c
6271 +++ kernel-power-2.6.28/drivers/media/video/saa7127.c
6272 @@ -149,7 +149,7 @@
6273         { SAA7127_REG_COPYGEN_0,                        0x77 },
6274         { SAA7127_REG_COPYGEN_1,                        0x41 },
6275         { SAA7127_REG_COPYGEN_2,                        0x00 }, /* Macrovision enable/disable */
6276 -       { SAA7127_REG_OUTPUT_PORT_CONTROL,              0x9e },
6277 +       { SAA7127_REG_OUTPUT_PORT_CONTROL,              0xbf },
6278         { SAA7127_REG_GAIN_LUMINANCE_RGB,               0x00 },
6279         { SAA7127_REG_GAIN_COLORDIFF_RGB,               0x00 },
6280         { SAA7127_REG_INPUT_PORT_CONTROL_1,             0x80 }, /* for color bars */
6281 @@ -479,12 +479,18 @@
6282                 break;
6283
6284         case SAA7127_OUTPUT_TYPE_COMPOSITE:
6285 -               state->reg_2d = 0x08;   /* 00001000 CVBS only, RGB DAC's off (high impedance mode) */
6286 +               if (state->ident == V4L2_IDENT_SAA7129)
6287 +                       state->reg_2d = 0x20;   /* CVBS only */
6288 +               else
6289 +                       state->reg_2d = 0x08;   /* 00001000 CVBS only, RGB DAC's off (high impedance mode) */
6290                 state->reg_3a = 0x13;   /* by default switch YUV to RGB-matrix on */
6291                 break;
6292
6293         case SAA7127_OUTPUT_TYPE_SVIDEO:
6294 -               state->reg_2d = 0xff;   /* 11111111  croma -> R, luma -> CVBS + G + B */
6295 +               if (state->ident == V4L2_IDENT_SAA7129)
6296 +                       state->reg_2d = 0x18;   /* Y + C */
6297 +               else
6298 +                       state->reg_2d = 0xff;   /*11111111  croma -> R, luma -> CVBS + G + B */
6299                 state->reg_3a = 0x13;   /* by default switch YUV to RGB-matrix on */
6300                 break;
6301
6302 @@ -499,7 +505,10 @@
6303                 break;
6304
6305         case SAA7127_OUTPUT_TYPE_BOTH:
6306 -               state->reg_2d = 0xbf;
6307 +               if (state->ident == V4L2_IDENT_SAA7129)
6308 +                       state->reg_2d = 0x38;
6309 +               else
6310 +                       state->reg_2d = 0xbf;
6311                 state->reg_3a = 0x13;   /* by default switch YUV to RGB-matrix on */
6312                 break;
6313
6314 @@ -691,24 +700,6 @@
6315
6316         i2c_set_clientdata(client, state);
6317
6318 -       /* Configure Encoder */
6319 -
6320 -       v4l_dbg(1, debug, client, "Configuring encoder\n");
6321 -       saa7127_write_inittab(client, saa7127_init_config_common);
6322 -       saa7127_set_std(client, V4L2_STD_NTSC);
6323 -       saa7127_set_output_type(client, SAA7127_OUTPUT_TYPE_BOTH);
6324 -       saa7127_set_vps(client, &vbi);
6325 -       saa7127_set_wss(client, &vbi);
6326 -       saa7127_set_cc(client, &vbi);
6327 -       saa7127_set_xds(client, &vbi);
6328 -       if (test_image == 1)
6329 -               /* The Encoder has an internal Colorbar generator */
6330 -               /* This can be used for debugging */
6331 -               saa7127_set_input_type(client, SAA7127_INPUT_TYPE_TEST_IMAGE);
6332 -       else
6333 -               saa7127_set_input_type(client, SAA7127_INPUT_TYPE_NORMAL);
6334 -       saa7127_set_video_enable(client, 1);
6335 -
6336         if (id->driver_data) {  /* Chip type is already known */
6337                 state->ident = id->driver_data;
6338         } else {                /* Needs detection */
6339 @@ -730,6 +721,23 @@
6340
6341         v4l_info(client, "%s found @ 0x%x (%s)\n", client->name,
6342                         client->addr << 1, client->adapter->name);
6343 +
6344 +       v4l_dbg(1, debug, client, "Configuring encoder\n");
6345 +       saa7127_write_inittab(client, saa7127_init_config_common);
6346 +       saa7127_set_std(client, V4L2_STD_NTSC);
6347 +       saa7127_set_output_type(client, SAA7127_OUTPUT_TYPE_BOTH);
6348 +       saa7127_set_vps(client, &vbi);
6349 +       saa7127_set_wss(client, &vbi);
6350 +       saa7127_set_cc(client, &vbi);
6351 +       saa7127_set_xds(client, &vbi);
6352 +       if (test_image == 1)
6353 +               /* The Encoder has an internal Colorbar generator */
6354 +               /* This can be used for debugging */
6355 +               saa7127_set_input_type(client, SAA7127_INPUT_TYPE_TEST_IMAGE);
6356 +       else
6357 +               saa7127_set_input_type(client, SAA7127_INPUT_TYPE_NORMAL);
6358 +       saa7127_set_video_enable(client, 1);
6359 +
6360         if (state->ident == V4L2_IDENT_SAA7129)
6361                 saa7127_write_inittab(client, saa7129_init_config_extra);
6362         return 0;
6363 --- kernel-power-2.6.28.orig/drivers/misc/acer-wmi.c
6364 +++ kernel-power-2.6.28/drivers/misc/acer-wmi.c
6365 @@ -1297,7 +1297,7 @@
6366
6367         set_quirks();
6368
6369 -       if (!acpi_video_backlight_support() && has_cap(ACER_CAP_BRIGHTNESS)) {
6370 +       if (acpi_video_backlight_support() && has_cap(ACER_CAP_BRIGHTNESS)) {
6371                 interface->capability &= ~ACER_CAP_BRIGHTNESS;
6372                 printk(ACER_INFO "Brightness must be controlled by "
6373                        "generic video driver\n");
6374 --- kernel-power-2.6.28.orig/drivers/misc/eeepc-laptop.c
6375 +++ kernel-power-2.6.28/drivers/misc/eeepc-laptop.c
6376 @@ -161,6 +161,10 @@
6377         {KE_KEY, 0x13, KEY_MUTE },
6378         {KE_KEY, 0x14, KEY_VOLUMEDOWN },
6379         {KE_KEY, 0x15, KEY_VOLUMEUP },
6380 +       {KE_KEY, 0x1a, KEY_COFFEE },
6381 +       {KE_KEY, 0x1b, KEY_ZOOM },
6382 +       {KE_KEY, 0x1c, KEY_PROG2 },
6383 +       {KE_KEY, 0x1d, KEY_PROG3 },
6384         {KE_KEY, 0x30, KEY_SWITCHVIDEOMODE },
6385         {KE_KEY, 0x31, KEY_SWITCHVIDEOMODE },
6386         {KE_KEY, 0x32, KEY_SWITCHVIDEOMODE },
6387 @@ -510,7 +514,8 @@
6388  static void notify_brn(void)
6389  {
6390         struct backlight_device *bd = eeepc_backlight_device;
6391 -       bd->props.brightness = read_brightness(bd);
6392 +       if (bd)
6393 +               bd->props.brightness = read_brightness(bd);
6394  }
6395
6396  static void eeepc_hotk_notify(acpi_handle handle, u32 event, void *data)
6397 --- kernel-power-2.6.28.orig/drivers/misc/hpilo.c
6398 +++ kernel-power-2.6.28/drivers/misc/hpilo.c
6399 @@ -710,6 +710,7 @@
6400
6401  static struct pci_device_id ilo_devices[] = {
6402         { PCI_DEVICE(PCI_VENDOR_ID_COMPAQ, 0xB204) },
6403 +       { PCI_DEVICE(PCI_VENDOR_ID_HP, 0x3307) },
6404         { }
6405  };
6406  MODULE_DEVICE_TABLE(pci, ilo_devices);
6407 --- kernel-power-2.6.28.orig/drivers/misc/panasonic-laptop.c
6408 +++ kernel-power-2.6.28/drivers/misc/panasonic-laptop.c
6409 @@ -515,7 +515,7 @@
6410
6411         hkey_num = result & 0xf;
6412
6413 -       if (hkey_num < 0 || hkey_num > ARRAY_SIZE(pcc->keymap)) {
6414 +       if (hkey_num < 0 || hkey_num >= ARRAY_SIZE(pcc->keymap)) {
6415                 ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
6416                                   "hotkey number out of range: %d\n",
6417                                   hkey_num));
6418 --- kernel-power-2.6.28.orig/drivers/misc/sgi-xp/xpc.h
6419 +++ kernel-power-2.6.28/drivers/misc/sgi-xp/xpc.h
6420 @@ -3,7 +3,7 @@
6421   * License.  See the file "COPYING" in the main directory of this archive
6422   * for more details.
6423   *
6424 - * Copyright (c) 2004-2008 Silicon Graphics, Inc.  All Rights Reserved.
6425 + * Copyright (c) 2004-2009 Silicon Graphics, Inc.  All Rights Reserved.
6426   */
6427
6428  /*
6429 @@ -502,7 +502,8 @@
6430                                                 /* partition's notify mq */
6431
6432         struct xpc_send_msg_slot_uv *send_msg_slots;
6433 -       struct xpc_notify_mq_msg_uv *recv_msg_slots;
6434 +       void *recv_msg_slots;   /* each slot will hold a xpc_notify_mq_msg_uv */
6435 +                               /* structure plus the user's payload */
6436
6437         struct xpc_fifo_head_uv msg_slot_free_list;
6438         struct xpc_fifo_head_uv recv_msg_list;  /* deliverable payloads */
6439 --- kernel-power-2.6.28.orig/drivers/misc/sgi-xp/xpc_sn2.c
6440 +++ kernel-power-2.6.28/drivers/misc/sgi-xp/xpc_sn2.c
6441 @@ -904,7 +904,7 @@
6442         dev_dbg(xpc_part, "  remote_vars_pa = 0x%016lx\n",
6443                 part_sn2->remote_vars_pa);
6444
6445 -       part->last_heartbeat = remote_vars->heartbeat;
6446 +       part->last_heartbeat = remote_vars->heartbeat - 1;
6447         dev_dbg(xpc_part, "  last_heartbeat = 0x%016lx\n",
6448                 part->last_heartbeat);
6449
6450 @@ -1841,6 +1841,7 @@
6451                  */
6452                 xpc_clear_remote_msgqueue_flags_sn2(ch);
6453
6454 +               smp_wmb(); /* ensure flags have been cleared before bte_copy */
6455                 ch_sn2->w_remote_GP.put = ch_sn2->remote_GP.put;
6456
6457                 dev_dbg(xpc_chan, "w_remote_GP.put changed to %ld, partid=%d, "
6458 @@ -1939,7 +1940,7 @@
6459                         break;
6460
6461                 get = ch_sn2->w_local_GP.get;
6462 -               rmb();  /* guarantee that .get loads before .put */
6463 +               smp_rmb();      /* guarantee that .get loads before .put */
6464                 if (get == ch_sn2->w_remote_GP.put)
6465                         break;
6466
6467 @@ -1961,11 +1962,13 @@
6468
6469                         msg = xpc_pull_remote_msg_sn2(ch, get);
6470
6471 -                       DBUG_ON(msg != NULL && msg->number != get);
6472 -                       DBUG_ON(msg != NULL && (msg->flags & XPC_M_SN2_DONE));
6473 -                       DBUG_ON(msg != NULL && !(msg->flags & XPC_M_SN2_READY));
6474 +                       if (msg != NULL) {
6475 +                               DBUG_ON(msg->number != get);
6476 +                               DBUG_ON(msg->flags & XPC_M_SN2_DONE);
6477 +                               DBUG_ON(!(msg->flags & XPC_M_SN2_READY));
6478
6479 -                       payload = &msg->payload;
6480 +                               payload = &msg->payload;
6481 +                       }
6482                         break;
6483                 }
6484
6485 @@ -2058,7 +2061,7 @@
6486         while (1) {
6487
6488                 put = ch_sn2->w_local_GP.put;
6489 -               rmb();  /* guarantee that .put loads before .get */
6490 +               smp_rmb();      /* guarantee that .put loads before .get */
6491                 if (put - ch_sn2->w_remote_GP.get < ch->local_nentries) {
6492
6493                         /* There are available message entries. We need to try
6494 @@ -2191,7 +2194,7 @@
6495          * The preceding store of msg->flags must occur before the following
6496          * load of local_GP->put.
6497          */
6498 -       mb();
6499 +       smp_mb();
6500
6501         /* see if the message is next in line to be sent, if so send it */
6502
6503 @@ -2292,7 +2295,7 @@
6504          * The preceding store of msg->flags must occur before the following
6505          * load of local_GP->get.
6506          */
6507 -       mb();
6508 +       smp_mb();
6509
6510         /*
6511          * See if this message is next in line to be acknowledged as having
6512 --- kernel-power-2.6.28.orig/drivers/misc/sgi-xp/xpc_uv.c
6513 +++ kernel-power-2.6.28/drivers/misc/sgi-xp/xpc_uv.c
6514 @@ -3,7 +3,7 @@
6515   * License.  See the file "COPYING" in the main directory of this archive
6516   * for more details.
6517   *
6518 - * Copyright (c) 2008 Silicon Graphics, Inc.  All Rights Reserved.
6519 + * Copyright (c) 2008-2009 Silicon Graphics, Inc.  All Rights Reserved.
6520   */
6521
6522  /*
6523 @@ -825,8 +825,8 @@
6524                         continue;
6525
6526                 for (entry = 0; entry < nentries; entry++) {
6527 -                       msg_slot = ch_uv->recv_msg_slots + entry *
6528 -                           ch->entry_size;
6529 +                       msg_slot = ch_uv->recv_msg_slots +
6530 +                           entry * ch->entry_size;
6531
6532                         msg_slot->hdr.msg_slot_number = entry;
6533                 }
6534 @@ -1123,9 +1123,8 @@
6535         /* we're dealing with a normal message sent via the notify_mq */
6536         ch_uv = &ch->sn.uv;
6537
6538 -       msg_slot = (struct xpc_notify_mq_msg_uv *)((u64)ch_uv->recv_msg_slots +
6539 -                   (msg->hdr.msg_slot_number % ch->remote_nentries) *
6540 -                   ch->entry_size);
6541 +       msg_slot = ch_uv->recv_msg_slots +
6542 +           (msg->hdr.msg_slot_number % ch->remote_nentries) * ch->entry_size;
6543
6544         BUG_ON(msg->hdr.msg_slot_number != msg_slot->hdr.msg_slot_number);
6545         BUG_ON(msg_slot->hdr.size != 0);
6546 @@ -1238,7 +1237,7 @@
6547                 atomic_inc(&ch->n_to_notify);
6548
6549                 msg_slot->key = key;
6550 -               wmb(); /* a non-NULL func must hit memory after the key */
6551 +               smp_wmb(); /* a non-NULL func must hit memory after the key */
6552                 msg_slot->func = func;
6553
6554                 if (ch->flags & XPC_C_DISCONNECTING) {
6555 --- kernel-power-2.6.28.orig/drivers/misc/thinkpad_acpi.c
6556 +++ kernel-power-2.6.28/drivers/misc/thinkpad_acpi.c
6557 @@ -281,11 +281,17 @@
6558
6559  static struct workqueue_struct *tpacpi_wq;
6560
6561 +enum led_status_t {
6562 +       TPACPI_LED_OFF = 0,
6563 +       TPACPI_LED_ON,
6564 +       TPACPI_LED_BLINK,
6565 +};
6566 +
6567  /* Special LED class that can defer work */
6568  struct tpacpi_led_classdev {
6569         struct led_classdev led_classdev;
6570         struct work_struct work;
6571 -       enum led_brightness new_brightness;
6572 +       enum led_status_t new_state;
6573         unsigned int led;
6574  };
6575
6576 @@ -3489,7 +3495,7 @@
6577                         container_of(work, struct tpacpi_led_classdev, work);
6578
6579         if (likely(tpacpi_lifecycle == TPACPI_LIFE_RUNNING))
6580 -               light_set_status((data->new_brightness != LED_OFF));
6581 +               light_set_status((data->new_state != TPACPI_LED_OFF));
6582  }
6583
6584  static void light_sysfs_set(struct led_classdev *led_cdev,
6585 @@ -3499,7 +3505,8 @@
6586                 container_of(led_cdev,
6587                              struct tpacpi_led_classdev,
6588                              led_classdev);
6589 -       data->new_brightness = brightness;
6590 +       data->new_state = (brightness != LED_OFF) ?
6591 +                               TPACPI_LED_ON : TPACPI_LED_OFF;
6592         queue_work(tpacpi_wq, &data->work);
6593  }
6594
6595 @@ -4006,12 +4013,6 @@
6596         TPACPI_LED_EC_HLMS = 0x0e,      /* EC reg to select led to command */
6597  };
6598
6599 -enum led_status_t {
6600 -       TPACPI_LED_OFF = 0,
6601 -       TPACPI_LED_ON,
6602 -       TPACPI_LED_BLINK,
6603 -};
6604 -
6605  static enum led_access_mode led_supported;
6606
6607  TPACPI_HANDLE(led, ec, "SLED", /* 570 */
6608 @@ -4105,23 +4106,13 @@
6609         return rc;
6610  }
6611
6612 -static void led_sysfs_set_status(unsigned int led,
6613 -                                enum led_brightness brightness)
6614 -{
6615 -       led_set_status(led,
6616 -                       (brightness == LED_OFF) ?
6617 -                       TPACPI_LED_OFF :
6618 -                       (tpacpi_led_state_cache[led] == TPACPI_LED_BLINK) ?
6619 -                               TPACPI_LED_BLINK : TPACPI_LED_ON);
6620 -}
6621 -
6622  static void led_set_status_worker(struct work_struct *work)
6623  {
6624         struct tpacpi_led_classdev *data =
6625                 container_of(work, struct tpacpi_led_classdev, work);
6626
6627         if (likely(tpacpi_lifecycle == TPACPI_LIFE_RUNNING))
6628 -               led_sysfs_set_status(data->led, data->new_brightness);
6629 +               led_set_status(data->led, data->new_state);
6630  }
6631
6632  static void led_sysfs_set(struct led_classdev *led_cdev,
6633 @@ -4130,7 +4121,13 @@
6634         struct tpacpi_led_classdev *data = container_of(led_cdev,
6635                              struct tpacpi_led_classdev, led_classdev);
6636
6637 -       data->new_brightness = brightness;
6638 +       if (brightness == LED_OFF)
6639 +               data->new_state = TPACPI_LED_OFF;
6640 +       else if (tpacpi_led_state_cache[data->led] != TPACPI_LED_BLINK)
6641 +               data->new_state = TPACPI_LED_ON;
6642 +       else
6643 +               data->new_state = TPACPI_LED_BLINK;
6644 +
6645         queue_work(tpacpi_wq, &data->work);
6646  }
6647
6648 @@ -4148,7 +4145,7 @@
6649         } else if ((*delay_on != 500) || (*delay_off != 500))
6650                 return -EINVAL;
6651
6652 -       data->new_brightness = TPACPI_LED_BLINK;
6653 +       data->new_state = TPACPI_LED_BLINK;
6654         queue_work(tpacpi_wq, &data->work);
6655
6656         return 0;
6657 @@ -6927,7 +6924,7 @@
6658   * if it is not there yet.
6659   */
6660  #define IBM_BIOS_MODULE_ALIAS(__type) \
6661 -       MODULE_ALIAS("dmi:bvnIBM:bvr" __type "ET??WW")
6662 +       MODULE_ALIAS("dmi:bvnIBM:bvr" __type "ET??WW*")
6663
6664  /* Non-ancient thinkpads */
6665  MODULE_ALIAS("dmi:bvnIBM:*:svnIBM:*:pvrThinkPad*:rvnIBM:*");
6666 @@ -6936,9 +6933,9 @@
6667  /* Ancient thinkpad BIOSes have to be identified by
6668   * BIOS type or model number, and there are far less
6669   * BIOS types than model numbers... */
6670 -IBM_BIOS_MODULE_ALIAS("I[B,D,H,I,M,N,O,T,W,V,Y,Z]");
6671 -IBM_BIOS_MODULE_ALIAS("1[0,3,6,8,A-G,I,K,M-P,S,T]");
6672 -IBM_BIOS_MODULE_ALIAS("K[U,X-Z]");
6673 +IBM_BIOS_MODULE_ALIAS("I[BDHIMNOTWVYZ]");
6674 +IBM_BIOS_MODULE_ALIAS("1[0368A-GIKM-PST]");
6675 +IBM_BIOS_MODULE_ALIAS("K[UX-Z]");
6676
6677  MODULE_AUTHOR("Borislav Deianov, Henrique de Moraes Holschuh");
6678  MODULE_DESCRIPTION(TPACPI_DESC);
6679 --- kernel-power-2.6.28.orig/drivers/mmc/card/mmc_test.c
6680 +++ kernel-power-2.6.28/drivers/mmc/card/mmc_test.c
6681 @@ -494,7 +494,7 @@
6682
6683         sg_init_one(&sg, test->buffer, 512);
6684
6685 -       ret = mmc_test_simple_transfer(test, &sg, 1, 0, 1, 512, 1);
6686 +       ret = mmc_test_simple_transfer(test, &sg, 1, 0, 1, 512, 0);
6687         if (ret)
6688                 return ret;
6689
6690 --- kernel-power-2.6.28.orig/drivers/mmc/host/s3cmci.c
6691 +++ kernel-power-2.6.28/drivers/mmc/host/s3cmci.c
6692 @@ -329,7 +329,7 @@
6693
6694         to_ptr = host->base + host->sdidata;
6695
6696 -       while ((fifo = fifo_free(host))) {
6697 +       while ((fifo = fifo_free(host)) > 3) {
6698                 if (!host->pio_bytes) {
6699                         res = get_data_buffer(host, &host->pio_bytes,
6700                                                         &host->pio_ptr);
6701 @@ -793,8 +793,7 @@
6702                               host->mem->start + host->sdidata);
6703
6704         if (!setup_ok) {
6705 -               s3c2410_dma_config(host->dma, 4,
6706 -                       (S3C2410_DCON_HWTRIG | S3C2410_DCON_CH0_SDI));
6707 +               s3c2410_dma_config(host->dma, 4, 0);
6708                 s3c2410_dma_set_buffdone_fn(host->dma,
6709                                             s3cmci_dma_done_callback);
6710                 s3c2410_dma_setflags(host->dma, S3C2410_DMAF_AUTOSTART);
6711 --- kernel-power-2.6.28.orig/drivers/mmc/host/sdhci-pci.c
6712 +++ kernel-power-2.6.28/drivers/mmc/host/sdhci-pci.c
6713 @@ -107,6 +107,7 @@
6714
6715  static const struct sdhci_pci_fixes sdhci_cafe = {
6716         .quirks         = SDHCI_QUIRK_NO_SIMULT_VDD_AND_POWER |
6717 +                         SDHCI_QUIRK_NO_BUSY_IRQ |
6718                           SDHCI_QUIRK_BROKEN_TIMEOUT_VAL,
6719  };
6720
6721 --- kernel-power-2.6.28.orig/drivers/mmc/host/sdhci.c
6722 +++ kernel-power-2.6.28/drivers/mmc/host/sdhci.c
6723 @@ -1286,8 +1286,11 @@
6724                 if (host->cmd->data)
6725                         DBG("Cannot wait for busy signal when also "
6726                                 "doing a data transfer");
6727 -               else
6728 +               else if (!(host->quirks & SDHCI_QUIRK_NO_BUSY_IRQ))
6729                         return;
6730 +
6731 +               /* The controller does not support the end-of-busy IRQ,
6732 +                * fall through and take the SDHCI_INT_RESPONSE */
6733         }
6734
6735         if (intmask & SDHCI_INT_RESPONSE)
6736 @@ -1718,7 +1721,9 @@
6737  #endif
6738
6739  #ifdef CONFIG_LEDS_CLASS
6740 -       host->led.name = mmc_hostname(mmc);
6741 +       snprintf(host->led_name, sizeof(host->led_name),
6742 +               "%s::", mmc_hostname(mmc));
6743 +       host->led.name = host->led_name;
6744         host->led.brightness = LED_OFF;
6745         host->led.default_trigger = mmc_hostname(mmc);
6746         host->led.brightness_set = sdhci_led_control;
6747 --- kernel-power-2.6.28.orig/drivers/mmc/host/sdhci.h
6748 +++ kernel-power-2.6.28/drivers/mmc/host/sdhci.h
6749 @@ -210,6 +210,8 @@
6750  #define SDHCI_QUIRK_BROKEN_SMALL_PIO                   (1<<13)
6751  /* Controller supports high speed but doesn't have the caps bit set */
6752  #define SDHCI_QUIRK_FORCE_HIGHSPEED                    (1<<14)
6753 +/* Controller does not provide transfer-complete interrupt when not busy */
6754 +#define SDHCI_QUIRK_NO_BUSY_IRQ                                (1<<15)
6755
6756         int                     irq;            /* Device IRQ */
6757         void __iomem *          ioaddr;         /* Mapped address */
6758 @@ -222,6 +224,7 @@
6759
6760  #ifdef CONFIG_LEDS_CLASS
6761         struct led_classdev     led;            /* LED control */
6762 +       char   led_name[32];
6763  #endif
6764
6765         spinlock_t              lock;           /* Mutex */
6766 --- kernel-power-2.6.28.orig/drivers/mtd/devices/mtd_dataflash.c
6767 +++ kernel-power-2.6.28/drivers/mtd/devices/mtd_dataflash.c
6768 @@ -815,7 +815,8 @@
6769                                         if (!(info->flags & IS_POW2PS))
6770                                                 return info;
6771                                 }
6772 -                       }
6773 +                       } else
6774 +                               return info;
6775                 }
6776         }
6777
6778 --- kernel-power-2.6.28.orig/drivers/net/3c505.c
6779 +++ kernel-power-2.6.28/drivers/net/3c505.c
6780 @@ -493,21 +493,27 @@
6781         }
6782         /* read the data */
6783         spin_lock_irqsave(&adapter->lock, flags);
6784 -       i = 0;
6785 -       do {
6786 -               j = 0;
6787 -               while (((stat = get_status(dev->base_addr)) & ACRF) == 0 && j++ < 20000);
6788 -               pcb->data.raw[i++] = inb_command(dev->base_addr);
6789 -               if (i > MAX_PCB_DATA)
6790 -                       INVALID_PCB_MSG(i);
6791 -       } while ((stat & ASF_PCB_MASK) != ASF_PCB_END && j < 20000);
6792 +       for (i = 0; i < MAX_PCB_DATA; i++) {
6793 +               for (j = 0; j < 20000; j++) {
6794 +                       stat = get_status(dev->base_addr);
6795 +                       if (stat & ACRF)
6796 +                               break;
6797 +               }
6798 +               pcb->data.raw[i] = inb_command(dev->base_addr);
6799 +               if ((stat & ASF_PCB_MASK) == ASF_PCB_END || j >= 20000)
6800 +                       break;
6801 +       }
6802         spin_unlock_irqrestore(&adapter->lock, flags);
6803 +       if (i >= MAX_PCB_DATA) {
6804 +               INVALID_PCB_MSG(i);
6805 +               return false;
6806 +       }
6807         if (j >= 20000) {
6808                 TIMEOUT_MSG(__LINE__);
6809                 return false;
6810         }
6811 -       /* woops, the last "data" byte was really the length! */
6812 -       total_length = pcb->data.raw[--i];
6813 +       /* the last "data" byte was really the length! */
6814 +       total_length = pcb->data.raw[i];
6815
6816         /* safety check total length vs data length */
6817         if (total_length != (pcb->length + 2)) {
6818 --- kernel-power-2.6.28.orig/drivers/net/b44.c
6819 +++ kernel-power-2.6.28/drivers/net/b44.c
6820 @@ -750,7 +750,7 @@
6821                                              dest_idx * sizeof(dest_desc),
6822                                              DMA_BIDIRECTIONAL);
6823
6824 -       ssb_dma_sync_single_for_device(bp->sdev, le32_to_cpu(src_desc->addr),
6825 +       ssb_dma_sync_single_for_device(bp->sdev, dest_map->mapping,
6826                                        RX_PKT_BUF_SZ,
6827                                        DMA_FROM_DEVICE);
6828  }
6829 --- kernel-power-2.6.28.orig/drivers/net/bnx2x_main.c
6830 +++ kernel-power-2.6.28/drivers/net/bnx2x_main.c
6831 @@ -8079,6 +8079,9 @@
6832         struct bnx2x *bp = netdev_priv(dev);
6833         int rc;
6834
6835 +       if (!netif_running(dev))
6836 +               return -EAGAIN;
6837 +
6838         DP(BNX2X_MSG_NVM, "ethtool_eeprom: cmd %d\n"
6839            DP_LEVEL "  magic 0x%x  offset 0x%x (%d)  len 0x%x (%d)\n",
6840            eeprom->cmd, eeprom->magic, eeprom->offset, eeprom->offset,
6841 --- kernel-power-2.6.28.orig/drivers/net/bonding/bond_main.c
6842 +++ kernel-power-2.6.28/drivers/net/bonding/bond_main.c
6843 @@ -3536,11 +3536,26 @@
6844                 }
6845                 break;
6846         case NETDEV_CHANGE:
6847 -               /*
6848 -                * TODO: is this what we get if somebody
6849 -                * sets up a hierarchical bond, then rmmod's
6850 -                * one of the slave bonding devices?
6851 -                */
6852 +               if (bond->params.mode == BOND_MODE_8023AD || bond_is_lb(bond)) {
6853 +                       struct slave *slave;
6854 +
6855 +                       slave = bond_get_slave_by_dev(bond, slave_dev);
6856 +                       if (slave) {
6857 +                               u16 old_speed = slave->speed;
6858 +                               u16 old_duplex = slave->duplex;
6859 +
6860 +                               bond_update_speed_duplex(slave);
6861 +
6862 +                               if (bond_is_lb(bond))
6863 +                                       break;
6864 +
6865 +                               if (old_speed != slave->speed)
6866 +                                       bond_3ad_adapter_speed_changed(slave);
6867 +                               if (old_duplex != slave->duplex)
6868 +                                       bond_3ad_adapter_duplex_changed(slave);
6869 +                       }
6870 +               }
6871 +
6872                 break;
6873         case NETDEV_DOWN:
6874                 /*
6875 --- kernel-power-2.6.28.orig/drivers/net/bonding/bonding.h
6876 +++ kernel-power-2.6.28/drivers/net/bonding/bonding.h
6877 @@ -248,6 +248,12 @@
6878         return (struct bonding *)slave->dev->master->priv;
6879  }
6880
6881 +static inline bool bond_is_lb(const struct bonding *bond)
6882 +{
6883 +        return bond->params.mode == BOND_MODE_TLB
6884 +                || bond->params.mode == BOND_MODE_ALB;
6885 +}
6886 +
6887  #define BOND_FOM_NONE                  0
6888  #define BOND_FOM_ACTIVE                        1
6889  #define BOND_FOM_FOLLOW                        2
6890 --- kernel-power-2.6.28.orig/drivers/net/e1000/e1000_main.c
6891 +++ kernel-power-2.6.28/drivers/net/e1000/e1000_main.c
6892 @@ -31,7 +31,7 @@
6893
6894  char e1000_driver_name[] = "e1000";
6895  static char e1000_driver_string[] = "Intel(R) PRO/1000 Network Driver";
6896 -#define DRV_VERSION "7.3.20-k3-NAPI"
6897 +#define DRV_VERSION "7.3.21-k3-NAPI"
6898  const char e1000_driver_version[] = DRV_VERSION;
6899  static const char e1000_copyright[] = "Copyright (c) 1999-2006 Intel Corporation.";
6900
6901 @@ -921,7 +921,7 @@
6902                 err = pci_enable_device(pdev);
6903         } else {
6904                 bars = pci_select_bars(pdev, IORESOURCE_MEM);
6905 -               err = pci_enable_device(pdev);
6906 +               err = pci_enable_device_mem(pdev);
6907         }
6908         if (err)
6909                 return err;
6910 @@ -3732,7 +3732,7 @@
6911         struct e1000_hw *hw = &adapter->hw;
6912         u32 rctl, icr = er32(ICR);
6913
6914 -       if (unlikely(!icr))
6915 +       if (unlikely((!icr) || test_bit(__E1000_RESETTING, &adapter->flags)))
6916                 return IRQ_NONE;  /* Not our interrupt */
6917
6918         /* IMS will not auto-mask if INT_ASSERTED is not set, and if it is
6919 --- kernel-power-2.6.28.orig/drivers/net/irda/irda-usb.c
6920 +++ kernel-power-2.6.28/drivers/net/irda/irda-usb.c
6921 @@ -1075,7 +1075,7 @@
6922  {
6923         unsigned int i;
6924         int ret;
6925 -       char stir421x_fw_name[11];
6926 +       char stir421x_fw_name[12];
6927         const struct firmware *fw;
6928         const unsigned char *fw_version_ptr; /* pointer to version string */
6929         unsigned long fw_version = 0;
6930 --- kernel-power-2.6.28.orig/drivers/net/r6040.c
6931 +++ kernel-power-2.6.28/drivers/net/r6040.c
6932 @@ -49,8 +49,8 @@
6933  #include <asm/processor.h>
6934
6935  #define DRV_NAME       "r6040"
6936 -#define DRV_VERSION    "0.18"
6937 -#define DRV_RELDATE    "13Jul2008"
6938 +#define DRV_VERSION    "0.19"
6939 +#define DRV_RELDATE    "18Dec2008"
6940
6941  /* PHY CHIP Address */
6942  #define PHY1_ADDR      1       /* For MAC1 */
6943 @@ -214,7 +214,7 @@
6944         /* Wait for the read bit to be cleared */
6945         while (limit--) {
6946                 cmd = ioread16(ioaddr + MMDIO);
6947 -               if (cmd & MDIO_READ)
6948 +               if (!(cmd & MDIO_READ))
6949                         break;
6950         }
6951
6952 @@ -233,7 +233,7 @@
6953         /* Wait for the write bit to be cleared */
6954         while (limit--) {
6955                 cmd = ioread16(ioaddr + MMDIO);
6956 -               if (cmd & MDIO_WRITE)
6957 +               if (!(cmd & MDIO_WRITE))
6958                         break;
6959         }
6960  }
6961 @@ -681,8 +681,10 @@
6962         struct net_device *dev = dev_id;
6963         struct r6040_private *lp = netdev_priv(dev);
6964         void __iomem *ioaddr = lp->base;
6965 -       u16 status;
6966 +       u16 misr, status;
6967
6968 +       /* Save MIER */
6969 +       misr = ioread16(ioaddr + MIER);
6970         /* Mask off RDC MAC interrupt */
6971         iowrite16(MSK_INT, ioaddr + MIER);
6972         /* Read MISR status and clear */
6973 @@ -702,7 +704,7 @@
6974                         dev->stats.rx_fifo_errors++;
6975
6976                 /* Mask off RX interrupt */
6977 -               iowrite16(ioread16(ioaddr + MIER) & ~RX_INTS, ioaddr + MIER);
6978 +               misr &= ~RX_INTS;
6979                 netif_rx_schedule(dev, &lp->napi);
6980         }
6981
6982 @@ -710,6 +712,9 @@
6983         if (status & TX_INTS)
6984                 r6040_tx(dev);
6985
6986 +       /* Restore RDC MAC interrupt */
6987 +       iowrite16(misr, ioaddr + MIER);
6988 +
6989         return IRQ_HANDLED;
6990  }
6991
6992 --- kernel-power-2.6.28.orig/drivers/net/r8169.c
6993 +++ kernel-power-2.6.28/drivers/net/r8169.c
6994 @@ -2026,8 +2026,7 @@
6995         if (!tp->pcie_cap && netif_msg_probe(tp))
6996                 dev_info(&pdev->dev, "no PCI Express capability\n");
6997
6998 -       /* Unneeded ? Don't mess with Mrs. Murphy. */
6999 -       rtl8169_irq_mask_and_ack(ioaddr);
7000 +       RTL_W16(IntrMask, 0x0000);
7001
7002         /* Soft reset the chip. */
7003         RTL_W8(ChipCmd, CmdReset);
7004 @@ -2039,6 +2038,8 @@
7005                 msleep_interruptible(1);
7006         }
7007
7008 +       RTL_W16(IntrStatus, 0xffff);
7009 +
7010         /* Identify chip attached to board */
7011         rtl8169_get_mac_version(tp, ioaddr);
7012
7013 --- kernel-power-2.6.28.orig/drivers/net/skfp/skfddi.c
7014 +++ kernel-power-2.6.28/drivers/net/skfp/skfddi.c
7015 @@ -998,9 +998,9 @@
7016                 break;
7017         case SKFP_CLR_STATS:    /* Zero out the driver statistics */
7018                 if (!capable(CAP_NET_ADMIN)) {
7019 -                       memset(&lp->MacStat, 0, sizeof(lp->MacStat));
7020 -               } else {
7021                         status = -EPERM;
7022 +               } else {
7023 +                       memset(&lp->MacStat, 0, sizeof(lp->MacStat));
7024                 }
7025                 break;
7026         default:
7027 --- kernel-power-2.6.28.orig/drivers/net/sky2.c
7028 +++ kernel-power-2.6.28/drivers/net/sky2.c
7029 @@ -1403,9 +1403,6 @@
7030
7031         }
7032
7033 -       if (netif_msg_ifup(sky2))
7034 -               printk(KERN_INFO PFX "%s: enabling interface\n", dev->name);
7035 -
7036         netif_carrier_off(dev);
7037
7038         /* must be power of 2 */
7039 @@ -1484,6 +1481,9 @@
7040         sky2_write32(hw, B0_IMSK, imask);
7041
7042         sky2_set_multicast(dev);
7043 +
7044 +       if (netif_msg_ifup(sky2))
7045 +               printk(KERN_INFO PFX "%s: enabling interface\n", dev->name);
7046         return 0;
7047
7048  err_out:
7049 --- kernel-power-2.6.28.orig/drivers/net/sungem.c
7050 +++ kernel-power-2.6.28/drivers/net/sungem.c
7051 @@ -2222,6 +2222,8 @@
7052
7053         gp->running = 1;
7054
7055 +       napi_enable(&gp->napi);
7056 +
7057         if (gp->lstate == link_up) {
7058                 netif_carrier_on(gp->dev);
7059                 gem_set_link_modes(gp);
7060 @@ -2239,6 +2241,8 @@
7061                 spin_lock_irqsave(&gp->lock, flags);
7062                 spin_lock(&gp->tx_lock);
7063
7064 +               napi_disable(&gp->napi);
7065 +
7066                 gp->running =  0;
7067                 gem_reset(gp);
7068                 gem_clean_rings(gp);
7069 @@ -2339,8 +2343,6 @@
7070         if (!gp->asleep)
7071                 rc = gem_do_start(dev);
7072         gp->opened = (rc == 0);
7073 -       if (gp->opened)
7074 -               napi_enable(&gp->napi);
7075
7076         mutex_unlock(&gp->pm_mutex);
7077
7078 @@ -2477,8 +2479,6 @@
7079
7080                 /* Re-attach net device */
7081                 netif_device_attach(dev);
7082 -
7083 -               napi_enable(&gp->napi);
7084         }
7085
7086         spin_lock_irqsave(&gp->lock, flags);
7087 --- kernel-power-2.6.28.orig/drivers/net/tun.c
7088 +++ kernel-power-2.6.28/drivers/net/tun.c
7089 @@ -157,10 +157,16 @@
7090
7091         nexact = n;
7092
7093 -       /* The rest is hashed */
7094 +       /* Remaining multicast addresses are hashed,
7095 +        * unicast will leave the filter disabled. */
7096         memset(filter->mask, 0, sizeof(filter->mask));
7097 -       for (; n < uf.count; n++)
7098 +       for (; n < uf.count; n++) {
7099 +               if (!is_multicast_ether_addr(addr[n].u)) {
7100 +                       err = 0; /* no filter */
7101 +                       goto done;
7102 +               }
7103                 addr_hash_set(filter->mask, addr[n].u);
7104 +       }
7105
7106         /* For ALLMULTI just set the mask to all ones.
7107          * This overrides the mask populated above. */
7108 --- kernel-power-2.6.28.orig/drivers/net/usb/asix.c
7109 +++ kernel-power-2.6.28/drivers/net/usb/asix.c
7110 @@ -1450,6 +1450,14 @@
7111         // Cables-to-Go USB Ethernet Adapter
7112         USB_DEVICE(0x0b95, 0x772a),
7113         .driver_info = (unsigned long) &ax88772_info,
7114 +}, {
7115 +       // ABOCOM for pci
7116 +       USB_DEVICE(0x14ea, 0xab11),
7117 +       .driver_info = (unsigned long) &ax88178_info,
7118 +}, {
7119 +       // ASIX 88772a
7120 +       USB_DEVICE(0x0db0, 0xa877),
7121 +       .driver_info = (unsigned long) &ax88772_info,
7122  },
7123         { },            // END
7124  };
7125 --- kernel-power-2.6.28.orig/drivers/net/usb/cdc_ether.c
7126 +++ kernel-power-2.6.28/drivers/net/usb/cdc_ether.c
7127 @@ -559,6 +559,11 @@
7128         USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ETHERNET,
7129                         USB_CDC_PROTO_NONE),
7130         .driver_info = (unsigned long) &cdc_info,
7131 +}, {
7132 +       /* Ericsson F3507g */
7133 +       USB_DEVICE_AND_INTERFACE_INFO(0x0bdb, 0x1900, USB_CLASS_COMM,
7134 +                       USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
7135 +       .driver_info = (unsigned long) &cdc_info,
7136  },
7137         { },            // END
7138  };
7139 --- kernel-power-2.6.28.orig/drivers/net/usb/zaurus.c
7140 +++ kernel-power-2.6.28/drivers/net/usb/zaurus.c
7141 @@ -341,6 +341,11 @@
7142         USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MDLM,
7143                         USB_CDC_PROTO_NONE),
7144         .driver_info = (unsigned long) &bogus_mdlm_info,
7145 +}, {
7146 +       /* Motorola MOTOMAGX phones */
7147 +       USB_DEVICE_AND_INTERFACE_INFO(0x22b8, 0x6425, USB_CLASS_COMM,
7148 +                       USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
7149 +       .driver_info = (unsigned long) &bogus_mdlm_info,
7150  },
7151
7152  /* Olympus has some models with a Zaurus-compatible option.
7153 --- kernel-power-2.6.28.orig/drivers/net/virtio_net.c
7154 +++ kernel-power-2.6.28/drivers/net/virtio_net.c
7155 @@ -24,6 +24,7 @@
7156  #include <linux/virtio.h>
7157  #include <linux/virtio_net.h>
7158  #include <linux/scatterlist.h>
7159 +#include <linux/if_vlan.h>
7160
7161  static int napi_weight = 128;
7162  module_param(napi_weight, int, 0444);
7163 @@ -33,7 +34,7 @@
7164  module_param(gso, bool, 0444);
7165
7166  /* FIXME: MTU in config. */
7167 -#define MAX_PACKET_LEN (ETH_HLEN+ETH_DATA_LEN)
7168 +#define MAX_PACKET_LEN (ETH_HLEN + VLAN_HLEN + ETH_DATA_LEN)
7169
7170  struct virtnet_info
7171  {
7172 --- kernel-power-2.6.28.orig/drivers/net/wireless/ath5k/base.c
7173 +++ kernel-power-2.6.28/drivers/net/wireless/ath5k/base.c
7174 @@ -2157,7 +2157,8 @@
7175
7176         if (sc->opmode == NL80211_IFTYPE_STATION) {
7177                 sc->imask |= AR5K_INT_BMISS;
7178 -       } else if (sc->opmode == NL80211_IFTYPE_ADHOC) {
7179 +       } else if (sc->opmode == NL80211_IFTYPE_ADHOC ||
7180 +                  sc->opmode == NL80211_IFTYPE_MESH_POINT) {
7181                 /*
7182                  * In IBSS mode we use a self-linked tx descriptor and let the
7183                  * hardware send the beacons automatically. We have to load it
7184 @@ -2748,6 +2749,7 @@
7185         switch (conf->type) {
7186         case NL80211_IFTYPE_STATION:
7187         case NL80211_IFTYPE_ADHOC:
7188 +       case NL80211_IFTYPE_MESH_POINT:
7189         case NL80211_IFTYPE_MONITOR:
7190                 sc->opmode = conf->type;
7191                 break;
7192 @@ -2819,7 +2821,8 @@
7193         }
7194
7195         if (conf->changed & IEEE80211_IFCC_BEACON &&
7196 -           vif->type == NL80211_IFTYPE_ADHOC) {
7197 +           (vif->type == NL80211_IFTYPE_ADHOC ||
7198 +            vif->type == NL80211_IFTYPE_MESH_POINT)) {
7199                 struct sk_buff *beacon = ieee80211_beacon_get(hw, vif);
7200                 if (!beacon) {
7201                         ret = -ENOMEM;
7202 @@ -2951,6 +2954,9 @@
7203                 sc->opmode == NL80211_IFTYPE_ADHOC) {
7204                 rfilt |= AR5K_RX_FILTER_BEACON;
7205         }
7206 +       if (sc->opmode == NL80211_IFTYPE_MESH_POINT)
7207 +               rfilt |= AR5K_RX_FILTER_CONTROL | AR5K_RX_FILTER_BEACON |
7208 +                       AR5K_RX_FILTER_PROBEREQ | AR5K_RX_FILTER_PROM;
7209
7210         /* Set filters */
7211         ath5k_hw_set_rx_filter(ah,rfilt);
7212 --- kernel-power-2.6.28.orig/drivers/net/wireless/ath5k/phy.c
7213 +++ kernel-power-2.6.28/drivers/net/wireless/ath5k/phy.c
7214 @@ -2195,9 +2195,7 @@
7215                 return ret;
7216         }
7217
7218 -       ret = ath5k_hw_noise_floor_calibration(ah, channel->center_freq);
7219 -       if (ret)
7220 -               return ret;
7221 +       ath5k_hw_noise_floor_calibration(ah, channel->center_freq);
7222
7223         /*
7224          * Re-enable RX/TX and beacons
7225 --- kernel-power-2.6.28.orig/drivers/net/wireless/ath5k/reset.c
7226 +++ kernel-power-2.6.28/drivers/net/wireless/ath5k/reset.c
7227 @@ -842,9 +842,7 @@
7228          *
7229          * XXX: Find an interval that's OK for all cards...
7230          */
7231 -       ret = ath5k_hw_noise_floor_calibration(ah, channel->center_freq);
7232 -       if (ret)
7233 -               return ret;
7234 +       ath5k_hw_noise_floor_calibration(ah, channel->center_freq);
7235
7236         /*
7237          * Reset queues and start beacon timers at the end of the reset routine
7238 --- kernel-power-2.6.28.orig/drivers/net/wireless/ath9k/ath9k.h
7239 +++ kernel-power-2.6.28/drivers/net/wireless/ath9k/ath9k.h
7240 @@ -590,8 +590,8 @@
7241         u8 iso[3];
7242  };
7243
7244 -#define REG_WRITE(_ah, _reg, _val) iowrite32(_val, _ah->ah_sh + _reg)
7245 -#define REG_READ(_ah, _reg) ioread32(_ah->ah_sh + _reg)
7246 +#define REG_WRITE(_ah, _reg, _val) ath9k_iowrite32((_ah), (_reg), (_val))
7247 +#define REG_READ(_ah, _reg) ath9k_ioread32((_ah), (_reg))
7248
7249  #define SM(_v, _f)  (((_v) << _f##_S) & _f)
7250  #define MS(_v, _f)  (((_v) & _f) >> _f##_S)
7251 --- kernel-power-2.6.28.orig/drivers/net/wireless/ath9k/core.c
7252 +++ kernel-power-2.6.28/drivers/net/wireless/ath9k/core.c
7253 @@ -1089,6 +1089,7 @@
7254         sc->sc_cachelsz = csz << 2;     /* convert to bytes */
7255
7256         spin_lock_init(&sc->sc_resetlock);
7257 +       spin_lock_init(&sc->sc_serial_rw);
7258
7259         ah = ath9k_hw_attach(devid, sc, sc->mem, &status);
7260         if (ah == NULL) {
7261 --- kernel-power-2.6.28.orig/drivers/net/wireless/ath9k/core.h
7262 +++ kernel-power-2.6.28/drivers/net/wireless/ath9k/core.h
7263 @@ -1040,6 +1040,7 @@
7264         spinlock_t sc_rxbuflock;
7265         spinlock_t sc_txbuflock;
7266         spinlock_t sc_resetlock;
7267 +       spinlock_t sc_serial_rw;
7268         spinlock_t node_lock;
7269
7270         /* LEDs */
7271 @@ -1081,4 +1082,36 @@
7272         struct ath9k_country_entry *ctry);
7273  u64 ath_extend_tsf(struct ath_softc *sc, u32 rstamp);
7274
7275 +/*
7276 + * Read and write, they both share the same lock. We do this to serialize
7277 + * reads and writes on Atheros 802.11n PCI devices only. This is required
7278 + * as the FIFO on these devices can only accept sanely 2 requests. After
7279 + * that the device goes bananas. Serializing the reads/writes prevents this
7280 + * from happening.
7281 + */
7282 +
7283 +static inline void ath9k_iowrite32(struct ath_hal *ah, u32 reg_offset, u32 val)
7284 +{
7285 +       if (ah->ah_config.serialize_regmode == SER_REG_MODE_ON) {
7286 +               unsigned long flags;
7287 +               spin_lock_irqsave(&ah->ah_sc->sc_serial_rw, flags);
7288 +               iowrite32(val, ah->ah_sc->mem + reg_offset);
7289 +               spin_unlock_irqrestore(&ah->ah_sc->sc_serial_rw, flags);
7290 +       } else
7291 +               iowrite32(val, ah->ah_sc->mem + reg_offset);
7292 +}
7293 +
7294 +static inline unsigned int ath9k_ioread32(struct ath_hal *ah, u32 reg_offset)
7295 +{
7296 +       u32 val;
7297 +       if (ah->ah_config.serialize_regmode == SER_REG_MODE_ON) {
7298 +               unsigned long flags;
7299 +               spin_lock_irqsave(&ah->ah_sc->sc_serial_rw, flags);
7300 +               val = ioread32(ah->ah_sc->mem + reg_offset);
7301 +               spin_unlock_irqrestore(&ah->ah_sc->sc_serial_rw, flags);
7302 +       } else
7303 +               val = ioread32(ah->ah_sc->mem + reg_offset);
7304 +       return val;
7305 +}
7306 +
7307  #endif /* CORE_H */
7308 --- kernel-power-2.6.28.orig/drivers/net/wireless/ath9k/hw.c
7309 +++ kernel-power-2.6.28/drivers/net/wireless/ath9k/hw.c
7310 @@ -346,6 +346,25 @@
7311         }
7312
7313         ah->ah_config.intr_mitigation = 0;
7314 +
7315 +       /*
7316 +        * We need this for PCI devices only (Cardbus, PCI, miniPCI)
7317 +        * _and_ if on non-uniprocessor systems (Multiprocessor/HT).
7318 +        * This means we use it for all AR5416 devices, and the few
7319 +        * minor PCI AR9280 devices out there.
7320 +        *
7321 +        * Serialization is required because these devices do not handle
7322 +        * well the case of two concurrent reads/writes due to the latency
7323 +        * involved. During one read/write another read/write can be issued
7324 +        * on another CPU while the previous read/write may still be working
7325 +        * on our hardware, if we hit this case the hardware poops in a loop.
7326 +        * We prevent this by serializing reads and writes.
7327 +        *
7328 +        * This issue is not present on PCI-Express devices or pre-AR5416
7329 +        * devices (legacy, 802.11abg).
7330 +        */
7331 +       if (num_possible_cpus() > 1)
7332 +               ah->ah_config.serialize_regmode = SER_REG_MODE_AUTO;
7333  }
7334
7335  static void ath9k_hw_override_ini(struct ath_hal *ah,
7336 @@ -3292,7 +3311,8 @@
7337         }
7338
7339         if (ah->ah_config.serialize_regmode == SER_REG_MODE_AUTO) {
7340 -               if (ah->ah_macVersion == AR_SREV_VERSION_5416_PCI) {
7341 +               if (ah->ah_macVersion == AR_SREV_VERSION_5416_PCI ||
7342 +                   (AR_SREV_9280(ah) && !ah->ah_isPciExpress)) {
7343                         ah->ah_config.serialize_regmode =
7344                                 SER_REG_MODE_ON;
7345                 } else {
7346 --- kernel-power-2.6.28.orig/drivers/net/wireless/ath9k/recv.c
7347 +++ kernel-power-2.6.28/drivers/net/wireless/ath9k/recv.c
7348 @@ -627,9 +627,8 @@
7349                 rfilt &= ~ATH9K_RX_FILTER_UCAST;
7350         }
7351
7352 -       if (((sc->sc_ah->ah_opmode == ATH9K_M_STA) &&
7353 -            (sc->rx_filter & FIF_BCN_PRBRESP_PROMISC)) ||
7354 -           (sc->sc_ah->ah_opmode == ATH9K_M_IBSS))
7355 +       if (sc->sc_ah->ah_opmode == ATH9K_M_STA ||
7356 +                       sc->sc_ah->ah_opmode == ATH9K_M_IBSS)
7357                 rfilt |= ATH9K_RX_FILTER_BEACON;
7358
7359         /* If in HOSTAP mode, want to enable reception of PSPOLL frames
7360 --- kernel-power-2.6.28.orig/drivers/net/wireless/b43/xmit.c
7361 +++ kernel-power-2.6.28/drivers/net/wireless/b43/xmit.c
7362 @@ -51,7 +51,7 @@
7363  }
7364
7365  /* Extract the bitrate index out of an OFDM PLCP header. */
7366 -static u8 b43_plcp_get_bitrate_idx_ofdm(struct b43_plcp_hdr6 *plcp, bool aphy)
7367 +static int b43_plcp_get_bitrate_idx_ofdm(struct b43_plcp_hdr6 *plcp, bool aphy)
7368  {
7369         int base = aphy ? 0 : 4;
7370
7371 --- kernel-power-2.6.28.orig/drivers/net/wireless/ipw2200.c
7372 +++ kernel-power-2.6.28/drivers/net/wireless/ipw2200.c
7373 @@ -4347,7 +4347,8 @@
7374                 return;
7375         }
7376
7377 -       if (priv->status & STATUS_SCANNING) {
7378 +       if (priv->status & STATUS_SCANNING &&
7379 +           missed_count > IPW_MB_SCAN_CANCEL_THRESHOLD) {
7380                 /* Stop scan to keep fw from getting
7381                  * stuck (only if we aren't roaming --
7382                  * otherwise we'll never scan more than 2 or 3
7383 @@ -6277,6 +6278,20 @@
7384         }
7385  }
7386
7387 +static int ipw_passive_dwell_time(struct ipw_priv *priv)
7388 +{
7389 +       /* staying on passive channels longer than the DTIM interval during a
7390 +        * scan, while associated, causes the firmware to cancel the scan
7391 +        * without notification. Hence, don't stay on passive channels longer
7392 +        * than the beacon interval.
7393 +        */
7394 +       if (priv->status & STATUS_ASSOCIATED
7395 +           && priv->assoc_network->beacon_interval > 10)
7396 +               return priv->assoc_network->beacon_interval - 10;
7397 +       else
7398 +               return 120;
7399 +}
7400 +
7401  static int ipw_request_scan_helper(struct ipw_priv *priv, int type, int direct)
7402  {
7403         struct ipw_scan_request_ext scan;
7404 @@ -6320,16 +6335,16 @@
7405         scan.full_scan_index = cpu_to_le32(ieee80211_get_scans(priv->ieee));
7406
7407         if (type == IW_SCAN_TYPE_PASSIVE) {
7408 -               IPW_DEBUG_WX("use passive scanning\n");
7409 -               scan_type = IPW_SCAN_PASSIVE_FULL_DWELL_SCAN;
7410 +               IPW_DEBUG_WX("use passive scanning\n");
7411 +               scan_type = IPW_SCAN_PASSIVE_FULL_DWELL_SCAN;
7412                 scan.dwell_time[IPW_SCAN_PASSIVE_FULL_DWELL_SCAN] =
7413 -                       cpu_to_le16(120);
7414 +                       cpu_to_le16(ipw_passive_dwell_time(priv));
7415                 ipw_add_scan_channels(priv, &scan, scan_type);
7416                 goto send_request;
7417         }
7418
7419         /* Use active scan by default. */
7420 -       if (priv->config & CFG_SPEED_SCAN)
7421 +       if (priv->config & CFG_SPEED_SCAN)
7422                 scan.dwell_time[IPW_SCAN_ACTIVE_BROADCAST_SCAN] =
7423                         cpu_to_le16(30);
7424         else
7425 @@ -6339,7 +6354,8 @@
7426         scan.dwell_time[IPW_SCAN_ACTIVE_BROADCAST_AND_DIRECT_SCAN] =
7427                 cpu_to_le16(20);
7428
7429 -       scan.dwell_time[IPW_SCAN_PASSIVE_FULL_DWELL_SCAN] = cpu_to_le16(120);
7430 +       scan.dwell_time[IPW_SCAN_PASSIVE_FULL_DWELL_SCAN] =
7431 +               cpu_to_le16(ipw_passive_dwell_time(priv));
7432         scan.dwell_time[IPW_SCAN_ACTIVE_DIRECT_SCAN] = cpu_to_le16(20);
7433
7434  #ifdef CONFIG_IPW2200_MONITOR
7435 --- kernel-power-2.6.28.orig/drivers/net/wireless/ipw2200.h
7436 +++ kernel-power-2.6.28/drivers/net/wireless/ipw2200.h
7437 @@ -244,6 +244,7 @@
7438  #define HOST_NOTIFICATION_S36_MEASUREMENT_REFUSED       31
7439
7440  #define HOST_NOTIFICATION_STATUS_BEACON_MISSING         1
7441 +#define IPW_MB_SCAN_CANCEL_THRESHOLD                    3
7442  #define IPW_MB_ROAMING_THRESHOLD_MIN                    1
7443  #define IPW_MB_ROAMING_THRESHOLD_DEFAULT                8
7444  #define IPW_MB_ROAMING_THRESHOLD_MAX                    30
7445 --- kernel-power-2.6.28.orig/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
7446 +++ kernel-power-2.6.28/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
7447 @@ -647,12 +647,16 @@
7448         s8 scale_action = 0;
7449         unsigned long flags;
7450         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
7451 -       u16 fc, rate_mask;
7452 +       u16 fc;
7453 +       u16 rate_mask = 0;
7454         struct iwl3945_priv *priv = (struct iwl3945_priv *)priv_r;
7455         DECLARE_MAC_BUF(mac);
7456
7457         IWL_DEBUG_RATE("enter\n");
7458
7459 +       if (sta)
7460 +               rate_mask = sta->supp_rates[sband->band];
7461 +
7462         /* Send management frames and broadcast/multicast data using lowest
7463          * rate. */
7464         fc = le16_to_cpu(hdr->frame_control);
7465 @@ -660,11 +664,13 @@
7466             is_multicast_ether_addr(hdr->addr1) ||
7467             !sta || !priv_sta) {
7468                 IWL_DEBUG_RATE("leave: No STA priv data to update!\n");
7469 -               sel->rate_idx = rate_lowest_index(sband, sta);
7470 +               if (!rate_mask)
7471 +                       sel->rate_idx = rate_lowest_index(sband, NULL);
7472 +               else
7473 +                       sel->rate_idx = rate_lowest_index(sband, sta);
7474                 return;
7475         }
7476
7477 -       rate_mask = sta->supp_rates[sband->band];
7478         index = min(rs_sta->last_txrate_idx & 0xffff, IWL_RATE_COUNT - 1);
7479
7480         if (sband->band == IEEE80211_BAND_5GHZ)
7481 --- kernel-power-2.6.28.orig/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
7482 +++ kernel-power-2.6.28/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
7483 @@ -951,7 +951,8 @@
7484         }
7485
7486         /* See if there's a better rate or modulation mode to try. */
7487 -       rs_rate_scale_perform(priv, hdr, sta, lq_sta);
7488 +       if (sta && sta->supp_rates[sband->band])
7489 +               rs_rate_scale_perform(priv, hdr, sta, lq_sta);
7490  out:
7491         return;
7492  }
7493 @@ -2114,15 +2115,22 @@
7494         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
7495         __le16 fc;
7496         struct iwl_lq_sta *lq_sta;
7497 +       u64 mask_bit = 0;
7498
7499         IWL_DEBUG_RATE_LIMIT("rate scale calculate new rate for skb\n");
7500
7501 +       if (sta)
7502 +               mask_bit = sta->supp_rates[sband->band];
7503 +
7504         /* Send management frames and broadcast/multicast data using lowest
7505          * rate. */
7506         fc = hdr->frame_control;
7507         if (!ieee80211_is_data(fc) || is_multicast_ether_addr(hdr->addr1) ||
7508             !sta || !priv_sta) {
7509 -               sel->rate_idx = rate_lowest_index(sband, sta);
7510 +               if (!mask_bit)
7511 +                       sel->rate_idx = rate_lowest_index(sband, NULL);
7512 +               else
7513 +                       sel->rate_idx = rate_lowest_index(sband, sta);
7514                 return;
7515         }
7516
7517 --- kernel-power-2.6.28.orig/drivers/net/wireless/iwlwifi/iwl-agn.c
7518 +++ kernel-power-2.6.28/drivers/net/wireless/iwlwifi/iwl-agn.c
7519 @@ -1334,16 +1334,6 @@
7520         priv->cfg->ops->lib->rx_handler_setup(priv);
7521  }
7522
7523 -/*
7524 - * this should be called while priv->lock is locked
7525 -*/
7526 -static void __iwl_rx_replenish(struct iwl_priv *priv)
7527 -{
7528 -       iwl_rx_allocate(priv);
7529 -       iwl_rx_queue_restock(priv);
7530 -}
7531 -
7532 -
7533  /**
7534   * iwl_rx_handle - Main entry function for receiving responses from uCode
7535   *
7536 @@ -1451,7 +1441,7 @@
7537                         count++;
7538                         if (count >= 8) {
7539                                 priv->rxq.read = i;
7540 -                               __iwl_rx_replenish(priv);
7541 +                               iwl_rx_queue_restock(priv);
7542                                 count = 0;
7543                         }
7544                 }
7545 --- kernel-power-2.6.28.orig/drivers/net/wireless/iwlwifi/iwl-rx.c
7546 +++ kernel-power-2.6.28/drivers/net/wireless/iwlwifi/iwl-rx.c
7547 @@ -245,25 +245,31 @@
7548         struct list_head *element;
7549         struct iwl_rx_mem_buffer *rxb;
7550         unsigned long flags;
7551 -       spin_lock_irqsave(&rxq->lock, flags);
7552 -       while (!list_empty(&rxq->rx_used)) {
7553 +
7554 +       while (1) {
7555 +               spin_lock_irqsave(&rxq->lock, flags);
7556 +
7557 +               if (list_empty(&rxq->rx_used)) {
7558 +                       spin_unlock_irqrestore(&rxq->lock, flags);
7559 +                       return;
7560 +               }
7561                 element = rxq->rx_used.next;
7562                 rxb = list_entry(element, struct iwl_rx_mem_buffer, list);
7563 +               list_del(element);
7564 +
7565 +               spin_unlock_irqrestore(&rxq->lock, flags);
7566
7567                 /* Alloc a new receive buffer */
7568                 rxb->skb = alloc_skb(priv->hw_params.rx_buf_size + 256,
7569 -                               __GFP_NOWARN | GFP_ATOMIC);
7570 +                                    GFP_KERNEL);
7571                 if (!rxb->skb) {
7572 -                       if (net_ratelimit())
7573 -                               printk(KERN_CRIT DRV_NAME
7574 -                                      ": Can not allocate SKB buffers\n");
7575 +                       printk(KERN_CRIT DRV_NAME
7576 +                                  "Can not allocate SKB buffers\n");
7577                         /* We don't reschedule replenish work here -- we will
7578                          * call the restock method and if it still needs
7579                          * more buffers it will schedule replenish */
7580                         break;
7581                 }
7582 -               priv->alloc_rxb_skb++;
7583 -               list_del(element);
7584
7585                 /* Get physical address of RB/SKB */
7586                 rxb->real_dma_addr = pci_map_single(
7587 @@ -277,12 +283,15 @@
7588                 rxb->aligned_dma_addr = ALIGN(rxb->real_dma_addr, 256);
7589                 skb_reserve(rxb->skb, rxb->aligned_dma_addr - rxb->real_dma_addr);
7590
7591 +               spin_lock_irqsave(&rxq->lock, flags);
7592 +
7593                 list_add_tail(&rxb->list, &rxq->rx_free);
7594                 rxq->free_count++;
7595 +               priv->alloc_rxb_skb++;
7596 +
7597 +               spin_unlock_irqrestore(&rxq->lock, flags);
7598         }
7599 -       spin_unlock_irqrestore(&rxq->lock, flags);
7600  }
7601 -EXPORT_SYMBOL(iwl_rx_allocate);
7602
7603  void iwl_rx_replenish(struct iwl_priv *priv)
7604  {
7605 --- kernel-power-2.6.28.orig/drivers/net/wireless/orinoco.c
7606 +++ kernel-power-2.6.28/drivers/net/wireless/orinoco.c
7607 @@ -4938,32 +4938,29 @@
7608         struct orinoco_private *priv = netdev_priv(dev);
7609         u8 *buf;
7610         unsigned long flags;
7611 -       int err = 0;
7612
7613         if ((wrqu->data.length > MAX_WPA_IE_LEN) ||
7614             (wrqu->data.length && (extra == NULL)))
7615                 return -EINVAL;
7616
7617 -       if (orinoco_lock(priv, &flags) != 0)
7618 -               return -EBUSY;
7619 -
7620         if (wrqu->data.length) {
7621                 buf = kmalloc(wrqu->data.length, GFP_KERNEL);
7622 -               if (buf == NULL) {
7623 -                       err = -ENOMEM;
7624 -                       goto out;
7625 -               }
7626 +               if (buf == NULL)
7627 +                       return -ENOMEM;
7628
7629                 memcpy(buf, extra, wrqu->data.length);
7630 -               kfree(priv->wpa_ie);
7631 -               priv->wpa_ie = buf;
7632 -               priv->wpa_ie_len = wrqu->data.length;
7633 -       } else {
7634 -               kfree(priv->wpa_ie);
7635 -               priv->wpa_ie = NULL;
7636 -               priv->wpa_ie_len = 0;
7637 +       } else
7638 +               buf = NULL;
7639 +
7640 +       if (orinoco_lock(priv, &flags) != 0) {
7641 +               kfree(buf);
7642 +               return -EBUSY;
7643         }
7644
7645 +       kfree(priv->wpa_ie);
7646 +       priv->wpa_ie = buf;
7647 +       priv->wpa_ie_len = wrqu->data.length;
7648 +
7649         if (priv->wpa_ie) {
7650                 /* Looks like wl_lkm wants to check the auth alg, and
7651                  * somehow pass it to the firmware.
7652 @@ -4972,9 +4969,8 @@
7653                  */
7654         }
7655
7656 -out:
7657         orinoco_unlock(priv, &flags);
7658 -       return err;
7659 +       return 0;
7660  }
7661
7662  static int orinoco_ioctl_get_genie(struct net_device *dev,
7663 --- kernel-power-2.6.28.orig/drivers/net/wireless/p54/p54common.c
7664 +++ kernel-power-2.6.28/drivers/net/wireless/p54/p54common.c
7665 @@ -741,17 +741,19 @@
7666  int p54_read_eeprom(struct ieee80211_hw *dev)
7667  {
7668         struct p54_common *priv = dev->priv;
7669 -       struct p54_control_hdr *hdr = NULL;
7670 +       struct p54_control_hdr *hdr = NULL, *org_hdr;
7671         struct p54_eeprom_lm86 *eeprom_hdr;
7672         size_t eeprom_size = 0x2020, offset = 0, blocksize;
7673         int ret = -ENOMEM;
7674         void *eeprom = NULL;
7675
7676 -       hdr = (struct p54_control_hdr *)kzalloc(sizeof(*hdr) +
7677 -               sizeof(*eeprom_hdr) + EEPROM_READBACK_LEN, GFP_KERNEL);
7678 -       if (!hdr)
7679 +       org_hdr = kzalloc(priv->tx_hdr_len + sizeof(*hdr) +
7680 +                         sizeof(*eeprom_hdr) + EEPROM_READBACK_LEN,
7681 +                         GFP_KERNEL);
7682 +       if (!org_hdr)
7683                 goto free;
7684
7685 +       hdr = (void *) org_hdr + priv->tx_hdr_len;
7686         priv->eeprom = kzalloc(EEPROM_READBACK_LEN, GFP_KERNEL);
7687         if (!priv->eeprom)
7688                 goto free;
7689 @@ -790,7 +792,7 @@
7690  free:
7691         kfree(priv->eeprom);
7692         priv->eeprom = NULL;
7693 -       kfree(hdr);
7694 +       kfree(org_hdr);
7695         kfree(eeprom);
7696
7697         return ret;
7698 --- kernel-power-2.6.28.orig/drivers/net/wireless/p54/p54usb.c
7699 +++ kernel-power-2.6.28/drivers/net/wireless/p54/p54usb.c
7700 @@ -54,6 +54,7 @@
7701         {USB_DEVICE(0x050d, 0x7050)},   /* Belkin F5D7050 ver 1000 */
7702         {USB_DEVICE(0x0572, 0x2000)},   /* Cohiba Proto board */
7703         {USB_DEVICE(0x0572, 0x2002)},   /* Cohiba Proto board */
7704 +       {USB_DEVICE(0x06b9, 0x0121)},   /* Thomson SpeedTouch 121g */
7705         {USB_DEVICE(0x0707, 0xee13)},   /* SMC 2862W-G version 2 */
7706         {USB_DEVICE(0x083a, 0x4521)},   /* Siemens Gigaset USB Adapter 54 version 2 */
7707         {USB_DEVICE(0x0846, 0x4240)},   /* Netgear WG111 (v2) */
7708 @@ -84,13 +85,13 @@
7709         struct ieee80211_hw *dev = info->dev;
7710         struct p54u_priv *priv = dev->priv;
7711
7712 +       skb_unlink(skb, &priv->rx_queue);
7713 +
7714         if (unlikely(urb->status)) {
7715 -               info->urb = NULL;
7716 -               usb_free_urb(urb);
7717 +               dev_kfree_skb_irq(skb);
7718                 return;
7719         }
7720
7721 -       skb_unlink(skb, &priv->rx_queue);
7722         skb_put(skb, urb->actual_length);
7723
7724         if (priv->hw_type == P54U_NET2280)
7725 @@ -103,7 +104,6 @@
7726         if (p54_rx(dev, skb)) {
7727                 skb = dev_alloc_skb(priv->common.rx_mtu + 32);
7728                 if (unlikely(!skb)) {
7729 -                       usb_free_urb(urb);
7730                         /* TODO check rx queue length and refill *somewhere* */
7731                         return;
7732                 }
7733 @@ -113,7 +113,6 @@
7734                 info->dev = dev;
7735                 urb->transfer_buffer = skb_tail_pointer(skb);
7736                 urb->context = skb;
7737 -               skb_queue_tail(&priv->rx_queue, skb);
7738         } else {
7739                 if (priv->hw_type == P54U_NET2280)
7740                         skb_push(skb, priv->common.tx_hdr_len);
7741 @@ -128,22 +127,23 @@
7742                         WARN_ON(1);
7743                         urb->transfer_buffer = skb_tail_pointer(skb);
7744                 }
7745 -
7746 -               skb_queue_tail(&priv->rx_queue, skb);
7747         }
7748
7749 -       usb_submit_urb(urb, GFP_ATOMIC);
7750 +       usb_anchor_urb(urb, &priv->submitted);
7751 +       if (usb_submit_urb(urb, GFP_ATOMIC)) {
7752 +               usb_unanchor_urb(urb);
7753 +               dev_kfree_skb_irq(skb);
7754 +       } else
7755 +               skb_queue_tail(&priv->rx_queue, skb);
7756  }
7757
7758 -static void p54u_tx_cb(struct urb *urb)
7759 -{
7760 -       usb_free_urb(urb);
7761 -}
7762 +static void p54u_tx_cb(struct urb *urb) { }
7763
7764 -static void p54u_tx_free_cb(struct urb *urb)
7765 +static void p54u_free_urbs(struct ieee80211_hw *dev)
7766  {
7767 -       kfree(urb->transfer_buffer);
7768 -       usb_free_urb(urb);
7769 +       struct p54u_priv *priv = dev->priv;
7770 +
7771 +       usb_kill_anchored_urbs(&priv->submitted);
7772  }
7773
7774  static int p54u_init_urbs(struct ieee80211_hw *dev)
7775 @@ -152,15 +152,18 @@
7776         struct urb *entry;
7777         struct sk_buff *skb;
7778         struct p54u_rx_info *info;
7779 +       int ret = 0;
7780
7781         while (skb_queue_len(&priv->rx_queue) < 32) {
7782                 skb = __dev_alloc_skb(priv->common.rx_mtu + 32, GFP_KERNEL);
7783 -               if (!skb)
7784 -                       break;
7785 +               if (!skb) {
7786 +                       ret = -ENOMEM;
7787 +                       goto err;
7788 +               }
7789                 entry = usb_alloc_urb(0, GFP_KERNEL);
7790                 if (!entry) {
7791 -                       kfree_skb(skb);
7792 -                       break;
7793 +                       ret = -ENOMEM;
7794 +                       goto err;
7795                 }
7796                 usb_fill_bulk_urb(entry, priv->udev,
7797                                   usb_rcvbulkpipe(priv->udev, P54U_PIPE_DATA),
7798 @@ -170,26 +173,25 @@
7799                 info->urb = entry;
7800                 info->dev = dev;
7801                 skb_queue_tail(&priv->rx_queue, skb);
7802 -               usb_submit_urb(entry, GFP_KERNEL);
7803 +
7804 +               usb_anchor_urb(entry, &priv->submitted);
7805 +               ret = usb_submit_urb(entry, GFP_KERNEL);
7806 +               if (ret) {
7807 +                       skb_unlink(skb, &priv->rx_queue);
7808 +                       usb_unanchor_urb(entry);
7809 +                       goto err;
7810 +               }
7811 +               usb_free_urb(entry);
7812 +               entry = NULL;
7813         }
7814
7815         return 0;
7816 -}
7817 -
7818 -static void p54u_free_urbs(struct ieee80211_hw *dev)
7819 -{
7820 -       struct p54u_priv *priv = dev->priv;
7821 -       struct p54u_rx_info *info;
7822 -       struct sk_buff *skb;
7823 -
7824 -       while ((skb = skb_dequeue(&priv->rx_queue))) {
7825 -               info = (struct p54u_rx_info *) skb->cb;
7826 -               if (!info->urb)
7827 -                       continue;
7828
7829 -               usb_kill_urb(info->urb);
7830 -               kfree_skb(skb);
7831 -       }
7832 +err:
7833 +       usb_free_urb(entry);
7834 +       kfree_skb(skb);
7835 +       p54u_free_urbs(dev);
7836 +       return ret;
7837  }
7838
7839  static void p54u_tx_3887(struct ieee80211_hw *dev, struct p54_control_hdr *data,
7840 @@ -209,23 +211,38 @@
7841         }
7842
7843         usb_fill_bulk_urb(addr_urb, priv->udev,
7844 -               usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA), &data->req_id,
7845 -               sizeof(data->req_id), p54u_tx_cb, dev);
7846 +                         usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA),
7847 +                         &data->req_id, sizeof(data->req_id), p54u_tx_cb,
7848 +                         dev);
7849         usb_fill_bulk_urb(data_urb, priv->udev,
7850 -               usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA), data, len,
7851 -               free_on_tx ? p54u_tx_free_cb : p54u_tx_cb, dev);
7852 +                         usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA),
7853 +                         data, len, p54u_tx_cb, dev);
7854 +       addr_urb->transfer_flags |= URB_ZERO_PACKET;
7855 +       data_urb->transfer_flags |= URB_ZERO_PACKET |
7856 +                                   (free_on_tx ? URB_FREE_BUFFER : 0);
7857 +
7858 +       usb_anchor_urb(addr_urb, &priv->submitted);
7859 +       if (usb_submit_urb(addr_urb, GFP_ATOMIC)) {
7860 +               usb_unanchor_urb(addr_urb);
7861 +               goto out;
7862 +       }
7863
7864 -       usb_submit_urb(addr_urb, GFP_ATOMIC);
7865 -       usb_submit_urb(data_urb, GFP_ATOMIC);
7866 +       usb_anchor_urb(data_urb, &priv->submitted);
7867 +       if (usb_submit_urb(data_urb, GFP_ATOMIC))
7868 +               usb_unanchor_urb(data_urb);
7869 +
7870 +out:
7871 +       usb_free_urb(addr_urb);
7872 +       usb_free_urb(data_urb);
7873  }
7874
7875 -static __le32 p54u_lm87_chksum(const u32 *data, size_t length)
7876 +static __le32 p54u_lm87_chksum(const __le32 *data, size_t length)
7877  {
7878         u32 chk = 0;
7879
7880         length >>= 2;
7881         while (length--) {
7882 -               chk ^= *data++;
7883 +               chk ^= le32_to_cpu(*data++);
7884                 chk = (chk >> 5) ^ (chk << 3);
7885         }
7886
7887 @@ -244,15 +261,20 @@
7888         if (!data_urb)
7889                 return;
7890
7891 -       hdr->chksum = p54u_lm87_chksum((u32 *)data, len);
7892 +       hdr->chksum = p54u_lm87_chksum((__le32 *) data, len);
7893         hdr->device_addr = data->req_id;
7894
7895         usb_fill_bulk_urb(data_urb, priv->udev,
7896 -               usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA), hdr,
7897 -               len + sizeof(*hdr), free_on_tx ? p54u_tx_free_cb : p54u_tx_cb,
7898 -               dev);
7899 +                         usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA), hdr,
7900 +                         len + sizeof(*hdr), p54u_tx_cb, dev);
7901 +       data_urb->transfer_flags |= URB_ZERO_PACKET |
7902 +                                   (free_on_tx ? URB_FREE_BUFFER : 0);
7903 +
7904 +       usb_anchor_urb(data_urb, &priv->submitted);
7905 +       if (usb_submit_urb(data_urb, GFP_ATOMIC))
7906 +               usb_unanchor_urb(data_urb);
7907
7908 -       usb_submit_urb(data_urb, GFP_ATOMIC);
7909 +       usb_free_urb(data_urb);
7910  }
7911
7912  static void p54u_tx_net2280(struct ieee80211_hw *dev, struct p54_control_hdr *data,
7913 @@ -291,14 +313,30 @@
7914         hdr->len = cpu_to_le16(len);
7915
7916         usb_fill_bulk_urb(int_urb, priv->udev,
7917 -               usb_sndbulkpipe(priv->udev, P54U_PIPE_DEV), reg, sizeof(*reg),
7918 -               p54u_tx_free_cb, dev);
7919 -       usb_submit_urb(int_urb, GFP_ATOMIC);
7920 +                         usb_sndbulkpipe(priv->udev, P54U_PIPE_DEV),
7921 +                         reg, sizeof(*reg), p54u_tx_cb, dev);
7922 +       int_urb->transfer_flags |= URB_ZERO_PACKET | URB_FREE_BUFFER;
7923 +       usb_anchor_urb(int_urb, &priv->submitted);
7924 +       if (usb_submit_urb(int_urb, GFP_ATOMIC)) {
7925 +               usb_unanchor_urb(int_urb);
7926 +               goto out;
7927 +       }
7928
7929         usb_fill_bulk_urb(data_urb, priv->udev,
7930 -               usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA), hdr, len + sizeof(*hdr),
7931 -               free_on_tx ? p54u_tx_free_cb : p54u_tx_cb, dev);
7932 -       usb_submit_urb(data_urb, GFP_ATOMIC);
7933 +                         usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA), hdr,
7934 +                         len + sizeof(*hdr), p54u_tx_cb, dev);
7935 +       data_urb->transfer_flags |= URB_ZERO_PACKET |
7936 +                                   (free_on_tx ? URB_FREE_BUFFER : 0);
7937 +
7938 +       usb_anchor_urb(int_urb, &priv->submitted);
7939 +       if (usb_submit_urb(data_urb, GFP_ATOMIC)) {
7940 +               usb_unanchor_urb(data_urb);
7941 +               goto out;
7942 +       }
7943 +
7944 +out:
7945 +       usb_free_urb(int_urb);
7946 +       usb_free_urb(data_urb);
7947  }
7948
7949  static int p54u_write(struct p54u_priv *priv,
7950 @@ -799,6 +837,7 @@
7951         SET_IEEE80211_DEV(dev, &intf->dev);
7952         usb_set_intfdata(intf, dev);
7953         priv->udev = udev;
7954 +       init_usb_anchor(&priv->submitted);
7955
7956         usb_get_dev(udev);
7957
7958 --- kernel-power-2.6.28.orig/drivers/net/wireless/p54/p54usb.h
7959 +++ kernel-power-2.6.28/drivers/net/wireless/p54/p54usb.h
7960 @@ -133,6 +133,7 @@
7961
7962         spinlock_t lock;
7963         struct sk_buff_head rx_queue;
7964 +       struct usb_anchor submitted;
7965  };
7966
7967  #endif /* P54USB_H */
7968 --- kernel-power-2.6.28.orig/drivers/net/wireless/rt2x00/rt73usb.c
7969 +++ kernel-power-2.6.28/drivers/net/wireless/rt2x00/rt73usb.c
7970 @@ -2434,6 +2434,7 @@
7971         /* Linksys */
7972         { USB_DEVICE(0x13b1, 0x0020), USB_DEVICE_DATA(&rt73usb_ops) },
7973         { USB_DEVICE(0x13b1, 0x0023), USB_DEVICE_DATA(&rt73usb_ops) },
7974 +       { USB_DEVICE(0x13b1, 0x0028), USB_DEVICE_DATA(&rt73usb_ops) },
7975         /* MSI */
7976         { USB_DEVICE(0x0db0, 0x6877), USB_DEVICE_DATA(&rt73usb_ops) },
7977         { USB_DEVICE(0x0db0, 0x6874), USB_DEVICE_DATA(&rt73usb_ops) },
7978 --- kernel-power-2.6.28.orig/drivers/net/wireless/rtl8187_dev.c
7979 +++ kernel-power-2.6.28/drivers/net/wireless/rtl8187_dev.c
7980 @@ -40,6 +40,10 @@
7981         {USB_DEVICE(0x0bda, 0x8189), .driver_info = DEVICE_RTL8187B},
7982         {USB_DEVICE(0x0bda, 0x8197), .driver_info = DEVICE_RTL8187B},
7983         {USB_DEVICE(0x0bda, 0x8198), .driver_info = DEVICE_RTL8187B},
7984 +       /* Surecom */
7985 +       {USB_DEVICE(0x0769, 0x11F2), .driver_info = DEVICE_RTL8187},
7986 +       /* Logitech */
7987 +       {USB_DEVICE(0x0789, 0x010C), .driver_info = DEVICE_RTL8187},
7988         /* Netgear */
7989         {USB_DEVICE(0x0846, 0x6100), .driver_info = DEVICE_RTL8187},
7990         {USB_DEVICE(0x0846, 0x6a00), .driver_info = DEVICE_RTL8187},
7991 @@ -49,8 +53,16 @@
7992         /* Sitecom */
7993         {USB_DEVICE(0x0df6, 0x000d), .driver_info = DEVICE_RTL8187},
7994         {USB_DEVICE(0x0df6, 0x0028), .driver_info = DEVICE_RTL8187B},
7995 +       /* Sphairon Access Systems GmbH */
7996 +       {USB_DEVICE(0x114B, 0x0150), .driver_info = DEVICE_RTL8187},
7997 +       /* Dick Smith Electronics */
7998 +       {USB_DEVICE(0x1371, 0x9401), .driver_info = DEVICE_RTL8187},
7999         /* Abocom */
8000         {USB_DEVICE(0x13d1, 0xabe6), .driver_info = DEVICE_RTL8187},
8001 +       /* Qcom */
8002 +       {USB_DEVICE(0x18E8, 0x6232), .driver_info = DEVICE_RTL8187},
8003 +       /* AirLive */
8004 +       {USB_DEVICE(0x1b75, 0x8187), .driver_info = DEVICE_RTL8187},
8005         {}
8006  };
8007
8008 @@ -263,6 +275,7 @@
8009
8010         usb_fill_bulk_urb(urb, priv->udev, usb_sndbulkpipe(priv->udev, ep),
8011                           buf, skb->len, rtl8187_tx_cb, skb);
8012 +       urb->transfer_flags |= URB_ZERO_PACKET;
8013         rc = usb_submit_urb(urb, GFP_ATOMIC);
8014         if (rc < 0) {
8015                 usb_free_urb(urb);
8016 --- kernel-power-2.6.28.orig/drivers/net/wireless/rtl8187_rtl8225.c
8017 +++ kernel-power-2.6.28/drivers/net/wireless/rtl8187_rtl8225.c
8018 @@ -287,7 +287,10 @@
8019         ofdm_power = priv->channels[channel - 1].hw_value >> 4;
8020
8021         cck_power = min(cck_power, (u8)11);
8022 -       ofdm_power = min(ofdm_power, (u8)35);
8023 +       if (ofdm_power > (u8)15)
8024 +               ofdm_power = 25;
8025 +       else
8026 +               ofdm_power += 10;
8027
8028         rtl818x_iowrite8(priv, &priv->map->TX_GAIN_CCK,
8029                          rtl8225_tx_gain_cck_ofdm[cck_power / 6] >> 1);
8030 @@ -540,7 +543,10 @@
8031         cck_power += priv->txpwr_base & 0xF;
8032         cck_power = min(cck_power, (u8)35);
8033
8034 -       ofdm_power = min(ofdm_power, (u8)15);
8035 +       if (ofdm_power > (u8)15)
8036 +               ofdm_power = 25;
8037 +       else
8038 +               ofdm_power += 10;
8039         ofdm_power += priv->txpwr_base >> 4;
8040         ofdm_power = min(ofdm_power, (u8)35);
8041
8042 --- kernel-power-2.6.28.orig/drivers/net/wireless/zd1211rw/zd_rf.c
8043 +++ kernel-power-2.6.28/drivers/net/wireless/zd1211rw/zd_rf.c
8044 @@ -86,6 +86,7 @@
8045         case AL7230B_RF:
8046                 r = zd_rf_init_al7230b(rf);
8047                 break;
8048 +       case MAXIM_NEW_RF:
8049         case UW2453_RF:
8050                 r = zd_rf_init_uw2453(rf);
8051                 break;
8052 --- kernel-power-2.6.28.orig/drivers/net/wireless/zd1211rw/zd_usb.c
8053 +++ kernel-power-2.6.28/drivers/net/wireless/zd1211rw/zd_usb.c
8054 @@ -37,6 +37,7 @@
8055  static struct usb_device_id usb_ids[] = {
8056         /* ZD1211 */
8057         { USB_DEVICE(0x0ace, 0x1211), .driver_info = DEVICE_ZD1211 },
8058 +       { USB_DEVICE(0x0ace, 0xa211), .driver_info = DEVICE_ZD1211 },
8059         { USB_DEVICE(0x07b8, 0x6001), .driver_info = DEVICE_ZD1211 },
8060         { USB_DEVICE(0x126f, 0xa006), .driver_info = DEVICE_ZD1211 },
8061         { USB_DEVICE(0x6891, 0xa727), .driver_info = DEVICE_ZD1211 },
8062 --- kernel-power-2.6.28.orig/drivers/parport/parport_serial.c
8063 +++ kernel-power-2.6.28/drivers/parport/parport_serial.c
8064 @@ -64,6 +64,11 @@
8065
8066  static int __devinit netmos_parallel_init(struct pci_dev *dev, struct parport_pc_pci *card, int autoirq, int autodma)
8067  {
8068 +       /* the rule described below doesn't hold for this device */
8069 +       if (dev->device == PCI_DEVICE_ID_NETMOS_9835 &&
8070 +                       dev->subsystem_vendor == PCI_VENDOR_ID_IBM &&
8071 +                       dev->subsystem_device == 0x0299)
8072 +               return -ENODEV;
8073         /*
8074          * Netmos uses the subdevice ID to indicate the number of parallel
8075          * and serial ports.  The form is 0x00PS, where <P> is the number of
8076 --- kernel-power-2.6.28.orig/drivers/pci/hotplug/pciehp_core.c
8077 +++ kernel-power-2.6.28/drivers/pci/hotplug/pciehp_core.c
8078 @@ -126,8 +126,10 @@
8079         mutex_lock(&slot->ctrl->crit_sect);
8080
8081         /* has it been >1 sec since our last toggle? */
8082 -       if ((get_seconds() - slot->last_emi_toggle) < 1)
8083 +       if ((get_seconds() - slot->last_emi_toggle) < 1) {
8084 +               mutex_unlock(&slot->ctrl->crit_sect);
8085                 return -EINVAL;
8086 +       }
8087
8088         /* see what our current state is */
8089         retval = get_lock_status(hotplug_slot, &value);
8090 --- kernel-power-2.6.28.orig/drivers/pci/intel-iommu.c
8091 +++ kernel-power-2.6.28/drivers/pci/intel-iommu.c
8092 @@ -71,6 +71,8 @@
8093  /* bitmap for indexing intel_iommus */
8094  static int g_num_of_iommus;
8095
8096 +static int rwbf_quirk = 0;
8097 +
8098  static DEFINE_SPINLOCK(async_umap_flush_lock);
8099  static LIST_HEAD(unmaps_to_do);
8100
8101 @@ -506,7 +508,7 @@
8102         u32 val;
8103         unsigned long flag;
8104
8105 -       if (!cap_rwbf(iommu->cap))
8106 +       if (!rwbf_quirk && !cap_rwbf(iommu->cap))
8107                 return;
8108         val = iommu->gcmd | DMA_GCMD_WBF;
8109
8110 @@ -2436,3 +2438,13 @@
8111         return pfn >> VTD_PAGE_SHIFT;
8112  }
8113  EXPORT_SYMBOL_GPL(intel_iommu_iova_to_pfn);
8114 +
8115 +static void __devinit quirk_iommu_rwbf(struct pci_dev *dev)
8116 +{
8117 +       /* Mobile 4 Series Chipset neglects to set RWBF capability,
8118 +          but needs it */
8119 +       printk(KERN_INFO "DMAR: Forcing write-buffer flush capability\n");
8120 +       rwbf_quirk = 1;
8121 +}
8122 +
8123 +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2a40, quirk_iommu_rwbf);
8124 --- kernel-power-2.6.28.orig/drivers/pci/msi.c
8125 +++ kernel-power-2.6.28/drivers/pci/msi.c
8126 @@ -378,21 +378,19 @@
8127         entry->msi_attrib.masked = 1;
8128         entry->msi_attrib.default_irq = dev->irq;       /* Save IOAPIC IRQ */
8129         entry->msi_attrib.pos = pos;
8130 -       if (entry->msi_attrib.maskbit) {
8131 -               entry->mask_base = (void __iomem *)(long)msi_mask_bits_reg(pos,
8132 -                               entry->msi_attrib.is_64);
8133 -       }
8134         entry->dev = dev;
8135         if (entry->msi_attrib.maskbit) {
8136 -               unsigned int maskbits, temp;
8137 +               unsigned int base, maskbits, temp;
8138 +
8139 +               base = msi_mask_bits_reg(pos, entry->msi_attrib.is_64);
8140 +               entry->mask_base = (void __iomem *)(long)base;
8141 +
8142                 /* All MSIs are unmasked by default, Mask them all */
8143 -               pci_read_config_dword(dev,
8144 -                       msi_mask_bits_reg(pos, entry->msi_attrib.is_64),
8145 -                       &maskbits);
8146 +               pci_read_config_dword(dev, base, &maskbits);
8147                 temp = (1 << multi_msi_capable(control));
8148                 temp = ((temp - 1) & ~temp);
8149                 maskbits |= temp;
8150 -               pci_write_config_dword(dev, entry->msi_attrib.is_64, maskbits);
8151 +               pci_write_config_dword(dev, base, maskbits);
8152                 entry->msi_attrib.maskbits_mask = temp;
8153         }
8154         list_add_tail(&entry->list, &dev->msi_list);
8155 --- kernel-power-2.6.28.orig/drivers/pci/pci-sysfs.c
8156 +++ kernel-power-2.6.28/drivers/pci/pci-sysfs.c
8157 @@ -777,8 +777,8 @@
8158                 return -EINVAL;
8159
8160         rom = pci_map_rom(pdev, &size); /* size starts out as PCI window size */
8161 -       if (!rom)
8162 -               return 0;
8163 +       if (!rom || !size)
8164 +               return -EIO;
8165
8166         if (off >= size)
8167                 count = 0;
8168 --- kernel-power-2.6.28.orig/drivers/pci/pcie/aer/aerdrv_core.c
8169 +++ kernel-power-2.6.28/drivers/pci/pcie/aer/aerdrv_core.c
8170 @@ -108,6 +108,34 @@
8171  }
8172  #endif  /*  0  */
8173
8174 +
8175 +static void set_device_error_reporting(struct pci_dev *dev, void *data)
8176 +{
8177 +       bool enable = *((bool *)data);
8178 +
8179 +       if (dev->pcie_type != PCIE_RC_PORT &&
8180 +           dev->pcie_type != PCIE_SW_UPSTREAM_PORT &&
8181 +           dev->pcie_type != PCIE_SW_DOWNSTREAM_PORT)
8182 +               return;
8183 +
8184 +       if (enable)
8185 +               pci_enable_pcie_error_reporting(dev);
8186 +       else
8187 +               pci_disable_pcie_error_reporting(dev);
8188 +}
8189 +
8190 +/**
8191 + * set_downstream_devices_error_reporting - enable/disable the error reporting  bits on the root port and its downstream ports.
8192 + * @dev: pointer to root port's pci_dev data structure
8193 + * @enable: true = enable error reporting, false = disable error reporting.
8194 + */
8195 +static void set_downstream_devices_error_reporting(struct pci_dev *dev,
8196 +                                                  bool enable)
8197 +{
8198 +       set_device_error_reporting(dev, &enable);
8199 +       pci_walk_bus(dev->subordinate, set_device_error_reporting, &enable);
8200 +}
8201 +
8202  static int find_device_iter(struct device *device, void *data)
8203  {
8204         struct pci_dev *dev;
8205 @@ -525,15 +553,11 @@
8206         pci_read_config_dword(pdev, aer_pos + PCI_ERR_UNCOR_STATUS, &reg32);
8207         pci_write_config_dword(pdev, aer_pos + PCI_ERR_UNCOR_STATUS, reg32);
8208
8209 -       /* Enable Root Port device reporting error itself */
8210 -       pci_read_config_word(pdev, pos+PCI_EXP_DEVCTL, &reg16);
8211 -       reg16 = reg16 |
8212 -               PCI_EXP_DEVCTL_CERE |
8213 -               PCI_EXP_DEVCTL_NFERE |
8214 -               PCI_EXP_DEVCTL_FERE |
8215 -               PCI_EXP_DEVCTL_URRE;
8216 -       pci_write_config_word(pdev, pos+PCI_EXP_DEVCTL,
8217 -               reg16);
8218 +       /*
8219 +        * Enable error reporting for the root port device and downstream port
8220 +        * devices.
8221 +        */
8222 +       set_downstream_devices_error_reporting(pdev, true);
8223
8224         /* Enable Root Port's interrupt in response to error messages */
8225         pci_write_config_dword(pdev,
8226 @@ -553,6 +577,12 @@
8227         u32 reg32;
8228         int pos;
8229
8230 +       /*
8231 +        * Disable error reporting for the root port device and downstream port
8232 +        * devices.
8233 +        */
8234 +       set_downstream_devices_error_reporting(pdev, false);
8235 +
8236         pos = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_ERR);
8237         /* Disable Root's interrupt in response to error messages */
8238         pci_write_config_dword(pdev, pos + PCI_ERR_ROOT_COMMAND, 0);
8239 --- kernel-power-2.6.28.orig/drivers/pci/pcie/aspm.c
8240 +++ kernel-power-2.6.28/drivers/pci/pcie/aspm.c
8241 @@ -33,6 +33,11 @@
8242  struct pcie_link_state {
8243         struct list_head sibiling;
8244         struct pci_dev *pdev;
8245 +       bool downstream_has_switch;
8246 +
8247 +       struct pcie_link_state *parent;
8248 +       struct list_head children;
8249 +       struct list_head link;
8250
8251         /* ASPM state */
8252         unsigned int support_state;
8253 @@ -125,7 +130,7 @@
8254         link_state->clk_pm_enabled = !!enable;
8255  }
8256
8257 -static void pcie_check_clock_pm(struct pci_dev *pdev)
8258 +static void pcie_check_clock_pm(struct pci_dev *pdev, int blacklist)
8259  {
8260         int pos;
8261         u32 reg32;
8262 @@ -149,10 +154,26 @@
8263                 if (!(reg16 & PCI_EXP_LNKCTL_CLKREQ_EN))
8264                         enabled = 0;
8265         }
8266 -       link_state->clk_pm_capable = capable;
8267         link_state->clk_pm_enabled = enabled;
8268         link_state->bios_clk_state = enabled;
8269 -       pcie_set_clock_pm(pdev, policy_to_clkpm_state(pdev));
8270 +       if (!blacklist) {
8271 +               link_state->clk_pm_capable = capable;
8272 +               pcie_set_clock_pm(pdev, policy_to_clkpm_state(pdev));
8273 +       } else {
8274 +               link_state->clk_pm_capable = 0;
8275 +               pcie_set_clock_pm(pdev, 0);
8276 +       }
8277 +}
8278 +
8279 +static bool pcie_aspm_downstream_has_switch(struct pci_dev *pdev)
8280 +{
8281 +       struct pci_dev *child_dev;
8282 +
8283 +       list_for_each_entry(child_dev, &pdev->subordinate->devices, bus_list) {
8284 +               if (child_dev->pcie_type == PCI_EXP_TYPE_UPSTREAM)
8285 +                       return true;
8286 +       }
8287 +       return false;
8288  }
8289
8290  /*
8291 @@ -419,9 +440,9 @@
8292  {
8293         struct pci_dev *child_dev;
8294
8295 -       /* If no child, disable the link */
8296 +       /* If no child, ignore the link */
8297         if (list_empty(&pdev->subordinate->devices))
8298 -               return 0;
8299 +               return state;
8300         list_for_each_entry(child_dev, &pdev->subordinate->devices, bus_list) {
8301                 if (child_dev->pcie_type == PCI_EXP_TYPE_PCI_BRIDGE) {
8302                         /*
8303 @@ -462,6 +483,9 @@
8304         int valid = 1;
8305         struct pcie_link_state *link_state = pdev->link_state;
8306
8307 +       /* If no child, disable the link */
8308 +       if (list_empty(&pdev->subordinate->devices))
8309 +               state = 0;
8310         /*
8311          * if the downstream component has pci bridge function, don't do ASPM
8312          * now
8313 @@ -493,20 +517,52 @@
8314         link_state->enabled_state = state;
8315  }
8316
8317 +static struct pcie_link_state *get_root_port_link(struct pcie_link_state *link)
8318 +{
8319 +       struct pcie_link_state *root_port_link = link;
8320 +       while (root_port_link->parent)
8321 +               root_port_link = root_port_link->parent;
8322 +       return root_port_link;
8323 +}
8324 +
8325 +/* check the whole hierarchy, and configure each link in the hierarchy */
8326  static void __pcie_aspm_configure_link_state(struct pci_dev *pdev,
8327         unsigned int state)
8328  {
8329         struct pcie_link_state *link_state = pdev->link_state;
8330 +       struct pcie_link_state *root_port_link = get_root_port_link(link_state);
8331 +       struct pcie_link_state *leaf;
8332
8333 -       if (link_state->support_state == 0)
8334 -               return;
8335         state &= PCIE_LINK_STATE_L0S|PCIE_LINK_STATE_L1;
8336
8337 -       /* state 0 means disabling aspm */
8338 -       state = pcie_aspm_check_state(pdev, state);
8339 +       /* check all links who have specific root port link */
8340 +       list_for_each_entry(leaf, &link_list, sibiling) {
8341 +               if (!list_empty(&leaf->children) ||
8342 +                       get_root_port_link(leaf) != root_port_link)
8343 +                       continue;
8344 +               state = pcie_aspm_check_state(leaf->pdev, state);
8345 +       }
8346 +       /* check root port link too in case it hasn't children */
8347 +       state = pcie_aspm_check_state(root_port_link->pdev, state);
8348 +
8349         if (link_state->enabled_state == state)
8350                 return;
8351 -       __pcie_aspm_config_link(pdev, state);
8352 +
8353 +       /*
8354 +        * we must change the hierarchy. See comments in
8355 +        * __pcie_aspm_config_link for the order
8356 +        **/
8357 +       if (state & PCIE_LINK_STATE_L1) {
8358 +               list_for_each_entry(leaf, &link_list, sibiling) {
8359 +                       if (get_root_port_link(leaf) == root_port_link)
8360 +                               __pcie_aspm_config_link(leaf->pdev, state);
8361 +               }
8362 +       } else {
8363 +               list_for_each_entry_reverse(leaf, &link_list, sibiling) {
8364 +                       if (get_root_port_link(leaf) == root_port_link)
8365 +                               __pcie_aspm_config_link(leaf->pdev, state);
8366 +               }
8367 +       }
8368  }
8369
8370  /*
8371 @@ -570,6 +626,7 @@
8372         unsigned int state;
8373         struct pcie_link_state *link_state;
8374         int error = 0;
8375 +       int blacklist;
8376
8377         if (aspm_disabled || !pdev->is_pcie || pdev->link_state)
8378                 return;
8379 @@ -580,29 +637,58 @@
8380         if (list_empty(&pdev->subordinate->devices))
8381                 goto out;
8382
8383 -       if (pcie_aspm_sanity_check(pdev))
8384 -               goto out;
8385 +       blacklist = !!pcie_aspm_sanity_check(pdev);
8386
8387         mutex_lock(&aspm_lock);
8388
8389         link_state = kzalloc(sizeof(*link_state), GFP_KERNEL);
8390         if (!link_state)
8391                 goto unlock_out;
8392 -       pdev->link_state = link_state;
8393
8394 -       pcie_aspm_configure_common_clock(pdev);
8395 -
8396 -       pcie_aspm_cap_init(pdev);
8397 +       link_state->downstream_has_switch = pcie_aspm_downstream_has_switch(pdev);
8398 +       INIT_LIST_HEAD(&link_state->children);
8399 +       INIT_LIST_HEAD(&link_state->link);
8400 +       if (pdev->bus->self) {/* this is a switch */
8401 +               struct pcie_link_state *parent_link_state;
8402 +
8403 +               parent_link_state = pdev->bus->parent->self->link_state;
8404 +               if (!parent_link_state) {
8405 +                       kfree(link_state);
8406 +                       goto unlock_out;
8407 +               }
8408 +               list_add(&link_state->link, &parent_link_state->children);
8409 +               link_state->parent = parent_link_state;
8410 +       }
8411
8412 -       /* config link state to avoid BIOS error */
8413 -       state = pcie_aspm_check_state(pdev, policy_to_aspm_state(pdev));
8414 -       __pcie_aspm_config_link(pdev, state);
8415 +       pdev->link_state = link_state;
8416
8417 -       pcie_check_clock_pm(pdev);
8418 +       if (!blacklist) {
8419 +               pcie_aspm_configure_common_clock(pdev);
8420 +               pcie_aspm_cap_init(pdev);
8421 +       } else {
8422 +               link_state->enabled_state = PCIE_LINK_STATE_L0S|PCIE_LINK_STATE_L1;
8423 +               link_state->bios_aspm_state = 0;
8424 +               /* Set support state to 0, so we will disable ASPM later */
8425 +               link_state->support_state = 0;
8426 +       }
8427
8428         link_state->pdev = pdev;
8429         list_add(&link_state->sibiling, &link_list);
8430
8431 +       if (link_state->downstream_has_switch) {
8432 +               /*
8433 +                * If link has switch, delay the link config. The leaf link
8434 +                * initialization will config the whole hierarchy. but we must
8435 +                * make sure BIOS doesn't set unsupported link state
8436 +                **/
8437 +               state = pcie_aspm_check_state(pdev, link_state->bios_aspm_state);
8438 +               __pcie_aspm_config_link(pdev, state);
8439 +       } else
8440 +               __pcie_aspm_configure_link_state(pdev,
8441 +                       policy_to_aspm_state(pdev));
8442 +
8443 +       pcie_check_clock_pm(pdev, blacklist);
8444 +
8445  unlock_out:
8446         if (error)
8447                 free_link_state(pdev);
8448 @@ -627,14 +713,15 @@
8449
8450         /*
8451          * All PCIe functions are in one slot, remove one function will remove
8452 -        * the the whole slot, so just wait
8453 +        * the whole slot, so just wait until we are the last function left.
8454          */
8455 -       if (!list_empty(&parent->subordinate->devices))
8456 +       if (!list_is_last(&pdev->bus_list, &parent->subordinate->devices))
8457                 goto out;
8458
8459         /* All functions are removed, so just disable ASPM for the link */
8460         __pcie_aspm_config_one_dev(parent, 0);
8461         list_del(&link_state->sibiling);
8462 +       list_del(&link_state->link);
8463         /* Clock PM is for endpoint device */
8464
8465         free_link_state(parent);
8466 --- kernel-power-2.6.28.orig/drivers/pci/pcie/portdrv_pci.c
8467 +++ kernel-power-2.6.28/drivers/pci/pcie/portdrv_pci.c
8468 @@ -101,14 +101,13 @@
8469
8470         pcie_portdrv_save_config(dev);
8471
8472 -       pci_enable_pcie_error_reporting(dev);
8473 -
8474         return 0;
8475  }
8476
8477  static void pcie_portdrv_remove (struct pci_dev *dev)
8478  {
8479         pcie_port_device_remove(dev);
8480 +       pci_disable_device(dev);
8481         kfree(pci_get_drvdata(dev));
8482  }
8483
8484 --- kernel-power-2.6.28.orig/drivers/pci/quirks.c
8485 +++ kernel-power-2.6.28/drivers/pci/quirks.c
8486 @@ -23,6 +23,7 @@
8487  #include <linux/acpi.h>
8488  #include <linux/kallsyms.h>
8489  #include <linux/dmi.h>
8490 +#include <linux/pci-aspm.h>
8491  #include "pci.h"
8492
8493  int isa_dma_bridge_buggy;
8494 @@ -1543,6 +1544,30 @@
8495  }
8496  DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, PCI_ANY_ID, quirk_e100_interrupt);
8497
8498 +/*
8499 + * The 82575 and 82598 may experience data corruption issues when transitioning
8500 + * out of L0S.  To prevent this we need to disable L0S on the pci-e link
8501 + */
8502 +static void __devinit quirk_disable_aspm_l0s(struct pci_dev *dev)
8503 +{
8504 +       dev_info(&dev->dev, "Disabling L0s\n");
8505 +       pci_disable_link_state(dev, PCIE_LINK_STATE_L0S);
8506 +}
8507 +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10a7, quirk_disable_aspm_l0s);
8508 +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10a9, quirk_disable_aspm_l0s);
8509 +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10b6, quirk_disable_aspm_l0s);
8510 +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10c6, quirk_disable_aspm_l0s);
8511 +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10c7, quirk_disable_aspm_l0s);
8512 +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10c8, quirk_disable_aspm_l0s);
8513 +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10d6, quirk_disable_aspm_l0s);
8514 +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10db, quirk_disable_aspm_l0s);
8515 +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10dd, quirk_disable_aspm_l0s);
8516 +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10e1, quirk_disable_aspm_l0s);
8517 +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10ec, quirk_disable_aspm_l0s);
8518 +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10f1, quirk_disable_aspm_l0s);
8519 +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10f4, quirk_disable_aspm_l0s);
8520 +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1508, quirk_disable_aspm_l0s);
8521 +
8522  static void __devinit fixup_rev1_53c810(struct pci_dev* dev)
8523  {
8524         /* rev 1 ncr53c810 chips don't set the class at all which means
8525 @@ -1778,7 +1803,6 @@
8526  DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_SERVERWORKS, PCI_DEVICE_ID_SERVERWORKS_HT2000_PCIE,
8527                         quirk_msi_ht_cap);
8528
8529 -
8530  /* The nVidia CK804 chipset may have 2 HT MSI mappings.
8531   * MSI are supported if the MSI capability set in any of these mappings.
8532   */
8533 @@ -1829,6 +1853,9 @@
8534                          PCI_DEVICE_ID_SERVERWORKS_HT1000_PXB,
8535                          ht_enable_msi_mapping);
8536
8537 +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_8132_BRIDGE,
8538 +                        ht_enable_msi_mapping);
8539 +
8540  /* The P5N32-SLI Premium motherboard from Asus has a problem with msi
8541   * for the MCP55 NIC. It is not yet determined whether the msi problem
8542   * also affects other devices. As for now, turn off msi for this device.
8543 --- kernel-power-2.6.28.orig/drivers/pci/rom.c
8544 +++ kernel-power-2.6.28/drivers/pci/rom.c
8545 @@ -63,7 +63,7 @@
8546   * The PCI window size could be much larger than the
8547   * actual image size.
8548   */
8549 -size_t pci_get_rom_size(void __iomem *rom, size_t size)
8550 +size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size)
8551  {
8552         void __iomem *image;
8553         int last_image;
8554 @@ -72,8 +72,10 @@
8555         do {
8556                 void __iomem *pds;
8557                 /* Standard PCI ROMs start out with these bytes 55 AA */
8558 -               if (readb(image) != 0x55)
8559 +               if (readb(image) != 0x55) {
8560 +                       dev_err(&pdev->dev, "Invalid ROM contents\n");
8561                         break;
8562 +               }
8563                 if (readb(image + 1) != 0xAA)
8564                         break;
8565                 /* get the PCI data structure and check its signature */
8566 @@ -159,7 +161,7 @@
8567          * size is much larger than the actual size of the ROM.
8568          * True size is important if the ROM is going to be copied.
8569          */
8570 -       *size = pci_get_rom_size(rom, *size);
8571 +       *size = pci_get_rom_size(pdev, rom, *size);
8572         return rom;
8573  }
8574
8575 --- kernel-power-2.6.28.orig/drivers/pci/syscall.c
8576 +++ kernel-power-2.6.28/drivers/pci/syscall.c
8577 @@ -14,10 +14,8 @@
8578  #include <asm/uaccess.h>
8579  #include "pci.h"
8580
8581 -asmlinkage long
8582 -sys_pciconfig_read(unsigned long bus, unsigned long dfn,
8583 -                  unsigned long off, unsigned long len,
8584 -                  void __user *buf)
8585 +SYSCALL_DEFINE5(pciconfig_read, unsigned long, bus, unsigned long, dfn,
8586 +               unsigned long, off, unsigned long, len, void __user *, buf)
8587  {
8588         struct pci_dev *dev;
8589         u8 byte;
8590 @@ -86,10 +84,8 @@
8591         return err;
8592  }
8593
8594 -asmlinkage long
8595 -sys_pciconfig_write(unsigned long bus, unsigned long dfn,
8596 -                   unsigned long off, unsigned long len,
8597 -                   void __user *buf)
8598 +SYSCALL_DEFINE5(pciconfig_write, unsigned long, bus, unsigned long, dfn,
8599 +               unsigned long, off, unsigned long, len, void __user *, buf)
8600  {
8601         struct pci_dev *dev;
8602         u8 byte;
8603 --- kernel-power-2.6.28.orig/drivers/scsi/eata.c
8604 +++ kernel-power-2.6.28/drivers/scsi/eata.c
8605 @@ -1626,8 +1626,15 @@
8606
8607         cpp->sense_len = SCSI_SENSE_BUFFERSIZE;
8608
8609 -       count = scsi_dma_map(SCpnt);
8610 -       BUG_ON(count < 0);
8611 +       if (!scsi_sg_count(SCpnt)) {
8612 +               cpp->data_len = 0;
8613 +               return;
8614 +       }
8615 +
8616 +       count = pci_map_sg(ha->pdev, scsi_sglist(SCpnt), scsi_sg_count(SCpnt),
8617 +                          pci_dir);
8618 +       BUG_ON(!count);
8619 +
8620         scsi_for_each_sg(SCpnt, sg, count, k) {
8621                 cpp->sglist[k].address = H2DEV(sg_dma_address(sg));
8622                 cpp->sglist[k].num_bytes = H2DEV(sg_dma_len(sg));
8623 @@ -1655,7 +1662,9 @@
8624                 pci_unmap_single(ha->pdev, DEV2H(cpp->sense_addr),
8625                                  DEV2H(cpp->sense_len), PCI_DMA_FROMDEVICE);
8626
8627 -       scsi_dma_unmap(SCpnt);
8628 +       if (scsi_sg_count(SCpnt))
8629 +               pci_unmap_sg(ha->pdev, scsi_sglist(SCpnt), scsi_sg_count(SCpnt),
8630 +                            pci_dir);
8631
8632         if (!DEV2H(cpp->data_len))
8633                 pci_dir = PCI_DMA_BIDIRECTIONAL;
8634 --- kernel-power-2.6.28.orig/drivers/scsi/hptiop.c
8635 +++ kernel-power-2.6.28/drivers/scsi/hptiop.c
8636 @@ -1251,6 +1251,7 @@
8637         { PCI_VDEVICE(TTI, 0x3530), (kernel_ulong_t)&hptiop_itl_ops },
8638         { PCI_VDEVICE(TTI, 0x3560), (kernel_ulong_t)&hptiop_itl_ops },
8639         { PCI_VDEVICE(TTI, 0x4322), (kernel_ulong_t)&hptiop_itl_ops },
8640 +       { PCI_VDEVICE(TTI, 0x4321), (kernel_ulong_t)&hptiop_itl_ops },
8641         { PCI_VDEVICE(TTI, 0x4210), (kernel_ulong_t)&hptiop_itl_ops },
8642         { PCI_VDEVICE(TTI, 0x4211), (kernel_ulong_t)&hptiop_itl_ops },
8643         { PCI_VDEVICE(TTI, 0x4310), (kernel_ulong_t)&hptiop_itl_ops },
8644 --- kernel-power-2.6.28.orig/drivers/scsi/ibmvscsi/ibmvfc.c
8645 +++ kernel-power-2.6.28/drivers/scsi/ibmvscsi/ibmvfc.c
8646 @@ -566,7 +566,7 @@
8647         struct ibmvfc_target *tgt;
8648
8649         if (vhost->action == IBMVFC_HOST_ACTION_INIT_WAIT) {
8650 -               if (++vhost->init_retries > IBMVFC_MAX_INIT_RETRIES) {
8651 +               if (++vhost->init_retries > IBMVFC_MAX_HOST_INIT_RETRIES) {
8652                         dev_err(vhost->dev,
8653                                 "Host initialization retries exceeded. Taking adapter offline\n");
8654                         ibmvfc_link_down(vhost, IBMVFC_HOST_OFFLINE);
8655 @@ -847,11 +847,12 @@
8656  static void ibmvfc_retry_host_init(struct ibmvfc_host *vhost)
8657  {
8658         if (vhost->action == IBMVFC_HOST_ACTION_INIT_WAIT) {
8659 -               if (++vhost->init_retries > IBMVFC_MAX_INIT_RETRIES) {
8660 +               vhost->delay_init = 1;
8661 +               if (++vhost->init_retries > IBMVFC_MAX_HOST_INIT_RETRIES) {
8662                         dev_err(vhost->dev,
8663                                 "Host initialization retries exceeded. Taking adapter offline\n");
8664                         ibmvfc_link_down(vhost, IBMVFC_HOST_OFFLINE);
8665 -               } else if (vhost->init_retries == IBMVFC_MAX_INIT_RETRIES)
8666 +               } else if (vhost->init_retries == IBMVFC_MAX_HOST_INIT_RETRIES)
8667                         __ibmvfc_reset_host(vhost);
8668                 else
8669                         ibmvfc_set_host_action(vhost, IBMVFC_HOST_ACTION_INIT);
8670 @@ -2089,15 +2090,17 @@
8671         case IBMVFC_AE_LINK_UP:
8672         case IBMVFC_AE_RESUME:
8673                 vhost->events_to_log |= IBMVFC_AE_LINKUP;
8674 -               ibmvfc_init_host(vhost, 1);
8675 +               vhost->delay_init = 1;
8676 +               __ibmvfc_reset_host(vhost);
8677                 break;
8678         case IBMVFC_AE_SCN_FABRIC:
8679 +       case IBMVFC_AE_SCN_DOMAIN:
8680                 vhost->events_to_log |= IBMVFC_AE_RSCN;
8681 -               ibmvfc_init_host(vhost, 1);
8682 +               vhost->delay_init = 1;
8683 +               __ibmvfc_reset_host(vhost);
8684                 break;
8685         case IBMVFC_AE_SCN_NPORT:
8686         case IBMVFC_AE_SCN_GROUP:
8687 -       case IBMVFC_AE_SCN_DOMAIN:
8688                 vhost->events_to_log |= IBMVFC_AE_RSCN;
8689         case IBMVFC_AE_ELS_LOGO:
8690         case IBMVFC_AE_ELS_PRLO:
8691 @@ -2669,7 +2672,7 @@
8692  static void ibmvfc_retry_tgt_init(struct ibmvfc_target *tgt,
8693                                   void (*job_step) (struct ibmvfc_target *))
8694  {
8695 -       if (++tgt->init_retries > IBMVFC_MAX_INIT_RETRIES) {
8696 +       if (++tgt->init_retries > IBMVFC_MAX_TGT_INIT_RETRIES) {
8697                 ibmvfc_set_tgt_action(tgt, IBMVFC_TGT_ACTION_DEL_RPORT);
8698                 wake_up(&tgt->vhost->work_wait_q);
8699         } else
8700 @@ -3519,7 +3522,13 @@
8701                 break;
8702         case IBMVFC_HOST_ACTION_INIT:
8703                 BUG_ON(vhost->state != IBMVFC_INITIALIZING);
8704 -               vhost->job_step(vhost);
8705 +               if (vhost->delay_init) {
8706 +                       vhost->delay_init = 0;
8707 +                       spin_unlock_irqrestore(vhost->host->host_lock, flags);
8708 +                       ssleep(15);
8709 +                       return;
8710 +               } else
8711 +                       vhost->job_step(vhost);
8712                 break;
8713         case IBMVFC_HOST_ACTION_QUERY:
8714                 list_for_each_entry(tgt, &vhost->targets, queue)
8715 --- kernel-power-2.6.28.orig/drivers/scsi/ibmvscsi/ibmvfc.h
8716 +++ kernel-power-2.6.28/drivers/scsi/ibmvscsi/ibmvfc.h
8717 @@ -33,7 +33,7 @@
8718  #define IBMVFC_DRIVER_DATE             "(August 14, 2008)"
8719
8720  #define IBMVFC_DEFAULT_TIMEOUT 15
8721 -#define IBMVFC_INIT_TIMEOUT            30
8722 +#define IBMVFC_INIT_TIMEOUT            120
8723  #define IBMVFC_MAX_REQUESTS_DEFAULT    100
8724
8725  #define IBMVFC_DEBUG                   0
8726 @@ -43,7 +43,8 @@
8727  #define IBMVFC_MAX_DISC_THREADS        4
8728  #define IBMVFC_TGT_MEMPOOL_SZ          64
8729  #define IBMVFC_MAX_CMDS_PER_LUN        64
8730 -#define IBMVFC_MAX_INIT_RETRIES        3
8731 +#define IBMVFC_MAX_HOST_INIT_RETRIES   6
8732 +#define IBMVFC_MAX_TGT_INIT_RETRIES            3
8733  #define IBMVFC_DEV_LOSS_TMO            (5 * 60)
8734  #define IBMVFC_DEFAULT_LOG_LEVEL       2
8735  #define IBMVFC_MAX_CDB_LEN             16
8736 @@ -671,6 +672,7 @@
8737         int discovery_threads;
8738         int client_migrated;
8739         int reinit;
8740 +       int delay_init;
8741         int events_to_log;
8742  #define IBMVFC_AE_LINKUP       0x0001
8743  #define IBMVFC_AE_LINKDOWN     0x0002
8744 --- kernel-power-2.6.28.orig/drivers/scsi/libiscsi.c
8745 +++ kernel-power-2.6.28/drivers/scsi/libiscsi.c
8746 @@ -1862,12 +1862,14 @@
8747                 num_arrays++;
8748         q->pool = kzalloc(num_arrays * max * sizeof(void*), GFP_KERNEL);
8749         if (q->pool == NULL)
8750 -               goto enomem;
8751 +               return -ENOMEM;
8752
8753         q->queue = kfifo_init((void*)q->pool, max * sizeof(void*),
8754                               GFP_KERNEL, NULL);
8755 -       if (q->queue == ERR_PTR(-ENOMEM))
8756 +       if (IS_ERR(q->queue)) {
8757 +               q->queue = NULL;
8758                 goto enomem;
8759 +       }
8760
8761         for (i = 0; i < max; i++) {
8762                 q->pool[i] = kzalloc(item_size, GFP_KERNEL);
8763 @@ -1897,8 +1899,8 @@
8764
8765         for (i = 0; i < q->max; i++)
8766                 kfree(q->pool[i]);
8767 -       if (q->pool)
8768 -               kfree(q->pool);
8769 +       kfree(q->pool);
8770 +       kfree(q->queue);
8771  }
8772  EXPORT_SYMBOL_GPL(iscsi_pool_free);
8773
8774 --- kernel-power-2.6.28.orig/drivers/scsi/mvsas.c
8775 +++ kernel-power-2.6.28/drivers/scsi/mvsas.c
8776 @@ -2959,7 +2959,7 @@
8777
8778         /* enable auto port detection */
8779         mw32(GBL_PORT_TYPE, MODE_AUTO_DET_EN);
8780 -       msleep(100);
8781 +       msleep(1100);
8782         /* init and reset phys */
8783         for (i = 0; i < mvi->chip->n_phy; i++) {
8784                 u32 lo = be32_to_cpu(*(u32 *)&mvi->sas_addr[4]);
8785 --- kernel-power-2.6.28.orig/drivers/scsi/pcmcia/aha152x_stub.c
8786 +++ kernel-power-2.6.28/drivers/scsi/pcmcia/aha152x_stub.c
8787 @@ -114,7 +114,7 @@
8788      link->io.NumPorts1 = 0x20;
8789      link->io.Attributes1 = IO_DATA_PATH_WIDTH_AUTO;
8790      link->io.IOAddrLines = 10;
8791 -    link->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
8792 +    link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
8793      link->irq.IRQInfo1 = IRQ_LEVEL_ID;
8794      link->conf.Attributes = CONF_ENABLE_IRQ;
8795      link->conf.IntType = INT_MEMORY_AND_IO;
8796 --- kernel-power-2.6.28.orig/drivers/scsi/sd.c
8797 +++ kernel-power-2.6.28/drivers/scsi/sd.c
8798 @@ -106,6 +106,7 @@
8799  static void sd_print_sense_hdr(struct scsi_disk *, struct scsi_sense_hdr *);
8800  static void sd_print_result(struct scsi_disk *, int);
8801
8802 +static DEFINE_SPINLOCK(sd_index_lock);
8803  static DEFINE_IDA(sd_index_ida);
8804
8805  /* This semaphore is used to mediate the 0->1 reference get in the
8806 @@ -1847,7 +1848,9 @@
8807                 if (!ida_pre_get(&sd_index_ida, GFP_KERNEL))
8808                         goto out_put;
8809
8810 +               spin_lock(&sd_index_lock);
8811                 error = ida_get_new(&sd_index_ida, &index);
8812 +               spin_unlock(&sd_index_lock);
8813         } while (error == -EAGAIN);
8814
8815         if (error)
8816 @@ -1910,7 +1913,9 @@
8817         return 0;
8818
8819   out_free_index:
8820 +       spin_lock(&sd_index_lock);
8821         ida_remove(&sd_index_ida, index);
8822 +       spin_unlock(&sd_index_lock);
8823   out_put:
8824         put_disk(gd);
8825   out_free:
8826 @@ -1960,7 +1965,9 @@
8827         struct scsi_disk *sdkp = to_scsi_disk(dev);
8828         struct gendisk *disk = sdkp->disk;
8829
8830 +       spin_lock(&sd_index_lock);
8831         ida_remove(&sd_index_ida, sdkp->index);
8832 +       spin_unlock(&sd_index_lock);
8833
8834         disk->private_data = NULL;
8835         put_disk(disk);
8836 --- kernel-power-2.6.28.orig/drivers/scsi/sg.c
8837 +++ kernel-power-2.6.28/drivers/scsi/sg.c
8838 @@ -101,6 +101,7 @@
8839  #define SG_SECTOR_MSK (SG_SECTOR_SZ - 1)
8840
8841  static int sg_add(struct device *, struct class_interface *);
8842 +static void sg_device_destroy(struct kref *kref);
8843  static void sg_remove(struct device *, struct class_interface *);
8844
8845  static DEFINE_IDR(sg_index_idr);
8846 @@ -137,6 +138,7 @@
8847         volatile char done;     /* 0->before bh, 1->before read, 2->read */
8848         struct request *rq;
8849         struct bio *bio;
8850 +       struct execute_work ew;
8851  } Sg_request;
8852
8853  typedef struct sg_fd {         /* holds the state of a file descriptor */
8854 @@ -158,6 +160,8 @@
8855         char next_cmd_len;      /* 0 -> automatic (def), >0 -> use on next write() */
8856         char keep_orphan;       /* 0 -> drop orphan (def), 1 -> keep for read() */
8857         char mmap_called;       /* 0 -> mmap() never called on this fd */
8858 +       struct kref f_ref;
8859 +       struct execute_work ew;
8860  } Sg_fd;
8861
8862  typedef struct sg_device { /* holds the state of each scsi generic device */
8863 @@ -171,6 +175,7 @@
8864         char sgdebug;           /* 0->off, 1->sense, 9->dump dev, 10-> all devs */
8865         struct gendisk *disk;
8866         struct cdev * cdev;     /* char_dev [sysfs: /sys/cdev/major/sg<n>] */
8867 +       struct kref d_ref;
8868  } Sg_device;
8869
8870  static int sg_fasync(int fd, struct file *filp, int mode);
8871 @@ -185,7 +190,7 @@
8872                            Sg_request * srp);
8873  static ssize_t sg_new_write(Sg_fd *sfp, struct file *file,
8874                         const char __user *buf, size_t count, int blocking,
8875 -                       int read_only, Sg_request **o_srp);
8876 +                       int read_only, int sg_io_owned, Sg_request **o_srp);
8877  static int sg_common_write(Sg_fd * sfp, Sg_request * srp,
8878                            unsigned char *cmnd, int timeout, int blocking);
8879  static int sg_read_oxfer(Sg_request * srp, char __user *outp, int num_read_xfer);
8880 @@ -194,13 +199,14 @@
8881  static void sg_link_reserve(Sg_fd * sfp, Sg_request * srp, int size);
8882  static void sg_unlink_reserve(Sg_fd * sfp, Sg_request * srp);
8883  static Sg_fd *sg_add_sfp(Sg_device * sdp, int dev);
8884 -static int sg_remove_sfp(Sg_device * sdp, Sg_fd * sfp);
8885 -static void __sg_remove_sfp(Sg_device * sdp, Sg_fd * sfp);
8886 +static void sg_remove_sfp(struct kref *);
8887  static Sg_request *sg_get_rq_mark(Sg_fd * sfp, int pack_id);
8888  static Sg_request *sg_add_request(Sg_fd * sfp);
8889  static int sg_remove_request(Sg_fd * sfp, Sg_request * srp);
8890  static int sg_res_in_use(Sg_fd * sfp);
8891 +static Sg_device *sg_lookup_dev(int dev);
8892  static Sg_device *sg_get_dev(int dev);
8893 +static void sg_put_dev(Sg_device *sdp);
8894  #ifdef CONFIG_SCSI_PROC_FS
8895  static int sg_last_dev(void);
8896  #endif
8897 @@ -237,22 +243,17 @@
8898         nonseekable_open(inode, filp);
8899         SCSI_LOG_TIMEOUT(3, printk("sg_open: dev=%d, flags=0x%x\n", dev, flags));
8900         sdp = sg_get_dev(dev);
8901 -       if ((!sdp) || (!sdp->device)) {
8902 -               unlock_kernel();
8903 -               return -ENXIO;
8904 -       }
8905 -       if (sdp->detached) {
8906 -               unlock_kernel();
8907 -               return -ENODEV;
8908 +       if (IS_ERR(sdp)) {
8909 +               retval = PTR_ERR(sdp);
8910 +               sdp = NULL;
8911 +               goto sg_put;
8912         }
8913
8914         /* This driver's module count bumped by fops_get in <linux/fs.h> */
8915         /* Prevent the device driver from vanishing while we sleep */
8916         retval = scsi_device_get(sdp->device);
8917 -       if (retval) {
8918 -               unlock_kernel();
8919 -               return retval;
8920 -       }
8921 +       if (retval)
8922 +               goto sg_put;
8923
8924         if (!((flags & O_NONBLOCK) ||
8925               scsi_block_when_processing_errors(sdp->device))) {
8926 @@ -303,16 +304,20 @@
8927         if ((sfp = sg_add_sfp(sdp, dev)))
8928                 filp->private_data = sfp;
8929         else {
8930 -               if (flags & O_EXCL)
8931 +               if (flags & O_EXCL) {
8932                         sdp->exclude = 0;       /* undo if error */
8933 +                       wake_up_interruptible(&sdp->o_excl_wait);
8934 +               }
8935                 retval = -ENOMEM;
8936                 goto error_out;
8937         }
8938 -       unlock_kernel();
8939 -       return 0;
8940 -
8941 -      error_out:
8942 -       scsi_device_put(sdp->device);
8943 +       retval = 0;
8944 +error_out:
8945 +       if (retval)
8946 +               scsi_device_put(sdp->device);
8947 +sg_put:
8948 +       if (sdp)
8949 +               sg_put_dev(sdp);
8950         unlock_kernel();
8951         return retval;
8952  }
8953 @@ -327,13 +332,13 @@
8954         if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
8955                 return -ENXIO;
8956         SCSI_LOG_TIMEOUT(3, printk("sg_release: %s\n", sdp->disk->disk_name));
8957 -       if (0 == sg_remove_sfp(sdp, sfp)) {     /* Returns 1 when sdp gone */
8958 -               if (!sdp->detached) {
8959 -                       scsi_device_put(sdp->device);
8960 -               }
8961 -               sdp->exclude = 0;
8962 -               wake_up_interruptible(&sdp->o_excl_wait);
8963 -       }
8964 +
8965 +       sfp->closed = 1;
8966 +
8967 +       sdp->exclude = 0;
8968 +       wake_up_interruptible(&sdp->o_excl_wait);
8969 +
8970 +       kref_put(&sfp->f_ref, sg_remove_sfp);
8971         return 0;
8972  }
8973
8974 @@ -557,7 +562,8 @@
8975                 return -EFAULT;
8976         blocking = !(filp->f_flags & O_NONBLOCK);
8977         if (old_hdr.reply_len < 0)
8978 -               return sg_new_write(sfp, filp, buf, count, blocking, 0, NULL);
8979 +               return sg_new_write(sfp, filp, buf, count,
8980 +                                   blocking, 0, 0, NULL);
8981         if (count < (SZ_SG_HEADER + 6))
8982                 return -EIO;    /* The minimum scsi command length is 6 bytes. */
8983
8984 @@ -638,7 +644,7 @@
8985
8986  static ssize_t
8987  sg_new_write(Sg_fd *sfp, struct file *file, const char __user *buf,
8988 -                size_t count, int blocking, int read_only,
8989 +                size_t count, int blocking, int read_only, int sg_io_owned,
8990                  Sg_request **o_srp)
8991  {
8992         int k;
8993 @@ -658,6 +664,7 @@
8994                 SCSI_LOG_TIMEOUT(1, printk("sg_new_write: queue full\n"));
8995                 return -EDOM;
8996         }
8997 +       srp->sg_io_owned = sg_io_owned;
8998         hp = &srp->header;
8999         if (__copy_from_user(hp, buf, SZ_SG_IO_HDR)) {
9000                 sg_remove_request(sfp, srp);
9001 @@ -755,24 +762,13 @@
9002         hp->duration = jiffies_to_msecs(jiffies);
9003
9004         srp->rq->timeout = timeout;
9005 +       kref_get(&sfp->f_ref); /* sg_rq_end_io() does kref_put(). */
9006         blk_execute_rq_nowait(sdp->device->request_queue, sdp->disk,
9007                               srp->rq, 1, sg_rq_end_io);
9008         return 0;
9009  }
9010
9011  static int
9012 -sg_srp_done(Sg_request *srp, Sg_fd *sfp)
9013 -{
9014 -       unsigned long iflags;
9015 -       int done;
9016 -
9017 -       read_lock_irqsave(&sfp->rq_list_lock, iflags);
9018 -       done = srp->done;
9019 -       read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
9020 -       return done;
9021 -}
9022 -
9023 -static int
9024  sg_ioctl(struct inode *inode, struct file *filp,
9025          unsigned int cmd_in, unsigned long arg)
9026  {
9027 @@ -804,27 +800,26 @@
9028                                 return -EFAULT;
9029                         result =
9030                             sg_new_write(sfp, filp, p, SZ_SG_IO_HDR,
9031 -                                        blocking, read_only, &srp);
9032 +                                        blocking, read_only, 1, &srp);
9033                         if (result < 0)
9034                                 return result;
9035 -                       srp->sg_io_owned = 1;
9036                         while (1) {
9037                                 result = 0;     /* following macro to beat race condition */
9038                                 __wait_event_interruptible(sfp->read_wait,
9039 -                                       (sdp->detached || sfp->closed || sg_srp_done(srp, sfp)),
9040 -                                                          result);
9041 +                                       (srp->done || sdp->detached),
9042 +                                       result);
9043                                 if (sdp->detached)
9044                                         return -ENODEV;
9045 -                               if (sfp->closed)
9046 -                                       return 0;       /* request packet dropped already */
9047 -                               if (0 == result)
9048 +                               write_lock_irq(&sfp->rq_list_lock);
9049 +                               if (srp->done) {
9050 +                                       srp->done = 2;
9051 +                                       write_unlock_irq(&sfp->rq_list_lock);
9052                                         break;
9053 +                               }
9054                                 srp->orphan = 1;
9055 +                               write_unlock_irq(&sfp->rq_list_lock);
9056                                 return result;  /* -ERESTARTSYS because signal hit process */
9057                         }
9058 -                       write_lock_irqsave(&sfp->rq_list_lock, iflags);
9059 -                       srp->done = 2;
9060 -                       write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
9061                         result = sg_new_read(sfp, p, SZ_SG_IO_HDR, srp);
9062                         return (result < 0) ? result : 0;
9063                 }
9064 @@ -1240,6 +1235,15 @@
9065         return 0;
9066  }
9067
9068 +static void sg_rq_end_io_usercontext(struct work_struct *work)
9069 +{
9070 +       struct sg_request *srp = container_of(work, struct sg_request, ew.work);
9071 +       struct sg_fd *sfp = srp->parentfp;
9072 +
9073 +       sg_finish_rem_req(srp);
9074 +       kref_put(&sfp->f_ref, sg_remove_sfp);
9075 +}
9076 +
9077  /*
9078   * This function is a "bottom half" handler that is called by the mid
9079   * level when a command is completed (or has failed).
9080 @@ -1247,24 +1251,23 @@
9081  static void sg_rq_end_io(struct request *rq, int uptodate)
9082  {
9083         struct sg_request *srp = rq->end_io_data;
9084 -       Sg_device *sdp = NULL;
9085 +       Sg_device *sdp;
9086         Sg_fd *sfp;
9087         unsigned long iflags;
9088         unsigned int ms;
9089         char *sense;
9090 -       int result, resid;
9091 +       int result, resid, done = 1;
9092
9093 -       if (NULL == srp) {
9094 -               printk(KERN_ERR "sg_cmd_done: NULL request\n");
9095 +       if (WARN_ON(srp->done != 0))
9096                 return;
9097 -       }
9098 +
9099         sfp = srp->parentfp;
9100 -       if (sfp)
9101 -               sdp = sfp->parentdp;
9102 -       if ((NULL == sdp) || sdp->detached) {
9103 -               printk(KERN_INFO "sg_cmd_done: device detached\n");
9104 +       if (WARN_ON(sfp == NULL))
9105                 return;
9106 -       }
9107 +
9108 +       sdp = sfp->parentdp;
9109 +       if (unlikely(sdp->detached))
9110 +               printk(KERN_INFO "sg_rq_end_io: device detached\n");
9111
9112         sense = rq->sense;
9113         result = rq->errors;
9114 @@ -1303,33 +1306,25 @@
9115         }
9116         /* Rely on write phase to clean out srp status values, so no "else" */
9117
9118 -       if (sfp->closed) {      /* whoops this fd already released, cleanup */
9119 -               SCSI_LOG_TIMEOUT(1, printk("sg_cmd_done: already closed, freeing ...\n"));
9120 -               sg_finish_rem_req(srp);
9121 -               srp = NULL;
9122 -               if (NULL == sfp->headrp) {
9123 -                       SCSI_LOG_TIMEOUT(1, printk("sg_cmd_done: already closed, final cleanup\n"));
9124 -                       if (0 == sg_remove_sfp(sdp, sfp)) {     /* device still present */
9125 -                               scsi_device_put(sdp->device);
9126 -                       }
9127 -                       sfp = NULL;
9128 -               }
9129 -       } else if (srp && srp->orphan) {
9130 +       write_lock_irqsave(&sfp->rq_list_lock, iflags);
9131 +       if (unlikely(srp->orphan)) {
9132                 if (sfp->keep_orphan)
9133                         srp->sg_io_owned = 0;
9134 -               else {
9135 -                       sg_finish_rem_req(srp);
9136 -                       srp = NULL;
9137 -               }
9138 +               else
9139 +                       done = 0;
9140         }
9141 -       if (sfp && srp) {
9142 -               /* Now wake up any sg_read() that is waiting for this packet. */
9143 -               kill_fasync(&sfp->async_qp, SIGPOLL, POLL_IN);
9144 -               write_lock_irqsave(&sfp->rq_list_lock, iflags);
9145 -               srp->done = 1;
9146 +       srp->done = done;
9147 +       write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
9148 +
9149 +       if (likely(done)) {
9150 +               /* Now wake up any sg_read() that is waiting for this
9151 +                * packet.
9152 +                */
9153                 wake_up_interruptible(&sfp->read_wait);
9154 -               write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
9155 -       }
9156 +               kill_fasync(&sfp->async_qp, SIGPOLL, POLL_IN);
9157 +               kref_put(&sfp->f_ref, sg_remove_sfp);
9158 +       } else
9159 +               execute_in_process_context(sg_rq_end_io_usercontext, &srp->ew);
9160  }
9161
9162  static struct file_operations sg_fops = {
9163 @@ -1364,17 +1359,18 @@
9164                 printk(KERN_WARNING "kmalloc Sg_device failure\n");
9165                 return ERR_PTR(-ENOMEM);
9166         }
9167 -       error = -ENOMEM;
9168 +
9169         if (!idr_pre_get(&sg_index_idr, GFP_KERNEL)) {
9170                 printk(KERN_WARNING "idr expansion Sg_device failure\n");
9171 +               error = -ENOMEM;
9172                 goto out;
9173         }
9174
9175         write_lock_irqsave(&sg_index_lock, iflags);
9176 -       error = idr_get_new(&sg_index_idr, sdp, &k);
9177 -       write_unlock_irqrestore(&sg_index_lock, iflags);
9178
9179 +       error = idr_get_new(&sg_index_idr, sdp, &k);
9180         if (error) {
9181 +               write_unlock_irqrestore(&sg_index_lock, iflags);
9182                 printk(KERN_WARNING "idr allocation Sg_device failure: %d\n",
9183                        error);
9184                 goto out;
9185 @@ -1391,6 +1387,9 @@
9186         init_waitqueue_head(&sdp->o_excl_wait);
9187         sdp->sg_tablesize = min(q->max_hw_segments, q->max_phys_segments);
9188         sdp->index = k;
9189 +       kref_init(&sdp->d_ref);
9190 +
9191 +       write_unlock_irqrestore(&sg_index_lock, iflags);
9192
9193         error = 0;
9194   out:
9195 @@ -1401,6 +1400,8 @@
9196         return sdp;
9197
9198   overflow:
9199 +       idr_remove(&sg_index_idr, k);
9200 +       write_unlock_irqrestore(&sg_index_lock, iflags);
9201         sdev_printk(KERN_WARNING, scsidp,
9202                     "Unable to attach sg device type=%d, minor "
9203                     "number exceeds %d\n", scsidp->type, SG_MAX_DEVS - 1);
9204 @@ -1488,49 +1489,46 @@
9205         return error;
9206  }
9207
9208 -static void
9209 -sg_remove(struct device *cl_dev, struct class_interface *cl_intf)
9210 +static void sg_device_destroy(struct kref *kref)
9211 +{
9212 +       struct sg_device *sdp = container_of(kref, struct sg_device, d_ref);
9213 +       unsigned long flags;
9214 +
9215 +       /* CAUTION!  Note that the device can still be found via idr_find()
9216 +        * even though the refcount is 0.  Therefore, do idr_remove() BEFORE
9217 +        * any other cleanup.
9218 +        */
9219 +
9220 +       write_lock_irqsave(&sg_index_lock, flags);
9221 +       idr_remove(&sg_index_idr, sdp->index);
9222 +       write_unlock_irqrestore(&sg_index_lock, flags);
9223 +
9224 +       SCSI_LOG_TIMEOUT(3,
9225 +               printk("sg_device_destroy: %s\n",
9226 +                       sdp->disk->disk_name));
9227 +
9228 +       put_disk(sdp->disk);
9229 +       kfree(sdp);
9230 +}
9231 +
9232 +static void sg_remove(struct device *cl_dev, struct class_interface *cl_intf)
9233  {
9234         struct scsi_device *scsidp = to_scsi_device(cl_dev->parent);
9235         Sg_device *sdp = dev_get_drvdata(cl_dev);
9236         unsigned long iflags;
9237         Sg_fd *sfp;
9238 -       Sg_fd *tsfp;
9239 -       Sg_request *srp;
9240 -       Sg_request *tsrp;
9241 -       int delay;
9242
9243 -       if (!sdp)
9244 +       if (!sdp || sdp->detached)
9245                 return;
9246
9247 -       delay = 0;
9248 +       SCSI_LOG_TIMEOUT(3, printk("sg_remove: %s\n", sdp->disk->disk_name));
9249 +
9250 +       /* Need a write lock to set sdp->detached. */
9251         write_lock_irqsave(&sg_index_lock, iflags);
9252 -       if (sdp->headfp) {
9253 -               sdp->detached = 1;
9254 -               for (sfp = sdp->headfp; sfp; sfp = tsfp) {
9255 -                       tsfp = sfp->nextfp;
9256 -                       for (srp = sfp->headrp; srp; srp = tsrp) {
9257 -                               tsrp = srp->nextrp;
9258 -                               if (sfp->closed || (0 == sg_srp_done(srp, sfp)))
9259 -                                       sg_finish_rem_req(srp);
9260 -                       }
9261 -                       if (sfp->closed) {
9262 -                               scsi_device_put(sdp->device);
9263 -                               __sg_remove_sfp(sdp, sfp);
9264 -                       } else {
9265 -                               delay = 1;
9266 -                               wake_up_interruptible(&sfp->read_wait);
9267 -                               kill_fasync(&sfp->async_qp, SIGPOLL,
9268 -                                           POLL_HUP);
9269 -                       }
9270 -               }
9271 -               SCSI_LOG_TIMEOUT(3, printk("sg_remove: dev=%d, dirty\n", sdp->index));
9272 -               if (NULL == sdp->headfp) {
9273 -                       idr_remove(&sg_index_idr, sdp->index);
9274 -               }
9275 -       } else {        /* nothing active, simple case */
9276 -               SCSI_LOG_TIMEOUT(3, printk("sg_remove: dev=%d\n", sdp->index));
9277 -               idr_remove(&sg_index_idr, sdp->index);
9278 +       sdp->detached = 1;
9279 +       for (sfp = sdp->headfp; sfp; sfp = sfp->nextfp) {
9280 +               wake_up_interruptible(&sfp->read_wait);
9281 +               kill_fasync(&sfp->async_qp, SIGPOLL, POLL_HUP);
9282         }
9283         write_unlock_irqrestore(&sg_index_lock, iflags);
9284
9285 @@ -1538,13 +1536,8 @@
9286         device_destroy(sg_sysfs_class, MKDEV(SCSI_GENERIC_MAJOR, sdp->index));
9287         cdev_del(sdp->cdev);
9288         sdp->cdev = NULL;
9289 -       put_disk(sdp->disk);
9290 -       sdp->disk = NULL;
9291 -       if (NULL == sdp->headfp)
9292 -               kfree(sdp);
9293
9294 -       if (delay)
9295 -               msleep(10);     /* dirty detach so delay device destruction */
9296 +       sg_put_dev(sdp);
9297  }
9298
9299  module_param_named(scatter_elem_sz, scatter_elem_sz, int, S_IRUGO | S_IWUSR);
9300 @@ -1939,22 +1932,6 @@
9301         return resp;
9302  }
9303
9304 -#ifdef CONFIG_SCSI_PROC_FS
9305 -static Sg_request *
9306 -sg_get_nth_request(Sg_fd * sfp, int nth)
9307 -{
9308 -       Sg_request *resp;
9309 -       unsigned long iflags;
9310 -       int k;
9311 -
9312 -       read_lock_irqsave(&sfp->rq_list_lock, iflags);
9313 -       for (k = 0, resp = sfp->headrp; resp && (k < nth);
9314 -            ++k, resp = resp->nextrp) ;
9315 -       read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
9316 -       return resp;
9317 -}
9318 -#endif
9319 -
9320  /* always adds to end of list */
9321  static Sg_request *
9322  sg_add_request(Sg_fd * sfp)
9323 @@ -2030,22 +2007,6 @@
9324         return res;
9325  }
9326
9327 -#ifdef CONFIG_SCSI_PROC_FS
9328 -static Sg_fd *
9329 -sg_get_nth_sfp(Sg_device * sdp, int nth)
9330 -{
9331 -       Sg_fd *resp;
9332 -       unsigned long iflags;
9333 -       int k;
9334 -
9335 -       read_lock_irqsave(&sg_index_lock, iflags);
9336 -       for (k = 0, resp = sdp->headfp; resp && (k < nth);
9337 -            ++k, resp = resp->nextfp) ;
9338 -       read_unlock_irqrestore(&sg_index_lock, iflags);
9339 -       return resp;
9340 -}
9341 -#endif
9342 -
9343  static Sg_fd *
9344  sg_add_sfp(Sg_device * sdp, int dev)
9345  {
9346 @@ -2060,6 +2021,7 @@
9347         init_waitqueue_head(&sfp->read_wait);
9348         rwlock_init(&sfp->rq_list_lock);
9349
9350 +       kref_init(&sfp->f_ref);
9351         sfp->timeout = SG_DEFAULT_TIMEOUT;
9352         sfp->timeout_user = SG_DEFAULT_TIMEOUT_USER;
9353         sfp->force_packid = SG_DEF_FORCE_PACK_ID;
9354 @@ -2087,15 +2049,54 @@
9355         sg_build_reserve(sfp, bufflen);
9356         SCSI_LOG_TIMEOUT(3, printk("sg_add_sfp:   bufflen=%d, k_use_sg=%d\n",
9357                            sfp->reserve.bufflen, sfp->reserve.k_use_sg));
9358 +
9359 +       kref_get(&sdp->d_ref);
9360 +       __module_get(THIS_MODULE);
9361         return sfp;
9362  }
9363
9364 -static void
9365 -__sg_remove_sfp(Sg_device * sdp, Sg_fd * sfp)
9366 +static void sg_remove_sfp_usercontext(struct work_struct *work)
9367  {
9368 +       struct sg_fd *sfp = container_of(work, struct sg_fd, ew.work);
9369 +       struct sg_device *sdp = sfp->parentdp;
9370 +
9371 +       /* Cleanup any responses which were never read(). */
9372 +       while (sfp->headrp)
9373 +               sg_finish_rem_req(sfp->headrp);
9374 +
9375 +       if (sfp->reserve.bufflen > 0) {
9376 +               SCSI_LOG_TIMEOUT(6,
9377 +                       printk("sg_remove_sfp:    bufflen=%d, k_use_sg=%d\n",
9378 +                               (int) sfp->reserve.bufflen,
9379 +                               (int) sfp->reserve.k_use_sg));
9380 +               sg_remove_scat(&sfp->reserve);
9381 +       }
9382 +
9383 +       SCSI_LOG_TIMEOUT(6,
9384 +               printk("sg_remove_sfp: %s, sfp=0x%p\n",
9385 +                       sdp->disk->disk_name,
9386 +                       sfp));
9387 +       kfree(sfp);
9388 +
9389 +       scsi_device_put(sdp->device);
9390 +       sg_put_dev(sdp);
9391 +       module_put(THIS_MODULE);
9392 +}
9393 +
9394 +static void sg_remove_sfp(struct kref *kref)
9395 +{
9396 +       struct sg_fd *sfp = container_of(kref, struct sg_fd, f_ref);
9397 +       struct sg_device *sdp = sfp->parentdp;
9398         Sg_fd *fp;
9399         Sg_fd *prev_fp;
9400 +       unsigned long iflags;
9401 +
9402 +       /* CAUTION!  Note that sfp can still be found by walking sdp->headfp
9403 +        * even though the refcount is now 0.  Therefore, unlink sfp from
9404 +        * sdp->headfp BEFORE doing any other cleanup.
9405 +        */
9406
9407 +       write_lock_irqsave(&sg_index_lock, iflags);
9408         prev_fp = sdp->headfp;
9409         if (sfp == prev_fp)
9410                 sdp->headfp = prev_fp->nextfp;
9411 @@ -2108,54 +2109,10 @@
9412                         prev_fp = fp;
9413                 }
9414         }
9415 -       if (sfp->reserve.bufflen > 0) {
9416 -               SCSI_LOG_TIMEOUT(6,
9417 -                       printk("__sg_remove_sfp:    bufflen=%d, k_use_sg=%d\n",
9418 -                       (int) sfp->reserve.bufflen, (int) sfp->reserve.k_use_sg));
9419 -               sg_remove_scat(&sfp->reserve);
9420 -       }
9421 -       sfp->parentdp = NULL;
9422 -       SCSI_LOG_TIMEOUT(6, printk("__sg_remove_sfp:    sfp=0x%p\n", sfp));
9423 -       kfree(sfp);
9424 -}
9425 -
9426 -/* Returns 0 in normal case, 1 when detached and sdp object removed */
9427 -static int
9428 -sg_remove_sfp(Sg_device * sdp, Sg_fd * sfp)
9429 -{
9430 -       Sg_request *srp;
9431 -       Sg_request *tsrp;
9432 -       int dirty = 0;
9433 -       int res = 0;
9434 -
9435 -       for (srp = sfp->headrp; srp; srp = tsrp) {
9436 -               tsrp = srp->nextrp;
9437 -               if (sg_srp_done(srp, sfp))
9438 -                       sg_finish_rem_req(srp);
9439 -               else
9440 -                       ++dirty;
9441 -       }
9442 -       if (0 == dirty) {
9443 -               unsigned long iflags;
9444 +       write_unlock_irqrestore(&sg_index_lock, iflags);
9445 +       wake_up_interruptible(&sdp->o_excl_wait);
9446
9447 -               write_lock_irqsave(&sg_index_lock, iflags);
9448 -               __sg_remove_sfp(sdp, sfp);
9449 -               if (sdp->detached && (NULL == sdp->headfp)) {
9450 -                       idr_remove(&sg_index_idr, sdp->index);
9451 -                       kfree(sdp);
9452 -                       res = 1;
9453 -               }
9454 -               write_unlock_irqrestore(&sg_index_lock, iflags);
9455 -       } else {
9456 -               /* MOD_INC's to inhibit unloading sg and associated adapter driver */
9457 -               /* only bump the access_count if we actually succeeded in
9458 -                * throwing another counter on the host module */
9459 -               scsi_device_get(sdp->device);   /* XXX: retval ignored? */
9460 -               sfp->closed = 1;        /* flag dirty state on this fd */
9461 -               SCSI_LOG_TIMEOUT(1, printk("sg_remove_sfp: worrisome, %d writes pending\n",
9462 -                                 dirty));
9463 -       }
9464 -       return res;
9465 +       execute_in_process_context(sg_remove_sfp_usercontext, &sfp->ew);
9466  }
9467
9468  static int
9469 @@ -2197,19 +2154,38 @@
9470  }
9471  #endif
9472
9473 -static Sg_device *
9474 -sg_get_dev(int dev)
9475 +/* must be called with sg_index_lock held */
9476 +static Sg_device *sg_lookup_dev(int dev)
9477  {
9478 -       Sg_device *sdp;
9479 -       unsigned long iflags;
9480 +       return idr_find(&sg_index_idr, dev);
9481 +}
9482
9483 -       read_lock_irqsave(&sg_index_lock, iflags);
9484 -       sdp = idr_find(&sg_index_idr, dev);
9485 -       read_unlock_irqrestore(&sg_index_lock, iflags);
9486 +static Sg_device *sg_get_dev(int dev)
9487 +{
9488 +       struct sg_device *sdp;
9489 +       unsigned long flags;
9490 +
9491 +       read_lock_irqsave(&sg_index_lock, flags);
9492 +       sdp = sg_lookup_dev(dev);
9493 +       if (!sdp)
9494 +               sdp = ERR_PTR(-ENXIO);
9495 +       else if (sdp->detached) {
9496 +               /* If sdp->detached, then the refcount may already be 0, in
9497 +                * which case it would be a bug to do kref_get().
9498 +                */
9499 +               sdp = ERR_PTR(-ENODEV);
9500 +       } else
9501 +               kref_get(&sdp->d_ref);
9502 +       read_unlock_irqrestore(&sg_index_lock, flags);
9503
9504         return sdp;
9505  }
9506
9507 +static void sg_put_dev(struct sg_device *sdp)
9508 +{
9509 +       kref_put(&sdp->d_ref, sg_device_destroy);
9510 +}
9511 +
9512  #ifdef CONFIG_SCSI_PROC_FS
9513
9514  static struct proc_dir_entry *sg_proc_sgp = NULL;
9515 @@ -2466,8 +2442,10 @@
9516         struct sg_proc_deviter * it = (struct sg_proc_deviter *) v;
9517         Sg_device *sdp;
9518         struct scsi_device *scsidp;
9519 +       unsigned long iflags;
9520
9521 -       sdp = it ? sg_get_dev(it->index) : NULL;
9522 +       read_lock_irqsave(&sg_index_lock, iflags);
9523 +       sdp = it ? sg_lookup_dev(it->index) : NULL;
9524         if (sdp && (scsidp = sdp->device) && (!sdp->detached))
9525                 seq_printf(s, "%d\t%d\t%d\t%d\t%d\t%d\t%d\t%d\t%d\n",
9526                               scsidp->host->host_no, scsidp->channel,
9527 @@ -2478,6 +2456,7 @@
9528                               (int) scsi_device_online(scsidp));
9529         else
9530                 seq_printf(s, "-1\t-1\t-1\t-1\t-1\t-1\t-1\t-1\t-1\n");
9531 +       read_unlock_irqrestore(&sg_index_lock, iflags);
9532         return 0;
9533  }
9534
9535 @@ -2491,16 +2470,20 @@
9536         struct sg_proc_deviter * it = (struct sg_proc_deviter *) v;
9537         Sg_device *sdp;
9538         struct scsi_device *scsidp;
9539 +       unsigned long iflags;
9540
9541 -       sdp = it ? sg_get_dev(it->index) : NULL;
9542 +       read_lock_irqsave(&sg_index_lock, iflags);
9543 +       sdp = it ? sg_lookup_dev(it->index) : NULL;
9544         if (sdp && (scsidp = sdp->device) && (!sdp->detached))
9545                 seq_printf(s, "%8.8s\t%16.16s\t%4.4s\n",
9546                            scsidp->vendor, scsidp->model, scsidp->rev);
9547         else
9548                 seq_printf(s, "<no active device>\n");
9549 +       read_unlock_irqrestore(&sg_index_lock, iflags);
9550         return 0;
9551  }
9552
9553 +/* must be called while holding sg_index_lock */
9554  static void sg_proc_debug_helper(struct seq_file *s, Sg_device * sdp)
9555  {
9556         int k, m, new_interface, blen, usg;
9557 @@ -2510,7 +2493,8 @@
9558         const char * cp;
9559         unsigned int ms;
9560
9561 -       for (k = 0; (fp = sg_get_nth_sfp(sdp, k)); ++k) {
9562 +       for (k = 0, fp = sdp->headfp; fp != NULL; ++k, fp = fp->nextfp) {
9563 +               read_lock(&fp->rq_list_lock); /* irqs already disabled */
9564                 seq_printf(s, "   FD(%d): timeout=%dms bufflen=%d "
9565                            "(res)sgat=%d low_dma=%d\n", k + 1,
9566                            jiffies_to_msecs(fp->timeout),
9567 @@ -2520,7 +2504,9 @@
9568                 seq_printf(s, "   cmd_q=%d f_packid=%d k_orphan=%d closed=%d\n",
9569                            (int) fp->cmd_q, (int) fp->force_packid,
9570                            (int) fp->keep_orphan, (int) fp->closed);
9571 -               for (m = 0; (srp = sg_get_nth_request(fp, m)); ++m) {
9572 +               for (m = 0, srp = fp->headrp;
9573 +                               srp != NULL;
9574 +                               ++m, srp = srp->nextrp) {
9575                         hp = &srp->header;
9576                         new_interface = (hp->interface_id == '\0') ? 0 : 1;
9577                         if (srp->res_used) {
9578 @@ -2557,6 +2543,7 @@
9579                 }
9580                 if (0 == m)
9581                         seq_printf(s, "     No requests active\n");
9582 +               read_unlock(&fp->rq_list_lock);
9583         }
9584  }
9585
9586 @@ -2569,39 +2556,34 @@
9587  {
9588         struct sg_proc_deviter * it = (struct sg_proc_deviter *) v;
9589         Sg_device *sdp;
9590 +       unsigned long iflags;
9591
9592         if (it && (0 == it->index)) {
9593                 seq_printf(s, "max_active_device=%d(origin 1)\n",
9594                            (int)it->max);
9595                 seq_printf(s, " def_reserved_size=%d\n", sg_big_buff);
9596         }
9597 -       sdp = it ? sg_get_dev(it->index) : NULL;
9598 -       if (sdp) {
9599 -               struct scsi_device *scsidp = sdp->device;
9600
9601 -               if (NULL == scsidp) {
9602 -                       seq_printf(s, "device %d detached ??\n",
9603 -                                  (int)it->index);
9604 -                       return 0;
9605 -               }
9606 +       read_lock_irqsave(&sg_index_lock, iflags);
9607 +       sdp = it ? sg_lookup_dev(it->index) : NULL;
9608 +       if (sdp && sdp->headfp) {
9609 +               struct scsi_device *scsidp = sdp->device;
9610
9611 -               if (sg_get_nth_sfp(sdp, 0)) {
9612 -                       seq_printf(s, " >>> device=%s ",
9613 -                               sdp->disk->disk_name);
9614 -                       if (sdp->detached)
9615 -                               seq_printf(s, "detached pending close ");
9616 -                       else
9617 -                               seq_printf
9618 -                                   (s, "scsi%d chan=%d id=%d lun=%d   em=%d",
9619 -                                    scsidp->host->host_no,
9620 -                                    scsidp->channel, scsidp->id,
9621 -                                    scsidp->lun,
9622 -                                    scsidp->host->hostt->emulated);
9623 -                       seq_printf(s, " sg_tablesize=%d excl=%d\n",
9624 -                                  sdp->sg_tablesize, sdp->exclude);
9625 -               }
9626 +               seq_printf(s, " >>> device=%s ", sdp->disk->disk_name);
9627 +               if (sdp->detached)
9628 +                       seq_printf(s, "detached pending close ");
9629 +               else
9630 +                       seq_printf
9631 +                           (s, "scsi%d chan=%d id=%d lun=%d   em=%d",
9632 +                            scsidp->host->host_no,
9633 +                            scsidp->channel, scsidp->id,
9634 +                            scsidp->lun,
9635 +                            scsidp->host->hostt->emulated);
9636 +               seq_printf(s, " sg_tablesize=%d excl=%d\n",
9637 +                          sdp->sg_tablesize, sdp->exclude);
9638                 sg_proc_debug_helper(s, sdp);
9639         }
9640 +       read_unlock_irqrestore(&sg_index_lock, iflags);
9641         return 0;
9642  }
9643
9644 --- kernel-power-2.6.28.orig/drivers/serial/8250.c
9645 +++ kernel-power-2.6.28/drivers/serial/8250.c
9646 @@ -2028,6 +2028,20 @@
9647
9648         serial8250_set_mctrl(&up->port, up->port.mctrl);
9649
9650 +       /* Serial over Lan (SoL) hack:
9651 +          Intel 8257x Gigabit ethernet chips have a
9652 +          16550 emulation, to be used for Serial Over Lan.
9653 +          Those chips take a longer time than a normal
9654 +          serial device to signalize that a transmission
9655 +          data was queued. Due to that, the above test generally
9656 +          fails. One solution would be to delay the reading of
9657 +          iir. However, this is not reliable, since the timeout
9658 +          is variable. So, let's just don't test if we receive
9659 +          TX irq. This way, we'll never enable UART_BUG_TXEN.
9660 +        */
9661 +       if (up->port.flags & UPF_NO_TXEN_TEST)
9662 +               goto dont_test_tx_en;
9663 +
9664         /*
9665          * Do a quick test to see if we receive an
9666          * interrupt when we enable the TX irq.
9667 @@ -2047,6 +2061,7 @@
9668                 up->bugs &= ~UART_BUG_TXEN;
9669         }
9670
9671 +dont_test_tx_en:
9672         spin_unlock_irqrestore(&up->port.lock, flags);
9673
9674         /*
9675 --- kernel-power-2.6.28.orig/drivers/serial/8250_pci.c
9676 +++ kernel-power-2.6.28/drivers/serial/8250_pci.c
9677 @@ -758,6 +758,21 @@
9678         return setup_port(priv, port, bar, offset, board->reg_shift);
9679  }
9680
9681 +static int skip_tx_en_setup(struct serial_private *priv,
9682 +                       const struct pciserial_board *board,
9683 +                       struct uart_port *port, int idx)
9684 +{
9685 +       port->flags |= UPF_NO_TXEN_TEST;
9686 +       printk(KERN_DEBUG "serial8250: skipping TxEn test for device "
9687 +                         "[%04x:%04x] subsystem [%04x:%04x]\n",
9688 +                         priv->dev->vendor,
9689 +                         priv->dev->device,
9690 +                         priv->dev->subsystem_vendor,
9691 +                         priv->dev->subsystem_device);
9692 +
9693 +       return pci_default_setup(priv, board, port, idx);
9694 +}
9695 +
9696  /* This should be in linux/pci_ids.h */
9697  #define PCI_VENDOR_ID_SBSMODULARIO     0x124B
9698  #define PCI_SUBVENDOR_ID_SBSMODULARIO  0x124B
9699 @@ -766,6 +781,8 @@
9700  #define PCI_SUBDEVICE_ID_OCTPRO422     0x0208
9701  #define PCI_SUBDEVICE_ID_POCTAL232     0x0308
9702  #define PCI_SUBDEVICE_ID_POCTAL422     0x0408
9703 +#define PCI_VENDOR_ID_ADVANTECH                0x13fe
9704 +#define PCI_DEVICE_ID_ADVANTECH_PCI3620        0x3620
9705
9706  /* Unknown vendors/cards - this should not be in linux/pci_ids.h */
9707  #define PCI_SUBDEVICE_ID_UNKNOWN_0x1584        0x1584
9708 @@ -822,6 +839,27 @@
9709                 .init           = pci_inteli960ni_init,
9710                 .setup          = pci_default_setup,
9711         },
9712 +       {
9713 +               .vendor         = PCI_VENDOR_ID_INTEL,
9714 +               .device         = PCI_DEVICE_ID_INTEL_8257X_SOL,
9715 +               .subvendor      = PCI_ANY_ID,
9716 +               .subdevice      = PCI_ANY_ID,
9717 +               .setup          = skip_tx_en_setup,
9718 +       },
9719 +       {
9720 +               .vendor         = PCI_VENDOR_ID_INTEL,
9721 +               .device         = PCI_DEVICE_ID_INTEL_82573L_SOL,
9722 +               .subvendor      = PCI_ANY_ID,
9723 +               .subdevice      = PCI_ANY_ID,
9724 +               .setup          = skip_tx_en_setup,
9725 +       },
9726 +       {
9727 +               .vendor         = PCI_VENDOR_ID_INTEL,
9728 +               .device         = PCI_DEVICE_ID_INTEL_82573E_SOL,
9729 +               .subvendor      = PCI_ANY_ID,
9730 +               .subdevice      = PCI_ANY_ID,
9731 +               .setup          = skip_tx_en_setup,
9732 +       },
9733         /*
9734          * ITE
9735          */
9736 @@ -2132,6 +2170,10 @@
9737  #endif
9738
9739  static struct pci_device_id serial_pci_tbl[] = {
9740 +       /* Advantech use PCI_DEVICE_ID_ADVANTECH_PCI3620 (0x3620) as 'PCI_SUBVENDOR_ID' */
9741 +       {       PCI_VENDOR_ID_ADVANTECH, PCI_DEVICE_ID_ADVANTECH_PCI3620,
9742 +               PCI_DEVICE_ID_ADVANTECH_PCI3620, 0x0001, 0, 0,
9743 +               pbn_b2_8_921600 },
9744         {       PCI_VENDOR_ID_V3, PCI_DEVICE_ID_V3_V960,
9745                 PCI_SUBVENDOR_ID_CONNECT_TECH,
9746                 PCI_SUBDEVICE_ID_CONNECT_TECH_BH8_232, 0, 0,
9747 @@ -2271,6 +2313,9 @@
9748         {       PCI_VENDOR_ID_SEALEVEL, PCI_DEVICE_ID_SEALEVEL_COMM8,
9749                 PCI_ANY_ID, PCI_ANY_ID, 0, 0,
9750                 pbn_b2_8_115200 },
9751 +       {       PCI_VENDOR_ID_SEALEVEL, PCI_DEVICE_ID_SEALEVEL_7803,
9752 +               PCI_ANY_ID, PCI_ANY_ID, 0, 0,
9753 +               pbn_b2_8_460800 },
9754         {       PCI_VENDOR_ID_SEALEVEL, PCI_DEVICE_ID_SEALEVEL_UCOMM8,
9755                 PCI_ANY_ID, PCI_ANY_ID, 0, 0,
9756                 pbn_b2_8_115200 },
9757 @@ -2372,6 +2417,9 @@
9758                  * For now just used the hex ID 0x950a.
9759                  */
9760         {       PCI_VENDOR_ID_OXSEMI, 0x950a,
9761 +               PCI_SUBVENDOR_ID_SIIG, PCI_SUBDEVICE_ID_SIIG_DUAL_SERIAL, 0, 0,
9762 +               pbn_b0_2_115200 },
9763 +       {       PCI_VENDOR_ID_OXSEMI, 0x950a,
9764                 PCI_ANY_ID, PCI_ANY_ID, 0, 0,
9765                 pbn_b0_2_1130000 },
9766         {       PCI_VENDOR_ID_OXSEMI, PCI_DEVICE_ID_OXSEMI_16PCI954,
9767 --- kernel-power-2.6.28.orig/drivers/serial/jsm/jsm_driver.c
9768 +++ kernel-power-2.6.28/drivers/serial/jsm/jsm_driver.c
9769 @@ -84,6 +84,8 @@
9770         brd->pci_dev = pdev;
9771         if (pdev->device == PCIE_DEVICE_ID_NEO_4_IBM)
9772                 brd->maxports = 4;
9773 +       else if (pdev->device == PCI_DEVICE_ID_DIGI_NEO_8)
9774 +               brd->maxports = 8;
9775         else
9776                 brd->maxports = 2;
9777
9778 @@ -212,6 +214,7 @@
9779         { PCI_DEVICE(PCI_VENDOR_ID_DIGI, PCI_DEVICE_ID_NEO_2RJ45), 0, 0, 2 },
9780         { PCI_DEVICE(PCI_VENDOR_ID_DIGI, PCI_DEVICE_ID_NEO_2RJ45PRI), 0, 0, 3 },
9781         { PCI_DEVICE(PCI_VENDOR_ID_DIGI, PCIE_DEVICE_ID_NEO_4_IBM), 0, 0, 4 },
9782 +       { PCI_DEVICE(PCI_VENDOR_ID_DIGI, PCI_DEVICE_ID_DIGI_NEO_8), 0, 0, 5 },
9783         { 0, }
9784  };
9785  MODULE_DEVICE_TABLE(pci, jsm_pci_tbl);
9786 --- kernel-power-2.6.28.orig/drivers/serial/jsm/jsm_tty.c
9787 +++ kernel-power-2.6.28/drivers/serial/jsm/jsm_tty.c
9788 @@ -161,6 +161,11 @@
9789         channel->ch_bd->bd_ops->disable_receiver(channel);
9790  }
9791
9792 +static void jsm_tty_enable_ms(struct uart_port *port)
9793 +{
9794 +       /* Nothing needed */
9795 +}
9796 +
9797  static void jsm_tty_break(struct uart_port *port, int break_state)
9798  {
9799         unsigned long lock_flags;
9800 @@ -345,6 +350,7 @@
9801         .start_tx       = jsm_tty_start_tx,
9802         .send_xchar     = jsm_tty_send_xchar,
9803         .stop_rx        = jsm_tty_stop_rx,
9804 +       .enable_ms      = jsm_tty_enable_ms,
9805         .break_ctl      = jsm_tty_break,
9806         .startup        = jsm_tty_open,
9807         .shutdown       = jsm_tty_close,
9808 --- kernel-power-2.6.28.orig/drivers/spi/spi.c
9809 +++ kernel-power-2.6.28/drivers/spi/spi.c
9810 @@ -660,7 +660,7 @@
9811
9812         int                     status;
9813         struct spi_message      message;
9814 -       struct spi_transfer     x;
9815 +       struct spi_transfer     x[2];
9816         u8                      *local_buf;
9817
9818         /* Use preallocated DMA-safe buffer.  We can't avoid copying here,
9819 @@ -671,9 +671,15 @@
9820                 return -EINVAL;
9821
9822         spi_message_init(&message);
9823 -       memset(&x, 0, sizeof x);
9824 -       x.len = n_tx + n_rx;
9825 -       spi_message_add_tail(&x, &message);
9826 +       memset(x, 0, sizeof x);
9827 +       if (n_tx) {
9828 +               x[0].len = n_tx;
9829 +               spi_message_add_tail(&x[0], &message);
9830 +       }
9831 +       if (n_rx) {
9832 +               x[1].len = n_rx;
9833 +               spi_message_add_tail(&x[1], &message);
9834 +       }
9835
9836         /* ... unless someone else is using the pre-allocated buffer */
9837         if (!mutex_trylock(&lock)) {
9838 @@ -684,15 +690,15 @@
9839                 local_buf = buf;
9840
9841         memcpy(local_buf, txbuf, n_tx);
9842 -       x.tx_buf = local_buf;
9843 -       x.rx_buf = local_buf;
9844 +       x[0].tx_buf = local_buf;
9845 +       x[1].rx_buf = local_buf + n_tx;
9846
9847         /* do the i/o */
9848         status = spi_sync(spi, &message);
9849         if (status == 0)
9850 -               memcpy(rxbuf, x.rx_buf + n_tx, n_rx);
9851 +               memcpy(rxbuf, x[1].rx_buf, n_rx);
9852
9853 -       if (x.tx_buf == buf)
9854 +       if (x[0].tx_buf == buf)
9855                 mutex_unlock(&lock);
9856         else
9857                 kfree(local_buf);
9858 --- kernel-power-2.6.28.orig/drivers/usb/class/cdc-acm.c
9859 +++ kernel-power-2.6.28/drivers/usb/class/cdc-acm.c
9860 @@ -1370,6 +1370,8 @@
9861         { USB_DEVICE(0x0572, 0x1321), /* Conexant USB MODEM CX93010 */
9862         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
9863         },
9864 +       { USB_DEVICE(0x22b8, 0x6425), /* Motorola MOTOMAGX phones */
9865 +       },
9866
9867         /* control interfaces with various AT-command sets */
9868         { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
9869 --- kernel-power-2.6.28.orig/drivers/usb/class/cdc-wdm.c
9870 +++ kernel-power-2.6.28/drivers/usb/class/cdc-wdm.c
9871 @@ -652,7 +652,7 @@
9872
9873         iface = &intf->altsetting[0];
9874         ep = &iface->endpoint[0].desc;
9875 -       if (!usb_endpoint_is_int_in(ep)) {
9876 +       if (!ep || !usb_endpoint_is_int_in(ep)) {
9877                 rv = -EINVAL;
9878                 goto err;
9879         }
9880 --- kernel-power-2.6.28.orig/drivers/usb/class/usbtmc.c
9881 +++ kernel-power-2.6.28/drivers/usb/class/usbtmc.c
9882 @@ -49,6 +49,7 @@
9883
9884  static struct usb_device_id usbtmc_devices[] = {
9885         { USB_INTERFACE_INFO(USB_CLASS_APP_SPEC, 3, 0), },
9886 +       { USB_INTERFACE_INFO(USB_CLASS_APP_SPEC, 3, 1), },
9887         { 0, } /* terminating entry */
9888  };
9889  MODULE_DEVICE_TABLE(usb, usbtmc_devices);
9890 @@ -105,12 +106,13 @@
9891  {
9892         struct usb_interface *intf;
9893         struct usbtmc_device_data *data;
9894 -       int retval = -ENODEV;
9895 +       int retval = 0;
9896
9897         intf = usb_find_interface(&usbtmc_driver, iminor(inode));
9898         if (!intf) {
9899                 printk(KERN_ERR KBUILD_MODNAME
9900                        ": can not find device for minor %d", iminor(inode));
9901 +               retval = -ENODEV;
9902                 goto exit;
9903         }
9904
9905 --- kernel-power-2.6.28.orig/drivers/usb/core/devio.c
9906 +++ kernel-power-2.6.28/drivers/usb/core/devio.c
9907 @@ -359,11 +359,6 @@
9908                 spin_lock_irqsave(&ps->lock, flags);
9909         }
9910         spin_unlock_irqrestore(&ps->lock, flags);
9911 -       as = async_getcompleted(ps);
9912 -       while (as) {
9913 -               free_async(as);
9914 -               as = async_getcompleted(ps);
9915 -       }
9916  }
9917
9918  static void destroy_async_on_interface(struct dev_state *ps,
9919 @@ -642,6 +637,7 @@
9920         struct dev_state *ps = file->private_data;
9921         struct usb_device *dev = ps->dev;
9922         unsigned int ifnum;
9923 +       struct async *as;
9924
9925         usb_lock_device(dev);
9926
9927 @@ -660,6 +656,12 @@
9928         usb_unlock_device(dev);
9929         usb_put_dev(dev);
9930         put_pid(ps->disc_pid);
9931 +
9932 +       as = async_getcompleted(ps);
9933 +       while (as) {
9934 +               free_async(as);
9935 +               as = async_getcompleted(ps);
9936 +       }
9937         kfree(ps);
9938         return 0;
9939  }
9940 @@ -1703,7 +1705,7 @@
9941         .release =      usbdev_release,
9942  };
9943
9944 -void usb_fs_classdev_common_remove(struct usb_device *udev)
9945 +static void usbdev_remove(struct usb_device *udev)
9946  {
9947         struct dev_state *ps;
9948         struct siginfo sinfo;
9949 @@ -1745,10 +1747,15 @@
9950  {
9951         if (dev->usb_classdev)
9952                 device_unregister(dev->usb_classdev);
9953 -       usb_fs_classdev_common_remove(dev);
9954  }
9955
9956 -static int usb_classdev_notify(struct notifier_block *self,
9957 +#else
9958 +#define usb_classdev_add(dev)          0
9959 +#define usb_classdev_remove(dev)       do {} while (0)
9960 +
9961 +#endif
9962 +
9963 +static int usbdev_notify(struct notifier_block *self,
9964                                unsigned long action, void *dev)
9965  {
9966         switch (action) {
9967 @@ -1758,15 +1765,15 @@
9968                 break;
9969         case USB_DEVICE_REMOVE:
9970                 usb_classdev_remove(dev);
9971 +               usbdev_remove(dev);
9972                 break;
9973         }
9974         return NOTIFY_OK;
9975  }
9976
9977  static struct notifier_block usbdev_nb = {
9978 -       .notifier_call =        usb_classdev_notify,
9979 +       .notifier_call =        usbdev_notify,
9980  };
9981 -#endif
9982
9983  static struct cdev usb_device_cdev;
9984
9985 @@ -1801,9 +1808,8 @@
9986          * to /sys/dev
9987          */
9988         usb_classdev_class->dev_kobj = NULL;
9989 -
9990 -       usb_register_notify(&usbdev_nb);
9991  #endif
9992 +       usb_register_notify(&usbdev_nb);
9993  out:
9994         return retval;
9995
9996 @@ -1814,8 +1820,8 @@
9997
9998  void usb_devio_cleanup(void)
9999  {
10000 -#ifdef CONFIG_USB_DEVICE_CLASS
10001         usb_unregister_notify(&usbdev_nb);
10002 +#ifdef CONFIG_USB_DEVICE_CLASS
10003         class_destroy(usb_classdev_class);
10004  #endif
10005         cdev_del(&usb_device_cdev);
10006 --- kernel-power-2.6.28.orig/drivers/usb/core/driver.c
10007 +++ kernel-power-2.6.28/drivers/usb/core/driver.c
10008 @@ -269,7 +269,7 @@
10009          * supports "soft" unbinding.
10010          */
10011         if (!driver->soft_unbind)
10012 -               usb_disable_interface(udev, intf);
10013 +               usb_disable_interface(udev, intf, false);
10014
10015         driver->disconnect(intf);
10016
10017 @@ -279,9 +279,12 @@
10018          * altsetting means creating new endpoint device entries).
10019          * When either of these happens, defer the Set-Interface.
10020          */
10021 -       if (intf->cur_altsetting->desc.bAlternateSetting == 0)
10022 -               ;       /* Already in altsetting 0 so skip Set-Interface */
10023 -       else if (!error && intf->dev.power.status == DPM_ON)
10024 +       if (intf->cur_altsetting->desc.bAlternateSetting == 0) {
10025 +               /* Already in altsetting 0 so skip Set-Interface.
10026 +                * Just re-enable it without affecting the endpoint toggles.
10027 +                */
10028 +               usb_enable_interface(udev, intf, false);
10029 +       } else if (!error && intf->dev.power.status == DPM_ON)
10030                 usb_set_interface(udev, intf->altsetting[0].
10031                                 desc.bInterfaceNumber, 0);
10032         else
10033 --- kernel-power-2.6.28.orig/drivers/usb/core/hub.c
10034 +++ kernel-power-2.6.28/drivers/usb/core/hub.c
10035 @@ -2383,9 +2383,9 @@
10036
10037  void usb_ep0_reinit(struct usb_device *udev)
10038  {
10039 -       usb_disable_endpoint(udev, 0 + USB_DIR_IN);
10040 -       usb_disable_endpoint(udev, 0 + USB_DIR_OUT);
10041 -       usb_enable_endpoint(udev, &udev->ep0);
10042 +       usb_disable_endpoint(udev, 0 + USB_DIR_IN, true);
10043 +       usb_disable_endpoint(udev, 0 + USB_DIR_OUT, true);
10044 +       usb_enable_endpoint(udev, &udev->ep0, true);
10045  }
10046  EXPORT_SYMBOL_GPL(usb_ep0_reinit);
10047
10048 --- kernel-power-2.6.28.orig/drivers/usb/core/inode.c
10049 +++ kernel-power-2.6.28/drivers/usb/core/inode.c
10050 @@ -718,7 +718,6 @@
10051                 fs_remove_file (dev->usbfs_dentry);
10052                 dev->usbfs_dentry = NULL;
10053         }
10054 -       usb_fs_classdev_common_remove(dev);
10055  }
10056
10057  static int usbfs_notify(struct notifier_block *self, unsigned long action, void *dev)
10058 --- kernel-power-2.6.28.orig/drivers/usb/core/message.c
10059 +++ kernel-power-2.6.28/drivers/usb/core/message.c
10060 @@ -651,7 +651,7 @@
10061                 if (result <= 0 && result != -ETIMEDOUT)
10062                         continue;
10063                 if (result > 1 && ((u8 *)buf)[1] != type) {
10064 -                       result = -EPROTO;
10065 +                       result = -ENODATA;
10066                         continue;
10067                 }
10068                 break;
10069 @@ -694,8 +694,13 @@
10070                         USB_REQ_GET_DESCRIPTOR, USB_DIR_IN,
10071                         (USB_DT_STRING << 8) + index, langid, buf, size,
10072                         USB_CTRL_GET_TIMEOUT);
10073 -               if (!(result == 0 || result == -EPIPE))
10074 -                       break;
10075 +               if (result == 0 || result == -EPIPE)
10076 +                       continue;
10077 +               if (result > 1 && ((u8 *) buf)[1] != USB_DT_STRING) {
10078 +                       result = -ENODATA;
10079 +                       continue;
10080 +               }
10081 +               break;
10082         }
10083         return result;
10084  }
10085 @@ -1009,14 +1014,15 @@
10086   * @dev: the device whose endpoint is being disabled
10087   * @epaddr: the endpoint's address.  Endpoint number for output,
10088   *     endpoint number + USB_DIR_IN for input
10089 + * @reset_hardware: flag to erase any endpoint state stored in the
10090 + *     controller hardware
10091   *
10092 - * Deallocates hcd/hardware state for this endpoint ... and nukes all
10093 - * pending urbs.
10094 - *
10095 - * If the HCD hasn't registered a disable() function, this sets the
10096 - * endpoint's maxpacket size to 0 to prevent further submissions.
10097 + * Disables the endpoint for URB submission and nukes all pending URBs.
10098 + * If @reset_hardware is set then also deallocates hcd/hardware state
10099 + * for the endpoint.
10100   */
10101 -void usb_disable_endpoint(struct usb_device *dev, unsigned int epaddr)
10102 +void usb_disable_endpoint(struct usb_device *dev, unsigned int epaddr,
10103 +               bool reset_hardware)
10104  {
10105         unsigned int epnum = epaddr & USB_ENDPOINT_NUMBER_MASK;
10106         struct usb_host_endpoint *ep;
10107 @@ -1026,15 +1032,18 @@
10108
10109         if (usb_endpoint_out(epaddr)) {
10110                 ep = dev->ep_out[epnum];
10111 -               dev->ep_out[epnum] = NULL;
10112 +               if (reset_hardware)
10113 +                       dev->ep_out[epnum] = NULL;
10114         } else {
10115                 ep = dev->ep_in[epnum];
10116 -               dev->ep_in[epnum] = NULL;
10117 +               if (reset_hardware)
10118 +                       dev->ep_in[epnum] = NULL;
10119         }
10120         if (ep) {
10121                 ep->enabled = 0;
10122                 usb_hcd_flush_endpoint(dev, ep);
10123 -               usb_hcd_disable_endpoint(dev, ep);
10124 +               if (reset_hardware)
10125 +                       usb_hcd_disable_endpoint(dev, ep);
10126         }
10127  }
10128
10129 @@ -1042,17 +1051,21 @@
10130   * usb_disable_interface -- Disable all endpoints for an interface
10131   * @dev: the device whose interface is being disabled
10132   * @intf: pointer to the interface descriptor
10133 + * @reset_hardware: flag to erase any endpoint state stored in the
10134 + *     controller hardware
10135   *
10136   * Disables all the endpoints for the interface's current altsetting.
10137   */
10138 -void usb_disable_interface(struct usb_device *dev, struct usb_interface *intf)
10139 +void usb_disable_interface(struct usb_device *dev, struct usb_interface *intf,
10140 +               bool reset_hardware)
10141  {
10142         struct usb_host_interface *alt = intf->cur_altsetting;
10143         int i;
10144
10145         for (i = 0; i < alt->desc.bNumEndpoints; ++i) {
10146                 usb_disable_endpoint(dev,
10147 -                               alt->endpoint[i].desc.bEndpointAddress);
10148 +                               alt->endpoint[i].desc.bEndpointAddress,
10149 +                               reset_hardware);
10150         }
10151  }
10152
10153 @@ -1073,8 +1086,8 @@
10154         dev_dbg(&dev->dev, "%s nuking %s URBs\n", __func__,
10155                 skip_ep0 ? "non-ep0" : "all");
10156         for (i = skip_ep0; i < 16; ++i) {
10157 -               usb_disable_endpoint(dev, i);
10158 -               usb_disable_endpoint(dev, i + USB_DIR_IN);
10159 +               usb_disable_endpoint(dev, i, true);
10160 +               usb_disable_endpoint(dev, i + USB_DIR_IN, true);
10161         }
10162         dev->toggle[0] = dev->toggle[1] = 0;
10163
10164 @@ -1113,22 +1126,26 @@
10165   * usb_enable_endpoint - Enable an endpoint for USB communications
10166   * @dev: the device whose interface is being enabled
10167   * @ep: the endpoint
10168 + * @reset_toggle: flag to set the endpoint's toggle back to 0
10169   *
10170 - * Resets the endpoint toggle, and sets dev->ep_{in,out} pointers.
10171 + * Resets the endpoint toggle if asked, and sets dev->ep_{in,out} pointers.
10172   * For control endpoints, both the input and output sides are handled.
10173   */
10174 -void usb_enable_endpoint(struct usb_device *dev, struct usb_host_endpoint *ep)
10175 +void usb_enable_endpoint(struct usb_device *dev, struct usb_host_endpoint *ep,
10176 +               bool reset_toggle)
10177  {
10178         int epnum = usb_endpoint_num(&ep->desc);
10179         int is_out = usb_endpoint_dir_out(&ep->desc);
10180         int is_control = usb_endpoint_xfer_control(&ep->desc);
10181
10182         if (is_out || is_control) {
10183 -               usb_settoggle(dev, epnum, 1, 0);
10184 +               if (reset_toggle)
10185 +                       usb_settoggle(dev, epnum, 1, 0);
10186                 dev->ep_out[epnum] = ep;
10187         }
10188         if (!is_out || is_control) {
10189 -               usb_settoggle(dev, epnum, 0, 0);
10190 +               if (reset_toggle)
10191 +                       usb_settoggle(dev, epnum, 0, 0);
10192                 dev->ep_in[epnum] = ep;
10193         }
10194         ep->enabled = 1;
10195 @@ -1138,17 +1155,18 @@
10196   * usb_enable_interface - Enable all the endpoints for an interface
10197   * @dev: the device whose interface is being enabled
10198   * @intf: pointer to the interface descriptor
10199 + * @reset_toggles: flag to set the endpoints' toggles back to 0
10200   *
10201   * Enables all the endpoints for the interface's current altsetting.
10202   */
10203 -static void usb_enable_interface(struct usb_device *dev,
10204 -                                struct usb_interface *intf)
10205 +void usb_enable_interface(struct usb_device *dev,
10206 +               struct usb_interface *intf, bool reset_toggles)
10207  {
10208         struct usb_host_interface *alt = intf->cur_altsetting;
10209         int i;
10210
10211         for (i = 0; i < alt->desc.bNumEndpoints; ++i)
10212 -               usb_enable_endpoint(dev, &alt->endpoint[i]);
10213 +               usb_enable_endpoint(dev, &alt->endpoint[i], reset_toggles);
10214  }
10215
10216  /**
10217 @@ -1237,7 +1255,7 @@
10218         /* prevent submissions using previous endpoint settings */
10219         if (iface->cur_altsetting != alt)
10220                 usb_remove_sysfs_intf_files(iface);
10221 -       usb_disable_interface(dev, iface);
10222 +       usb_disable_interface(dev, iface, true);
10223
10224         iface->cur_altsetting = alt;
10225
10226 @@ -1271,7 +1289,7 @@
10227          * during the SETUP stage - hence EP0 toggles are "don't care" here.
10228          * (Likewise, EP0 never "halts" on well designed devices.)
10229          */
10230 -       usb_enable_interface(dev, iface);
10231 +       usb_enable_interface(dev, iface, true);
10232         if (device_is_registered(&iface->dev))
10233                 usb_create_sysfs_intf_files(iface);
10234
10235 @@ -1315,8 +1333,8 @@
10236          */
10237
10238         for (i = 1; i < 16; ++i) {
10239 -               usb_disable_endpoint(dev, i);
10240 -               usb_disable_endpoint(dev, i + USB_DIR_IN);
10241 +               usb_disable_endpoint(dev, i, true);
10242 +               usb_disable_endpoint(dev, i + USB_DIR_IN, true);
10243         }
10244
10245         config = dev->actconfig;
10246 @@ -1346,7 +1364,7 @@
10247                         alt = &intf->altsetting[0];
10248
10249                 intf->cur_altsetting = alt;
10250 -               usb_enable_interface(dev, intf);
10251 +               usb_enable_interface(dev, intf, true);
10252                 if (device_is_registered(&intf->dev))
10253                         usb_create_sysfs_intf_files(intf);
10254         }
10255 @@ -1604,7 +1622,7 @@
10256                         alt = &intf->altsetting[0];
10257
10258                 intf->cur_altsetting = alt;
10259 -               usb_enable_interface(dev, intf);
10260 +               usb_enable_interface(dev, intf, true);
10261                 intf->dev.parent = &dev->dev;
10262                 intf->dev.driver = NULL;
10263                 intf->dev.bus = &usb_bus_type;
10264 @@ -1619,7 +1637,8 @@
10265         }
10266         kfree(new_interfaces);
10267
10268 -       if (cp->string == NULL)
10269 +       if (cp->string == NULL &&
10270 +                       !(dev->quirks & USB_QUIRK_CONFIG_INTF_STRINGS))
10271                 cp->string = usb_cache_string(dev, cp->desc.iConfiguration);
10272
10273         /* Now that all the interfaces are set up, register them
10274 --- kernel-power-2.6.28.orig/drivers/usb/core/quirks.c
10275 +++ kernel-power-2.6.28/drivers/usb/core/quirks.c
10276 @@ -54,6 +54,10 @@
10277         { USB_DEVICE(0x0638, 0x0a13), .driver_info =
10278           USB_QUIRK_STRING_FETCH_255 },
10279
10280 +       /* Saitek Cyborg Gold Joystick */
10281 +       { USB_DEVICE(0x06a3, 0x0006), .driver_info =
10282 +                       USB_QUIRK_CONFIG_INTF_STRINGS },
10283 +
10284         /* M-Systems Flash Disk Pioneers */
10285         { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
10286
10287 --- kernel-power-2.6.28.orig/drivers/usb/core/sysfs.c
10288 +++ kernel-power-2.6.28/drivers/usb/core/sysfs.c
10289 @@ -13,6 +13,7 @@
10290  #include <linux/kernel.h>
10291  #include <linux/string.h>
10292  #include <linux/usb.h>
10293 +#include <linux/usb/quirks.h>
10294  #include "usb.h"
10295
10296  /* Active configuration fields */
10297 @@ -847,7 +848,8 @@
10298          * and missing in others.  Hence its attribute cannot be created
10299          * before the uevent is broadcast.
10300          */
10301 -       if (alt->string == NULL)
10302 +       if (alt->string == NULL &&
10303 +                       !(udev->quirks & USB_QUIRK_CONFIG_INTF_STRINGS))
10304                 alt->string = usb_cache_string(udev, alt->desc.iInterface);
10305         if (alt->string)
10306                 retval = device_create_file(&intf->dev, &dev_attr_interface);
10307 --- kernel-power-2.6.28.orig/drivers/usb/core/usb.c
10308 +++ kernel-power-2.6.28/drivers/usb/core/usb.c
10309 @@ -362,7 +362,7 @@
10310         dev->ep0.desc.bLength = USB_DT_ENDPOINT_SIZE;
10311         dev->ep0.desc.bDescriptorType = USB_DT_ENDPOINT;
10312         /* ep0 maxpacket comes later, from device descriptor */
10313 -       usb_enable_endpoint(dev, &dev->ep0);
10314 +       usb_enable_endpoint(dev, &dev->ep0, true);
10315         dev->can_submit = 1;
10316
10317         /* Save readable and stable topology id, distinguishing devices
10318 --- kernel-power-2.6.28.orig/drivers/usb/core/usb.h
10319 +++ kernel-power-2.6.28/drivers/usb/core/usb.h
10320 @@ -10,10 +10,13 @@
10321  extern void usb_remove_ep_files(struct usb_host_endpoint *endpoint);
10322
10323  extern void usb_enable_endpoint(struct usb_device *dev,
10324 -               struct usb_host_endpoint *ep);
10325 -extern void usb_disable_endpoint(struct usb_device *dev, unsigned int epaddr);
10326 +               struct usb_host_endpoint *ep, bool reset_toggle);
10327 +extern void usb_enable_interface(struct usb_device *dev,
10328 +               struct usb_interface *intf, bool reset_toggles);
10329 +extern void usb_disable_endpoint(struct usb_device *dev, unsigned int epaddr,
10330 +               bool reset_hardware);
10331  extern void usb_disable_interface(struct usb_device *dev,
10332 -               struct usb_interface *intf);
10333 +               struct usb_interface *intf, bool reset_hardware);
10334  extern void usb_release_interface_cache(struct kref *ref);
10335  extern void usb_disable_device(struct usb_device *dev, int skip_ep0);
10336  extern int usb_deauthorize_device(struct usb_device *);
10337 @@ -145,7 +148,6 @@
10338  extern const struct file_operations usbfs_devices_fops;
10339  extern const struct file_operations usbdev_file_operations;
10340  extern void usbfs_conn_disc_event(void);
10341 -extern void usb_fs_classdev_common_remove(struct usb_device *udev);
10342
10343  extern int usb_devio_init(void);
10344  extern void usb_devio_cleanup(void);
10345 --- kernel-power-2.6.28.orig/drivers/usb/gadget/f_rndis.c
10346 +++ kernel-power-2.6.28/drivers/usb/gadget/f_rndis.c
10347 @@ -437,7 +437,7 @@
10348                 DBG(cdev, "rndis req%02x.%02x v%04x i%04x l%d\n",
10349                         ctrl->bRequestType, ctrl->bRequest,
10350                         w_value, w_index, w_length);
10351 -               req->zero = 0;
10352 +               req->zero = (value < w_length);
10353                 req->length = value;
10354                 value = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC);
10355                 if (value < 0)
10356 --- kernel-power-2.6.28.orig/drivers/usb/gadget/u_ether.c
10357 +++ kernel-power-2.6.28/drivers/usb/gadget/u_ether.c
10358 @@ -174,12 +174,6 @@
10359         strlcpy(p->bus_info, dev_name(&dev->gadget->dev), sizeof p->bus_info);
10360  }
10361
10362 -static u32 eth_get_link(struct net_device *net)
10363 -{
10364 -       struct eth_dev  *dev = netdev_priv(net);
10365 -       return dev->gadget->speed != USB_SPEED_UNKNOWN;
10366 -}
10367 -
10368  /* REVISIT can also support:
10369   *   - WOL (by tracking suspends and issuing remote wakeup)
10370   *   - msglevel (implies updated messaging)
10371 @@ -188,7 +182,7 @@
10372
10373  static struct ethtool_ops ops = {
10374         .get_drvinfo = eth_get_drvinfo,
10375 -       .get_link = eth_get_link
10376 +       .get_link = ethtool_op_get_link,
10377  };
10378
10379  static void defer_kevent(struct eth_dev *dev, int flag)
10380 --- kernel-power-2.6.28.orig/drivers/usb/host/ehci-hcd.c
10381 +++ kernel-power-2.6.28/drivers/usb/host/ehci-hcd.c
10382 @@ -485,6 +485,7 @@
10383          * periodic_size can shrink by USBCMD update if hcc_params allows.
10384          */
10385         ehci->periodic_size = DEFAULT_I_TDPS;
10386 +       INIT_LIST_HEAD(&ehci->cached_itd_list);
10387         if ((retval = ehci_mem_init(ehci, GFP_KERNEL)) < 0)
10388                 return retval;
10389
10390 @@ -497,6 +498,7 @@
10391
10392         ehci->reclaim = NULL;
10393         ehci->next_uframe = -1;
10394 +       ehci->clock_frame = -1;
10395
10396         /*
10397          * dedicate a qh for the async ring head, since we couldn't unlink
10398 --- kernel-power-2.6.28.orig/drivers/usb/host/ehci-mem.c
10399 +++ kernel-power-2.6.28/drivers/usb/host/ehci-mem.c
10400 @@ -128,6 +128,7 @@
10401
10402  static void ehci_mem_cleanup (struct ehci_hcd *ehci)
10403  {
10404 +       free_cached_itd_list(ehci);
10405         if (ehci->async)
10406                 qh_put (ehci->async);
10407         ehci->async = NULL;
10408 --- kernel-power-2.6.28.orig/drivers/usb/host/ehci-q.c
10409 +++ kernel-power-2.6.28/drivers/usb/host/ehci-q.c
10410 @@ -333,12 +333,40 @@
10411                 token = hc32_to_cpu(ehci, qtd->hw_token);
10412
10413                 /* always clean up qtds the hc de-activated */
10414 + retry_xacterr:
10415                 if ((token & QTD_STS_ACTIVE) == 0) {
10416
10417                         /* on STALL, error, and short reads this urb must
10418                          * complete and all its qtds must be recycled.
10419                          */
10420                         if ((token & QTD_STS_HALT) != 0) {
10421 +
10422 +                               /* retry transaction errors until we
10423 +                                * reach the software xacterr limit
10424 +                                */
10425 +                               if ((token & QTD_STS_XACT) &&
10426 +                                               QTD_CERR(token) == 0 &&
10427 +                                               --qh->xacterrs > 0 &&
10428 +                                               !urb->unlinked) {
10429 +                                       ehci_dbg(ehci,
10430 +       "detected XactErr len %d/%d retry %d\n",
10431 +       qtd->length - QTD_LENGTH(token), qtd->length,
10432 +       QH_XACTERR_MAX - qh->xacterrs);
10433 +
10434 +                                       /* reset the token in the qtd and the
10435 +                                        * qh overlay (which still contains
10436 +                                        * the qtd) so that we pick up from
10437 +                                        * where we left off
10438 +                                        */
10439 +                                       token &= ~QTD_STS_HALT;
10440 +                                       token |= QTD_STS_ACTIVE |
10441 +                                                       (EHCI_TUNE_CERR << 10);
10442 +                                       qtd->hw_token = cpu_to_hc32(ehci,
10443 +                                                       token);
10444 +                                       wmb();
10445 +                                       qh->hw_token = cpu_to_hc32(ehci, token);
10446 +                                       goto retry_xacterr;
10447 +                               }
10448                                 stopped = 1;
10449
10450                         /* magic dummy for some short reads; qh won't advance.
10451 @@ -421,6 +449,9 @@
10452                 /* remove qtd; it's recycled after possible urb completion */
10453                 list_del (&qtd->qtd_list);
10454                 last = qtd;
10455 +
10456 +               /* reinit the xacterr counter for the next qtd */
10457 +               qh->xacterrs = QH_XACTERR_MAX;
10458         }
10459
10460         /* last urb's completion might still need calling */
10461 @@ -862,6 +893,7 @@
10462         head->qh_next.qh = qh;
10463         head->hw_next = dma;
10464
10465 +       qh->xacterrs = QH_XACTERR_MAX;
10466         qh->qh_state = QH_STATE_LINKED;
10467         /* qtd completions reported later by interrupt */
10468  }
10469 @@ -1095,7 +1127,8 @@
10470         prev->qh_next = qh->qh_next;
10471         wmb ();
10472
10473 -       if (unlikely (ehci_to_hcd(ehci)->state == HC_STATE_HALT)) {
10474 +       /* If the controller isn't running, we don't have to wait for it */
10475 +       if (unlikely(!HC_IS_RUNNING(ehci_to_hcd(ehci)->state))) {
10476                 /* if (unlikely (qh->reclaim != 0))
10477                  *      this will recurse, probably not much
10478                  */
10479 --- kernel-power-2.6.28.orig/drivers/usb/host/ehci-sched.c
10480 +++ kernel-power-2.6.28/drivers/usb/host/ehci-sched.c
10481 @@ -1004,7 +1004,8 @@
10482
10483                 is_in = (stream->bEndpointAddress & USB_DIR_IN) ? 0x10 : 0;
10484                 stream->bEndpointAddress &= 0x0f;
10485 -               stream->ep->hcpriv = NULL;
10486 +               if (stream->ep)
10487 +                       stream->ep->hcpriv = NULL;
10488
10489                 if (stream->rescheduled) {
10490                         ehci_info (ehci, "ep%d%s-iso rescheduled "
10491 @@ -1535,7 +1536,7 @@
10492                                         struct ehci_itd, itd_list);
10493                         list_move_tail (&itd->itd_list, &stream->td_list);
10494                         itd->stream = iso_stream_get (stream);
10495 -                       itd->urb = usb_get_urb (urb);
10496 +                       itd->urb = urb;
10497                         itd_init (ehci, stream, itd);
10498                 }
10499
10500 @@ -1644,7 +1645,7 @@
10501         (void) disable_periodic(ehci);
10502         ehci_to_hcd(ehci)->self.bandwidth_isoc_reqs--;
10503
10504 -       if (unlikely (list_empty (&stream->td_list))) {
10505 +       if (unlikely(list_is_singular(&stream->td_list))) {
10506                 ehci_to_hcd(ehci)->self.bandwidth_allocated
10507                                 -= stream->bandwidth;
10508                 ehci_vdbg (ehci,
10509 @@ -1653,14 +1654,27 @@
10510                         (stream->bEndpointAddress & USB_DIR_IN) ? "in" : "out");
10511         }
10512         iso_stream_put (ehci, stream);
10513 -       /* OK to recycle this ITD now that its completion callback ran. */
10514 +
10515  done:
10516 -       usb_put_urb(urb);
10517         itd->urb = NULL;
10518 -       itd->stream = NULL;
10519 -       list_move(&itd->itd_list, &stream->free_list);
10520 -       iso_stream_put(ehci, stream);
10521 -
10522 +       if (ehci->clock_frame != itd->frame || itd->index[7] != -1) {
10523 +               /* OK to recycle this ITD now. */
10524 +               itd->stream = NULL;
10525 +               list_move(&itd->itd_list, &stream->free_list);
10526 +               iso_stream_put(ehci, stream);
10527 +       } else {
10528 +               /* HW might remember this ITD, so we can't recycle it yet.
10529 +                * Move it to a safe place until a new frame starts.
10530 +                */
10531 +               list_move(&itd->itd_list, &ehci->cached_itd_list);
10532 +               if (stream->refcount == 2) {
10533 +                       /* If iso_stream_put() were called here, stream
10534 +                        * would be freed.  Instead, just prevent reuse.
10535 +                        */
10536 +                       stream->ep->hcpriv = NULL;
10537 +                       stream->ep = NULL;
10538 +               }
10539 +       }
10540         return retval;
10541  }
10542
10543 @@ -1934,7 +1948,7 @@
10544                                 struct ehci_sitd, sitd_list);
10545                 list_move_tail (&sitd->sitd_list, &stream->td_list);
10546                 sitd->stream = iso_stream_get (stream);
10547 -               sitd->urb = usb_get_urb (urb);
10548 +               sitd->urb = urb;
10549
10550                 sitd_patch(ehci, stream, sitd, sched, packet);
10551                 sitd_link (ehci, (next_uframe >> 3) % ehci->periodic_size,
10552 @@ -2019,7 +2033,7 @@
10553         (void) disable_periodic(ehci);
10554         ehci_to_hcd(ehci)->self.bandwidth_isoc_reqs--;
10555
10556 -       if (list_empty (&stream->td_list)) {
10557 +       if (list_is_singular(&stream->td_list)) {
10558                 ehci_to_hcd(ehci)->self.bandwidth_allocated
10559                                 -= stream->bandwidth;
10560                 ehci_vdbg (ehci,
10561 @@ -2030,7 +2044,6 @@
10562         iso_stream_put (ehci, stream);
10563         /* OK to recycle this SITD now that its completion callback ran. */
10564  done:
10565 -       usb_put_urb(urb);
10566         sitd->urb = NULL;
10567         sitd->stream = NULL;
10568         list_move(&sitd->sitd_list, &stream->free_list);
10569 @@ -2101,6 +2114,20 @@
10570
10571  /*-------------------------------------------------------------------------*/
10572
10573 +static void free_cached_itd_list(struct ehci_hcd *ehci)
10574 +{
10575 +       struct ehci_itd *itd, *n;
10576 +
10577 +       list_for_each_entry_safe(itd, n, &ehci->cached_itd_list, itd_list) {
10578 +               struct ehci_iso_stream  *stream = itd->stream;
10579 +               itd->stream = NULL;
10580 +               list_move(&itd->itd_list, &stream->free_list);
10581 +               iso_stream_put(ehci, stream);
10582 +       }
10583 +}
10584 +
10585 +/*-------------------------------------------------------------------------*/
10586 +
10587  static void
10588  scan_periodic (struct ehci_hcd *ehci)
10589  {
10590 @@ -2115,10 +2142,17 @@
10591          * Touches as few pages as possible:  cache-friendly.
10592          */
10593         now_uframe = ehci->next_uframe;
10594 -       if (HC_IS_RUNNING (ehci_to_hcd(ehci)->state))
10595 +       if (HC_IS_RUNNING(ehci_to_hcd(ehci)->state)) {
10596                 clock = ehci_readl(ehci, &ehci->regs->frame_index);
10597 -       else
10598 +               clock_frame = (clock >> 3) % ehci->periodic_size;
10599 +       } else  {
10600                 clock = now_uframe + mod - 1;
10601 +               clock_frame = -1;
10602 +       }
10603 +       if (ehci->clock_frame != clock_frame) {
10604 +               free_cached_itd_list(ehci);
10605 +               ehci->clock_frame = clock_frame;
10606 +       }
10607         clock %= mod;
10608         clock_frame = clock >> 3;
10609
10610 @@ -2277,6 +2311,10 @@
10611                         /* rescan the rest of this frame, then ... */
10612                         clock = now;
10613                         clock_frame = clock >> 3;
10614 +                       if (ehci->clock_frame != clock_frame) {
10615 +                               free_cached_itd_list(ehci);
10616 +                               ehci->clock_frame = clock_frame;
10617 +                       }
10618                 } else {
10619                         now_uframe++;
10620                         now_uframe %= mod;
10621 --- kernel-power-2.6.28.orig/drivers/usb/host/ehci.h
10622 +++ kernel-power-2.6.28/drivers/usb/host/ehci.h
10623 @@ -87,6 +87,10 @@
10624         int                     next_uframe;    /* scan periodic, start here */
10625         unsigned                periodic_sched; /* periodic activity count */
10626
10627 +       /* list of itds completed while clock_frame was still active */
10628 +       struct list_head        cached_itd_list;
10629 +       unsigned                clock_frame;
10630 +
10631         /* per root hub port */
10632         unsigned long           reset_done [EHCI_MAX_ROOT_PORTS];
10633
10634 @@ -210,6 +214,8 @@
10635         }
10636  }
10637
10638 +static void free_cached_itd_list(struct ehci_hcd *ehci);
10639 +
10640  /*-------------------------------------------------------------------------*/
10641
10642  #include <linux/usb/ehci_def.h>
10643 @@ -360,6 +366,9 @@
10644  #define        QH_STATE_UNLINK_WAIT    4               /* LINKED and on reclaim q */
10645  #define        QH_STATE_COMPLETING     5               /* don't touch token.HALT */
10646
10647 +       u8                      xacterrs;       /* XactErr retry counter */
10648 +#define        QH_XACTERR_MAX          32              /* XactErr retry limit */
10649 +
10650         /* periodic schedule info */
10651         u8                      usecs;          /* intr bandwidth */
10652         u8                      gap_uf;         /* uframes split/csplit gap */
10653 --- kernel-power-2.6.28.orig/drivers/usb/host/isp1760-if.c
10654 +++ kernel-power-2.6.28/drivers/usb/host/isp1760-if.c
10655 @@ -129,23 +129,23 @@
10656  #endif
10657
10658  #ifdef CONFIG_PCI
10659 -static u32 nxp_pci_io_base;
10660 -static u32 iolength;
10661 -static u32 pci_mem_phy0;
10662 -static u32 length;
10663 -static u8 __iomem *chip_addr;
10664 -static u8 __iomem *iobase;
10665 -
10666  static int __devinit isp1761_pci_probe(struct pci_dev *dev,
10667                 const struct pci_device_id *id)
10668  {
10669         u8 latency, limit;
10670         __u32 reg_data;
10671         int retry_count;
10672 -       int length;
10673 -       int status = 1;
10674         struct usb_hcd *hcd;
10675         unsigned int devflags = 0;
10676 +       int ret_status = 0;
10677 +
10678 +       resource_size_t pci_mem_phy0;
10679 +       resource_size_t memlength;
10680 +
10681 +       u8 __iomem *chip_addr;
10682 +       u8 __iomem *iobase;
10683 +       resource_size_t nxp_pci_io_base;
10684 +       resource_size_t iolength;
10685
10686         if (usb_disabled())
10687                 return -ENODEV;
10688 @@ -168,26 +168,30 @@
10689         iobase = ioremap_nocache(nxp_pci_io_base, iolength);
10690         if (!iobase) {
10691                 printk(KERN_ERR "ioremap #1\n");
10692 -               release_mem_region(nxp_pci_io_base, iolength);
10693 -               return -ENOMEM;
10694 +               ret_status = -ENOMEM;
10695 +               goto cleanup1;
10696         }
10697         /* Grab the PLX PCI shared memory of the ISP 1761 we need  */
10698         pci_mem_phy0 = pci_resource_start(dev, 3);
10699 -       length = pci_resource_len(dev, 3);
10700 -
10701 -       if (length < 0xffff) {
10702 -               printk(KERN_ERR "memory length for this resource is less than "
10703 -                               "required\n");
10704 -               release_mem_region(nxp_pci_io_base, iolength);
10705 -               iounmap(iobase);
10706 -               return  -ENOMEM;
10707 +       memlength = pci_resource_len(dev, 3);
10708 +       if (memlength < 0xffff) {
10709 +               printk(KERN_ERR "memory length for this resource is wrong\n");
10710 +               ret_status = -ENOMEM;
10711 +               goto cleanup2;
10712         }
10713
10714 -       if (!request_mem_region(pci_mem_phy0, length, "ISP-PCI")) {
10715 +       if (!request_mem_region(pci_mem_phy0, memlength, "ISP-PCI")) {
10716                 printk(KERN_ERR "host controller already in use\n");
10717 -               release_mem_region(nxp_pci_io_base, iolength);
10718 -               iounmap(iobase);
10719 -               return -EBUSY;
10720 +               ret_status = -EBUSY;
10721 +               goto cleanup2;
10722 +       }
10723 +
10724 +       /* map available memory */
10725 +       chip_addr = ioremap_nocache(pci_mem_phy0,memlength);
10726 +       if (!chip_addr) {
10727 +               printk(KERN_ERR "Error ioremap failed\n");
10728 +               ret_status = -ENOMEM;
10729 +               goto cleanup3;
10730         }
10731
10732         /* bad pci latencies can contribute to overruns */
10733 @@ -210,39 +214,54 @@
10734                  * */
10735                 writel(0xface, chip_addr + HC_SCRATCH_REG);
10736                 udelay(100);
10737 -               reg_data = readl(chip_addr + HC_SCRATCH_REG);
10738 +               reg_data = readl(chip_addr + HC_SCRATCH_REG) & 0x0000ffff;
10739                 retry_count--;
10740         }
10741
10742 +       iounmap(chip_addr);
10743 +
10744         /* Host Controller presence is detected by writing to scratch register
10745          * and reading back and checking the contents are same or not
10746          */
10747         if (reg_data != 0xFACE) {
10748                 dev_err(&dev->dev, "scratch register mismatch %x\n", reg_data);
10749 -               goto clean;
10750 +               ret_status = -ENOMEM;
10751 +               goto cleanup3;
10752         }
10753
10754         pci_set_master(dev);
10755
10756 -       status = readl(iobase + 0x68);
10757 -       status |= 0x900;
10758 -       writel(status, iobase + 0x68);
10759 +       /* configure PLX PCI chip to pass interrupts */
10760 +#define PLX_INT_CSR_REG 0x68
10761 +       reg_data = readl(iobase + PLX_INT_CSR_REG);
10762 +       reg_data |= 0x900;
10763 +       writel(reg_data, iobase + PLX_INT_CSR_REG);
10764
10765         dev->dev.dma_mask = NULL;
10766 -       hcd = isp1760_register(pci_mem_phy0, length, dev->irq,
10767 +       hcd = isp1760_register(pci_mem_phy0, memlength, dev->irq,
10768                 IRQF_SHARED | IRQF_DISABLED, &dev->dev, dev_name(&dev->dev),
10769                 devflags);
10770 -       if (!IS_ERR(hcd)) {
10771 -               pci_set_drvdata(dev, hcd);
10772 -               return 0;
10773 +       if (IS_ERR(hcd)) {
10774 +               ret_status = -ENODEV;
10775 +               goto cleanup3;
10776         }
10777 -clean:
10778 -       status = -ENODEV;
10779 +
10780 +       /* done with PLX IO access */
10781         iounmap(iobase);
10782 -       release_mem_region(pci_mem_phy0, length);
10783         release_mem_region(nxp_pci_io_base, iolength);
10784 -       return status;
10785 +
10786 +       pci_set_drvdata(dev, hcd);
10787 +       return 0;
10788 +
10789 +cleanup3:
10790 +       release_mem_region(pci_mem_phy0, memlength);
10791 +cleanup2:
10792 +       iounmap(iobase);
10793 +cleanup1:
10794 +       release_mem_region(nxp_pci_io_base, iolength);
10795 +       return ret_status;
10796  }
10797 +
10798  static void isp1761_pci_remove(struct pci_dev *dev)
10799  {
10800         struct usb_hcd *hcd;
10801 @@ -255,12 +274,6 @@
10802         usb_put_hcd(hcd);
10803
10804         pci_disable_device(dev);
10805 -
10806 -       iounmap(iobase);
10807 -       iounmap(chip_addr);
10808 -
10809 -       release_mem_region(nxp_pci_io_base, iolength);
10810 -       release_mem_region(pci_mem_phy0, length);
10811  }
10812
10813  static void isp1761_pci_shutdown(struct pci_dev *dev)
10814 @@ -268,12 +281,16 @@
10815         printk(KERN_ERR "ips1761_pci_shutdown\n");
10816  }
10817
10818 -static const struct pci_device_id isp1760_plx [] = { {
10819 -       /* handle any USB 2.0 EHCI controller */
10820 -       PCI_DEVICE_CLASS(((PCI_CLASS_BRIDGE_OTHER << 8) | (0x06 << 16)), ~0),
10821 -               .driver_data = 0,
10822 -},
10823 -{ /* end: all zeroes */ }
10824 +static const struct pci_device_id isp1760_plx [] = {
10825 +       {
10826 +               .class          = PCI_CLASS_BRIDGE_OTHER << 8,
10827 +               .class_mask     = ~0,
10828 +               .vendor         = PCI_VENDOR_ID_PLX,
10829 +               .device         = 0x5406,
10830 +               .subvendor      = PCI_VENDOR_ID_PLX,
10831 +               .subdevice      = 0x9054,
10832 +       },
10833 +       { }
10834  };
10835  MODULE_DEVICE_TABLE(pci, isp1760_plx);
10836
10837 --- kernel-power-2.6.28.orig/drivers/usb/misc/emi26.c
10838 +++ kernel-power-2.6.28/drivers/usb/misc/emi26.c
10839 @@ -160,7 +160,7 @@
10840                         err("%s - error loading firmware: error = %d", __func__, err);
10841                         goto wraperr;
10842                 }
10843 -       } while (i > 0);
10844 +       } while (rec);
10845
10846         /* Assert reset (stop the CPU in the EMI) */
10847         err = emi26_set_reset(dev,1);
10848 --- kernel-power-2.6.28.orig/drivers/usb/mon/mon_bin.c
10849 +++ kernel-power-2.6.28/drivers/usb/mon/mon_bin.c
10850 @@ -37,6 +37,7 @@
10851  #define MON_IOCX_GET   _IOW(MON_IOC_MAGIC, 6, struct mon_bin_get)
10852  #define MON_IOCX_MFETCH _IOWR(MON_IOC_MAGIC, 7, struct mon_bin_mfetch)
10853  #define MON_IOCH_MFLUSH _IO(MON_IOC_MAGIC, 8)
10854 +
10855  #ifdef CONFIG_COMPAT
10856  #define MON_IOCX_GET32 _IOW(MON_IOC_MAGIC, 6, struct mon_bin_get32)
10857  #define MON_IOCX_MFETCH32 _IOWR(MON_IOC_MAGIC, 7, struct mon_bin_mfetch32)
10858 @@ -921,21 +922,6 @@
10859                 }
10860                 break;
10861
10862 -#ifdef CONFIG_COMPAT
10863 -       case MON_IOCX_GET32: {
10864 -               struct mon_bin_get32 getb;
10865 -
10866 -               if (copy_from_user(&getb, (void __user *)arg,
10867 -                                           sizeof(struct mon_bin_get32)))
10868 -                       return -EFAULT;
10869 -
10870 -               ret = mon_bin_get_event(file, rp,
10871 -                   compat_ptr(getb.hdr32), compat_ptr(getb.data32),
10872 -                   getb.alloc32);
10873 -               }
10874 -               break;
10875 -#endif
10876 -
10877         case MON_IOCX_MFETCH:
10878                 {
10879                 struct mon_bin_mfetch mfetch;
10880 @@ -962,7 +948,57 @@
10881                 }
10882                 break;
10883
10884 +       case MON_IOCG_STATS: {
10885 +               struct mon_bin_stats __user *sp;
10886 +               unsigned int nevents;
10887 +               unsigned int ndropped;
10888 +
10889 +               spin_lock_irqsave(&rp->b_lock, flags);
10890 +               ndropped = rp->cnt_lost;
10891 +               rp->cnt_lost = 0;
10892 +               spin_unlock_irqrestore(&rp->b_lock, flags);
10893 +               nevents = mon_bin_queued(rp);
10894 +
10895 +               sp = (struct mon_bin_stats __user *)arg;
10896 +               if (put_user(rp->cnt_lost, &sp->dropped))
10897 +                       return -EFAULT;
10898 +               if (put_user(nevents, &sp->queued))
10899 +                       return -EFAULT;
10900 +
10901 +               }
10902 +               break;
10903 +
10904 +       default:
10905 +               return -ENOTTY;
10906 +       }
10907 +
10908 +       return ret;
10909 +}
10910 +
10911  #ifdef CONFIG_COMPAT
10912 +static long mon_bin_compat_ioctl(struct file *file,
10913 +    unsigned int cmd, unsigned long arg)
10914 +{
10915 +       struct mon_reader_bin *rp = file->private_data;
10916 +       int ret;
10917 +
10918 +       switch (cmd) {
10919 +
10920 +       case MON_IOCX_GET32: {
10921 +               struct mon_bin_get32 getb;
10922 +
10923 +               if (copy_from_user(&getb, (void __user *)arg,
10924 +                                           sizeof(struct mon_bin_get32)))
10925 +                       return -EFAULT;
10926 +
10927 +               ret = mon_bin_get_event(file, rp,
10928 +                   compat_ptr(getb.hdr32), compat_ptr(getb.data32),
10929 +                   getb.alloc32);
10930 +               if (ret < 0)
10931 +                       return ret;
10932 +               }
10933 +               return 0;
10934 +
10935         case MON_IOCX_MFETCH32:
10936                 {
10937                 struct mon_bin_mfetch32 mfetch;
10938 @@ -986,37 +1022,25 @@
10939                         return ret;
10940                 if (put_user(ret, &uptr->nfetch32))
10941                         return -EFAULT;
10942 -               ret = 0;
10943                 }
10944 -               break;
10945 -#endif
10946 -
10947 -       case MON_IOCG_STATS: {
10948 -               struct mon_bin_stats __user *sp;
10949 -               unsigned int nevents;
10950 -               unsigned int ndropped;
10951 -
10952 -               spin_lock_irqsave(&rp->b_lock, flags);
10953 -               ndropped = rp->cnt_lost;
10954 -               rp->cnt_lost = 0;
10955 -               spin_unlock_irqrestore(&rp->b_lock, flags);
10956 -               nevents = mon_bin_queued(rp);
10957 +               return 0;
10958
10959 -               sp = (struct mon_bin_stats __user *)arg;
10960 -               if (put_user(rp->cnt_lost, &sp->dropped))
10961 -                       return -EFAULT;
10962 -               if (put_user(nevents, &sp->queued))
10963 -                       return -EFAULT;
10964 +       case MON_IOCG_STATS:
10965 +               return mon_bin_ioctl(NULL, file, cmd,
10966 +                                           (unsigned long) compat_ptr(arg));
10967
10968 -               }
10969 -               break;
10970 +       case MON_IOCQ_URB_LEN:
10971 +       case MON_IOCQ_RING_SIZE:
10972 +       case MON_IOCT_RING_SIZE:
10973 +       case MON_IOCH_MFLUSH:
10974 +               return mon_bin_ioctl(NULL, file, cmd, arg);
10975
10976         default:
10977 -               return -ENOTTY;
10978 +               ;
10979         }
10980 -
10981 -       return ret;
10982 +       return -ENOTTY;
10983  }
10984 +#endif /* CONFIG_COMPAT */
10985
10986  static unsigned int
10987  mon_bin_poll(struct file *file, struct poll_table_struct *wait)
10988 @@ -1094,6 +1118,9 @@
10989         /* .write =     mon_text_write, */
10990         .poll =         mon_bin_poll,
10991         .ioctl =        mon_bin_ioctl,
10992 +#ifdef CONFIG_COMPAT
10993 +       .compat_ioctl = mon_bin_compat_ioctl,
10994 +#endif
10995         .release =      mon_bin_release,
10996         .mmap =         mon_bin_mmap,
10997  };
10998 --- kernel-power-2.6.28.orig/drivers/usb/serial/cp2101.c
10999 +++ kernel-power-2.6.28/drivers/usb/serial/cp2101.c
11000 @@ -79,6 +79,7 @@
11001         { USB_DEVICE(0x10C4, 0x814A) }, /* West Mountain Radio RIGblaster P&P */
11002         { USB_DEVICE(0x10C4, 0x814B) }, /* West Mountain Radio RIGtalk */
11003         { USB_DEVICE(0x10C4, 0x815E) }, /* Helicomm IP-Link 1220-DVM */
11004 +       { USB_DEVICE(0x10C4, 0x819F) }, /* MJS USB Toslink Switcher */
11005         { USB_DEVICE(0x10C4, 0x81A6) }, /* ThinkOptics WavIt */
11006         { USB_DEVICE(0x10C4, 0x81AC) }, /* MSD Dash Hawk */
11007         { USB_DEVICE(0x10C4, 0x81C8) }, /* Lipowsky Industrie Elektronik GmbH, Baby-JTAG */
11008 --- kernel-power-2.6.28.orig/drivers/usb/serial/ftdi_sio.c
11009 +++ kernel-power-2.6.28/drivers/usb/serial/ftdi_sio.c
11010 @@ -660,6 +660,12 @@
11011         { USB_DEVICE(PAPOUCH_VID, PAPOUCH_QUIDO4x4_PID) },
11012         { USB_DEVICE(FTDI_VID, FTDI_DOMINTELL_DGQG_PID) },
11013         { USB_DEVICE(FTDI_VID, FTDI_DOMINTELL_DUSB_PID) },
11014 +       { USB_DEVICE(ATMEL_VID, STK541_PID) },
11015 +       { USB_DEVICE(DE_VID, STB_PID) },
11016 +       { USB_DEVICE(DE_VID, WHT_PID) },
11017 +       { USB_DEVICE(ADI_VID, ADI_GNICE_PID),
11018 +               .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
11019 +       { USB_DEVICE(JETI_VID, JETI_SPC1201_PID) },
11020         { },                                    /* Optional parameter entry */
11021         { }                                     /* Terminating entry */
11022  };
11023 --- kernel-power-2.6.28.orig/drivers/usb/serial/ftdi_sio.h
11024 +++ kernel-power-2.6.28/drivers/usb/serial/ftdi_sio.h
11025 @@ -881,6 +881,33 @@
11026  #define RATOC_PRODUCT_ID_USB60F        0xb020
11027
11028  /*
11029 + * Atmel STK541
11030 + */
11031 +#define ATMEL_VID              0x03eb /* Vendor ID */
11032 +#define STK541_PID             0x2109 /* Zigbee Controller */
11033 +
11034 +/*
11035 + * Dresden Elektronic Sensor Terminal Board
11036 + */
11037 +#define DE_VID                 0x1cf1 /* Vendor ID */
11038 +#define STB_PID                        0x0001 /* Sensor Terminal Board */
11039 +#define WHT_PID                        0x0004 /* Wireless Handheld Terminal */
11040 +
11041 +/*
11042 + * Blackfin gnICE JTAG
11043 + * http://docs.blackfin.uclinux.org/doku.php?id=hw:jtag:gnice
11044 + */
11045 +#define ADI_VID                0x0456
11046 +#define ADI_GNICE_PID          0xF000
11047 +
11048 +/*
11049 + * JETI SPECTROMETER SPECBOS 1201
11050 + * http://www.jeti.com/products/sys/scb/scb1201.php
11051 + */
11052 +#define JETI_VID               0x0c6c
11053 +#define JETI_SPC1201_PID       0x04b2
11054 +
11055 +/*
11056   *   BmRequestType:  1100 0000b
11057   *   bRequest:       FTDI_E2_READ
11058   *   wValue:         0
11059 --- kernel-power-2.6.28.orig/drivers/usb/serial/option.c
11060 +++ kernel-power-2.6.28/drivers/usb/serial/option.c
11061 @@ -89,6 +89,7 @@
11062  #define OPTION_PRODUCT_ETNA_MODEM_GT           0x7041
11063  #define OPTION_PRODUCT_ETNA_MODEM_EX           0x7061
11064  #define OPTION_PRODUCT_ETNA_KOI_MODEM          0x7100
11065 +#define OPTION_PRODUCT_GTM380_MODEM            0x7201
11066
11067  #define HUAWEI_VENDOR_ID                       0x12D1
11068  #define HUAWEI_PRODUCT_E600                    0x1001
11069 @@ -190,16 +191,18 @@
11070  /* OVATION PRODUCTS */
11071  #define NOVATELWIRELESS_PRODUCT_MC727          0x4100
11072  #define NOVATELWIRELESS_PRODUCT_MC950D         0x4400
11073 +#define NOVATELWIRELESS_PRODUCT_U727           0x5010
11074
11075  /* FUTURE NOVATEL PRODUCTS */
11076 -#define NOVATELWIRELESS_PRODUCT_EVDO_1         0x6000
11077 -#define NOVATELWIRELESS_PRODUCT_HSPA_1         0x7000
11078 -#define NOVATELWIRELESS_PRODUCT_EMBEDDED_1     0x8000
11079 -#define NOVATELWIRELESS_PRODUCT_GLOBAL_1       0x9000
11080 -#define NOVATELWIRELESS_PRODUCT_EVDO_2         0x6001
11081 -#define NOVATELWIRELESS_PRODUCT_HSPA_2         0x7001
11082 -#define NOVATELWIRELESS_PRODUCT_EMBEDDED_2     0x8001
11083 -#define NOVATELWIRELESS_PRODUCT_GLOBAL_2       0x9001
11084 +#define NOVATELWIRELESS_PRODUCT_EVDO_FULLSPEED 0X6000
11085 +#define NOVATELWIRELESS_PRODUCT_EVDO_HIGHSPEED 0X6001
11086 +#define NOVATELWIRELESS_PRODUCT_HSPA_FULLSPEED 0X7000
11087 +#define NOVATELWIRELESS_PRODUCT_HSPA_HIGHSPEED 0X7001
11088 +#define NOVATELWIRELESS_PRODUCT_EVDO_EMBEDDED_FULLSPEED        0X8000
11089 +#define NOVATELWIRELESS_PRODUCT_EVDO_EMBEDDED_HIGHSPEED        0X8001
11090 +#define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_FULLSPEED        0X9000
11091 +#define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_HIGHSPEED        0X9001
11092 +#define NOVATELWIRELESS_PRODUCT_GLOBAL         0XA001
11093
11094  /* AMOI PRODUCTS */
11095  #define AMOI_VENDOR_ID                         0x1614
11096 @@ -209,6 +212,27 @@
11097
11098  #define DELL_VENDOR_ID                         0x413C
11099
11100 +/* Dell modems */
11101 +#define DELL_PRODUCT_5700_MINICARD             0x8114
11102 +#define DELL_PRODUCT_5500_MINICARD             0x8115
11103 +#define DELL_PRODUCT_5505_MINICARD             0x8116
11104 +#define DELL_PRODUCT_5700_EXPRESSCARD          0x8117
11105 +#define DELL_PRODUCT_5510_EXPRESSCARD          0x8118
11106 +
11107 +#define DELL_PRODUCT_5700_MINICARD_SPRINT      0x8128
11108 +#define DELL_PRODUCT_5700_MINICARD_TELUS       0x8129
11109 +
11110 +#define DELL_PRODUCT_5720_MINICARD_VZW         0x8133
11111 +#define DELL_PRODUCT_5720_MINICARD_SPRINT      0x8134
11112 +#define DELL_PRODUCT_5720_MINICARD_TELUS       0x8135
11113 +#define DELL_PRODUCT_5520_MINICARD_CINGULAR    0x8136
11114 +#define DELL_PRODUCT_5520_MINICARD_GENERIC_L   0x8137
11115 +#define DELL_PRODUCT_5520_MINICARD_GENERIC_I   0x8138
11116 +
11117 +#define DELL_PRODUCT_5730_MINICARD_SPRINT      0x8180
11118 +#define DELL_PRODUCT_5730_MINICARD_TELUS       0x8181
11119 +#define DELL_PRODUCT_5730_MINICARD_VZW         0x8182
11120 +
11121  #define KYOCERA_VENDOR_ID                      0x0c88
11122  #define KYOCERA_PRODUCT_KPC650                 0x17da
11123  #define KYOCERA_PRODUCT_KPC680                 0x180a
11124 @@ -259,19 +283,13 @@
11125
11126  /* ZTE PRODUCTS */
11127  #define ZTE_VENDOR_ID                          0x19d2
11128 +#define ZTE_PRODUCT_MF622                      0x0001
11129  #define ZTE_PRODUCT_MF628                      0x0015
11130  #define ZTE_PRODUCT_MF626                      0x0031
11131  #define ZTE_PRODUCT_CDMA_TECH                  0xfffe
11132
11133 -/* Ericsson products */
11134 -#define ERICSSON_VENDOR_ID                     0x0bdb
11135 -#define ERICSSON_PRODUCT_F3507G                        0x1900
11136 -
11137 -/* Pantech products */
11138 -#define PANTECH_VENDOR_ID                      0x106c
11139 -#define PANTECH_PRODUCT_PC5740                 0x3701
11140 -#define PANTECH_PRODUCT_PC5750                 0x3702  /* PX-500 */
11141 -#define PANTECH_PRODUCT_UM150                  0x3711
11142 +#define BENQ_VENDOR_ID                         0x04a5
11143 +#define BENQ_PRODUCT_H10                       0x4068
11144
11145  static struct usb_device_id option_ids[] = {
11146         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
11147 @@ -298,6 +316,7 @@
11148         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_ETNA_MODEM_GT) },
11149         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_ETNA_MODEM_EX) },
11150         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_ETNA_KOI_MODEM) },
11151 +       { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_GTM380_MODEM) },
11152         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E600, 0xff, 0xff, 0xff) },
11153         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E220, 0xff, 0xff, 0xff) },
11154         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E220BIS, 0xff, 0xff, 0xff) },
11155 @@ -383,31 +402,37 @@
11156         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EU870D) }, /* Novatel EU850D/EU860D/EU870D */
11157         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC950D) }, /* Novatel MC930D/MC950D */
11158         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC727) }, /* Novatel MC727/U727/USB727 */
11159 -       { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EVDO_1) }, /* Novatel EVDO product */
11160 -       { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_HSPA_1) }, /* Novatel HSPA product */
11161 -       { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EMBEDDED_1) }, /* Novatel Embedded product */
11162 -       { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_GLOBAL_1) }, /* Novatel Global product */
11163 -       { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EVDO_2) }, /* Novatel EVDO product */
11164 -       { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_HSPA_2) }, /* Novatel HSPA product */
11165 -       { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EMBEDDED_2) }, /* Novatel Embedded product */
11166 -       { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_GLOBAL_2) }, /* Novatel Global product */
11167 +       { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_U727) }, /* Novatel MC727/U727/USB727 */
11168 +       { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EVDO_FULLSPEED) }, /* Novatel EVDO product */
11169 +       { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_HSPA_FULLSPEED) }, /* Novatel HSPA product */
11170 +       { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EVDO_EMBEDDED_FULLSPEED) }, /* Novatel EVDO Embedded product */
11171 +       { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_FULLSPEED) }, /* Novatel HSPA Embedded product */
11172 +       { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EVDO_HIGHSPEED) }, /* Novatel EVDO product */
11173 +       { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_HSPA_HIGHSPEED) }, /* Novatel HSPA product */
11174 +       { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EVDO_EMBEDDED_HIGHSPEED) }, /* Novatel EVDO Embedded product */
11175 +       { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_HIGHSPEED) }, /* Novatel HSPA Embedded product */
11176 +       { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_GLOBAL) }, /* Novatel Global product */
11177
11178         { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01) },
11179         { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01A) },
11180         { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H02) },
11181
11182 -       { USB_DEVICE(DELL_VENDOR_ID, 0x8114) }, /* Dell Wireless 5700 Mobile Broadband CDMA/EVDO Mini-Card == Novatel Expedite EV620 CDMA/EV-DO */
11183 -       { USB_DEVICE(DELL_VENDOR_ID, 0x8115) }, /* Dell Wireless 5500 Mobile Broadband HSDPA Mini-Card == Novatel Expedite EU740 HSDPA/3G */
11184 -       { USB_DEVICE(DELL_VENDOR_ID, 0x8116) }, /* Dell Wireless 5505 Mobile Broadband HSDPA Mini-Card == Novatel Expedite EU740 HSDPA/3G */
11185 -       { USB_DEVICE(DELL_VENDOR_ID, 0x8117) }, /* Dell Wireless 5700 Mobile Broadband CDMA/EVDO ExpressCard == Novatel Merlin XV620 CDMA/EV-DO */
11186 -       { USB_DEVICE(DELL_VENDOR_ID, 0x8118) }, /* Dell Wireless 5510 Mobile Broadband HSDPA ExpressCard == Novatel Merlin XU870 HSDPA/3G */
11187 -       { USB_DEVICE(DELL_VENDOR_ID, 0x8128) }, /* Dell Wireless 5700 Mobile Broadband CDMA/EVDO Mini-Card == Novatel Expedite E720 CDMA/EV-DO */
11188 -       { USB_DEVICE(DELL_VENDOR_ID, 0x8129) }, /* Dell Wireless 5700 Mobile Broadband CDMA/EVDO Mini-Card == Novatel Expedite ET620 CDMA/EV-DO */
11189 -       { USB_DEVICE(DELL_VENDOR_ID, 0x8133) }, /* Dell Wireless 5720 == Novatel EV620 CDMA/EV-DO */
11190 -       { USB_DEVICE(DELL_VENDOR_ID, 0x8136) }, /* Dell Wireless HSDPA 5520 == Novatel Expedite EU860D */
11191 -       { USB_DEVICE(DELL_VENDOR_ID, 0x8137) }, /* Dell Wireless HSDPA 5520 */
11192 -       { USB_DEVICE(DELL_VENDOR_ID, 0x8138) }, /* Dell Wireless 5520 Voda I Mobile Broadband (3G HSDPA) Minicard */
11193 -       { USB_DEVICE(DELL_VENDOR_ID, 0x8147) }, /* Dell Wireless 5530 Mobile Broadband (3G HSPA) Mini-Card */
11194 +       { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5700_MINICARD) },             /* Dell Wireless 5700 Mobile Broadband CDMA/EVDO Mini-Card == Novatel Expedite EV620 CDMA/EV-DO */
11195 +       { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5500_MINICARD) },             /* Dell Wireless 5500 Mobile Broadband HSDPA Mini-Card == Novatel Expedite EU740 HSDPA/3G */
11196 +       { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5505_MINICARD) },             /* Dell Wireless 5505 Mobile Broadband HSDPA Mini-Card == Novatel Expedite EU740 HSDPA/3G */
11197 +       { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5700_EXPRESSCARD) },          /* Dell Wireless 5700 Mobile Broadband CDMA/EVDO ExpressCard == Novatel Merlin XV620 CDMA/EV-DO */
11198 +       { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5510_EXPRESSCARD) },          /* Dell Wireless 5510 Mobile Broadband HSDPA ExpressCard == Novatel Merlin XU870 HSDPA/3G */
11199 +       { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5700_MINICARD_SPRINT) },      /* Dell Wireless 5700 Mobile Broadband CDMA/EVDO Mini-Card == Novatel Expedite E720 CDMA/EV-DO */
11200 +       { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5700_MINICARD_TELUS) },       /* Dell Wireless 5700 Mobile Broadband CDMA/EVDO Mini-Card == Novatel Expedite ET620 CDMA/EV-DO */
11201 +       { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5720_MINICARD_VZW) },         /* Dell Wireless 5720 == Novatel EV620 CDMA/EV-DO */
11202 +       { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5720_MINICARD_SPRINT) },      /* Dell Wireless 5720 == Novatel EV620 CDMA/EV-DO */
11203 +       { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5720_MINICARD_TELUS) },       /* Dell Wireless 5720 == Novatel EV620 CDMA/EV-DO */
11204 +       { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5520_MINICARD_CINGULAR) },    /* Dell Wireless HSDPA 5520 == Novatel Expedite EU860D */
11205 +       { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5520_MINICARD_GENERIC_L) },   /* Dell Wireless HSDPA 5520 */
11206 +       { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5520_MINICARD_GENERIC_I) },   /* Dell Wireless 5520 Voda I Mobile Broadband (3G HSDPA) Minicard */
11207 +       { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5730_MINICARD_SPRINT) },      /* Dell Wireless 5730 Mobile Broadband EVDO/HSPA Mini-Card */
11208 +       { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5730_MINICARD_TELUS) },       /* Dell Wireless 5730 Mobile Broadband EVDO/HSPA Mini-Card */
11209 +       { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5730_MINICARD_VZW) },         /* Dell Wireless 5730 Mobile Broadband EVDO/HSPA Mini-Card */
11210         { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_E100A) },   /* ADU-E100, ADU-310 */
11211         { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_500A) },
11212         { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_620UW) },
11213 @@ -472,13 +497,12 @@
11214         { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
11215         { USB_DEVICE(MAXON_VENDOR_ID, 0x6280) }, /* BP3-USB & BP3-EXT HSDPA */
11216         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864E) },
11217 +       { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622) },
11218         { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_MF626) },
11219         { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_MF628) },
11220         { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH) },
11221 -       { USB_DEVICE(ERICSSON_VENDOR_ID, ERICSSON_PRODUCT_F3507G) },
11222 -       { USB_DEVICE(PANTECH_VENDOR_ID, PANTECH_PRODUCT_PC5740) },
11223 -       { USB_DEVICE(PANTECH_VENDOR_ID, PANTECH_PRODUCT_PC5750) },
11224 -       { USB_DEVICE(PANTECH_VENDOR_ID, PANTECH_PRODUCT_UM150) },
11225 +       { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) },
11226 +       { USB_DEVICE(0x1da5, 0x4515) }, /* BenQ H20 */
11227         { } /* Terminating entry */
11228  };
11229  MODULE_DEVICE_TABLE(usb, option_ids);
11230 --- kernel-power-2.6.28.orig/drivers/usb/serial/ti_usb_3410_5052.c
11231 +++ kernel-power-2.6.28/drivers/usb/serial/ti_usb_3410_5052.c
11232 @@ -176,25 +176,32 @@
11233  /* the array dimension is the number of default entries plus */
11234  /* TI_EXTRA_VID_PID_COUNT user defined entries plus 1 terminating */
11235  /* null entry */
11236 -static struct usb_device_id ti_id_table_3410[1+TI_EXTRA_VID_PID_COUNT+1] = {
11237 +static struct usb_device_id ti_id_table_3410[10+TI_EXTRA_VID_PID_COUNT+1] = {
11238         { USB_DEVICE(TI_VENDOR_ID, TI_3410_PRODUCT_ID) },
11239         { USB_DEVICE(TI_VENDOR_ID, TI_3410_EZ430_ID) },
11240 +       { USB_DEVICE(IBM_VENDOR_ID, IBM_4543_PRODUCT_ID) },
11241 +       { USB_DEVICE(IBM_VENDOR_ID, IBM_454B_PRODUCT_ID) },
11242 +       { USB_DEVICE(IBM_VENDOR_ID, IBM_454C_PRODUCT_ID) },
11243  };
11244
11245 -static struct usb_device_id ti_id_table_5052[4+TI_EXTRA_VID_PID_COUNT+1] = {
11246 +static struct usb_device_id ti_id_table_5052[5+TI_EXTRA_VID_PID_COUNT+1] = {
11247         { USB_DEVICE(TI_VENDOR_ID, TI_5052_BOOT_PRODUCT_ID) },
11248         { USB_DEVICE(TI_VENDOR_ID, TI_5152_BOOT_PRODUCT_ID) },
11249         { USB_DEVICE(TI_VENDOR_ID, TI_5052_EEPROM_PRODUCT_ID) },
11250         { USB_DEVICE(TI_VENDOR_ID, TI_5052_FIRMWARE_PRODUCT_ID) },
11251 +       { USB_DEVICE(IBM_VENDOR_ID, IBM_4543_PRODUCT_ID) },
11252  };
11253
11254 -static struct usb_device_id ti_id_table_combined[] = {
11255 +static struct usb_device_id ti_id_table_combined[14+2*TI_EXTRA_VID_PID_COUNT+1] = {
11256         { USB_DEVICE(TI_VENDOR_ID, TI_3410_PRODUCT_ID) },
11257         { USB_DEVICE(TI_VENDOR_ID, TI_3410_EZ430_ID) },
11258         { USB_DEVICE(TI_VENDOR_ID, TI_5052_BOOT_PRODUCT_ID) },
11259         { USB_DEVICE(TI_VENDOR_ID, TI_5152_BOOT_PRODUCT_ID) },
11260         { USB_DEVICE(TI_VENDOR_ID, TI_5052_EEPROM_PRODUCT_ID) },
11261         { USB_DEVICE(TI_VENDOR_ID, TI_5052_FIRMWARE_PRODUCT_ID) },
11262 +       { USB_DEVICE(IBM_VENDOR_ID, IBM_4543_PRODUCT_ID) },
11263 +       { USB_DEVICE(IBM_VENDOR_ID, IBM_454B_PRODUCT_ID) },
11264 +       { USB_DEVICE(IBM_VENDOR_ID, IBM_454C_PRODUCT_ID) },
11265         { }
11266  };
11267
11268 --- kernel-power-2.6.28.orig/drivers/usb/serial/ti_usb_3410_5052.h
11269 +++ kernel-power-2.6.28/drivers/usb/serial/ti_usb_3410_5052.h
11270 @@ -27,7 +27,11 @@
11271
11272  /* Vendor and product ids */
11273  #define TI_VENDOR_ID                   0x0451
11274 +#define IBM_VENDOR_ID                  0x04b3
11275  #define TI_3410_PRODUCT_ID             0x3410
11276 +#define IBM_4543_PRODUCT_ID            0x4543
11277 +#define IBM_454B_PRODUCT_ID            0x454b
11278 +#define IBM_454C_PRODUCT_ID            0x454c
11279  #define TI_3410_EZ430_ID               0xF430  /* TI ez430 development tool */
11280  #define TI_5052_BOOT_PRODUCT_ID                0x5052  /* no EEPROM, no firmware */
11281  #define TI_5152_BOOT_PRODUCT_ID                0x5152  /* no EEPROM, no firmware */
11282 --- kernel-power-2.6.28.orig/drivers/usb/storage/cypress_atacb.c
11283 +++ kernel-power-2.6.28/drivers/usb/storage/cypress_atacb.c
11284 @@ -133,19 +133,18 @@
11285
11286                 /* build the command for
11287                  * reading the ATA registers */
11288 -               scsi_eh_prep_cmnd(srb, &ses, NULL, 0, 0);
11289 -               srb->sdb.length = sizeof(regs);
11290 -               sg_init_one(&ses.sense_sgl, regs, srb->sdb.length);
11291 -               srb->sdb.table.sgl = &ses.sense_sgl;
11292 -               srb->sc_data_direction = DMA_FROM_DEVICE;
11293 -               srb->sdb.table.nents = 1;
11294 +               scsi_eh_prep_cmnd(srb, &ses, NULL, 0, sizeof(regs));
11295 +
11296                 /* we use the same command as before, but we set
11297                  * the read taskfile bit, for not executing atacb command,
11298                  * but reading register selected in srb->cmnd[4]
11299                  */
11300 +               srb->cmd_len = 16;
11301 +               srb->cmnd = ses.cmnd;
11302                 srb->cmnd[2] = 1;
11303
11304                 usb_stor_transparent_scsi_command(srb, us);
11305 +               memcpy(regs, srb->sense_buffer, sizeof(regs));
11306                 tmp_result = srb->result;
11307                 scsi_eh_restore_cmnd(srb, &ses);
11308                 /* we fail to get registers, report invalid command */
11309 @@ -162,8 +161,8 @@
11310
11311                 /* XXX we should generate sk, asc, ascq from status and error
11312                  * regs
11313 -                * (see 11.1 Error translation  ATA device error to SCSI error map)
11314 -                * and ata_to_sense_error from libata.
11315 +                * (see 11.1 Error translation ATA device error to SCSI error
11316 +                *  map, and ata_to_sense_error from libata.)
11317                  */
11318
11319                 /* Sense data is current and format is descriptor. */
11320 --- kernel-power-2.6.28.orig/drivers/usb/storage/libusual.c
11321 +++ kernel-power-2.6.28/drivers/usb/storage/libusual.c
11322 @@ -46,6 +46,12 @@
11323  { USB_DEVICE_VER(id_vendor, id_product, bcdDeviceMin,bcdDeviceMax), \
11324    .driver_info = (flags)|(USB_US_TYPE_STOR<<24) }
11325
11326 +#define COMPLIANT_DEV(id_vendor, id_product, bcdDeviceMin, bcdDeviceMax, \
11327 +                   vendorName, productName, useProtocol, useTransport, \
11328 +                   initFunction, flags) \
11329 +{ USB_DEVICE_VER(id_vendor, id_product, bcdDeviceMin, bcdDeviceMax), \
11330 +  .driver_info = (flags) }
11331 +
11332  #define USUAL_DEV(useProto, useTrans, useType) \
11333  { USB_INTERFACE_INFO(USB_CLASS_MASS_STORAGE, useProto, useTrans), \
11334    .driver_info = ((useType)<<24) }
11335 @@ -57,6 +63,7 @@
11336
11337  #undef USUAL_DEV
11338  #undef UNUSUAL_DEV
11339 +#undef COMPLIANT_DEV
11340
11341  MODULE_DEVICE_TABLE(usb, storage_usb_ids);
11342  EXPORT_SYMBOL_GPL(storage_usb_ids);
11343 --- kernel-power-2.6.28.orig/drivers/usb/storage/scsiglue.c
11344 +++ kernel-power-2.6.28/drivers/usb/storage/scsiglue.c
11345 @@ -59,6 +59,14 @@
11346  #include "transport.h"
11347  #include "protocol.h"
11348
11349 +/* Vendor IDs for companies that seem to include the READ CAPACITY bug
11350 + * in all their devices
11351 + */
11352 +#define VENDOR_ID_NOKIA                0x0421
11353 +#define VENDOR_ID_NIKON                0x04b0
11354 +#define VENDOR_ID_PENTAX       0x0a17
11355 +#define VENDOR_ID_MOTOROLA     0x22b8
11356 +
11357  /***********************************************************************
11358   * Host functions
11359   ***********************************************************************/
11360 @@ -127,6 +135,12 @@
11361                 if (sdev->request_queue->max_sectors > max_sectors)
11362                         blk_queue_max_sectors(sdev->request_queue,
11363                                               max_sectors);
11364 +       } else if (sdev->type == TYPE_TAPE) {
11365 +               /* Tapes need much higher max_sector limits, so just
11366 +                * raise it to the maximum possible (4 GB / 512) and
11367 +                * let the queue segment size sort out the real limit.
11368 +                */
11369 +               blk_queue_max_sectors(sdev->request_queue, 0x7FFFFF);
11370         }
11371
11372         /* We can't put these settings in slave_alloc() because that gets
11373 @@ -134,6 +148,23 @@
11374          * settings can't be overridden via the scsi devinfo mechanism. */
11375         if (sdev->type == TYPE_DISK) {
11376
11377 +               /* Some vendors seem to put the READ CAPACITY bug into
11378 +                * all their devices -- primarily makers of cell phones
11379 +                * and digital cameras.  Since these devices always use
11380 +                * flash media and can be expected to have an even number
11381 +                * of sectors, we will always enable the CAPACITY_HEURISTICS
11382 +                * flag unless told otherwise. */
11383 +               switch (le16_to_cpu(us->pusb_dev->descriptor.idVendor)) {
11384 +               case VENDOR_ID_NOKIA:
11385 +               case VENDOR_ID_NIKON:
11386 +               case VENDOR_ID_PENTAX:
11387 +               case VENDOR_ID_MOTOROLA:
11388 +                       if (!(us->fflags & (US_FL_FIX_CAPACITY |
11389 +                                       US_FL_CAPACITY_OK)))
11390 +                               us->fflags |= US_FL_CAPACITY_HEURISTICS;
11391 +                       break;
11392 +               }
11393 +
11394                 /* Disk-type devices use MODE SENSE(6) if the protocol
11395                  * (SubClass) is Transparent SCSI, otherwise they use
11396                  * MODE SENSE(10). */
11397 @@ -196,6 +227,14 @@
11398                  * sector in a larger then 1 sector read, since the performance
11399                  * impact is negible we set this flag for all USB disks */
11400                 sdev->last_sector_bug = 1;
11401 +
11402 +               /* Enable last-sector hacks for single-target devices using
11403 +                * the Bulk-only transport, unless we already know the
11404 +                * capacity will be decremented or is correct. */
11405 +               if (!(us->fflags & (US_FL_FIX_CAPACITY | US_FL_CAPACITY_OK |
11406 +                                       US_FL_SCM_MULT_TARG)) &&
11407 +                               us->protocol == US_PR_BULK)
11408 +                       us->use_last_sector_hacks = 1;
11409         } else {
11410
11411                 /* Non-disk-type devices don't need to blacklist any pages
11412 --- kernel-power-2.6.28.orig/drivers/usb/storage/transport.c
11413 +++ kernel-power-2.6.28/drivers/usb/storage/transport.c
11414 @@ -57,6 +57,9 @@
11415  #include "scsiglue.h"
11416  #include "debug.h"
11417
11418 +#include <linux/blkdev.h>
11419 +#include "../../scsi/sd.h"
11420 +
11421
11422  /***********************************************************************
11423   * Data transfer routines
11424 @@ -511,6 +514,80 @@
11425   * Transport routines
11426   ***********************************************************************/
11427
11428 +/* There are so many devices that report the capacity incorrectly,
11429 + * this routine was written to counteract some of the resulting
11430 + * problems.
11431 + */
11432 +static void last_sector_hacks(struct us_data *us, struct scsi_cmnd *srb)
11433 +{
11434 +       struct gendisk *disk;
11435 +       struct scsi_disk *sdkp;
11436 +       u32 sector;
11437 +
11438 +       /* To Report "Medium Error: Record Not Found */
11439 +       static unsigned char record_not_found[18] = {
11440 +               [0]     = 0x70,                 /* current error */
11441 +               [2]     = MEDIUM_ERROR,         /* = 0x03 */
11442 +               [7]     = 0x0a,                 /* additional length */
11443 +               [12]    = 0x14                  /* Record Not Found */
11444 +       };
11445 +
11446 +       /* If last-sector problems can't occur, whether because the
11447 +        * capacity was already decremented or because the device is
11448 +        * known to report the correct capacity, then we don't need
11449 +        * to do anything.
11450 +        */
11451 +       if (!us->use_last_sector_hacks)
11452 +               return;
11453 +
11454 +       /* Was this command a READ(10) or a WRITE(10)? */
11455 +       if (srb->cmnd[0] != READ_10 && srb->cmnd[0] != WRITE_10)
11456 +               goto done;
11457 +
11458 +       /* Did this command access the last sector? */
11459 +       sector = (srb->cmnd[2] << 24) | (srb->cmnd[3] << 16) |
11460 +                       (srb->cmnd[4] << 8) | (srb->cmnd[5]);
11461 +       disk = srb->request->rq_disk;
11462 +       if (!disk)
11463 +               goto done;
11464 +       sdkp = scsi_disk(disk);
11465 +       if (!sdkp)
11466 +               goto done;
11467 +       if (sector + 1 != sdkp->capacity)
11468 +               goto done;
11469 +
11470 +       if (srb->result == SAM_STAT_GOOD && scsi_get_resid(srb) == 0) {
11471 +
11472 +               /* The command succeeded.  We know this device doesn't
11473 +                * have the last-sector bug, so stop checking it.
11474 +                */
11475 +               us->use_last_sector_hacks = 0;
11476 +
11477 +       } else {
11478 +               /* The command failed.  Allow up to 3 retries in case this
11479 +                * is some normal sort of failure.  After that, assume the
11480 +                * capacity is wrong and we're trying to access the sector
11481 +                * beyond the end.  Replace the result code and sense data
11482 +                * with values that will cause the SCSI core to fail the
11483 +                * command immediately, instead of going into an infinite
11484 +                * (or even just a very long) retry loop.
11485 +                */
11486 +               if (++us->last_sector_retries < 3)
11487 +                       return;
11488 +               srb->result = SAM_STAT_CHECK_CONDITION;
11489 +               memcpy(srb->sense_buffer, record_not_found,
11490 +                               sizeof(record_not_found));
11491 +       }
11492 +
11493 + done:
11494 +       /* Don't reset the retry counter for TEST UNIT READY commands,
11495 +        * because they get issued after device resets which might be
11496 +        * caused by a failed last-sector access.
11497 +        */
11498 +       if (srb->cmnd[0] != TEST_UNIT_READY)
11499 +               us->last_sector_retries = 0;
11500 +}
11501 +
11502  /* Invoke the transport and basic error-handling/recovery methods
11503   *
11504   * This is used by the protocol layers to actually send the message to
11505 @@ -544,6 +621,7 @@
11506         /* if the transport provided its own sense data, don't auto-sense */
11507         if (result == USB_STOR_TRANSPORT_NO_SENSE) {
11508                 srb->result = SAM_STAT_CHECK_CONDITION;
11509 +               last_sector_hacks(us, srb);
11510                 return;
11511         }
11512
11513 @@ -667,6 +745,7 @@
11514                         scsi_bufflen(srb) - scsi_get_resid(srb) < srb->underflow)
11515                 srb->result = (DID_ERROR << 16) | (SUGGEST_RETRY << 24);
11516
11517 +       last_sector_hacks(us, srb);
11518         return;
11519
11520         /* Error and abort processing: try to resynchronize with the device
11521 @@ -694,6 +773,7 @@
11522                 us->transport_reset(us);
11523         }
11524         clear_bit(US_FLIDX_RESETTING, &us->dflags);
11525 +       last_sector_hacks(us, srb);
11526  }
11527
11528  /* Stop the current URB transfer */
11529 --- kernel-power-2.6.28.orig/drivers/usb/storage/unusual_devs.h
11530 +++ kernel-power-2.6.28/drivers/usb/storage/unusual_devs.h
11531 @@ -27,7 +27,8 @@
11532
11533  /* IMPORTANT NOTE: This file must be included in another file which does
11534   * the following thing for it to work:
11535 - * The macro UNUSUAL_DEV() must be defined before this file is included
11536 + * The UNUSUAL_DEV, COMPLIANT_DEV, and USUAL_DEV macros must be defined
11537 + * before this file is included.
11538   */
11539
11540  /* If you edit this file, please try to keep it sorted first by VendorID,
11541 @@ -46,6 +47,12 @@
11542   * <usb-storage@lists.one-eyed-alien.net>
11543   */
11544
11545 +/* Note: If you add an entry only in order to set the CAPACITY_OK flag,
11546 + * use the COMPLIANT_DEV macro instead of UNUSUAL_DEV.  This is
11547 + * because such entries mark devices which actually work correctly,
11548 + * as opposed to devices that do something strangely or wrongly.
11549 + */
11550 +
11551  /* patch submitted by Vivian Bregier <Vivian.Bregier@imag.fr>
11552   */
11553  UNUSUAL_DEV(  0x03eb, 0x2002, 0x0100, 0x0100,
11554 @@ -160,34 +167,6 @@
11555                 US_SC_DEVICE, US_PR_DEVICE, NULL,
11556                 US_FL_MAX_SECTORS_64 ),
11557
11558 -/* Reported by Filip Joelsson <filip@blueturtle.nu> */
11559 -UNUSUAL_DEV(  0x0421, 0x005d, 0x0001, 0x0600,
11560 -               "Nokia",
11561 -               "Nokia 3110c",
11562 -               US_SC_DEVICE, US_PR_DEVICE, NULL,
11563 -               US_FL_FIX_CAPACITY ),
11564 -
11565 -/* Reported by Ozan Sener <themgzzy@gmail.com> */
11566 -UNUSUAL_DEV(  0x0421, 0x0060, 0x0551, 0x0551,
11567 -               "Nokia",
11568 -               "3500c",
11569 -               US_SC_DEVICE, US_PR_DEVICE, NULL,
11570 -               US_FL_FIX_CAPACITY ),
11571 -
11572 -/* Reported by CSECSY Laszlo <boobaa@frugalware.org> */
11573 -UNUSUAL_DEV(  0x0421, 0x0063, 0x0001, 0x0601,
11574 -               "Nokia",
11575 -               "Nokia 3109c",
11576 -               US_SC_DEVICE, US_PR_DEVICE, NULL,
11577 -               US_FL_FIX_CAPACITY ),
11578 -
11579 -/* Patch for Nokia 5310 capacity */
11580 -UNUSUAL_DEV(  0x0421, 0x006a, 0x0000, 0x0701,
11581 -               "Nokia",
11582 -               "5310",
11583 -               US_SC_DEVICE, US_PR_DEVICE, NULL,
11584 -               US_FL_FIX_CAPACITY ),
11585 -
11586  /* Reported by Mario Rettig <mariorettig@web.de> */
11587  UNUSUAL_DEV(  0x0421, 0x042e, 0x0100, 0x0100,
11588                 "Nokia",
11589 @@ -240,7 +219,7 @@
11590                 US_FL_MAX_SECTORS_64 ),
11591
11592  /* Reported by Manuel Osdoba <manuel.osdoba@tu-ilmenau.de> */
11593 -UNUSUAL_DEV( 0x0421, 0x0492, 0x0452, 0x0452,
11594 +UNUSUAL_DEV( 0x0421, 0x0492, 0x0452, 0x9999,
11595                 "Nokia",
11596                 "Nokia 6233",
11597                 US_SC_DEVICE, US_PR_DEVICE, NULL,
11598 @@ -253,35 +232,6 @@
11599                 US_SC_DEVICE, US_PR_DEVICE, NULL,
11600                 US_FL_MAX_SECTORS_64 ),
11601
11602 -/* Reported by Cedric Godin <cedric@belbone.be> */
11603 -UNUSUAL_DEV(  0x0421, 0x04b9, 0x0500, 0x0551,
11604 -               "Nokia",
11605 -               "5300",
11606 -               US_SC_DEVICE, US_PR_DEVICE, NULL,
11607 -               US_FL_FIX_CAPACITY ),
11608 -
11609 -/* Reported by Richard Nauber <RichardNauber@web.de> */
11610 -UNUSUAL_DEV(  0x0421, 0x04fa, 0x0550, 0x0660,
11611 -               "Nokia",
11612 -               "6300",
11613 -               US_SC_DEVICE, US_PR_DEVICE, NULL,
11614 -               US_FL_FIX_CAPACITY ),
11615 -
11616 -/* Patch for Nokia 5310 capacity */
11617 -UNUSUAL_DEV(  0x0421, 0x006a, 0x0000, 0x0591,
11618 -       "Nokia",
11619 -       "5310",
11620 -       US_SC_DEVICE, US_PR_DEVICE, NULL,
11621 -       US_FL_FIX_CAPACITY ),
11622 -
11623 -/* Submitted by Ricky Wong Yung Fei <evilbladewarrior@gmail.com> */
11624 -/* Nokia 7610 Supernova - Too many sectors reported in usb storage mode */
11625 -UNUSUAL_DEV(  0x0421, 0x00f5, 0x0000, 0x0470,
11626 -       "Nokia",
11627 -       "7610 Supernova",
11628 -       US_SC_DEVICE, US_PR_DEVICE, NULL,
11629 -       US_FL_FIX_CAPACITY ),
11630 -
11631  /* Reported by Olaf Hering <olh@suse.de> from novell bug #105878 */
11632  UNUSUAL_DEV(  0x0424, 0x0fdc, 0x0210, 0x0210,
11633                 "SMSC",
11634 @@ -396,83 +346,6 @@
11635                 US_SC_DEVICE, US_PR_DEVICE,NULL,
11636                 US_FL_NOT_LOCKABLE ),
11637
11638 -/* Reported by Stefan de Konink <skinkie@xs4all.nl> */
11639 -UNUSUAL_DEV(  0x04b0, 0x0401, 0x0200, 0x0200,
11640 -               "NIKON",
11641 -               "NIKON DSC D100",
11642 -               US_SC_DEVICE, US_PR_DEVICE, NULL,
11643 -               US_FL_FIX_CAPACITY),
11644 -
11645 -/* Reported by Tobias Kunze Briseno <t-linux@fictive.com> */
11646 -UNUSUAL_DEV(  0x04b0, 0x0403, 0x0200, 0x0200,
11647 -               "NIKON",
11648 -               "NIKON DSC D2H",
11649 -               US_SC_DEVICE, US_PR_DEVICE, NULL,
11650 -               US_FL_FIX_CAPACITY),
11651 -
11652 -/* Reported by Milinevsky Dmitry <niam.niam@gmail.com> */
11653 -UNUSUAL_DEV(  0x04b0, 0x0409, 0x0100, 0x0100,
11654 -               "NIKON",
11655 -               "NIKON DSC D50",
11656 -               US_SC_DEVICE, US_PR_DEVICE, NULL,
11657 -               US_FL_FIX_CAPACITY),
11658 -
11659 -/* Reported by Andreas Bockhold <andreas@bockionline.de> */
11660 -UNUSUAL_DEV(  0x04b0, 0x0405, 0x0100, 0x0100,
11661 -               "NIKON",
11662 -               "NIKON DSC D70",
11663 -               US_SC_DEVICE, US_PR_DEVICE, NULL,
11664 -               US_FL_FIX_CAPACITY),
11665 -
11666 -/* Reported by Jamie Kitson <jamie@staberinde.fsnet.co.uk> */
11667 -UNUSUAL_DEV(  0x04b0, 0x040d, 0x0100, 0x0100,
11668 -               "NIKON",
11669 -               "NIKON DSC D70s",
11670 -               US_SC_DEVICE, US_PR_DEVICE, NULL,
11671 -               US_FL_FIX_CAPACITY),
11672 -
11673 -/* Reported by Graber and Mike Pagano <mpagano-kernel@mpagano.com> */
11674 -UNUSUAL_DEV(  0x04b0, 0x040f, 0x0100, 0x0200,
11675 -               "NIKON",
11676 -               "NIKON DSC D200",
11677 -               US_SC_DEVICE, US_PR_DEVICE, NULL,
11678 -               US_FL_FIX_CAPACITY),
11679 -
11680 -/* Reported by Emil Larsson <emil@swip.net> */
11681 -UNUSUAL_DEV(  0x04b0, 0x0411, 0x0100, 0x0111,
11682 -               "NIKON",
11683 -               "NIKON DSC D80",
11684 -               US_SC_DEVICE, US_PR_DEVICE, NULL,
11685 -               US_FL_FIX_CAPACITY),
11686 -
11687 -/* Reported by Ortwin Glueck <odi@odi.ch> */
11688 -UNUSUAL_DEV(  0x04b0, 0x0413, 0x0110, 0x0111,
11689 -               "NIKON",
11690 -               "NIKON DSC D40",
11691 -               US_SC_DEVICE, US_PR_DEVICE, NULL,
11692 -               US_FL_FIX_CAPACITY),
11693 -
11694 -/* Reported by Paul Check <paul@openstreet.com> */
11695 -UNUSUAL_DEV(  0x04b0, 0x0415, 0x0100, 0x0100,
11696 -               "NIKON",
11697 -               "NIKON DSC D2Xs",
11698 -               US_SC_DEVICE, US_PR_DEVICE, NULL,
11699 -               US_FL_FIX_CAPACITY),
11700 -
11701 -/* Reported by Shan Destromp (shansan@gmail.com) */
11702 -UNUSUAL_DEV(  0x04b0, 0x0417, 0x0100, 0x0100,
11703 -               "NIKON",
11704 -               "NIKON DSC D40X",
11705 -               US_SC_DEVICE, US_PR_DEVICE, NULL,
11706 -               US_FL_FIX_CAPACITY),
11707 -
11708 -/* Reported by paul ready <lxtwin@homecall.co.uk> */
11709 -UNUSUAL_DEV(  0x04b0, 0x0419, 0x0100, 0x0200,
11710 -               "NIKON",
11711 -               "NIKON DSC D300",
11712 -               US_SC_DEVICE, US_PR_DEVICE, NULL,
11713 -               US_FL_FIX_CAPACITY),
11714 -
11715  /* Reported by Doug Maxey (dwm@austin.ibm.com) */
11716  UNUSUAL_DEV(  0x04b3, 0x4001, 0x0110, 0x0110,
11717                 "IBM",
11718 @@ -685,6 +558,13 @@
11719                 US_SC_8070, US_PR_DEVICE, NULL,
11720                 US_FL_FIX_INQUIRY ),
11721
11722 +/* Added by Alan Stern <stern@rowland.harvard.edu> */
11723 +COMPLIANT_DEV(0x0525, 0xa4a5, 0x0000, 0x9999,
11724 +               "Linux",
11725 +               "File-backed Storage Gadget",
11726 +               US_SC_DEVICE, US_PR_DEVICE, NULL,
11727 +               US_FL_CAPACITY_OK ),
11728 +
11729  /* Yakumo Mega Image 37
11730   * Submitted by Stephan Fuhrmann <atomenergie@t-online.de> */
11731  UNUSUAL_DEV(  0x052b, 0x1801, 0x0100, 0x0100,
11732 @@ -996,13 +876,13 @@
11733                 "Genesys Logic",
11734                 "USB to IDE Optical",
11735                 US_SC_DEVICE, US_PR_DEVICE, NULL,
11736 -               US_FL_GO_SLOW | US_FL_MAX_SECTORS_64 ),
11737 +               US_FL_GO_SLOW | US_FL_MAX_SECTORS_64 | US_FL_IGNORE_RESIDUE ),
11738
11739  UNUSUAL_DEV(  0x05e3, 0x0702, 0x0000, 0xffff,
11740                 "Genesys Logic",
11741                 "USB to IDE Disk",
11742                 US_SC_DEVICE, US_PR_DEVICE, NULL,
11743 -               US_FL_GO_SLOW | US_FL_MAX_SECTORS_64 ),
11744 +               US_FL_GO_SLOW | US_FL_MAX_SECTORS_64 | US_FL_IGNORE_RESIDUE ),
11745
11746  /* Reported by Hanno Boeck <hanno@gmx.de>
11747   * Taken from the Lycoris Kernel */
11748 @@ -1033,14 +913,16 @@
11749                 US_FL_FIX_CAPACITY ),
11750
11751  /* Reported by Richard -=[]=- <micro_flyer@hotmail.com> */
11752 -UNUSUAL_DEV( 0x067b, 0x2507, 0x0100, 0x0100,
11753 +/* Change to bcdDeviceMin (0x0100 to 0x0001) reported by
11754 + * Thomas Bartosik <tbartdev@gmx-topmail.de> */
11755 +UNUSUAL_DEV( 0x067b, 0x2507, 0x0001, 0x0100,
11756                 "Prolific Technology Inc.",
11757                 "Mass Storage Device",
11758                 US_SC_DEVICE, US_PR_DEVICE, NULL,
11759                 US_FL_FIX_CAPACITY | US_FL_GO_SLOW ),
11760
11761  /* Reported by Alex Butcher <alex.butcher@assursys.co.uk> */
11762 -UNUSUAL_DEV( 0x067b, 0x3507, 0x0001, 0x0001,
11763 +UNUSUAL_DEV( 0x067b, 0x3507, 0x0001, 0x0101,
11764                 "Prolific Technology Inc.",
11765                 "ATAPI-6 Bridge Controller",
11766                 US_SC_DEVICE, US_PR_DEVICE, NULL,
11767 @@ -1282,12 +1164,14 @@
11768                 US_SC_DEVICE, US_PR_DEVICE, NULL,
11769                 US_FL_FIX_INQUIRY ),
11770
11771 -/* Reported by Rauch Wolke <rauchwolke@gmx.net> */
11772 +/* Reported by Rauch Wolke <rauchwolke@gmx.net>
11773 + * and augmented by binbin <binbinsh@gmail.com> (Bugzilla #12882)
11774 + */
11775  UNUSUAL_DEV(  0x07c4, 0xa4a5, 0x0000, 0xffff,
11776                 "Simple Tech/Datafab",
11777                 "CF+SM Reader",
11778                 US_SC_DEVICE, US_PR_DEVICE, NULL,
11779 -               US_FL_IGNORE_RESIDUE ),
11780 +               US_FL_IGNORE_RESIDUE | US_FL_MAX_SECTORS_64 ),
11781
11782  /* Casio QV 2x00/3x00/4000/8000 digital still cameras are not conformant
11783   * to the USB storage specification in two ways:
11784 @@ -1320,6 +1204,13 @@
11785                 US_SC_DEVICE, US_PR_DEVICE, NULL,
11786                 US_FL_FIX_CAPACITY),
11787
11788 +/* Reported and patched by Nguyen Anh Quynh <aquynh@gmail.com> */
11789 +UNUSUAL_DEV( 0x0840, 0x0084, 0x0001, 0x0001,
11790 +               "Argosy",
11791 +               "Storage",
11792 +               US_SC_DEVICE, US_PR_DEVICE, NULL,
11793 +               US_FL_FIX_CAPACITY),
11794 +
11795  /* Entry and supporting patch by Theodore Kilgore <kilgota@auburn.edu>.
11796   * Flag will support Bulk devices which use a standards-violating 32-byte
11797   * Command Block Wrapper. Here, the "DC2MEGA" cameras (several brands) with
11798 @@ -1417,14 +1308,6 @@
11799                 US_SC_DEVICE, US_PR_DEVICE, NULL,
11800                 US_FL_FIX_INQUIRY ),
11801
11802 -
11803 -/* Submitted by Per Winkvist <per.winkvist@uk.com> */
11804 -UNUSUAL_DEV( 0x0a17, 0x006, 0x0000, 0xffff,
11805 -               "Pentax",
11806 -               "Optio S/S4",
11807 -               US_SC_DEVICE, US_PR_DEVICE, NULL,
11808 -               US_FL_FIX_INQUIRY ),
11809 -
11810  /* These are virtual windows driver CDs, which the zd1211rw driver
11811   * automatically converts into WLAN devices. */
11812  UNUSUAL_DEV( 0x0ace, 0x2011, 0x0101, 0x0101,
11813 @@ -1449,6 +1332,16 @@
11814                 US_SC_DEVICE, US_PR_DEVICE, NULL,
11815                 0 ),
11816
11817 +/* Reported by Jan Dumon <j.dumon@option.com>
11818 + * This device (wrongly) has a vendor-specific device descriptor.
11819 + * The entry is needed so usb-storage can bind to it's mass-storage
11820 + * interface as an interface driver */
11821 +UNUSUAL_DEV( 0x0af0, 0x7501, 0x0000, 0x0000,
11822 +               "Option",
11823 +               "GI 0431 SD-Card",
11824 +               US_SC_DEVICE, US_PR_DEVICE, NULL,
11825 +               0 ),
11826 +
11827  #ifdef CONFIG_USB_STORAGE_ISD200
11828  UNUSUAL_DEV(  0x0bf6, 0xa001, 0x0100, 0x0110,
11829                 "ATI",
11830 @@ -2076,6 +1969,12 @@
11831                 US_SC_DEVICE, US_PR_DEVICE, NULL,
11832                 US_FL_IGNORE_DEVICE),
11833
11834 +UNUSUAL_DEV( 0x2116, 0x0320, 0x0001, 0x0001,
11835 +               "ST",
11836 +               "2A",
11837 +               US_SC_DEVICE, US_PR_DEVICE, NULL,
11838 +               US_FL_FIX_CAPACITY),
11839 +
11840  /* patch submitted by Davide Perini <perini.davide@dpsoftware.org>
11841   * and Renato Perini <rperini@email.it>
11842   */
11843 @@ -2086,27 +1985,6 @@
11844                 US_FL_FIX_CAPACITY | US_FL_IGNORE_RESIDUE ),
11845
11846  /*
11847 - * Patch by Pete Zaitcev <zaitcev@redhat.com>
11848 - * Report by Mark Patton. Red Hat bz#208928.
11849 - * Added support for rev 0x0002 (Motorola ROKR W5)
11850 - * by Javier Smaldone <javier@smaldone.com.ar>
11851 - */
11852 -UNUSUAL_DEV(  0x22b8, 0x4810, 0x0001, 0x0002,
11853 -               "Motorola",
11854 -               "RAZR V3i/ROKR W5",
11855 -               US_SC_DEVICE, US_PR_DEVICE, NULL,
11856 -               US_FL_FIX_CAPACITY),
11857 -
11858 -/*
11859 - * Patch by Jost Diederichs <jost@qdusa.com>
11860 - */
11861 -UNUSUAL_DEV(0x22b8, 0x6410, 0x0001, 0x9999,
11862 -               "Motorola Inc.",
11863 -               "Motorola Phone (RAZRV3xx)",
11864 -               US_SC_DEVICE, US_PR_DEVICE, NULL,
11865 -               US_FL_FIX_CAPACITY),
11866 -
11867 -/*
11868   * Patch by Constantin Baranov <const@tltsu.ru>
11869   * Report by Andreas Koenecke.
11870   * Motorola ROKR Z6.
11871 --- kernel-power-2.6.28.orig/drivers/usb/storage/usb.c
11872 +++ kernel-power-2.6.28/drivers/usb/storage/usb.c
11873 @@ -126,6 +126,8 @@
11874  { USB_DEVICE_VER(id_vendor, id_product, bcdDeviceMin,bcdDeviceMax), \
11875    .driver_info = (flags)|(USB_US_TYPE_STOR<<24) }
11876
11877 +#define COMPLIANT_DEV  UNUSUAL_DEV
11878 +
11879  #define USUAL_DEV(useProto, useTrans, useType) \
11880  { USB_INTERFACE_INFO(USB_CLASS_MASS_STORAGE, useProto, useTrans), \
11881    .driver_info = (USB_US_TYPE_STOR<<24) }
11882 @@ -134,6 +136,7 @@
11883
11884  #      include "unusual_devs.h"
11885  #undef UNUSUAL_DEV
11886 +#undef COMPLIANT_DEV
11887  #undef USUAL_DEV
11888         /* Terminating entry */
11889         { }
11890 @@ -164,6 +167,8 @@
11891         .initFunction = init_function,  \
11892  }
11893
11894 +#define COMPLIANT_DEV  UNUSUAL_DEV
11895 +
11896  #define USUAL_DEV(use_protocol, use_transport, use_type) \
11897  { \
11898         .useProtocol = use_protocol,    \
11899 @@ -173,6 +178,7 @@
11900  static struct us_unusual_dev us_unusual_dev_list[] = {
11901  #      include "unusual_devs.h"
11902  #      undef UNUSUAL_DEV
11903 +#      undef COMPLIANT_DEV
11904  #      undef USUAL_DEV
11905
11906         /* Terminating entry */
11907 --- kernel-power-2.6.28.orig/drivers/usb/storage/usb.h
11908 +++ kernel-power-2.6.28/drivers/usb/storage/usb.h
11909 @@ -155,6 +155,10 @@
11910  #ifdef CONFIG_PM
11911         pm_hook                 suspend_resume_hook;
11912  #endif
11913 +
11914 +       /* hacks for READ CAPACITY bug handling */
11915 +       int                     use_last_sector_hacks;
11916 +       int                     last_sector_retries;
11917  };
11918
11919  /* Convert between us_data and the corresponding Scsi_Host */
11920 --- kernel-power-2.6.28.orig/drivers/video/aty/mach64_ct.c
11921 +++ kernel-power-2.6.28/drivers/video/aty/mach64_ct.c
11922 @@ -8,6 +8,9 @@
11923  #include <asm/io.h>
11924  #include <video/mach64.h>
11925  #include "atyfb.h"
11926 +#ifdef CONFIG_PPC
11927 +#include <asm/machdep.h>
11928 +#endif
11929
11930  #undef DEBUG
11931
11932 @@ -536,6 +539,14 @@
11933         pll->ct.xclk_post_div_real = postdividers[xpost_div];
11934         pll->ct.mclk_fb_div = q * pll->ct.xclk_post_div_real / 8;
11935
11936 +#ifdef CONFIG_PPC
11937 +       if (machine_is(powermac)) {
11938 +               /* Override PLL_EXT_CNTL & 0x07. */
11939 +               pll->ct.xclk_post_div = xpost_div;
11940 +               pll->ct.xclk_ref_div = 1;
11941 +       }
11942 +#endif
11943 +
11944  #ifdef DEBUG
11945         pllmclk = (1000000 * pll->ct.mclk_fb_mult * pll->ct.mclk_fb_div) /
11946                         (par->ref_clk_per * pll->ct.pll_ref_div);
11947 --- kernel-power-2.6.28.orig/drivers/w1/slaves/w1_therm.c
11948 +++ kernel-power-2.6.28/drivers/w1/slaves/w1_therm.c
11949 @@ -115,7 +115,7 @@
11950
11951  static inline int w1_DS18B20_convert_temp(u8 rom[9])
11952  {
11953 -       s16 t = (rom[1] << 8) | rom[0];
11954 +       int t = ((s16)rom[1] << 8) | rom[0];
11955         t = t*1000/16;
11956         return t;
11957  }
11958 --- kernel-power-2.6.28.orig/drivers/watchdog/Kconfig
11959 +++ kernel-power-2.6.28/drivers/watchdog/Kconfig
11960 @@ -406,7 +406,7 @@
11961         ---help---
11962           Hardware driver for the intel TCO timer based watchdog devices.
11963           These drivers are included in the Intel 82801 I/O Controller
11964 -         Hub family (from ICH0 up to ICH8) and in the Intel 6300ESB
11965 +         Hub family (from ICH0 up to ICH10) and in the Intel 63xxESB
11966           controller hub.
11967
11968           The TCO (Total Cost of Ownership) timer is a watchdog timer
11969 --- kernel-power-2.6.28.orig/drivers/watchdog/iTCO_vendor_support.c
11970 +++ kernel-power-2.6.28/drivers/watchdog/iTCO_vendor_support.c
11971 @@ -1,7 +1,7 @@
11972  /*
11973   *     intel TCO vendor specific watchdog driver support
11974   *
11975 - *     (c) Copyright 2006-2008 Wim Van Sebroeck <wim@iguana.be>.
11976 + *     (c) Copyright 2006-2009 Wim Van Sebroeck <wim@iguana.be>.
11977   *
11978   *     This program is free software; you can redistribute it and/or
11979   *     modify it under the terms of the GNU General Public License
11980 @@ -19,7 +19,7 @@
11981
11982  /* Module and version information */
11983  #define DRV_NAME       "iTCO_vendor_support"
11984 -#define DRV_VERSION    "1.02"
11985 +#define DRV_VERSION    "1.03"
11986  #define PFX            DRV_NAME ": "
11987
11988  /* Includes */
11989 @@ -77,6 +77,26 @@
11990   *         20.6 seconds.
11991   */
11992
11993 +static void supermicro_old_pre_start(unsigned long acpibase)
11994 +{
11995 +       unsigned long val32;
11996 +
11997 +       /* Bit 13: TCO_EN -> 0 = Disables TCO logic generating an SMI# */
11998 +       val32 = inl(SMI_EN);
11999 +       val32 &= 0xffffdfff;    /* Turn off SMI clearing watchdog */
12000 +       outl(val32, SMI_EN);    /* Needed to activate watchdog */
12001 +}
12002 +
12003 +static void supermicro_old_pre_stop(unsigned long acpibase)
12004 +{
12005 +       unsigned long val32;
12006 +
12007 +       /* Bit 13: TCO_EN -> 1 = Enables the TCO logic to generate SMI# */
12008 +       val32 = inl(SMI_EN);
12009 +       val32 |= 0x00002000;    /* Turn on SMI clearing watchdog */
12010 +       outl(val32, SMI_EN);    /* Needed to deactivate watchdog */
12011 +}
12012 +
12013  static void supermicro_old_pre_keepalive(unsigned long acpibase)
12014  {
12015         /* Reload TCO Timer (done in iTCO_wdt_keepalive) + */
12016 @@ -228,14 +248,18 @@
12017  void iTCO_vendor_pre_start(unsigned long acpibase,
12018                            unsigned int heartbeat)
12019  {
12020 -       if (vendorsupport == SUPERMICRO_NEW_BOARD)
12021 +       if (vendorsupport == SUPERMICRO_OLD_BOARD)
12022 +               supermicro_old_pre_start(acpibase);
12023 +       else if (vendorsupport == SUPERMICRO_NEW_BOARD)
12024                 supermicro_new_pre_start(heartbeat);
12025  }
12026  EXPORT_SYMBOL(iTCO_vendor_pre_start);
12027
12028  void iTCO_vendor_pre_stop(unsigned long acpibase)
12029  {
12030 -       if (vendorsupport == SUPERMICRO_NEW_BOARD)
12031 +       if (vendorsupport == SUPERMICRO_OLD_BOARD)
12032 +               supermicro_old_pre_stop(acpibase);
12033 +       else if (vendorsupport == SUPERMICRO_NEW_BOARD)
12034                 supermicro_new_pre_stop();
12035  }
12036  EXPORT_SYMBOL(iTCO_vendor_pre_stop);
12037 --- kernel-power-2.6.28.orig/drivers/watchdog/iTCO_wdt.c
12038 +++ kernel-power-2.6.28/drivers/watchdog/iTCO_wdt.c
12039 @@ -1,7 +1,7 @@
12040  /*
12041 - *     intel TCO Watchdog Driver (Used in i82801 and i6300ESB chipsets)
12042 + *     intel TCO Watchdog Driver (Used in i82801 and i63xxESB chipsets)
12043   *
12044 - *     (c) Copyright 2006-2008 Wim Van Sebroeck <wim@iguana.be>.
12045 + *     (c) Copyright 2006-2009 Wim Van Sebroeck <wim@iguana.be>.
12046   *
12047   *     This program is free software; you can redistribute it and/or
12048   *     modify it under the terms of the GNU General Public License
12049 @@ -63,7 +63,7 @@
12050
12051  /* Module and version information */
12052  #define DRV_NAME       "iTCO_wdt"
12053 -#define DRV_VERSION    "1.04"
12054 +#define DRV_VERSION    "1.05"
12055  #define PFX            DRV_NAME ": "
12056
12057  /* Includes */
12058 @@ -236,16 +236,16 @@
12059
12060  /* Address definitions for the TCO */
12061  /* TCO base address */
12062 -#define        TCOBASE         iTCO_wdt_private.ACPIBASE + 0x60
12063 +#define TCOBASE                iTCO_wdt_private.ACPIBASE + 0x60
12064  /* SMI Control and Enable Register */
12065 -#define        SMI_EN          iTCO_wdt_private.ACPIBASE + 0x30
12066 +#define SMI_EN         iTCO_wdt_private.ACPIBASE + 0x30
12067
12068  #define TCO_RLD                TCOBASE + 0x00  /* TCO Timer Reload and Curr. Value */
12069  #define TCOv1_TMR      TCOBASE + 0x01  /* TCOv1 Timer Initial Value    */
12070 -#define        TCO_DAT_IN      TCOBASE + 0x02  /* TCO Data In Register         */
12071 -#define        TCO_DAT_OUT     TCOBASE + 0x03  /* TCO Data Out Register        */
12072 -#define        TCO1_STS        TCOBASE + 0x04  /* TCO1 Status Register         */
12073 -#define        TCO2_STS        TCOBASE + 0x06  /* TCO2 Status Register         */
12074 +#define TCO_DAT_IN     TCOBASE + 0x02  /* TCO Data In Register         */
12075 +#define TCO_DAT_OUT    TCOBASE + 0x03  /* TCO Data Out Register        */
12076 +#define TCO1_STS       TCOBASE + 0x04  /* TCO1 Status Register         */
12077 +#define TCO2_STS       TCOBASE + 0x06  /* TCO2 Status Register         */
12078  #define TCO1_CNT       TCOBASE + 0x08  /* TCO1 Control Register        */
12079  #define TCO2_CNT       TCOBASE + 0x0a  /* TCO2 Control Register        */
12080  #define TCOv2_TMR      TCOBASE + 0x12  /* TCOv2 Timer Initial Value    */
12081 @@ -338,7 +338,6 @@
12082  static int iTCO_wdt_start(void)
12083  {
12084         unsigned int val;
12085 -       unsigned long val32;
12086
12087         spin_lock(&iTCO_wdt_private.io_lock);
12088
12089 @@ -351,11 +350,6 @@
12090                 return -EIO;
12091         }
12092
12093 -       /* Bit 13: TCO_EN -> 0 = Disables TCO logic generating an SMI# */
12094 -       val32 = inl(SMI_EN);
12095 -       val32 &= 0xffffdfff;    /* Turn off SMI clearing watchdog */
12096 -       outl(val32, SMI_EN);
12097 -
12098         /* Force the timer to its reload value by writing to the TCO_RLD
12099            register */
12100         if (iTCO_wdt_private.iTCO_version == 2)
12101 @@ -378,7 +372,6 @@
12102  static int iTCO_wdt_stop(void)
12103  {
12104         unsigned int val;
12105 -       unsigned long val32;
12106
12107         spin_lock(&iTCO_wdt_private.io_lock);
12108
12109 @@ -390,11 +383,6 @@
12110         outw(val, TCO1_CNT);
12111         val = inw(TCO1_CNT);
12112
12113 -       /* Bit 13: TCO_EN -> 1 = Enables the TCO logic to generate SMI# */
12114 -       val32 = inl(SMI_EN);
12115 -       val32 |= 0x00002000;
12116 -       outl(val32, SMI_EN);
12117 -
12118         /* Set the NO_REBOOT bit to prevent later reboots, just for sure */
12119         iTCO_wdt_set_NO_REBOOT_bit();
12120
12121 @@ -649,6 +637,7 @@
12122         int ret;
12123         u32 base_address;
12124         unsigned long RCBA;
12125 +       unsigned long val32;
12126
12127         /*
12128          *      Find the ACPI/PM base I/O address which is the base
12129 @@ -695,6 +684,10 @@
12130                 ret = -EIO;
12131                 goto out;
12132         }
12133 +       /* Bit 13: TCO_EN -> 0 = Disables TCO logic generating an SMI# */
12134 +       val32 = inl(SMI_EN);
12135 +       val32 &= 0xffffdfff;    /* Turn off SMI clearing watchdog */
12136 +       outl(val32, SMI_EN);
12137
12138         /* The TCO I/O registers reside in a 32-byte range pointed to
12139            by the TCOBASE value */
12140 --- kernel-power-2.6.28.orig/drivers/watchdog/ks8695_wdt.c
12141 +++ kernel-power-2.6.28/drivers/watchdog/ks8695_wdt.c
12142 @@ -21,6 +21,7 @@
12143  #include <linux/watchdog.h>
12144  #include <linux/io.h>
12145  #include <linux/uaccess.h>
12146 +#include <mach/timex.h>
12147  #include <mach/regs-timer.h>
12148
12149  #define WDT_DEFAULT_TIME       5       /* seconds */
12150 --- kernel-power-2.6.28.orig/drivers/watchdog/rc32434_wdt.c
12151 +++ kernel-power-2.6.28/drivers/watchdog/rc32434_wdt.c
12152 @@ -34,104 +34,89 @@
12153  #include <asm/time.h>
12154  #include <asm/mach-rc32434/integ.h>
12155
12156 -#define MAX_TIMEOUT                    20
12157 -#define RC32434_WDT_INTERVAL           (15 * HZ)
12158 -
12159 -#define VERSION "0.2"
12160 +#define VERSION "0.4"
12161
12162  static struct {
12163 -       struct completion stop;
12164 -       int running;
12165 -       struct timer_list timer;
12166 -       int queue;
12167 -       int default_ticks;
12168         unsigned long inuse;
12169  } rc32434_wdt_device;
12170
12171  static struct integ __iomem *wdt_reg;
12172 -static int ticks = 100 * HZ;
12173
12174  static int expect_close;
12175 -static int timeout;
12176 +
12177 +/* Board internal clock speed in Hz,
12178 + * the watchdog timer ticks at. */
12179 +extern unsigned int idt_cpu_freq;
12180 +
12181 +/* translate wtcompare value to seconds and vice versa */
12182 +#define WTCOMP2SEC(x)  (x / idt_cpu_freq)
12183 +#define SEC2WTCOMP(x)  (x * idt_cpu_freq)
12184 +
12185 +/* Use a default timeout of 20s. This should be
12186 + * safe for CPU clock speeds up to 400MHz, as
12187 + * ((2 ^ 32) - 1) / (400MHz / 2) = 21s.  */
12188 +#define WATCHDOG_TIMEOUT 20
12189 +
12190 +static int timeout = WATCHDOG_TIMEOUT;
12191
12192  static int nowayout = WATCHDOG_NOWAYOUT;
12193  module_param(nowayout, int, 0);
12194  MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default="
12195         __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
12196
12197 +/* apply or and nand masks to data read from addr and write back */
12198 +#define SET_BITS(addr, or, nand) \
12199 +       writel((readl(&addr) | or) & ~nand, &addr)
12200
12201  static void rc32434_wdt_start(void)
12202  {
12203 -       u32 val;
12204 +       u32 or, nand;
12205
12206 -       if (!rc32434_wdt_device.inuse) {
12207 -               writel(0, &wdt_reg->wtcount);
12208 +       /* zero the counter before enabling */
12209 +       writel(0, &wdt_reg->wtcount);
12210
12211 -               val = RC32434_ERR_WRE;
12212 -               writel(readl(&wdt_reg->errcs) | val, &wdt_reg->errcs);
12213 +       /* don't generate a non-maskable interrupt,
12214 +        * do a warm reset instead */
12215 +       nand = 1 << RC32434_ERR_WNE;
12216 +       or = 1 << RC32434_ERR_WRE;
12217
12218 -               val = RC32434_WTC_EN;
12219 -               writel(readl(&wdt_reg->wtc) | val, &wdt_reg->wtc);
12220 -       }
12221 -       rc32434_wdt_device.running++;
12222 -}
12223 +       /* reset the ERRCS timeout bit in case it's set */
12224 +       nand |= 1 << RC32434_ERR_WTO;
12225
12226 -static void rc32434_wdt_stop(void)
12227 -{
12228 -       u32 val;
12229 -
12230 -       if (rc32434_wdt_device.running) {
12231 +       SET_BITS(wdt_reg->errcs, or, nand);
12232
12233 -               val = ~RC32434_WTC_EN;
12234 -               writel(readl(&wdt_reg->wtc) & val, &wdt_reg->wtc);
12235 +       /* reset WTC timeout bit and enable WDT */
12236 +       nand = 1 << RC32434_WTC_TO;
12237 +       or = 1 << RC32434_WTC_EN;
12238
12239 -               val = ~RC32434_ERR_WRE;
12240 -               writel(readl(&wdt_reg->errcs) & val, &wdt_reg->errcs);
12241 +       SET_BITS(wdt_reg->wtc, or, nand);
12242 +}
12243
12244 -               rc32434_wdt_device.running = 0;
12245 -       }
12246 +static void rc32434_wdt_stop(void)
12247 +{
12248 +       /* Disable WDT */
12249 +       SET_BITS(wdt_reg->wtc, 0, 1 << RC32434_WTC_EN);
12250  }
12251
12252 -static void rc32434_wdt_set(int new_timeout)
12253 +static int rc32434_wdt_set(int new_timeout)
12254  {
12255 -       u32 cmp = new_timeout * HZ;
12256 -       u32 state, val;
12257 +       int max_to = WTCOMP2SEC((u32)-1);
12258
12259 +       if (new_timeout < 0 || new_timeout > max_to) {
12260 +               printk(KERN_ERR KBUILD_MODNAME
12261 +                       ": timeout value must be between 0 and %d",
12262 +                       max_to);
12263 +               return -EINVAL;
12264 +       }
12265         timeout = new_timeout;
12266 -       /*
12267 -        * store and disable WTC
12268 -        */
12269 -       state = (u32)(readl(&wdt_reg->wtc) & RC32434_WTC_EN);
12270 -       val = ~RC32434_WTC_EN;
12271 -       writel(readl(&wdt_reg->wtc) & val, &wdt_reg->wtc);
12272 -
12273 -       writel(0, &wdt_reg->wtcount);
12274 -       writel(cmp, &wdt_reg->wtcompare);
12275 -
12276 -       /*
12277 -        * restore WTC
12278 -        */
12279 +       writel(SEC2WTCOMP(timeout), &wdt_reg->wtcompare);
12280
12281 -       writel(readl(&wdt_reg->wtc) | state, &wdt_reg);
12282 -}
12283 -
12284 -static void rc32434_wdt_reset(void)
12285 -{
12286 -       ticks = rc32434_wdt_device.default_ticks;
12287 +       return 0;
12288  }
12289
12290 -static void rc32434_wdt_update(unsigned long unused)
12291 +static void rc32434_wdt_ping(void)
12292  {
12293 -       if (rc32434_wdt_device.running)
12294 -               ticks--;
12295 -
12296         writel(0, &wdt_reg->wtcount);
12297 -
12298 -       if (rc32434_wdt_device.queue && ticks)
12299 -               mod_timer(&rc32434_wdt_device.timer,
12300 -                       jiffies + RC32434_WDT_INTERVAL);
12301 -       else
12302 -               complete(&rc32434_wdt_device.stop);
12303  }
12304
12305  static int rc32434_wdt_open(struct inode *inode, struct file *file)
12306 @@ -142,19 +127,23 @@
12307         if (nowayout)
12308                 __module_get(THIS_MODULE);
12309
12310 +       rc32434_wdt_start();
12311 +       rc32434_wdt_ping();
12312 +
12313         return nonseekable_open(inode, file);
12314  }
12315
12316  static int rc32434_wdt_release(struct inode *inode, struct file *file)
12317  {
12318 -       if (expect_close && nowayout == 0) {
12319 +       if (expect_close == 42) {
12320                 rc32434_wdt_stop();
12321                 printk(KERN_INFO KBUILD_MODNAME ": disabling watchdog timer\n");
12322                 module_put(THIS_MODULE);
12323 -       } else
12324 +       } else {
12325                 printk(KERN_CRIT KBUILD_MODNAME
12326                         ": device closed unexpectedly. WDT will not stop !\n");
12327 -
12328 +               rc32434_wdt_ping();
12329 +       }
12330         clear_bit(0, &rc32434_wdt_device.inuse);
12331         return 0;
12332  }
12333 @@ -174,10 +163,10 @@
12334                                 if (get_user(c, data + i))
12335                                         return -EFAULT;
12336                                 if (c == 'V')
12337 -                                       expect_close = 1;
12338 +                                       expect_close = 42;
12339                         }
12340                 }
12341 -               rc32434_wdt_update(0);
12342 +               rc32434_wdt_ping();
12343                 return len;
12344         }
12345         return 0;
12346 @@ -197,11 +186,11 @@
12347         };
12348         switch (cmd) {
12349         case WDIOC_KEEPALIVE:
12350 -               rc32434_wdt_reset();
12351 +               rc32434_wdt_ping();
12352                 break;
12353         case WDIOC_GETSTATUS:
12354         case WDIOC_GETBOOTSTATUS:
12355 -               value = readl(&wdt_reg->wtcount);
12356 +               value = 0;
12357                 if (copy_to_user(argp, &value, sizeof(int)))
12358                         return -EFAULT;
12359                 break;
12360 @@ -218,6 +207,7 @@
12361                         break;
12362                 case WDIOS_DISABLECARD:
12363                         rc32434_wdt_stop();
12364 +                       break;
12365                 default:
12366                         return -EINVAL;
12367                 }
12368 @@ -225,11 +215,9 @@
12369         case WDIOC_SETTIMEOUT:
12370                 if (copy_from_user(&new_timeout, argp, sizeof(int)))
12371                         return -EFAULT;
12372 -               if (new_timeout < 1)
12373 +               if (rc32434_wdt_set(new_timeout))
12374                         return -EINVAL;
12375 -               if (new_timeout > MAX_TIMEOUT)
12376 -                       return -EINVAL;
12377 -               rc32434_wdt_set(new_timeout);
12378 +               /* Fall through */
12379         case WDIOC_GETTIMEOUT:
12380                 return copy_to_user(argp, &timeout, sizeof(int));
12381         default:
12382 @@ -254,15 +242,15 @@
12383         .fops   = &rc32434_wdt_fops,
12384  };
12385
12386 -static char banner[] = KERN_INFO KBUILD_MODNAME
12387 +static char banner[] __devinitdata = KERN_INFO KBUILD_MODNAME
12388                 ": Watchdog Timer version " VERSION ", timer margin: %d sec\n";
12389
12390 -static int rc32434_wdt_probe(struct platform_device *pdev)
12391 +static int __devinit rc32434_wdt_probe(struct platform_device *pdev)
12392  {
12393         int ret;
12394         struct resource *r;
12395
12396 -       r = platform_get_resource_byname(pdev, IORESOURCE_MEM, "rb500_wdt_res");
12397 +       r = platform_get_resource_byname(pdev, IORESOURCE_MEM, "rb532_wdt_res");
12398         if (!r) {
12399                 printk(KERN_ERR KBUILD_MODNAME
12400                         "failed to retrieve resources\n");
12401 @@ -277,24 +265,12 @@
12402         }
12403
12404         ret = misc_register(&rc32434_wdt_miscdev);
12405 -
12406         if (ret < 0) {
12407                 printk(KERN_ERR KBUILD_MODNAME
12408                         "failed to register watchdog device\n");
12409                 goto unmap;
12410         }
12411
12412 -       init_completion(&rc32434_wdt_device.stop);
12413 -       rc32434_wdt_device.queue = 0;
12414 -
12415 -       clear_bit(0, &rc32434_wdt_device.inuse);
12416 -
12417 -       setup_timer(&rc32434_wdt_device.timer, rc32434_wdt_update, 0L);
12418 -
12419 -       rc32434_wdt_device.default_ticks = ticks;
12420 -
12421 -       rc32434_wdt_start();
12422 -
12423         printk(banner, timeout);
12424
12425         return 0;
12426 @@ -304,23 +280,17 @@
12427         return ret;
12428  }
12429
12430 -static int rc32434_wdt_remove(struct platform_device *pdev)
12431 +static int __devexit rc32434_wdt_remove(struct platform_device *pdev)
12432  {
12433 -       if (rc32434_wdt_device.queue) {
12434 -               rc32434_wdt_device.queue = 0;
12435 -               wait_for_completion(&rc32434_wdt_device.stop);
12436 -       }
12437         misc_deregister(&rc32434_wdt_miscdev);
12438 -
12439         iounmap(wdt_reg);
12440 -
12441         return 0;
12442  }
12443
12444  static struct platform_driver rc32434_wdt = {
12445         .probe  = rc32434_wdt_probe,
12446 -       .remove = rc32434_wdt_remove,
12447 -       .driver = {
12448 +       .remove = __devexit_p(rc32434_wdt_remove),
12449 +       .driver = {
12450                 .name = "rc32434_wdt",
12451         }
12452  };
12453 --- kernel-power-2.6.28.orig/drivers/xen/balloon.c
12454 +++ kernel-power-2.6.28/drivers/xen/balloon.c
12455 @@ -488,7 +488,7 @@
12456         if (!capable(CAP_SYS_ADMIN))
12457                 return -EPERM;
12458
12459 -       target_bytes = memparse(buf, &endchar);
12460 +       target_bytes = simple_strtoull(buf, &endchar, 0) * 1024;
12461
12462         balloon_set_new_target(target_bytes >> PAGE_SHIFT);
12463
12464 @@ -498,8 +498,39 @@
12465  static SYSDEV_ATTR(target_kb, S_IRUGO | S_IWUSR,
12466                    show_target_kb, store_target_kb);
12467
12468 +
12469 +static ssize_t show_target(struct sys_device *dev, struct sysdev_attribute *attr,
12470 +                             char *buf)
12471 +{
12472 +       return sprintf(buf, "%llu\n",
12473 +                      (u64)balloon_stats.target_pages << PAGE_SHIFT);
12474 +}
12475 +
12476 +static ssize_t store_target(struct sys_device *dev,
12477 +                           struct sysdev_attribute *attr,
12478 +                           const char *buf,
12479 +                           size_t count)
12480 +{
12481 +       char *endchar;
12482 +       unsigned long long target_bytes;
12483 +
12484 +       if (!capable(CAP_SYS_ADMIN))
12485 +               return -EPERM;
12486 +
12487 +       target_bytes = memparse(buf, &endchar);
12488 +
12489 +       balloon_set_new_target(target_bytes >> PAGE_SHIFT);
12490 +
12491 +       return count;
12492 +}
12493 +
12494 +static SYSDEV_ATTR(target, S_IRUGO | S_IWUSR,
12495 +                  show_target, store_target);
12496 +
12497 +
12498  static struct sysdev_attribute *balloon_attrs[] = {
12499         &attr_target_kb,
12500 +       &attr_target,
12501  };
12502
12503  static struct attribute *balloon_info_attrs[] = {
12504 --- kernel-power-2.6.28.orig/fs/affs/file.c
12505 +++ kernel-power-2.6.28/fs/affs/file.c
12506 @@ -628,7 +628,7 @@
12507         }
12508
12509         index = pos >> PAGE_CACHE_SHIFT;
12510 -       page = __grab_cache_page(mapping, index);
12511 +       page = grab_cache_page_write_begin(mapping, index, flags);
12512         if (!page)
12513                 return -ENOMEM;
12514         *pagep = page;
12515 --- kernel-power-2.6.28.orig/fs/afs/write.c
12516 +++ kernel-power-2.6.28/fs/afs/write.c
12517 @@ -144,7 +144,7 @@
12518         candidate->state = AFS_WBACK_PENDING;
12519         init_waitqueue_head(&candidate->waitq);
12520
12521 -       page = __grab_cache_page(mapping, index);
12522 +       page = grab_cache_page_write_begin(mapping, index, flags);
12523         if (!page) {
12524                 kfree(candidate);
12525                 return -ENOMEM;
12526 --- kernel-power-2.6.28.orig/fs/aio.c
12527 +++ kernel-power-2.6.28/fs/aio.c
12528 @@ -428,7 +428,7 @@
12529         req->private = NULL;
12530         req->ki_iovec = NULL;
12531         INIT_LIST_HEAD(&req->ki_run_list);
12532 -       req->ki_eventfd = ERR_PTR(-EINVAL);
12533 +       req->ki_eventfd = NULL;
12534
12535         /* Check if the completion queue has enough free space to
12536          * accept an event from this io.
12537 @@ -470,8 +470,6 @@
12538  {
12539         assert_spin_locked(&ctx->ctx_lock);
12540
12541 -       if (!IS_ERR(req->ki_eventfd))
12542 -               fput(req->ki_eventfd);
12543         if (req->ki_dtor)
12544                 req->ki_dtor(req);
12545         if (req->ki_iovec != &req->ki_inline_vec)
12546 @@ -493,8 +491,11 @@
12547                 list_del(&req->ki_list);
12548                 spin_unlock_irq(&fput_lock);
12549
12550 -               /* Complete the fput */
12551 -               __fput(req->ki_filp);
12552 +               /* Complete the fput(s) */
12553 +               if (req->ki_filp != NULL)
12554 +                       __fput(req->ki_filp);
12555 +               if (req->ki_eventfd != NULL)
12556 +                       __fput(req->ki_eventfd);
12557
12558                 /* Link the iocb into the context's free list */
12559                 spin_lock_irq(&ctx->ctx_lock);
12560 @@ -512,12 +513,14 @@
12561   */
12562  static int __aio_put_req(struct kioctx *ctx, struct kiocb *req)
12563  {
12564 +       int schedule_putreq = 0;
12565 +
12566         dprintk(KERN_DEBUG "aio_put(%p): f_count=%ld\n",
12567                 req, atomic_long_read(&req->ki_filp->f_count));
12568
12569         assert_spin_locked(&ctx->ctx_lock);
12570
12571 -       req->ki_users --;
12572 +       req->ki_users--;
12573         BUG_ON(req->ki_users < 0);
12574         if (likely(req->ki_users))
12575                 return 0;
12576 @@ -525,10 +528,23 @@
12577         req->ki_cancel = NULL;
12578         req->ki_retry = NULL;
12579
12580 -       /* Must be done under the lock to serialise against cancellation.
12581 -        * Call this aio_fput as it duplicates fput via the fput_work.
12582 +       /*
12583 +        * Try to optimize the aio and eventfd file* puts, by avoiding to
12584 +        * schedule work in case it is not __fput() time. In normal cases,
12585 +        * we would not be holding the last reference to the file*, so
12586 +        * this function will be executed w/out any aio kthread wakeup.
12587          */
12588 -       if (unlikely(atomic_long_dec_and_test(&req->ki_filp->f_count))) {
12589 +       if (unlikely(atomic_long_dec_and_test(&req->ki_filp->f_count)))
12590 +               schedule_putreq++;
12591 +       else
12592 +               req->ki_filp = NULL;
12593 +       if (req->ki_eventfd != NULL) {
12594 +               if (unlikely(atomic_long_dec_and_test(&req->ki_eventfd->f_count)))
12595 +                       schedule_putreq++;
12596 +               else
12597 +                       req->ki_eventfd = NULL;
12598 +       }
12599 +       if (unlikely(schedule_putreq)) {
12600                 get_ioctx(ctx);
12601                 spin_lock(&fput_lock);
12602                 list_add(&req->ki_list, &fput_head);
12603 @@ -992,7 +1008,7 @@
12604          * eventfd. The eventfd_signal() function is safe to be called
12605          * from IRQ context.
12606          */
12607 -       if (!IS_ERR(iocb->ki_eventfd))
12608 +       if (iocb->ki_eventfd != NULL)
12609                 eventfd_signal(iocb->ki_eventfd, 1);
12610
12611  put_rq:
12612 @@ -1258,7 +1274,7 @@
12613   *     pointer is passed for ctxp.  Will fail with -ENOSYS if not
12614   *     implemented.
12615   */
12616 -asmlinkage long sys_io_setup(unsigned nr_events, aio_context_t __user *ctxp)
12617 +SYSCALL_DEFINE2(io_setup, unsigned, nr_events, aio_context_t __user *, ctxp)
12618  {
12619         struct kioctx *ioctx = NULL;
12620         unsigned long ctx;
12621 @@ -1296,7 +1312,7 @@
12622   *     implemented.  May fail with -EFAULT if the context pointed to
12623   *     is invalid.
12624   */
12625 -asmlinkage long sys_io_destroy(aio_context_t ctx)
12626 +SYSCALL_DEFINE1(io_destroy, aio_context_t, ctx)
12627  {
12628         struct kioctx *ioctx = lookup_ioctx(ctx);
12629         if (likely(NULL != ioctx)) {
12630 @@ -1596,6 +1612,7 @@
12631                 req->ki_eventfd = eventfd_fget((int) iocb->aio_resfd);
12632                 if (IS_ERR(req->ki_eventfd)) {
12633                         ret = PTR_ERR(req->ki_eventfd);
12634 +                       req->ki_eventfd = NULL;
12635                         goto out_put_req;
12636                 }
12637         }
12638 @@ -1650,8 +1667,8 @@
12639   *     are available to queue any iocbs.  Will return 0 if nr is 0.  Will
12640   *     fail with -ENOSYS if not implemented.
12641   */
12642 -asmlinkage long sys_io_submit(aio_context_t ctx_id, long nr,
12643 -                             struct iocb __user * __user *iocbpp)
12644 +SYSCALL_DEFINE3(io_submit, aio_context_t, ctx_id, long, nr,
12645 +               struct iocb __user * __user *, iocbpp)
12646  {
12647         struct kioctx *ctx;
12648         long ret = 0;
12649 @@ -1725,8 +1742,8 @@
12650   *     invalid.  May fail with -EAGAIN if the iocb specified was not
12651   *     cancelled.  Will fail with -ENOSYS if not implemented.
12652   */
12653 -asmlinkage long sys_io_cancel(aio_context_t ctx_id, struct iocb __user *iocb,
12654 -                             struct io_event __user *result)
12655 +SYSCALL_DEFINE3(io_cancel, aio_context_t, ctx_id, struct iocb __user *, iocb,
12656 +               struct io_event __user *, result)
12657  {
12658         int (*cancel)(struct kiocb *iocb, struct io_event *res);
12659         struct kioctx *ctx;
12660 @@ -1787,11 +1804,11 @@
12661   *     will be updated if not NULL and the operation blocks.  Will fail
12662   *     with -ENOSYS if not implemented.
12663   */
12664 -asmlinkage long sys_io_getevents(aio_context_t ctx_id,
12665 -                                long min_nr,
12666 -                                long nr,
12667 -                                struct io_event __user *events,
12668 -                                struct timespec __user *timeout)
12669 +SYSCALL_DEFINE5(io_getevents, aio_context_t, ctx_id,
12670 +               long, min_nr,
12671 +               long, nr,
12672 +               struct io_event __user *, events,
12673 +               struct timespec __user *, timeout)
12674  {
12675         struct kioctx *ioctx = lookup_ioctx(ctx_id);
12676         long ret = -EINVAL;
12677 --- kernel-power-2.6.28.orig/fs/anon_inodes.c
12678 +++ kernel-power-2.6.28/fs/anon_inodes.c
12679 @@ -79,9 +79,12 @@
12680         if (IS_ERR(anon_inode_inode))
12681                 return -ENODEV;
12682
12683 +       if (fops->owner && !try_module_get(fops->owner))
12684 +               return -ENOENT;
12685 +
12686         error = get_unused_fd_flags(flags);
12687         if (error < 0)
12688 -               return error;
12689 +               goto err_module;
12690         fd = error;
12691
12692         /*
12693 @@ -128,6 +131,8 @@
12694         dput(dentry);
12695  err_put_unused_fd:
12696         put_unused_fd(fd);
12697 +err_module:
12698 +       module_put(fops->owner);
12699         return error;
12700  }
12701  EXPORT_SYMBOL_GPL(anon_inode_getfd);
12702 --- kernel-power-2.6.28.orig/fs/binfmt_elf.c
12703 +++ kernel-power-2.6.28/fs/binfmt_elf.c
12704 @@ -1196,9 +1196,11 @@
12705          * check for an ELF header.  If we find one, dump the first page to
12706          * aid in determining what was mapped here.
12707          */
12708 -       if (FILTER(ELF_HEADERS) && vma->vm_file != NULL && vma->vm_pgoff == 0) {
12709 +       if (FILTER(ELF_HEADERS) &&
12710 +           vma->vm_pgoff == 0 && (vma->vm_flags & VM_READ)) {
12711                 u32 __user *header = (u32 __user *) vma->vm_start;
12712                 u32 word;
12713 +               mm_segment_t fs = get_fs();
12714                 /*
12715                  * Doing it this way gets the constant folded by GCC.
12716                  */
12717 @@ -1211,7 +1213,15 @@
12718                 magic.elfmag[EI_MAG1] = ELFMAG1;
12719                 magic.elfmag[EI_MAG2] = ELFMAG2;
12720                 magic.elfmag[EI_MAG3] = ELFMAG3;
12721 -               if (get_user(word, header) == 0 && word == magic.cmp)
12722 +               /*
12723 +                * Switch to the user "segment" for get_user(),
12724 +                * then put back what elf_core_dump() had in place.
12725 +                */
12726 +               set_fs(USER_DS);
12727 +               if (unlikely(get_user(word, header)))
12728 +                       word = 0;
12729 +               set_fs(fs);
12730 +               if (word == magic.cmp)
12731                         return PAGE_SIZE;
12732         }
12733
12734 --- kernel-power-2.6.28.orig/fs/buffer.c
12735 +++ kernel-power-2.6.28/fs/buffer.c
12736 @@ -1988,7 +1988,7 @@
12737         page = *pagep;
12738         if (page == NULL) {
12739                 ownpage = 1;
12740 -               page = __grab_cache_page(mapping, index);
12741 +               page = grab_cache_page_write_begin(mapping, index, flags);
12742                 if (!page) {
12743                         status = -ENOMEM;
12744                         goto out;
12745 @@ -2494,7 +2494,7 @@
12746         from = pos & (PAGE_CACHE_SIZE - 1);
12747         to = from + len;
12748
12749 -       page = __grab_cache_page(mapping, index);
12750 +       page = grab_cache_page_write_begin(mapping, index, flags);
12751         if (!page)
12752                 return -ENOMEM;
12753         *pagep = page;
12754 @@ -3042,7 +3042,7 @@
12755         if (test_clear_buffer_dirty(bh)) {
12756                 get_bh(bh);
12757                 bh->b_end_io = end_buffer_write_sync;
12758 -               ret = submit_bh(WRITE_SYNC, bh);
12759 +               ret = submit_bh(WRITE, bh);
12760                 wait_on_buffer(bh);
12761                 if (buffer_eopnotsupp(bh)) {
12762                         clear_buffer_eopnotsupp(bh);
12763 @@ -3177,7 +3177,7 @@
12764   * Use of bdflush() is deprecated and will be removed in a future kernel.
12765   * The `pdflush' kernel threads fully replace bdflush daemons and this call.
12766   */
12767 -asmlinkage long sys_bdflush(int func, long data)
12768 +SYSCALL_DEFINE2(bdflush, int, func, long, data)
12769  {
12770         static int msg_count;
12771
12772 --- kernel-power-2.6.28.orig/fs/cifs/CHANGES
12773 +++ kernel-power-2.6.28/fs/cifs/CHANGES
12774 @@ -1,3 +1,8 @@
12775 +Fix oops in cifs_dfs_ref.c when prefixpath is not reachable when using DFS.
12776 +Fix "redzone overwritten" bug in cifs_put_tcon (CIFSTcon may allocate too
12777 +little memory for the "nativeFileSystem" field returned by the server
12778 +during mount).
12779 +
12780  Version 1.55
12781  ------------
12782  Various fixes to make delete of open files behavior more predictable
12783 --- kernel-power-2.6.28.orig/fs/cifs/cifs_dfs_ref.c
12784 +++ kernel-power-2.6.28/fs/cifs/cifs_dfs_ref.c
12785 @@ -122,7 +122,7 @@
12786                                    char **devname)
12787  {
12788         int rc;
12789 -       char *mountdata;
12790 +       char *mountdata = NULL;
12791         int md_len;
12792         char *tkn_e;
12793         char *srvIP = NULL;
12794 @@ -136,10 +136,9 @@
12795         *devname = cifs_get_share_name(ref->node_name);
12796         rc = dns_resolve_server_name_to_ip(*devname, &srvIP);
12797         if (rc != 0) {
12798 -               cERROR(1, ("%s: Failed to resolve server part of %s to IP",
12799 -                         __func__, *devname));
12800 -               mountdata = ERR_PTR(rc);
12801 -               goto compose_mount_options_out;
12802 +               cERROR(1, ("%s: Failed to resolve server part of %s to IP: %d",
12803 +                         __func__, *devname, rc));;
12804 +               goto compose_mount_options_err;
12805         }
12806         /* md_len = strlen(...) + 12 for 'sep+prefixpath='
12807          * assuming that we have 'unc=' and 'ip=' in
12808 @@ -149,8 +148,8 @@
12809                 strlen(ref->node_name) + 12;
12810         mountdata = kzalloc(md_len+1, GFP_KERNEL);
12811         if (mountdata == NULL) {
12812 -               mountdata = ERR_PTR(-ENOMEM);
12813 -               goto compose_mount_options_out;
12814 +               rc = -ENOMEM;
12815 +               goto compose_mount_options_err;
12816         }
12817
12818         /* copy all options except of unc,ip,prefixpath */
12819 @@ -197,18 +196,32 @@
12820
12821         /* find & copy prefixpath */
12822         tkn_e = strchr(ref->node_name + 2, '\\');
12823 -       if (tkn_e == NULL) /* invalid unc, missing share name*/
12824 -               goto compose_mount_options_out;
12825 +       if (tkn_e == NULL) {
12826 +               /* invalid unc, missing share name*/
12827 +               rc = -EINVAL;
12828 +               goto compose_mount_options_err;
12829 +       }
12830
12831 +       /*
12832 +        * this function gives us a path with a double backslash prefix. We
12833 +        * require a single backslash for DFS. Temporarily increment fullpath
12834 +        * to put it in the proper form and decrement before freeing it.
12835 +        */
12836         fullpath = build_path_from_dentry(dentry);
12837 +       if (!fullpath) {
12838 +               rc = -ENOMEM;
12839 +               goto compose_mount_options_err;
12840 +       }
12841 +       ++fullpath;
12842         tkn_e = strchr(tkn_e + 1, '\\');
12843 -       if (tkn_e || strlen(fullpath) - (ref->path_consumed)) {
12844 +       if (tkn_e || (strlen(fullpath) - ref->path_consumed)) {
12845                 strncat(mountdata, &sep, 1);
12846                 strcat(mountdata, "prefixpath=");
12847                 if (tkn_e)
12848                         strcat(mountdata, tkn_e + 1);
12849 -               strcat(mountdata, fullpath + (ref->path_consumed));
12850 +               strcat(mountdata, fullpath + ref->path_consumed);
12851         }
12852 +       --fullpath;
12853         kfree(fullpath);
12854
12855         /*cFYI(1,("%s: parent mountdata: %s", __func__,sb_mountdata));*/
12856 @@ -217,6 +230,11 @@
12857  compose_mount_options_out:
12858         kfree(srvIP);
12859         return mountdata;
12860 +
12861 +compose_mount_options_err:
12862 +       kfree(mountdata);
12863 +       mountdata = ERR_PTR(rc);
12864 +       goto compose_mount_options_out;
12865  }
12866
12867
12868 @@ -309,13 +327,19 @@
12869                 goto out_err;
12870         }
12871
12872 +       /*
12873 +        * The MSDFS spec states that paths in DFS referral requests and
12874 +        * responses must be prefixed by a single '\' character instead of
12875 +        * the double backslashes usually used in the UNC. This function
12876 +        * gives us the latter, so we must adjust the result.
12877 +        */
12878         full_path = build_path_from_dentry(dentry);
12879         if (full_path == NULL) {
12880                 rc = -ENOMEM;
12881                 goto out_err;
12882         }
12883
12884 -       rc = get_dfs_path(xid, ses , full_path, cifs_sb->local_nls,
12885 +       rc = get_dfs_path(xid, ses , full_path + 1, cifs_sb->local_nls,
12886                 &num_referrals, &referrals,
12887                 cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
12888
12889 --- kernel-power-2.6.28.orig/fs/cifs/cifssmb.c
12890 +++ kernel-power-2.6.28/fs/cifs/cifssmb.c
12891 @@ -2350,8 +2350,10 @@
12892                                      PATH_MAX, nls_codepage, remap);
12893                 name_len++;     /* trailing null */
12894                 name_len *= 2;
12895 -               pSMB->OldFileName[name_len] = 0;        /* pad */
12896 -               pSMB->OldFileName[name_len + 1] = 0x04;
12897 +
12898 +               /* protocol specifies ASCII buffer format (0x04) for unicode */
12899 +               pSMB->OldFileName[name_len] = 0x04;
12900 +               pSMB->OldFileName[name_len + 1] = 0x00; /* pad */
12901                 name_len2 =
12902                     cifsConvertToUCS((__le16 *)&pSMB->OldFileName[name_len + 2],
12903                                      toName, PATH_MAX, nls_codepage, remap);
12904 --- kernel-power-2.6.28.orig/fs/cifs/connect.c
12905 +++ kernel-power-2.6.28/fs/cifs/connect.c
12906 @@ -1356,7 +1356,7 @@
12907  }
12908
12909  static struct TCP_Server_Info *
12910 -cifs_find_tcp_session(struct sockaddr *addr)
12911 +cifs_find_tcp_session(struct sockaddr_storage *addr)
12912  {
12913         struct list_head *tmp;
12914         struct TCP_Server_Info *server;
12915 @@ -1376,11 +1376,11 @@
12916                 if (server->tcpStatus == CifsNew)
12917                         continue;
12918
12919 -               if (addr->sa_family == AF_INET &&
12920 +               if (addr->ss_family == AF_INET &&
12921                     (addr4->sin_addr.s_addr !=
12922                      server->addr.sockAddr.sin_addr.s_addr))
12923                         continue;
12924 -               else if (addr->sa_family == AF_INET6 &&
12925 +               else if (addr->ss_family == AF_INET6 &&
12926                          memcmp(&server->addr.sockAddr6.sin6_addr,
12927                                 &addr6->sin6_addr, sizeof(addr6->sin6_addr)))
12928                         continue;
12929 @@ -2036,7 +2036,7 @@
12930         int rc = 0;
12931         int xid;
12932         struct socket *csocket = NULL;
12933 -       struct sockaddr addr;
12934 +       struct sockaddr_storage addr;
12935         struct sockaddr_in *sin_server = (struct sockaddr_in *) &addr;
12936         struct sockaddr_in6 *sin_server6 = (struct sockaddr_in6 *) &addr;
12937         struct smb_vol volume_info;
12938 @@ -2048,7 +2048,7 @@
12939
12940  /* cFYI(1, ("Entering cifs_mount. Xid: %d with: %s", xid, mount_data)); */
12941
12942 -       memset(&addr, 0, sizeof(struct sockaddr));
12943 +       memset(&addr, 0, sizeof(struct sockaddr_storage));
12944         memset(&volume_info, 0, sizeof(struct smb_vol));
12945         if (cifs_parse_mount_options(mount_data, devname, &volume_info)) {
12946                 rc = -EINVAL;
12947 @@ -2078,9 +2078,9 @@
12948                         rc = cifs_inet_pton(AF_INET6, volume_info.UNCip,
12949                                             &sin_server6->sin6_addr.in6_u);
12950                         if (rc > 0)
12951 -                               addr.sa_family = AF_INET6;
12952 +                               addr.ss_family = AF_INET6;
12953                 } else {
12954 -                       addr.sa_family = AF_INET;
12955 +                       addr.ss_family = AF_INET;
12956                 }
12957
12958                 if (rc <= 0) {
12959 @@ -2122,7 +2122,7 @@
12960
12961         srvTcp = cifs_find_tcp_session(&addr);
12962         if (!srvTcp) { /* create socket */
12963 -               if (addr.sa_family == AF_INET6) {
12964 +               if (addr.ss_family == AF_INET6) {
12965                         cFYI(1, ("attempting ipv6 connect"));
12966                         /* BB should we allow ipv6 on port 139? */
12967                         /* other OS never observed in Wild doing 139 with v6 */
12968 @@ -2153,7 +2153,7 @@
12969                 } else {
12970                         srvTcp->noblocksnd = volume_info.noblocksnd;
12971                         srvTcp->noautotune = volume_info.noautotune;
12972 -                       if (addr.sa_family == AF_INET6)
12973 +                       if (addr.ss_family == AF_INET6)
12974                                 memcpy(&srvTcp->addr.sockAddr6, sin_server6,
12975                                         sizeof(struct sockaddr_in6));
12976                         else
12977 @@ -3565,7 +3565,7 @@
12978                             BCC(smb_buffer_response)) {
12979                                 kfree(tcon->nativeFileSystem);
12980                                 tcon->nativeFileSystem =
12981 -                                   kzalloc(length + 2, GFP_KERNEL);
12982 +                                   kzalloc(2*(length + 1), GFP_KERNEL);
12983                                 if (tcon->nativeFileSystem)
12984                                         cifs_strfromUCS_le(
12985                                                 tcon->nativeFileSystem,
12986 --- kernel-power-2.6.28.orig/fs/cifs/file.c
12987 +++ kernel-power-2.6.28/fs/cifs/file.c
12988 @@ -2073,7 +2073,7 @@
12989
12990         cFYI(1, ("write_begin from %lld len %d", (long long)pos, len));
12991
12992 -       page = __grab_cache_page(mapping, index);
12993 +       page = grab_cache_page_write_begin(mapping, index, flags);
12994         if (!page) {
12995                 rc = -ENOMEM;
12996                 goto out;
12997 --- kernel-power-2.6.28.orig/fs/cifs/sess.c
12998 +++ kernel-power-2.6.28/fs/cifs/sess.c
12999 @@ -228,7 +228,7 @@
13000
13001         kfree(ses->serverOS);
13002         /* UTF-8 string will not grow more than four times as big as UCS-16 */
13003 -       ses->serverOS = kzalloc(4 * len, GFP_KERNEL);
13004 +       ses->serverOS = kzalloc((4 * len) + 2 /* trailing null */, GFP_KERNEL);
13005         if (ses->serverOS != NULL)
13006                 cifs_strfromUCS_le(ses->serverOS, (__le16 *)data, len, nls_cp);
13007         data += 2 * (len + 1);
13008 @@ -241,7 +241,7 @@
13009                 return rc;
13010
13011         kfree(ses->serverNOS);
13012 -       ses->serverNOS = kzalloc(4 * len, GFP_KERNEL); /* BB this is wrong length FIXME BB */
13013 +       ses->serverNOS = kzalloc((4 * len) + 2 /* trailing null */, GFP_KERNEL);
13014         if (ses->serverNOS != NULL) {
13015                 cifs_strfromUCS_le(ses->serverNOS, (__le16 *)data, len,
13016                                    nls_cp);
13017 --- kernel-power-2.6.28.orig/fs/compat.c
13018 +++ kernel-power-2.6.28/fs/compat.c
13019 @@ -1386,12 +1386,17 @@
13020  {
13021         struct linux_binprm *bprm;
13022         struct file *file;
13023 +       struct files_struct *displaced;
13024         int retval;
13025
13026 +       retval = unshare_files(&displaced);
13027 +       if (retval)
13028 +               goto out_ret;
13029 +
13030         retval = -ENOMEM;
13031         bprm = kzalloc(sizeof(*bprm), GFP_KERNEL);
13032         if (!bprm)
13033 -               goto out_ret;
13034 +               goto out_files;
13035
13036         file = open_exec(filename);
13037         retval = PTR_ERR(file);
13038 @@ -1443,6 +1448,8 @@
13039                 security_bprm_free(bprm);
13040                 acct_update_integrals(current);
13041                 free_bprm(bprm);
13042 +               if (displaced)
13043 +                       put_files_struct(displaced);
13044                 return retval;
13045         }
13046
13047 @@ -1463,6 +1470,9 @@
13048  out_kfree:
13049         free_bprm(bprm);
13050
13051 +out_files:
13052 +       if (displaced)
13053 +               reset_files_struct(displaced);
13054  out_ret:
13055         return retval;
13056  }
13057 @@ -1697,7 +1707,7 @@
13058  }
13059
13060  #ifdef HAVE_SET_RESTORE_SIGMASK
13061 -asmlinkage long compat_sys_pselect7(int n, compat_ulong_t __user *inp,
13062 +static long do_compat_pselect(int n, compat_ulong_t __user *inp,
13063         compat_ulong_t __user *outp, compat_ulong_t __user *exp,
13064         struct compat_timespec __user *tsp, compat_sigset_t __user *sigmask,
13065         compat_size_t sigsetsize)
13066 @@ -1763,8 +1773,8 @@
13067                                 (compat_size_t __user *)(sig+sizeof(up))))
13068                         return -EFAULT;
13069         }
13070 -       return compat_sys_pselect7(n, inp, outp, exp, tsp, compat_ptr(up),
13071 -                                       sigsetsize);
13072 +       return do_compat_pselect(n, inp, outp, exp, tsp, compat_ptr(up),
13073 +                                sigsetsize);
13074  }
13075
13076  asmlinkage long compat_sys_ppoll(struct pollfd __user *ufds,
13077 --- kernel-power-2.6.28.orig/fs/compat_ioctl.c
13078 +++ kernel-power-2.6.28/fs/compat_ioctl.c
13079 @@ -538,6 +538,7 @@
13080                  * cannot be fixed without breaking all existing apps.
13081                  */
13082                 case TUNSETIFF:
13083 +               case TUNGETIFF:
13084                 case SIOCGIFFLAGS:
13085                 case SIOCGIFMETRIC:
13086                 case SIOCGIFMTU:
13087 @@ -1937,6 +1938,8 @@
13088  /* Big K */
13089  COMPATIBLE_IOCTL(PIO_FONT)
13090  COMPATIBLE_IOCTL(GIO_FONT)
13091 +COMPATIBLE_IOCTL(PIO_CMAP)
13092 +COMPATIBLE_IOCTL(GIO_CMAP)
13093  ULONG_IOCTL(KDSIGACCEPT)
13094  COMPATIBLE_IOCTL(KDGETKEYCODE)
13095  COMPATIBLE_IOCTL(KDSETKEYCODE)
13096 @@ -1982,6 +1985,11 @@
13097  COMPATIBLE_IOCTL(TUNSETDEBUG)
13098  COMPATIBLE_IOCTL(TUNSETPERSIST)
13099  COMPATIBLE_IOCTL(TUNSETOWNER)
13100 +COMPATIBLE_IOCTL(TUNSETLINK)
13101 +COMPATIBLE_IOCTL(TUNSETGROUP)
13102 +COMPATIBLE_IOCTL(TUNGETFEATURES)
13103 +COMPATIBLE_IOCTL(TUNSETOFFLOAD)
13104 +COMPATIBLE_IOCTL(TUNSETTXFILTER)
13105  /* Big V */
13106  COMPATIBLE_IOCTL(VT_SETMODE)
13107  COMPATIBLE_IOCTL(VT_GETMODE)
13108 @@ -2573,6 +2581,7 @@
13109  HANDLE_IOCTL(SIOCGIFTXQLEN, dev_ifsioc)
13110  HANDLE_IOCTL(SIOCSIFTXQLEN, dev_ifsioc)
13111  HANDLE_IOCTL(TUNSETIFF, dev_ifsioc)
13112 +HANDLE_IOCTL(TUNGETIFF, dev_ifsioc)
13113  HANDLE_IOCTL(SIOCETHTOOL, ethtool_ioctl)
13114  HANDLE_IOCTL(SIOCBONDENSLAVE, bond_ioctl)
13115  HANDLE_IOCTL(SIOCBONDRELEASE, bond_ioctl)
13116 --- kernel-power-2.6.28.orig/fs/dcache.c
13117 +++ kernel-power-2.6.28/fs/dcache.c
13118 @@ -1620,8 +1620,11 @@
13119                          */
13120                         memcpy(dentry->d_iname, target->d_name.name,
13121                                         target->d_name.len + 1);
13122 +                       dentry->d_name.len = target->d_name.len;
13123 +                       return;
13124                 }
13125         }
13126 +       do_switch(dentry->d_name.len, target->d_name.len);
13127  }
13128
13129  /*
13130 @@ -1681,7 +1684,6 @@
13131
13132         /* Switch the names.. */
13133         switch_names(dentry, target);
13134 -       do_switch(dentry->d_name.len, target->d_name.len);
13135         do_switch(dentry->d_name.hash, target->d_name.hash);
13136
13137         /* ... and switch the parents */
13138 @@ -1791,7 +1793,6 @@
13139         struct dentry *dparent, *aparent;
13140
13141         switch_names(dentry, anon);
13142 -       do_switch(dentry->d_name.len, anon->d_name.len);
13143         do_switch(dentry->d_name.hash, anon->d_name.hash);
13144
13145         dparent = dentry->d_parent;
13146 @@ -2095,7 +2096,7 @@
13147   *             return NULL;
13148   *     }
13149   */
13150 -asmlinkage long sys_getcwd(char __user *buf, unsigned long size)
13151 +SYSCALL_DEFINE2(getcwd, char __user *, buf, unsigned long, size)
13152  {
13153         int error;
13154         struct path pwd, root;
13155 --- kernel-power-2.6.28.orig/fs/dcookies.c
13156 +++ kernel-power-2.6.28/fs/dcookies.c
13157 @@ -140,7 +140,7 @@
13158  /* And here is where the userspace process can look up the cookie value
13159   * to retrieve the path.
13160   */
13161 -asmlinkage long sys_lookup_dcookie(u64 cookie64, char __user * buf, size_t len)
13162 +SYSCALL_DEFINE(lookup_dcookie)(u64 cookie64, char __user * buf, size_t len)
13163  {
13164         unsigned long cookie = (unsigned long)cookie64;
13165         int err = -EINVAL;
13166 @@ -193,7 +193,13 @@
13167         mutex_unlock(&dcookie_mutex);
13168         return err;
13169  }
13170 -
13171 +#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
13172 +asmlinkage long SyS_lookup_dcookie(u64 cookie64, long buf, long len)
13173 +{
13174 +       return SYSC_lookup_dcookie(cookie64, (char __user *) buf, (size_t) len);
13175 +}
13176 +SYSCALL_ALIAS(sys_lookup_dcookie, SyS_lookup_dcookie);
13177 +#endif
13178
13179  static int dcookie_init(void)
13180  {
13181 --- kernel-power-2.6.28.orig/fs/dlm/plock.c
13182 +++ kernel-power-2.6.28/fs/dlm/plock.c
13183 @@ -304,7 +304,9 @@
13184         if (rv == -ENOENT)
13185                 rv = 0;
13186         else if (rv > 0) {
13187 +               locks_init_lock(fl);
13188                 fl->fl_type = (op->info.ex) ? F_WRLCK : F_RDLCK;
13189 +               fl->fl_flags = FL_POSIX;
13190                 fl->fl_pid = op->info.pid;
13191                 fl->fl_start = op->info.start;
13192                 fl->fl_end = op->info.end;
13193 --- kernel-power-2.6.28.orig/fs/dquot.c
13194 +++ kernel-power-2.6.28/fs/dquot.c
13195 @@ -724,7 +724,7 @@
13196                         continue;
13197                 if (!dqinit_needed(inode, type))
13198                         continue;
13199 -               if (inode->i_state & (I_FREEING|I_WILL_FREE))
13200 +               if (inode->i_state & (I_FREEING|I_CLEAR|I_WILL_FREE))
13201                         continue;
13202
13203                 __iget(inode);
13204 --- kernel-power-2.6.28.orig/fs/drop_caches.c
13205 +++ kernel-power-2.6.28/fs/drop_caches.c
13206 @@ -18,7 +18,7 @@
13207
13208         spin_lock(&inode_lock);
13209         list_for_each_entry(inode, &sb->s_inodes, i_sb_list) {
13210 -               if (inode->i_state & (I_FREEING|I_WILL_FREE))
13211 +               if (inode->i_state & (I_FREEING|I_CLEAR|I_WILL_FREE))
13212                         continue;
13213                 if (inode->i_mapping->nrpages == 0)
13214                         continue;
13215 --- kernel-power-2.6.28.orig/fs/ecryptfs/crypto.c
13216 +++ kernel-power-2.6.28/fs/ecryptfs/crypto.c
13217 @@ -1310,14 +1310,13 @@
13218  }
13219
13220  static int
13221 -ecryptfs_write_metadata_to_contents(struct ecryptfs_crypt_stat *crypt_stat,
13222 -                                   struct dentry *ecryptfs_dentry,
13223 -                                   char *virt)
13224 +ecryptfs_write_metadata_to_contents(struct dentry *ecryptfs_dentry,
13225 +                                   char *virt, size_t virt_len)
13226  {
13227         int rc;
13228
13229         rc = ecryptfs_write_lower(ecryptfs_dentry->d_inode, virt,
13230 -                                 0, crypt_stat->num_header_bytes_at_front);
13231 +                                 0, virt_len);
13232         if (rc)
13233                 printk(KERN_ERR "%s: Error attempting to write header "
13234                        "information to lower file; rc = [%d]\n", __func__,
13235 @@ -1327,7 +1326,6 @@
13236
13237  static int
13238  ecryptfs_write_metadata_to_xattr(struct dentry *ecryptfs_dentry,
13239 -                                struct ecryptfs_crypt_stat *crypt_stat,
13240                                  char *page_virt, size_t size)
13241  {
13242         int rc;
13243 @@ -1337,6 +1335,17 @@
13244         return rc;
13245  }
13246
13247 +static unsigned long ecryptfs_get_zeroed_pages(gfp_t gfp_mask,
13248 +                                              unsigned int order)
13249 +{
13250 +       struct page *page;
13251 +
13252 +       page = alloc_pages(gfp_mask | __GFP_ZERO, order);
13253 +       if (page)
13254 +               return (unsigned long) page_address(page);
13255 +       return 0;
13256 +}
13257 +
13258  /**
13259   * ecryptfs_write_metadata
13260   * @ecryptfs_dentry: The eCryptfs dentry
13261 @@ -1353,7 +1362,9 @@
13262  {
13263         struct ecryptfs_crypt_stat *crypt_stat =
13264                 &ecryptfs_inode_to_private(ecryptfs_dentry->d_inode)->crypt_stat;
13265 +       unsigned int order;
13266         char *virt;
13267 +       size_t virt_len;
13268         size_t size = 0;
13269         int rc = 0;
13270
13271 @@ -1369,33 +1380,35 @@
13272                 rc = -EINVAL;
13273                 goto out;
13274         }
13275 +       virt_len = crypt_stat->num_header_bytes_at_front;
13276 +       order = get_order(virt_len);
13277         /* Released in this function */
13278 -       virt = (char *)get_zeroed_page(GFP_KERNEL);
13279 +       virt = (char *)ecryptfs_get_zeroed_pages(GFP_KERNEL, order);
13280         if (!virt) {
13281                 printk(KERN_ERR "%s: Out of memory\n", __func__);
13282                 rc = -ENOMEM;
13283                 goto out;
13284         }
13285 -       rc = ecryptfs_write_headers_virt(virt, PAGE_CACHE_SIZE, &size,
13286 -                                        crypt_stat, ecryptfs_dentry);
13287 +       rc = ecryptfs_write_headers_virt(virt, virt_len, &size, crypt_stat,
13288 +                                        ecryptfs_dentry);
13289         if (unlikely(rc)) {
13290                 printk(KERN_ERR "%s: Error whilst writing headers; rc = [%d]\n",
13291                        __func__, rc);
13292                 goto out_free;
13293         }
13294         if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR)
13295 -               rc = ecryptfs_write_metadata_to_xattr(ecryptfs_dentry,
13296 -                                                     crypt_stat, virt, size);
13297 +               rc = ecryptfs_write_metadata_to_xattr(ecryptfs_dentry, virt,
13298 +                                                     size);
13299         else
13300 -               rc = ecryptfs_write_metadata_to_contents(crypt_stat,
13301 -                                                        ecryptfs_dentry, virt);
13302 +               rc = ecryptfs_write_metadata_to_contents(ecryptfs_dentry, virt,
13303 +                                                        virt_len);
13304         if (rc) {
13305                 printk(KERN_ERR "%s: Error writing metadata out to lower file; "
13306                        "rc = [%d]\n", __func__, rc);
13307                 goto out_free;
13308         }
13309  out_free:
13310 -       free_page((unsigned long)virt);
13311 +       free_pages((unsigned long)virt, order);
13312  out:
13313         return rc;
13314  }
13315 --- kernel-power-2.6.28.orig/fs/ecryptfs/inode.c
13316 +++ kernel-power-2.6.28/fs/ecryptfs/inode.c
13317 @@ -673,10 +673,11 @@
13318         ecryptfs_printk(KERN_DEBUG, "Calling readlink w/ "
13319                         "dentry->d_name.name = [%s]\n", dentry->d_name.name);
13320         rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
13321 -       buf[rc] = '\0';
13322         set_fs(old_fs);
13323         if (rc < 0)
13324                 goto out_free;
13325 +       else
13326 +               buf[rc] = '\0';
13327         rc = 0;
13328         nd_set_link(nd, buf);
13329         goto out;
13330 --- kernel-power-2.6.28.orig/fs/ecryptfs/mmap.c
13331 +++ kernel-power-2.6.28/fs/ecryptfs/mmap.c
13332 @@ -288,7 +288,7 @@
13333         loff_t prev_page_end_size;
13334         int rc = 0;
13335
13336 -       page = __grab_cache_page(mapping, index);
13337 +       page = grab_cache_page_write_begin(mapping, index, flags);
13338         if (!page)
13339                 return -ENOMEM;
13340         *pagep = page;
13341 --- kernel-power-2.6.28.orig/fs/eventfd.c
13342 +++ kernel-power-2.6.28/fs/eventfd.c
13343 @@ -198,7 +198,7 @@
13344         return file;
13345  }
13346
13347 -asmlinkage long sys_eventfd2(unsigned int count, int flags)
13348 +SYSCALL_DEFINE2(eventfd2, unsigned int, count, int, flags)
13349  {
13350         int fd;
13351         struct eventfd_ctx *ctx;
13352 @@ -228,8 +228,7 @@
13353         return fd;
13354  }
13355
13356 -asmlinkage long sys_eventfd(unsigned int count)
13357 +SYSCALL_DEFINE1(eventfd, unsigned int, count)
13358  {
13359         return sys_eventfd2(count, 0);
13360  }
13361 -
13362 --- kernel-power-2.6.28.orig/fs/eventpoll.c
13363 +++ kernel-power-2.6.28/fs/eventpoll.c
13364 @@ -1095,7 +1095,7 @@
13365  /*
13366   * Open an eventpoll file descriptor.
13367   */
13368 -asmlinkage long sys_epoll_create1(int flags)
13369 +SYSCALL_DEFINE1(epoll_create1, int, flags)
13370  {
13371         int error, fd = -1;
13372         struct eventpoll *ep;
13373 @@ -1134,7 +1134,7 @@
13374         return fd;
13375  }
13376
13377 -asmlinkage long sys_epoll_create(int size)
13378 +SYSCALL_DEFINE1(epoll_create, int, size)
13379  {
13380         if (size < 0)
13381                 return -EINVAL;
13382 @@ -1147,8 +1147,8 @@
13383   * the eventpoll file that enables the insertion/removal/change of
13384   * file descriptors inside the interest set.
13385   */
13386 -asmlinkage long sys_epoll_ctl(int epfd, int op, int fd,
13387 -                             struct epoll_event __user *event)
13388 +SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
13389 +               struct epoll_event __user *, event)
13390  {
13391         int error;
13392         struct file *file, *tfile;
13393 @@ -1245,8 +1245,8 @@
13394   * Implement the event wait interface for the eventpoll file. It is the kernel
13395   * part of the user space epoll_wait(2).
13396   */
13397 -asmlinkage long sys_epoll_wait(int epfd, struct epoll_event __user *events,
13398 -                              int maxevents, int timeout)
13399 +SYSCALL_DEFINE4(epoll_wait, int, epfd, struct epoll_event __user *, events,
13400 +               int, maxevents, int, timeout)
13401  {
13402         int error;
13403         struct file *file;
13404 @@ -1303,9 +1303,9 @@
13405   * Implement the event wait interface for the eventpoll file. It is the kernel
13406   * part of the user space epoll_pwait(2).
13407   */
13408 -asmlinkage long sys_epoll_pwait(int epfd, struct epoll_event __user *events,
13409 -               int maxevents, int timeout, const sigset_t __user *sigmask,
13410 -               size_t sigsetsize)
13411 +SYSCALL_DEFINE6(epoll_pwait, int, epfd, struct epoll_event __user *, events,
13412 +               int, maxevents, int, timeout, const sigset_t __user *, sigmask,
13413 +               size_t, sigsetsize)
13414  {
13415         int error;
13416         sigset_t ksigmask, sigsaved;
13417 --- kernel-power-2.6.28.orig/fs/exec.c
13418 +++ kernel-power-2.6.28/fs/exec.c
13419 @@ -102,7 +102,7 @@
13420   *
13421   * Also note that we take the address to load from from the file itself.
13422   */
13423 -asmlinkage long sys_uselib(const char __user * library)
13424 +SYSCALL_DEFINE1(uselib, const char __user *, library)
13425  {
13426         struct file *file;
13427         struct nameidata nd;
13428 @@ -1084,9 +1084,7 @@
13429  {
13430         int unsafe = tracehook_unsafe_exec(p);
13431
13432 -       if (atomic_read(&p->fs->count) > 1 ||
13433 -           atomic_read(&p->files->count) > 1 ||
13434 -           atomic_read(&p->sighand->count) > 1)
13435 +       if (atomic_read(&p->fs->count) > 1)
13436                 unsafe |= LSM_UNSAFE_SHARE;
13437
13438         return unsafe;
13439 --- kernel-power-2.6.28.orig/fs/ext2/super.c
13440 +++ kernel-power-2.6.28/fs/ext2/super.c
13441 @@ -1177,9 +1177,12 @@
13442         es = sbi->s_es;
13443         if (((sbi->s_mount_opt & EXT2_MOUNT_XIP) !=
13444             (old_mount_opt & EXT2_MOUNT_XIP)) &&
13445 -           invalidate_inodes(sb))
13446 -               ext2_warning(sb, __func__, "busy inodes while remounting "\
13447 -                            "xip remain in cache (no functional problem)");
13448 +           invalidate_inodes(sb)) {
13449 +               ext2_warning(sb, __func__, "refusing change of xip flag "
13450 +                            "with busy inodes while remounting");
13451 +               sbi->s_mount_opt &= ~EXT2_MOUNT_XIP;
13452 +               sbi->s_mount_opt |= old_mount_opt & EXT2_MOUNT_XIP;
13453 +       }
13454         if ((*flags & MS_RDONLY) == (sb->s_flags & MS_RDONLY))
13455                 return 0;
13456         if (*flags & MS_RDONLY) {
13457 --- kernel-power-2.6.28.orig/fs/ext3/inode.c
13458 +++ kernel-power-2.6.28/fs/ext3/inode.c
13459 @@ -1160,7 +1160,7 @@
13460         to = from + len;
13461
13462  retry:
13463 -       page = __grab_cache_page(mapping, index);
13464 +       page = grab_cache_page_write_begin(mapping, index, flags);
13465         if (!page)
13466                 return -ENOMEM;
13467         *pagep = page;
13468 --- kernel-power-2.6.28.orig/fs/ext3/namei.c
13469 +++ kernel-power-2.6.28/fs/ext3/namei.c
13470 @@ -1357,7 +1357,7 @@
13471         struct fake_dirent *fde;
13472
13473         blocksize =  dir->i_sb->s_blocksize;
13474 -       dxtrace(printk("Creating index\n"));
13475 +       dxtrace(printk(KERN_DEBUG "Creating index: inode %lu\n", dir->i_ino));
13476         retval = ext3_journal_get_write_access(handle, bh);
13477         if (retval) {
13478                 ext3_std_error(dir->i_sb, retval);
13479 @@ -1366,6 +1366,19 @@
13480         }
13481         root = (struct dx_root *) bh->b_data;
13482
13483 +       /* The 0th block becomes the root, move the dirents out */
13484 +       fde = &root->dotdot;
13485 +       de = (struct ext3_dir_entry_2 *)((char *)fde +
13486 +                       ext3_rec_len_from_disk(fde->rec_len));
13487 +       if ((char *) de >= (((char *) root) + blocksize)) {
13488 +               ext3_error(dir->i_sb, __func__,
13489 +                          "invalid rec_len for '..' in inode %lu",
13490 +                          dir->i_ino);
13491 +               brelse(bh);
13492 +               return -EIO;
13493 +       }
13494 +       len = ((char *) root) + blocksize - (char *) de;
13495 +
13496         bh2 = ext3_append (handle, dir, &block, &retval);
13497         if (!(bh2)) {
13498                 brelse(bh);
13499 @@ -1374,11 +1387,6 @@
13500         EXT3_I(dir)->i_flags |= EXT3_INDEX_FL;
13501         data1 = bh2->b_data;
13502
13503 -       /* The 0th block becomes the root, move the dirents out */
13504 -       fde = &root->dotdot;
13505 -       de = (struct ext3_dir_entry_2 *)((char *)fde +
13506 -                       ext3_rec_len_from_disk(fde->rec_len));
13507 -       len = ((char *) root) + blocksize - (char *) de;
13508         memcpy (data1, de, len);
13509         de = (struct ext3_dir_entry_2 *) data1;
13510         top = data1 + len;
13511 @@ -2170,8 +2178,7 @@
13512                  * We have a transaction open.  All is sweetness.  It also sets
13513                  * i_size in generic_commit_write().
13514                  */
13515 -               err = __page_symlink(inode, symname, l,
13516 -                               mapping_gfp_mask(inode->i_mapping) & ~__GFP_FS);
13517 +               err = __page_symlink(inode, symname, l, 1);
13518                 if (err) {
13519                         drop_nlink(inode);
13520                         ext3_mark_inode_dirty(handle, inode);
13521 --- kernel-power-2.6.28.orig/fs/ext4/balloc.c
13522 +++ kernel-power-2.6.28/fs/ext4/balloc.c
13523 @@ -20,6 +20,7 @@
13524  #include "ext4.h"
13525  #include "ext4_jbd2.h"
13526  #include "group.h"
13527 +#include "mballoc.h"
13528
13529  /*
13530   * balloc.c contains the blocks allocation and deallocation routines
13531 @@ -319,20 +320,41 @@
13532                             block_group, bitmap_blk);
13533                 return NULL;
13534         }
13535 -       if (buffer_uptodate(bh) &&
13536 -           !(desc->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT)))
13537 +
13538 +       if (bitmap_uptodate(bh))
13539                 return bh;
13540
13541         lock_buffer(bh);
13542 +       if (bitmap_uptodate(bh)) {
13543 +               unlock_buffer(bh);
13544 +               return bh;
13545 +       }
13546         spin_lock(sb_bgl_lock(EXT4_SB(sb), block_group));
13547         if (desc->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT)) {
13548                 ext4_init_block_bitmap(sb, bh, block_group, desc);
13549 +               set_bitmap_uptodate(bh);
13550                 set_buffer_uptodate(bh);
13551                 unlock_buffer(bh);
13552                 spin_unlock(sb_bgl_lock(EXT4_SB(sb), block_group));
13553                 return bh;
13554         }
13555         spin_unlock(sb_bgl_lock(EXT4_SB(sb), block_group));
13556 +       if (buffer_uptodate(bh)) {
13557 +               /*
13558 +                * if not uninit if bh is uptodate,
13559 +                * bitmap is also uptodate
13560 +                */
13561 +               set_bitmap_uptodate(bh);
13562 +               unlock_buffer(bh);
13563 +               return bh;
13564 +       }
13565 +       /*
13566 +        * submit the buffer_head for read. We can
13567 +        * safely mark the bitmap as uptodate now.
13568 +        * We do it here so the bitmap uptodate bit
13569 +        * get set with buffer lock held.
13570 +        */
13571 +       set_bitmap_uptodate(bh);
13572         if (bh_submit_read(bh) < 0) {
13573                 put_bh(bh);
13574                 ext4_error(sb, __func__,
13575 @@ -350,62 +372,44 @@
13576  }
13577
13578  /**
13579 - * ext4_free_blocks_sb() -- Free given blocks and update quota
13580 + * ext4_add_groupblocks() -- Add given blocks to an existing group
13581   * @handle:                    handle to this transaction
13582   * @sb:                                super block
13583 - * @block:                     start physcial block to free
13584 + * @block:                     start physcial block to add to the block group
13585   * @count:                     number of blocks to free
13586 - * @pdquot_freed_blocks:       pointer to quota
13587   *
13588 - * XXX This function is only used by the on-line resizing code, which
13589 - * should probably be fixed up to call the mballoc variant.  There
13590 - * this needs to be cleaned up later; in fact, I'm not convinced this
13591 - * is 100% correct in the face of the mballoc code.  The online resizing
13592 - * code needs to be fixed up to more tightly (and correctly) interlock
13593 - * with the mballoc code.
13594 - */
13595 -void ext4_free_blocks_sb(handle_t *handle, struct super_block *sb,
13596 -                        ext4_fsblk_t block, unsigned long count,
13597 -                        unsigned long *pdquot_freed_blocks)
13598 + * This marks the blocks as free in the bitmap. We ask the
13599 + * mballoc to reload the buddy after this by setting group
13600 + * EXT4_GROUP_INFO_NEED_INIT_BIT flag
13601 + */
13602 +void ext4_add_groupblocks(handle_t *handle, struct super_block *sb,
13603 +                        ext4_fsblk_t block, unsigned long count)
13604  {
13605         struct buffer_head *bitmap_bh = NULL;
13606         struct buffer_head *gd_bh;
13607         ext4_group_t block_group;
13608         ext4_grpblk_t bit;
13609         unsigned long i;
13610 -       unsigned long overflow;
13611         struct ext4_group_desc *desc;
13612         struct ext4_super_block *es;
13613         struct ext4_sb_info *sbi;
13614         int err = 0, ret;
13615 -       ext4_grpblk_t group_freed;
13616 +       ext4_grpblk_t blocks_freed;
13617 +       struct ext4_group_info *grp;
13618
13619 -       *pdquot_freed_blocks = 0;
13620         sbi = EXT4_SB(sb);
13621         es = sbi->s_es;
13622 -       if (block < le32_to_cpu(es->s_first_data_block) ||
13623 -           block + count < block ||
13624 -           block + count > ext4_blocks_count(es)) {
13625 -               ext4_error(sb, "ext4_free_blocks",
13626 -                          "Freeing blocks not in datazone - "
13627 -                          "block = %llu, count = %lu", block, count);
13628 -               goto error_return;
13629 -       }
13630 -
13631 -       ext4_debug("freeing block(s) %llu-%llu\n", block, block + count - 1);
13632 +       ext4_debug("Adding block(s) %llu-%llu\n", block, block + count - 1);
13633
13634 -do_more:
13635 -       overflow = 0;
13636         ext4_get_group_no_and_offset(sb, block, &block_group, &bit);
13637 +       grp = ext4_get_group_info(sb, block_group);
13638         /*
13639          * Check to see if we are freeing blocks across a group
13640          * boundary.
13641          */
13642         if (bit + count > EXT4_BLOCKS_PER_GROUP(sb)) {
13643 -               overflow = bit + count - EXT4_BLOCKS_PER_GROUP(sb);
13644 -               count -= overflow;
13645 +               goto error_return;
13646         }
13647 -       brelse(bitmap_bh);
13648         bitmap_bh = ext4_read_block_bitmap(sb, block_group);
13649         if (!bitmap_bh)
13650                 goto error_return;
13651 @@ -418,18 +422,17 @@
13652             in_range(block, ext4_inode_table(sb, desc), sbi->s_itb_per_group) ||
13653             in_range(block + count - 1, ext4_inode_table(sb, desc),
13654                      sbi->s_itb_per_group)) {
13655 -               ext4_error(sb, "ext4_free_blocks",
13656 -                          "Freeing blocks in system zones - "
13657 +               ext4_error(sb, __func__,
13658 +                          "Adding blocks in system zones - "
13659                            "Block = %llu, count = %lu",
13660                            block, count);
13661                 goto error_return;
13662         }
13663
13664         /*
13665 -        * We are about to start releasing blocks in the bitmap,
13666 +        * We are about to add blocks to the bitmap,
13667          * so we need undo access.
13668          */
13669 -       /* @@@ check errors */
13670         BUFFER_TRACE(bitmap_bh, "getting undo access");
13671         err = ext4_journal_get_undo_access(handle, bitmap_bh);
13672         if (err)
13673 @@ -444,90 +447,42 @@
13674         err = ext4_journal_get_write_access(handle, gd_bh);
13675         if (err)
13676                 goto error_return;
13677 -
13678 -       jbd_lock_bh_state(bitmap_bh);
13679 -
13680 -       for (i = 0, group_freed = 0; i < count; i++) {
13681 -               /*
13682 -                * An HJ special.  This is expensive...
13683 -                */
13684 -#ifdef CONFIG_JBD2_DEBUG
13685 -               jbd_unlock_bh_state(bitmap_bh);
13686 -               {
13687 -                       struct buffer_head *debug_bh;
13688 -                       debug_bh = sb_find_get_block(sb, block + i);
13689 -                       if (debug_bh) {
13690 -                               BUFFER_TRACE(debug_bh, "Deleted!");
13691 -                               if (!bh2jh(bitmap_bh)->b_committed_data)
13692 -                                       BUFFER_TRACE(debug_bh,
13693 -                                               "No commited data in bitmap");
13694 -                               BUFFER_TRACE2(debug_bh, bitmap_bh, "bitmap");
13695 -                               __brelse(debug_bh);
13696 -                       }
13697 -               }
13698 -               jbd_lock_bh_state(bitmap_bh);
13699 -#endif
13700 -               if (need_resched()) {
13701 -                       jbd_unlock_bh_state(bitmap_bh);
13702 -                       cond_resched();
13703 -                       jbd_lock_bh_state(bitmap_bh);
13704 -               }
13705 -               /* @@@ This prevents newly-allocated data from being
13706 -                * freed and then reallocated within the same
13707 -                * transaction.
13708 -                *
13709 -                * Ideally we would want to allow that to happen, but to
13710 -                * do so requires making jbd2_journal_forget() capable of
13711 -                * revoking the queued write of a data block, which
13712 -                * implies blocking on the journal lock.  *forget()
13713 -                * cannot block due to truncate races.
13714 -                *
13715 -                * Eventually we can fix this by making jbd2_journal_forget()
13716 -                * return a status indicating whether or not it was able
13717 -                * to revoke the buffer.  On successful revoke, it is
13718 -                * safe not to set the allocation bit in the committed
13719 -                * bitmap, because we know that there is no outstanding
13720 -                * activity on the buffer any more and so it is safe to
13721 -                * reallocate it.
13722 -                */
13723 -               BUFFER_TRACE(bitmap_bh, "set in b_committed_data");
13724 -               J_ASSERT_BH(bitmap_bh,
13725 -                               bh2jh(bitmap_bh)->b_committed_data != NULL);
13726 -               ext4_set_bit_atomic(sb_bgl_lock(sbi, block_group), bit + i,
13727 -                               bh2jh(bitmap_bh)->b_committed_data);
13728 -
13729 -               /*
13730 -                * We clear the bit in the bitmap after setting the committed
13731 -                * data bit, because this is the reverse order to that which
13732 -                * the allocator uses.
13733 -                */
13734 +       /*
13735 +        * make sure we don't allow a parallel init on other groups in the
13736 +        * same buddy cache
13737 +        */
13738 +       down_write(&grp->alloc_sem);
13739 +       for (i = 0, blocks_freed = 0; i < count; i++) {
13740                 BUFFER_TRACE(bitmap_bh, "clear bit");
13741                 if (!ext4_clear_bit_atomic(sb_bgl_lock(sbi, block_group),
13742                                                 bit + i, bitmap_bh->b_data)) {
13743 -                       jbd_unlock_bh_state(bitmap_bh);
13744                         ext4_error(sb, __func__,
13745                                    "bit already cleared for block %llu",
13746                                    (ext4_fsblk_t)(block + i));
13747 -                       jbd_lock_bh_state(bitmap_bh);
13748                         BUFFER_TRACE(bitmap_bh, "bit already cleared");
13749                 } else {
13750 -                       group_freed++;
13751 +                       blocks_freed++;
13752                 }
13753         }
13754 -       jbd_unlock_bh_state(bitmap_bh);
13755 -
13756         spin_lock(sb_bgl_lock(sbi, block_group));
13757 -       le16_add_cpu(&desc->bg_free_blocks_count, group_freed);
13758 +       le16_add_cpu(&desc->bg_free_blocks_count, blocks_freed);
13759         desc->bg_checksum = ext4_group_desc_csum(sbi, block_group, desc);
13760         spin_unlock(sb_bgl_lock(sbi, block_group));
13761 -       percpu_counter_add(&sbi->s_freeblocks_counter, count);
13762 +       percpu_counter_add(&sbi->s_freeblocks_counter, blocks_freed);
13763
13764         if (sbi->s_log_groups_per_flex) {
13765                 ext4_group_t flex_group = ext4_flex_group(sbi, block_group);
13766                 spin_lock(sb_bgl_lock(sbi, flex_group));
13767 -               sbi->s_flex_groups[flex_group].free_blocks += count;
13768 +               sbi->s_flex_groups[flex_group].free_blocks += blocks_freed;
13769                 spin_unlock(sb_bgl_lock(sbi, flex_group));
13770         }
13771 +       /*
13772 +        * request to reload the buddy with the
13773 +        * new bitmap information
13774 +        */
13775 +       set_bit(EXT4_GROUP_INFO_NEED_INIT_BIT, &(grp->bb_state));
13776 +       ext4_mb_update_group_info(grp, blocks_freed);
13777 +       up_write(&grp->alloc_sem);
13778
13779         /* We dirtied the bitmap block */
13780         BUFFER_TRACE(bitmap_bh, "dirtied bitmap block");
13781 @@ -536,15 +491,10 @@
13782         /* And the group descriptor block */
13783         BUFFER_TRACE(gd_bh, "dirtied group descriptor block");
13784         ret = ext4_journal_dirty_metadata(handle, gd_bh);
13785 -       if (!err) err = ret;
13786 -       *pdquot_freed_blocks += group_freed;
13787 -
13788 -       if (overflow && !err) {
13789 -               block += count;
13790 -               count = overflow;
13791 -               goto do_more;
13792 -       }
13793 +       if (!err)
13794 +               err = ret;
13795         mark_sb_dirty(sb);
13796 +
13797  error_return:
13798         brelse(bitmap_bh);
13799         ext4_std_error(sb, err);
13800 --- kernel-power-2.6.28.orig/fs/ext4/ext4.h
13801 +++ kernel-power-2.6.28/fs/ext4/ext4.h
13802 @@ -19,6 +19,7 @@
13803  #include <linux/types.h>
13804  #include <linux/blkdev.h>
13805  #include <linux/magic.h>
13806 +#include <linux/jbd2.h>
13807  #include "ext4_i.h"
13808
13809  /*
13810 @@ -861,7 +862,7 @@
13811  {
13812         unsigned len = le16_to_cpu(dlen);
13813
13814 -       if (len == EXT4_MAX_REC_LEN)
13815 +       if (len == EXT4_MAX_REC_LEN || len == 0)
13816                 return 1 << 16;
13817         return len;
13818  }
13819 @@ -891,6 +892,9 @@
13820  #define DX_HASH_LEGACY         0
13821  #define DX_HASH_HALF_MD4       1
13822  #define DX_HASH_TEA            2
13823 +#define DX_HASH_LEGACY_UNSIGNED        3
13824 +#define DX_HASH_HALF_MD4_UNSIGNED      4
13825 +#define DX_HASH_TEA_UNSIGNED           5
13826
13827  #ifdef __KERNEL__
13828
13829 @@ -1006,9 +1010,8 @@
13830  extern int ext4_has_free_blocks(struct ext4_sb_info *sbi, s64 nblocks);
13831  extern void ext4_free_blocks(handle_t *handle, struct inode *inode,
13832                         ext4_fsblk_t block, unsigned long count, int metadata);
13833 -extern void ext4_free_blocks_sb(handle_t *handle, struct super_block *sb,
13834 -                               ext4_fsblk_t block, unsigned long count,
13835 -                               unsigned long *pdquot_freed_blocks);
13836 +extern void ext4_add_groupblocks(handle_t *handle, struct super_block *sb,
13837 +                               ext4_fsblk_t block, unsigned long count);
13838  extern ext4_fsblk_t ext4_count_free_blocks(struct super_block *);
13839  extern void ext4_check_blocks_bitmap(struct super_block *);
13840  extern struct ext4_group_desc * ext4_get_group_desc(struct super_block * sb,
13841 @@ -1054,12 +1057,13 @@
13842  extern void exit_ext4_mballoc(void);
13843  extern void ext4_mb_free_blocks(handle_t *, struct inode *,
13844                 unsigned long, unsigned long, int, unsigned long *);
13845 -extern int ext4_mb_add_more_groupinfo(struct super_block *sb,
13846 +extern int ext4_mb_add_groupinfo(struct super_block *sb,
13847                 ext4_group_t i, struct ext4_group_desc *desc);
13848  extern void ext4_mb_update_group_info(struct ext4_group_info *grp,
13849                 ext4_grpblk_t add);
13850 -
13851 -
13852 +extern int ext4_mb_get_buddy_cache_lock(struct super_block *, ext4_group_t);
13853 +extern void ext4_mb_put_buddy_cache_lock(struct super_block *,
13854 +                                               ext4_group_t, int);
13855  /* inode.c */
13856  int ext4_forget(handle_t *handle, int is_metadata, struct inode *inode,
13857                 struct buffer_head *bh, ext4_fsblk_t blocknr);
13858 @@ -1184,8 +1188,11 @@
13859
13860  static inline loff_t ext4_isize(struct ext4_inode *raw_inode)
13861  {
13862 -       return ((loff_t)le32_to_cpu(raw_inode->i_size_high) << 32) |
13863 -               le32_to_cpu(raw_inode->i_size_lo);
13864 +       if (S_ISREG(le16_to_cpu(raw_inode->i_mode)))
13865 +               return ((loff_t)le32_to_cpu(raw_inode->i_size_high) << 32) |
13866 +                       le32_to_cpu(raw_inode->i_size_lo);
13867 +       else
13868 +               return (loff_t) le32_to_cpu(raw_inode->i_size_lo);
13869  }
13870
13871  static inline void ext4_isize_set(struct ext4_inode *raw_inode, loff_t i_size)
13872 @@ -1283,6 +1290,24 @@
13873                         sector_t block, unsigned long max_blocks,
13874                         struct buffer_head *bh, int create,
13875                         int extend_disksize, int flag);
13876 +
13877 +/*
13878 + * Add new method to test wether block and inode bitmaps are properly
13879 + * initialized. With uninit_bg reading the block from disk is not enough
13880 + * to mark the bitmap uptodate. We need to also zero-out the bitmap
13881 + */
13882 +#define BH_BITMAP_UPTODATE BH_JBDPrivateStart
13883 +
13884 +static inline int bitmap_uptodate(struct buffer_head *bh)
13885 +{
13886 +       return (buffer_uptodate(bh) &&
13887 +                       test_bit(BH_BITMAP_UPTODATE, &(bh)->b_state));
13888 +}
13889 +static inline void set_bitmap_uptodate(struct buffer_head *bh)
13890 +{
13891 +       set_bit(BH_BITMAP_UPTODATE, &(bh)->b_state);
13892 +}
13893 +
13894  #endif /* __KERNEL__ */
13895
13896  #endif /* _EXT4_H */
13897 --- kernel-power-2.6.28.orig/fs/ext4/ext4_sb.h
13898 +++ kernel-power-2.6.28/fs/ext4/ext4_sb.h
13899 @@ -57,6 +57,7 @@
13900         u32 s_next_generation;
13901         u32 s_hash_seed[4];
13902         int s_def_hash_version;
13903 +       int s_hash_unsigned;    /* 3 if hash should be signed, 0 if not */
13904         struct percpu_counter s_freeblocks_counter;
13905         struct percpu_counter s_freeinodes_counter;
13906         struct percpu_counter s_dirs_counter;
13907 @@ -101,7 +102,8 @@
13908         spinlock_t s_reserve_lock;
13909         spinlock_t s_md_lock;
13910         tid_t s_last_transaction;
13911 -       unsigned short *s_mb_offsets, *s_mb_maxs;
13912 +       unsigned short *s_mb_offsets;
13913 +       unsigned int *s_mb_maxs;
13914
13915         /* tunables */
13916         unsigned long s_stripe;
13917 --- kernel-power-2.6.28.orig/fs/ext4/hash.c
13918 +++ kernel-power-2.6.28/fs/ext4/hash.c
13919 @@ -35,23 +35,71 @@
13920
13921
13922  /* The old legacy hash */
13923 -static __u32 dx_hack_hash(const char *name, int len)
13924 +static __u32 dx_hack_hash_unsigned(const char *name, int len)
13925  {
13926 -       __u32 hash0 = 0x12a3fe2d, hash1 = 0x37abe8f9;
13927 +       __u32 hash, hash0 = 0x12a3fe2d, hash1 = 0x37abe8f9;
13928 +       const unsigned char *ucp = (const unsigned char *) name;
13929 +
13930 +       while (len--) {
13931 +               hash = hash1 + (hash0 ^ (((int) *ucp++) * 7152373));
13932 +
13933 +               if (hash & 0x80000000)
13934 +                       hash -= 0x7fffffff;
13935 +               hash1 = hash0;
13936 +               hash0 = hash;
13937 +       }
13938 +       return hash0 << 1;
13939 +}
13940 +
13941 +static __u32 dx_hack_hash_signed(const char *name, int len)
13942 +{
13943 +       __u32 hash, hash0 = 0x12a3fe2d, hash1 = 0x37abe8f9;
13944 +       const signed char *scp = (const signed char *) name;
13945 +
13946         while (len--) {
13947 -               __u32 hash = hash1 + (hash0 ^ (*name++ * 7152373));
13948 +               hash = hash1 + (hash0 ^ (((int) *scp++) * 7152373));
13949
13950 -               if (hash & 0x80000000) hash -= 0x7fffffff;
13951 +               if (hash & 0x80000000)
13952 +                       hash -= 0x7fffffff;
13953                 hash1 = hash0;
13954                 hash0 = hash;
13955         }
13956 -       return (hash0 << 1);
13957 +       return hash0 << 1;
13958 +}
13959 +
13960 +static void str2hashbuf_signed(const char *msg, int len, __u32 *buf, int num)
13961 +{
13962 +       __u32   pad, val;
13963 +       int     i;
13964 +       const signed char *scp = (const signed char *) msg;
13965 +
13966 +       pad = (__u32)len | ((__u32)len << 8);
13967 +       pad |= pad << 16;
13968 +
13969 +       val = pad;
13970 +       if (len > num*4)
13971 +               len = num * 4;
13972 +       for (i = 0; i < len; i++) {
13973 +               if ((i % 4) == 0)
13974 +                       val = pad;
13975 +               val = ((int) scp[i]) + (val << 8);
13976 +               if ((i % 4) == 3) {
13977 +                       *buf++ = val;
13978 +                       val = pad;
13979 +                       num--;
13980 +               }
13981 +       }
13982 +       if (--num >= 0)
13983 +               *buf++ = val;
13984 +       while (--num >= 0)
13985 +               *buf++ = pad;
13986  }
13987
13988 -static void str2hashbuf(const char *msg, int len, __u32 *buf, int num)
13989 +static void str2hashbuf_unsigned(const char *msg, int len, __u32 *buf, int num)
13990  {
13991         __u32   pad, val;
13992         int     i;
13993 +       const unsigned char *ucp = (const unsigned char *) msg;
13994
13995         pad = (__u32)len | ((__u32)len << 8);
13996         pad |= pad << 16;
13997 @@ -62,7 +110,7 @@
13998         for (i = 0; i < len; i++) {
13999                 if ((i % 4) == 0)
14000                         val = pad;
14001 -               val = msg[i] + (val << 8);
14002 +               val = ((int) ucp[i]) + (val << 8);
14003                 if ((i % 4) == 3) {
14004                         *buf++ = val;
14005                         val = pad;
14006 @@ -95,6 +143,8 @@
14007         const char      *p;
14008         int             i;
14009         __u32           in[8], buf[4];
14010 +       void            (*str2hashbuf)(const char *, int, __u32 *, int) =
14011 +                               str2hashbuf_signed;
14012
14013         /* Initialize the default seed for the hash checksum functions */
14014         buf[0] = 0x67452301;
14015 @@ -113,13 +163,18 @@
14016         }
14017
14018         switch (hinfo->hash_version) {
14019 +       case DX_HASH_LEGACY_UNSIGNED:
14020 +               hash = dx_hack_hash_unsigned(name, len);
14021 +               break;
14022         case DX_HASH_LEGACY:
14023 -               hash = dx_hack_hash(name, len);
14024 +               hash = dx_hack_hash_signed(name, len);
14025                 break;
14026 +       case DX_HASH_HALF_MD4_UNSIGNED:
14027 +               str2hashbuf = str2hashbuf_unsigned;
14028         case DX_HASH_HALF_MD4:
14029                 p = name;
14030                 while (len > 0) {
14031 -                       str2hashbuf(p, len, in, 8);
14032 +                       (*str2hashbuf)(p, len, in, 8);
14033                         half_md4_transform(buf, in);
14034                         len -= 32;
14035                         p += 32;
14036 @@ -127,10 +182,12 @@
14037                 minor_hash = buf[2];
14038                 hash = buf[1];
14039                 break;
14040 +       case DX_HASH_TEA_UNSIGNED:
14041 +               str2hashbuf = str2hashbuf_unsigned;
14042         case DX_HASH_TEA:
14043                 p = name;
14044                 while (len > 0) {
14045 -                       str2hashbuf(p, len, in, 4);
14046 +                       (*str2hashbuf)(p, len, in, 4);
14047                         TEA_transform(buf, in);
14048                         len -= 16;
14049                         p += 16;
14050 --- kernel-power-2.6.28.orig/fs/ext4/ialloc.c
14051 +++ kernel-power-2.6.28/fs/ext4/ialloc.c
14052 @@ -84,7 +84,7 @@
14053         }
14054
14055         memset(bh->b_data, 0, (EXT4_INODES_PER_GROUP(sb) + 7) / 8);
14056 -       mark_bitmap_end(EXT4_INODES_PER_GROUP(sb), EXT4_BLOCKS_PER_GROUP(sb),
14057 +       mark_bitmap_end(EXT4_INODES_PER_GROUP(sb), sb->s_blocksize * 8,
14058                         bh->b_data);
14059
14060         return EXT4_INODES_PER_GROUP(sb);
14061 @@ -115,20 +115,40 @@
14062                             block_group, bitmap_blk);
14063                 return NULL;
14064         }
14065 -       if (buffer_uptodate(bh) &&
14066 -           !(desc->bg_flags & cpu_to_le16(EXT4_BG_INODE_UNINIT)))
14067 +       if (bitmap_uptodate(bh))
14068                 return bh;
14069
14070         lock_buffer(bh);
14071 +       if (bitmap_uptodate(bh)) {
14072 +               unlock_buffer(bh);
14073 +               return bh;
14074 +       }
14075         spin_lock(sb_bgl_lock(EXT4_SB(sb), block_group));
14076         if (desc->bg_flags & cpu_to_le16(EXT4_BG_INODE_UNINIT)) {
14077                 ext4_init_inode_bitmap(sb, bh, block_group, desc);
14078 +               set_bitmap_uptodate(bh);
14079                 set_buffer_uptodate(bh);
14080                 unlock_buffer(bh);
14081                 spin_unlock(sb_bgl_lock(EXT4_SB(sb), block_group));
14082                 return bh;
14083         }
14084         spin_unlock(sb_bgl_lock(EXT4_SB(sb), block_group));
14085 +       if (buffer_uptodate(bh)) {
14086 +               /*
14087 +                * if not uninit if bh is uptodate,
14088 +                * bitmap is also uptodate
14089 +                */
14090 +               set_bitmap_uptodate(bh);
14091 +               unlock_buffer(bh);
14092 +               return bh;
14093 +       }
14094 +       /*
14095 +        * submit the buffer_head for read. We can
14096 +        * safely mark the bitmap as uptodate now.
14097 +        * We do it here so the bitmap uptodate bit
14098 +        * get set with buffer lock held.
14099 +        */
14100 +       set_bitmap_uptodate(bh);
14101         if (bh_submit_read(bh) < 0) {
14102                 put_bh(bh);
14103                 ext4_error(sb, __func__,
14104 @@ -570,6 +590,77 @@
14105  }
14106
14107  /*
14108 + * claim the inode from the inode bitmap. If the group
14109 + * is uninit we need to take the groups's sb_bgl_lock
14110 + * and clear the uninit flag. The inode bitmap update
14111 + * and group desc uninit flag clear should be done
14112 + * after holding sb_bgl_lock so that ext4_read_inode_bitmap
14113 + * doesn't race with the ext4_claim_inode
14114 + */
14115 +static int ext4_claim_inode(struct super_block *sb,
14116 +                       struct buffer_head *inode_bitmap_bh,
14117 +                       unsigned long ino, ext4_group_t group, int mode)
14118 +{
14119 +       int free = 0, retval = 0;
14120 +       struct ext4_sb_info *sbi = EXT4_SB(sb);
14121 +       struct ext4_group_desc *gdp = ext4_get_group_desc(sb, group, NULL);
14122 +
14123 +       spin_lock(sb_bgl_lock(sbi, group));
14124 +       if (ext4_set_bit(ino, inode_bitmap_bh->b_data)) {
14125 +               /* not a free inode */
14126 +               retval = 1;
14127 +               goto err_ret;
14128 +       }
14129 +       ino++;
14130 +       if ((group == 0 && ino < EXT4_FIRST_INO(sb)) ||
14131 +                       ino > EXT4_INODES_PER_GROUP(sb)) {
14132 +               spin_unlock(sb_bgl_lock(sbi, group));
14133 +               ext4_error(sb, __func__,
14134 +                          "reserved inode or inode > inodes count - "
14135 +                          "block_group = %lu, inode=%lu", group,
14136 +                          ino + group * EXT4_INODES_PER_GROUP(sb));
14137 +               return 1;
14138 +       }
14139 +       /* If we didn't allocate from within the initialized part of the inode
14140 +        * table then we need to initialize up to this inode. */
14141 +       if (EXT4_HAS_RO_COMPAT_FEATURE(sb, EXT4_FEATURE_RO_COMPAT_GDT_CSUM)) {
14142 +
14143 +               if (gdp->bg_flags & cpu_to_le16(EXT4_BG_INODE_UNINIT)) {
14144 +                       gdp->bg_flags &= cpu_to_le16(~EXT4_BG_INODE_UNINIT);
14145 +                       /* When marking the block group with
14146 +                        * ~EXT4_BG_INODE_UNINIT we don't want to depend
14147 +                        * on the value of bg_itable_unused even though
14148 +                        * mke2fs could have initialized the same for us.
14149 +                        * Instead we calculated the value below
14150 +                        */
14151 +
14152 +                       free = 0;
14153 +               } else {
14154 +                       free = EXT4_INODES_PER_GROUP(sb) -
14155 +                               le16_to_cpu(gdp->bg_itable_unused);
14156 +               }
14157 +
14158 +               /*
14159 +                * Check the relative inode number against the last used
14160 +                * relative inode number in this group. if it is greater
14161 +                * we need to  update the bg_itable_unused count
14162 +                *
14163 +                */
14164 +               if (ino > free)
14165 +                       gdp->bg_itable_unused =
14166 +                               cpu_to_le16(EXT4_INODES_PER_GROUP(sb) - ino);
14167 +       }
14168 +       le16_add_cpu(&gdp->bg_free_inodes_count, -1);
14169 +       if (S_ISDIR(mode)) {
14170 +               le16_add_cpu(&gdp->bg_used_dirs_count, 1);
14171 +       }
14172 +       gdp->bg_checksum = ext4_group_desc_csum(sbi, group, gdp);
14173 +err_ret:
14174 +       spin_unlock(sb_bgl_lock(sbi, group));
14175 +       return retval;
14176 +}
14177 +
14178 +/*
14179   * There are two policies for allocating an inode.  If the new inode is
14180   * a directory, then a forward search is made for a block group with both
14181   * free space and a low directory-to-inode ratio; if that fails, then of
14182 @@ -612,6 +703,13 @@
14183
14184         if (sbi->s_log_groups_per_flex) {
14185                 ret2 = find_group_flex(sb, dir, &group);
14186 +               if (ret2 == -1) {
14187 +                       ret2 = find_group_other(sb, dir, &group);
14188 +                       if (ret2 == 0 && printk_ratelimit())
14189 +                               printk(KERN_NOTICE "ext4: find_group_flex "
14190 +                                      "failed, fallback succeeded dir %lu\n",
14191 +                                      dir->i_ino);
14192 +               }
14193                 goto got_group;
14194         }
14195
14196 @@ -652,8 +750,12 @@
14197                         if (err)
14198                                 goto fail;
14199
14200 -                       if (!ext4_set_bit_atomic(sb_bgl_lock(sbi, group),
14201 -                                               ino, bitmap_bh->b_data)) {
14202 +                       BUFFER_TRACE(bh2, "get_write_access");
14203 +                       err = ext4_journal_get_write_access(handle, bh2);
14204 +                       if (err)
14205 +                               goto fail;
14206 +                       if (!ext4_claim_inode(sb, bitmap_bh,
14207 +                                               ino, group, mode)) {
14208                                 /* we won it */
14209                                 BUFFER_TRACE(bitmap_bh,
14210                                         "call ext4_journal_dirty_metadata");
14211 @@ -661,10 +763,13 @@
14212                                                                 bitmap_bh);
14213                                 if (err)
14214                                         goto fail;
14215 +                               /* zero bit is inode number 1*/
14216 +                               ino++;
14217                                 goto got;
14218                         }
14219                         /* we lost it */
14220                         jbd2_journal_release_buffer(handle, bitmap_bh);
14221 +                       jbd2_journal_release_buffer(handle, bh2);
14222
14223                         if (++ino < EXT4_INODES_PER_GROUP(sb))
14224                                 goto repeat_in_this_group;
14225 @@ -684,21 +789,6 @@
14226         goto out;
14227
14228  got:
14229 -       ino++;
14230 -       if ((group == 0 && ino < EXT4_FIRST_INO(sb)) ||
14231 -           ino > EXT4_INODES_PER_GROUP(sb)) {
14232 -               ext4_error(sb, __func__,
14233 -                          "reserved inode or inode > inodes count - "
14234 -                          "block_group = %lu, inode=%lu", group,
14235 -                          ino + group * EXT4_INODES_PER_GROUP(sb));
14236 -               err = -EIO;
14237 -               goto fail;
14238 -       }
14239 -
14240 -       BUFFER_TRACE(bh2, "get_write_access");
14241 -       err = ext4_journal_get_write_access(handle, bh2);
14242 -       if (err) goto fail;
14243 -
14244         /* We may have to initialize the block bitmap if it isn't already */
14245         if (EXT4_HAS_RO_COMPAT_FEATURE(sb, EXT4_FEATURE_RO_COMPAT_GDT_CSUM) &&
14246             gdp->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT)) {
14247 @@ -733,47 +823,10 @@
14248                 if (err)
14249                         goto fail;
14250         }
14251 -
14252 -       spin_lock(sb_bgl_lock(sbi, group));
14253 -       /* If we didn't allocate from within the initialized part of the inode
14254 -        * table then we need to initialize up to this inode. */
14255 -       if (EXT4_HAS_RO_COMPAT_FEATURE(sb, EXT4_FEATURE_RO_COMPAT_GDT_CSUM)) {
14256 -               if (gdp->bg_flags & cpu_to_le16(EXT4_BG_INODE_UNINIT)) {
14257 -                       gdp->bg_flags &= cpu_to_le16(~EXT4_BG_INODE_UNINIT);
14258 -
14259 -                       /* When marking the block group with
14260 -                        * ~EXT4_BG_INODE_UNINIT we don't want to depend
14261 -                        * on the value of bg_itable_unused even though
14262 -                        * mke2fs could have initialized the same for us.
14263 -                        * Instead we calculated the value below
14264 -                        */
14265 -
14266 -                       free = 0;
14267 -               } else {
14268 -                       free = EXT4_INODES_PER_GROUP(sb) -
14269 -                               le16_to_cpu(gdp->bg_itable_unused);
14270 -               }
14271 -
14272 -               /*
14273 -                * Check the relative inode number against the last used
14274 -                * relative inode number in this group. if it is greater
14275 -                * we need to  update the bg_itable_unused count
14276 -                *
14277 -                */
14278 -               if (ino > free)
14279 -                       gdp->bg_itable_unused =
14280 -                               cpu_to_le16(EXT4_INODES_PER_GROUP(sb) - ino);
14281 -       }
14282 -
14283 -       le16_add_cpu(&gdp->bg_free_inodes_count, -1);
14284 -       if (S_ISDIR(mode)) {
14285 -               le16_add_cpu(&gdp->bg_used_dirs_count, 1);
14286 -       }
14287 -       gdp->bg_checksum = ext4_group_desc_csum(sbi, group, gdp);
14288 -       spin_unlock(sb_bgl_lock(sbi, group));
14289 -       BUFFER_TRACE(bh2, "call ext4_journal_dirty_metadata");
14290 +       BUFFER_TRACE(bh2, "call ext4_handle_dirty_metadata");
14291         err = ext4_journal_dirty_metadata(handle, bh2);
14292 -       if (err) goto fail;
14293 +       if (err)
14294 +               goto fail;
14295
14296         percpu_counter_dec(&sbi->s_freeinodes_counter);
14297         if (S_ISDIR(mode))
14298 --- kernel-power-2.6.28.orig/fs/ext4/inode.c
14299 +++ kernel-power-2.6.28/fs/ext4/inode.c
14300 @@ -46,8 +46,10 @@
14301  static inline int ext4_begin_ordered_truncate(struct inode *inode,
14302                                               loff_t new_size)
14303  {
14304 -       return jbd2_journal_begin_ordered_truncate(&EXT4_I(inode)->jinode,
14305 -                                                  new_size);
14306 +       return jbd2_journal_begin_ordered_truncate(
14307 +                                       EXT4_SB(inode->i_sb)->s_journal,
14308 +                                       &EXT4_I(inode)->jinode,
14309 +                                       new_size);
14310  }
14311
14312  static void ext4_invalidatepage(struct page *page, unsigned long offset);
14313 @@ -351,9 +353,9 @@
14314                 final = ptrs;
14315         } else {
14316                 ext4_warning(inode->i_sb, "ext4_block_to_path",
14317 -                               "block %lu > max",
14318 +                               "block %lu > max in inode %lu",
14319                                 i_block + direct_blocks +
14320 -                               indirect_blocks + double_blocks);
14321 +                               indirect_blocks + double_blocks, inode->i_ino);
14322         }
14323         if (boundary)
14324                 *boundary = final - 1 - (i_block & (ptrs - 1));
14325 @@ -1345,7 +1347,11 @@
14326                 goto out;
14327         }
14328
14329 -       page = __grab_cache_page(mapping, index);
14330 +       /* We cannot recurse into the filesystem as the transaction is already
14331 +        * started */
14332 +       flags |= AOP_FLAG_NOFS;
14333 +
14334 +       page = grab_cache_page_write_begin(mapping, index, flags);
14335         if (!page) {
14336                 ext4_journal_stop(handle);
14337                 ret = -ENOMEM;
14338 @@ -1354,7 +1360,7 @@
14339         *pagep = page;
14340
14341         ret = block_write_begin(file, mapping, pos, len, flags, pagep, fsdata,
14342 -                                                       ext4_get_block);
14343 +                               ext4_get_block);
14344
14345         if (!ret && ext4_should_journal_data(inode)) {
14346                 ret = walk_page_buffers(handle, page_buffers(page),
14347 @@ -1644,35 +1650,39 @@
14348   */
14349  static int mpage_da_submit_io(struct mpage_da_data *mpd)
14350  {
14351 -       struct address_space *mapping = mpd->inode->i_mapping;
14352 -       int ret = 0, err, nr_pages, i;
14353 -       unsigned long index, end;
14354 -       struct pagevec pvec;
14355         long pages_skipped;
14356 +       struct pagevec pvec;
14357 +       unsigned long index, end;
14358 +       int ret = 0, err, nr_pages, i;
14359 +       struct inode *inode = mpd->inode;
14360 +       struct address_space *mapping = inode->i_mapping;
14361
14362         BUG_ON(mpd->next_page <= mpd->first_page);
14363 -       pagevec_init(&pvec, 0);
14364 +       /*
14365 +        * We need to start from the first_page to the next_page - 1
14366 +        * to make sure we also write the mapped dirty buffer_heads.
14367 +        * If we look at mpd->lbh.b_blocknr we would only be looking
14368 +        * at the currently mapped buffer_heads.
14369 +        */
14370         index = mpd->first_page;
14371         end = mpd->next_page - 1;
14372
14373 +       pagevec_init(&pvec, 0);
14374         while (index <= end) {
14375 -               /*
14376 -                * We can use PAGECACHE_TAG_DIRTY lookup here because
14377 -                * even though we have cleared the dirty flag on the page
14378 -                * We still keep the page in the radix tree with tag
14379 -                * PAGECACHE_TAG_DIRTY. See clear_page_dirty_for_io.
14380 -                * The PAGECACHE_TAG_DIRTY is cleared in set_page_writeback
14381 -                * which is called via the below writepage callback.
14382 -                */
14383 -               nr_pages = pagevec_lookup_tag(&pvec, mapping, &index,
14384 -                                       PAGECACHE_TAG_DIRTY,
14385 -                                       min(end - index,
14386 -                                       (pgoff_t)PAGEVEC_SIZE-1) + 1);
14387 +               nr_pages = pagevec_lookup(&pvec, mapping, index, PAGEVEC_SIZE);
14388                 if (nr_pages == 0)
14389                         break;
14390                 for (i = 0; i < nr_pages; i++) {
14391                         struct page *page = pvec.pages[i];
14392
14393 +                       index = page->index;
14394 +                       if (index > end)
14395 +                               break;
14396 +                       index++;
14397 +
14398 +                       BUG_ON(!PageLocked(page));
14399 +                       BUG_ON(PageWriteback(page));
14400 +
14401                         pages_skipped = mpd->wbc->pages_skipped;
14402                         err = mapping->a_ops->writepage(page, mpd->wbc);
14403                         if (!err && (pages_skipped == mpd->wbc->pages_skipped))
14404 @@ -2086,11 +2096,29 @@
14405                 bh = head;
14406                 do {
14407                         BUG_ON(buffer_locked(bh));
14408 +                       /*
14409 +                        * We need to try to allocate
14410 +                        * unmapped blocks in the same page.
14411 +                        * Otherwise we won't make progress
14412 +                        * with the page in ext4_da_writepage
14413 +                        */
14414                         if (buffer_dirty(bh) &&
14415                                 (!buffer_mapped(bh) || buffer_delay(bh))) {
14416                                 mpage_add_bh_to_extent(mpd, logical, bh);
14417                                 if (mpd->io_done)
14418                                         return MPAGE_DA_EXTENT_TAIL;
14419 +                       } else if (buffer_dirty(bh) && (buffer_mapped(bh))) {
14420 +                               /*
14421 +                                * mapped dirty buffer. We need to update
14422 +                                * the b_state because we look at
14423 +                                * b_state in mpage_da_map_blocks. We don't
14424 +                                * update b_size because if we find an
14425 +                                * unmapped buffer_head later we need to
14426 +                                * use the b_state flag of that buffer_head.
14427 +                                */
14428 +                               if (mpd->lbh.b_size == 0)
14429 +                                       mpd->lbh.b_state =
14430 +                                               bh->b_state & BH_FLAGS;
14431                         }
14432                         logical++;
14433                 } while ((bh = bh->b_this_page) != head);
14434 @@ -2378,6 +2406,7 @@
14435         struct inode *inode = mapping->host;
14436         int no_nrwrite_index_update;
14437         long pages_written = 0, pages_skipped;
14438 +       int range_cyclic, cycled = 1, io_done = 0;
14439         int needed_blocks, ret = 0, nr_to_writebump = 0;
14440         struct ext4_sb_info *sbi = EXT4_SB(mapping->host->i_sb);
14441
14442 @@ -2388,6 +2417,20 @@
14443          */
14444         if (!mapping->nrpages || !mapping_tagged(mapping, PAGECACHE_TAG_DIRTY))
14445                 return 0;
14446 +
14447 +       /*
14448 +        * If the filesystem has aborted, it is read-only, so return
14449 +        * right away instead of dumping stack traces later on that
14450 +        * will obscure the real source of the problem.  We test
14451 +        * EXT4_MOUNT_ABORT instead of sb->s_flag's MS_RDONLY because
14452 +        * the latter could be true if the filesystem is mounted
14453 +        * read-only, and in that case, ext4_da_writepages should
14454 +        * *never* be called, so if that ever happens, we would want
14455 +        * the stack trace.
14456 +        */
14457 +       if (unlikely(sbi->s_mount_opt & EXT4_MOUNT_ABORT))
14458 +               return -EROFS;
14459 +
14460         /*
14461          * Make sure nr_to_write is >= sbi->s_mb_stream_request
14462          * This make sure small files blocks are allocated in
14463 @@ -2401,9 +2444,15 @@
14464         if (wbc->range_start == 0 && wbc->range_end == LLONG_MAX)
14465                 range_whole = 1;
14466
14467 -       if (wbc->range_cyclic)
14468 +       range_cyclic = wbc->range_cyclic;
14469 +       if (wbc->range_cyclic) {
14470                 index = mapping->writeback_index;
14471 -       else
14472 +               if (index)
14473 +                       cycled = 0;
14474 +               wbc->range_start = index << PAGE_CACHE_SHIFT;
14475 +               wbc->range_end  = LLONG_MAX;
14476 +               wbc->range_cyclic = 0;
14477 +       } else
14478                 index = wbc->range_start >> PAGE_CACHE_SHIFT;
14479
14480         mpd.wbc = wbc;
14481 @@ -2417,6 +2466,7 @@
14482         wbc->no_nrwrite_index_update = 1;
14483         pages_skipped = wbc->pages_skipped;
14484
14485 +retry:
14486         while (!ret && wbc->nr_to_write > 0) {
14487
14488                 /*
14489 @@ -2432,7 +2482,7 @@
14490                 handle = ext4_journal_start(inode, needed_blocks);
14491                 if (IS_ERR(handle)) {
14492                         ret = PTR_ERR(handle);
14493 -                       printk(KERN_EMERG "%s: jbd2_start: "
14494 +                       printk(KERN_CRIT "%s: jbd2_start: "
14495                                "%ld pages, ino %lu; err %d\n", __func__,
14496                                 wbc->nr_to_write, inode->i_ino, ret);
14497                         dump_stack();
14498 @@ -2459,6 +2509,7 @@
14499                         pages_written += mpd.pages_written;
14500                         wbc->pages_skipped = pages_skipped;
14501                         ret = 0;
14502 +                       io_done = 1;
14503                 } else if (wbc->nr_to_write)
14504                         /*
14505                          * There is no more writeout needed
14506 @@ -2467,6 +2518,13 @@
14507                          */
14508                         break;
14509         }
14510 +       if (!io_done && !cycled) {
14511 +               cycled = 1;
14512 +               index = 0;
14513 +               wbc->range_start = index << PAGE_CACHE_SHIFT;
14514 +               wbc->range_end  = mapping->writeback_index - 1;
14515 +               goto retry;
14516 +       }
14517         if (pages_skipped != wbc->pages_skipped)
14518                 printk(KERN_EMERG "This should not happen leaving %s "
14519                                 "with nr_to_write = %ld ret = %d\n",
14520 @@ -2474,6 +2532,7 @@
14521
14522         /* Update index */
14523         index += pages_written;
14524 +       wbc->range_cyclic = range_cyclic;
14525         if (wbc->range_cyclic || (range_whole && wbc->nr_to_write > 0))
14526                 /*
14527                  * set the writeback_index so that range_cyclic
14528 @@ -2548,8 +2607,11 @@
14529                 ret = PTR_ERR(handle);
14530                 goto out;
14531         }
14532 +       /* We cannot recurse into the filesystem as the transaction is already
14533 +        * started */
14534 +       flags |= AOP_FLAG_NOFS;
14535
14536 -       page = __grab_cache_page(mapping, index);
14537 +       page = grab_cache_page_write_begin(mapping, index, flags);
14538         if (!page) {
14539                 ext4_journal_stop(handle);
14540                 ret = -ENOMEM;
14541 --- kernel-power-2.6.28.orig/fs/ext4/mballoc.c
14542 +++ kernel-power-2.6.28/fs/ext4/mballoc.c
14543 @@ -100,7 +100,7 @@
14544   * inode as:
14545   *
14546   *  {                        page                        }
14547 - *  [ group 0 buddy][ group 0 bitmap] [group 1][ group 1]...
14548 + *  [ group 0 bitmap][ group 0 buddy] [group 1][ group 1]...
14549   *
14550   *
14551   * one block each for bitmap and buddy information.  So for each group we
14552 @@ -330,6 +330,18 @@
14553   *        object
14554   *
14555   */
14556 +static struct kmem_cache *ext4_pspace_cachep;
14557 +static struct kmem_cache *ext4_ac_cachep;
14558 +static struct kmem_cache *ext4_free_ext_cachep;
14559 +static void ext4_mb_generate_from_pa(struct super_block *sb, void *bitmap,
14560 +                                       ext4_group_t group);
14561 +static void ext4_mb_generate_from_freelist(struct super_block *sb, void *bitmap,
14562 +                                               ext4_group_t group);
14563 +static int ext4_mb_init_per_dev_proc(struct super_block *sb);
14564 +static int ext4_mb_destroy_per_dev_proc(struct super_block *sb);
14565 +static void release_blocks_on_commit(journal_t *journal, transaction_t *txn);
14566 +
14567 +
14568
14569  static inline void *mb_correct_addr_and_bit(int *bit, void *addr)
14570  {
14571 @@ -716,7 +728,7 @@
14572   * stored in the inode as
14573   *
14574   * {                        page                        }
14575 - * [ group 0 buddy][ group 0 bitmap] [group 1][ group 1]...
14576 + * [ group 0 bitmap][ group 0 buddy] [group 1][ group 1]...
14577   *
14578   *
14579   * one block each for bitmap and buddy information.
14580 @@ -782,22 +794,42 @@
14581                 if (bh[i] == NULL)
14582                         goto out;
14583
14584 -               if (buffer_uptodate(bh[i]) &&
14585 -                   !(desc->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT)))
14586 +               if (bitmap_uptodate(bh[i]))
14587                         continue;
14588
14589                 lock_buffer(bh[i]);
14590 +               if (bitmap_uptodate(bh[i])) {
14591 +                       unlock_buffer(bh[i]);
14592 +                       continue;
14593 +               }
14594                 spin_lock(sb_bgl_lock(EXT4_SB(sb), first_group + i));
14595                 if (desc->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT)) {
14596                         ext4_init_block_bitmap(sb, bh[i],
14597                                                 first_group + i, desc);
14598 +                       set_bitmap_uptodate(bh[i]);
14599                         set_buffer_uptodate(bh[i]);
14600                         unlock_buffer(bh[i]);
14601                         spin_unlock(sb_bgl_lock(EXT4_SB(sb), first_group + i));
14602                         continue;
14603                 }
14604                 spin_unlock(sb_bgl_lock(EXT4_SB(sb), first_group + i));
14605 +               if (buffer_uptodate(bh[i])) {
14606 +                       /*
14607 +                        * if not uninit if bh is uptodate,
14608 +                        * bitmap is also uptodate
14609 +                        */
14610 +                       set_bitmap_uptodate(bh[i]);
14611 +                       unlock_buffer(bh[i]);
14612 +                       continue;
14613 +               }
14614                 get_bh(bh[i]);
14615 +               /*
14616 +                * submit the buffer_head for read. We can
14617 +                * safely mark the bitmap as uptodate now.
14618 +                * We do it here so the bitmap uptodate bit
14619 +                * get set with buffer lock held.
14620 +                */
14621 +               set_bitmap_uptodate(bh[i]);
14622                 bh[i]->b_end_io = end_buffer_read_sync;
14623                 submit_bh(READ, bh[i]);
14624                 mb_debug("read bitmap for group %lu\n", first_group + i);
14625 @@ -814,6 +846,8 @@
14626
14627         err = 0;
14628         first_block = page->index * blocks_per_page;
14629 +       /* init the page  */
14630 +       memset(page_address(page), 0xff, PAGE_CACHE_SIZE);
14631         for (i = 0; i < blocks_per_page; i++) {
14632                 int group;
14633                 struct ext4_group_info *grinfo;
14634 @@ -840,7 +874,6 @@
14635                         BUG_ON(incore == NULL);
14636                         mb_debug("put buddy for group %u in page %lu/%x\n",
14637                                 group, page->index, i * blocksize);
14638 -                       memset(data, 0xff, blocksize);
14639                         grinfo = ext4_get_group_info(sb, group);
14640                         grinfo->bb_fragments = 0;
14641                         memset(grinfo->bb_counters, 0,
14642 @@ -848,7 +881,9 @@
14643                         /*
14644                          * incore got set to the group block bitmap below
14645                          */
14646 +                       ext4_lock_group(sb, group);
14647                         ext4_mb_generate_buddy(sb, data, incore, group);
14648 +                       ext4_unlock_group(sb, group);
14649                         incore = NULL;
14650                 } else {
14651                         /* this is block of bitmap */
14652 @@ -862,6 +897,7 @@
14653
14654                         /* mark all preallocated blks used in in-core bitmap */
14655                         ext4_mb_generate_from_pa(sb, data, group);
14656 +                       ext4_mb_generate_from_freelist(sb, data, group);
14657                         ext4_unlock_group(sb, group);
14658
14659                         /* set incore so that the buddy information can be
14660 @@ -886,18 +922,20 @@
14661  ext4_mb_load_buddy(struct super_block *sb, ext4_group_t group,
14662                                         struct ext4_buddy *e4b)
14663  {
14664 -       struct ext4_sb_info *sbi = EXT4_SB(sb);
14665 -       struct inode *inode = sbi->s_buddy_cache;
14666         int blocks_per_page;
14667         int block;
14668         int pnum;
14669         int poff;
14670         struct page *page;
14671         int ret;
14672 +       struct ext4_group_info *grp;
14673 +       struct ext4_sb_info *sbi = EXT4_SB(sb);
14674 +       struct inode *inode = sbi->s_buddy_cache;
14675
14676         mb_debug("load group %lu\n", group);
14677
14678         blocks_per_page = PAGE_CACHE_SIZE / sb->s_blocksize;
14679 +       grp = ext4_get_group_info(sb, group);
14680
14681         e4b->bd_blkbits = sb->s_blocksize_bits;
14682         e4b->bd_info = ext4_get_group_info(sb, group);
14683 @@ -905,6 +943,15 @@
14684         e4b->bd_group = group;
14685         e4b->bd_buddy_page = NULL;
14686         e4b->bd_bitmap_page = NULL;
14687 +       e4b->alloc_semp = &grp->alloc_sem;
14688 +
14689 +       /* Take the read lock on the group alloc
14690 +        * sem. This would make sure a parallel
14691 +        * ext4_mb_init_group happening on other
14692 +        * groups mapped by the page is blocked
14693 +        * till we are done with allocation
14694 +        */
14695 +       down_read(e4b->alloc_semp);
14696
14697         /*
14698          * the buddy cache inode stores the block bitmap
14699 @@ -920,6 +967,14 @@
14700         page = find_get_page(inode->i_mapping, pnum);
14701         if (page == NULL || !PageUptodate(page)) {
14702                 if (page)
14703 +                       /*
14704 +                        * drop the page reference and try
14705 +                        * to get the page with lock. If we
14706 +                        * are not uptodate that implies
14707 +                        * somebody just created the page but
14708 +                        * is yet to initialize the same. So
14709 +                        * wait for it to initialize.
14710 +                        */
14711                         page_cache_release(page);
14712                 page = find_or_create_page(inode->i_mapping, pnum, GFP_NOFS);
14713                 if (page) {
14714 @@ -985,6 +1040,9 @@
14715                 page_cache_release(e4b->bd_buddy_page);
14716         e4b->bd_buddy = NULL;
14717         e4b->bd_bitmap = NULL;
14718 +
14719 +       /* Done with the buddy cache */
14720 +       up_read(e4b->alloc_semp);
14721         return ret;
14722  }
14723
14724 @@ -994,6 +1052,9 @@
14725                 page_cache_release(e4b->bd_bitmap_page);
14726         if (e4b->bd_buddy_page)
14727                 page_cache_release(e4b->bd_buddy_page);
14728 +       /* Done with the buddy cache */
14729 +       if (e4b->alloc_semp)
14730 +               up_read(e4b->alloc_semp);
14731  }
14732
14733
14734 @@ -1031,7 +1092,10 @@
14735                         cur += 32;
14736                         continue;
14737                 }
14738 -               mb_clear_bit_atomic(lock, cur, bm);
14739 +               if (lock)
14740 +                       mb_clear_bit_atomic(lock, cur, bm);
14741 +               else
14742 +                       mb_clear_bit(cur, bm);
14743                 cur++;
14744         }
14745  }
14746 @@ -1049,7 +1113,10 @@
14747                         cur += 32;
14748                         continue;
14749                 }
14750 -               mb_set_bit_atomic(lock, cur, bm);
14751 +               if (lock)
14752 +                       mb_set_bit_atomic(lock, cur, bm);
14753 +               else
14754 +                       mb_set_bit(cur, bm);
14755                 cur++;
14756         }
14757  }
14758 @@ -1296,13 +1363,20 @@
14759         ac->ac_tail = ret & 0xffff;
14760         ac->ac_buddy = ret >> 16;
14761
14762 -       /* XXXXXXX: SUCH A HORRIBLE **CK */
14763 -       /*FIXME!! Why ? */
14764 +       /*
14765 +        * take the page reference. We want the page to be pinned
14766 +        * so that we don't get a ext4_mb_init_cache_call for this
14767 +        * group until we update the bitmap. That would mean we
14768 +        * double allocate blocks. The reference is dropped
14769 +        * in ext4_mb_release_context
14770 +        */
14771         ac->ac_bitmap_page = e4b->bd_bitmap_page;
14772         get_page(ac->ac_bitmap_page);
14773         ac->ac_buddy_page = e4b->bd_buddy_page;
14774         get_page(ac->ac_buddy_page);
14775 -
14776 +       /* on allocation we use ac to track the held semaphore */
14777 +       ac->alloc_semp =  e4b->alloc_semp;
14778 +       e4b->alloc_semp = NULL;
14779         /* store last allocated for subsequent stream allocation */
14780         if ((ac->ac_flags & EXT4_MB_HINT_DATA)) {
14781                 spin_lock(&sbi->s_md_lock);
14782 @@ -1326,6 +1400,8 @@
14783         struct ext4_free_extent ex;
14784         int max;
14785
14786 +       if (ac->ac_status == AC_STATUS_FOUND)
14787 +               return;
14788         /*
14789          * We don't want to scan for a whole year
14790          */
14791 @@ -1692,6 +1768,173 @@
14792         return 0;
14793  }
14794
14795 +/*
14796 + * lock the group_info alloc_sem of all the groups
14797 + * belonging to the same buddy cache page. This
14798 + * make sure other parallel operation on the buddy
14799 + * cache doesn't happen  whild holding the buddy cache
14800 + * lock
14801 + */
14802 +int ext4_mb_get_buddy_cache_lock(struct super_block *sb, ext4_group_t group)
14803 +{
14804 +       int i;
14805 +       int block, pnum;
14806 +       int blocks_per_page;
14807 +       int groups_per_page;
14808 +       ext4_group_t first_group;
14809 +       struct ext4_group_info *grp;
14810 +
14811 +       blocks_per_page = PAGE_CACHE_SIZE / sb->s_blocksize;
14812 +       /*
14813 +        * the buddy cache inode stores the block bitmap
14814 +        * and buddy information in consecutive blocks.
14815 +        * So for each group we need two blocks.
14816 +        */
14817 +       block = group * 2;
14818 +       pnum = block / blocks_per_page;
14819 +       first_group = pnum * blocks_per_page / 2;
14820 +
14821 +       groups_per_page = blocks_per_page >> 1;
14822 +       if (groups_per_page == 0)
14823 +               groups_per_page = 1;
14824 +       /* read all groups the page covers into the cache */
14825 +       for (i = 0; i < groups_per_page; i++) {
14826 +
14827 +               if ((first_group + i) >= EXT4_SB(sb)->s_groups_count)
14828 +                       break;
14829 +               grp = ext4_get_group_info(sb, first_group + i);
14830 +               /* take all groups write allocation
14831 +                * semaphore. This make sure there is
14832 +                * no block allocation going on in any
14833 +                * of that groups
14834 +                */
14835 +               down_write(&grp->alloc_sem);
14836 +       }
14837 +       return i;
14838 +}
14839 +
14840 +void ext4_mb_put_buddy_cache_lock(struct super_block *sb,
14841 +                                       ext4_group_t group, int locked_group)
14842 +{
14843 +       int i;
14844 +       int block, pnum;
14845 +       int blocks_per_page;
14846 +       ext4_group_t first_group;
14847 +       struct ext4_group_info *grp;
14848 +
14849 +       blocks_per_page = PAGE_CACHE_SIZE / sb->s_blocksize;
14850 +       /*
14851 +        * the buddy cache inode stores the block bitmap
14852 +        * and buddy information in consecutive blocks.
14853 +        * So for each group we need two blocks.
14854 +        */
14855 +       block = group * 2;
14856 +       pnum = block / blocks_per_page;
14857 +       first_group = pnum * blocks_per_page / 2;
14858 +       /* release locks on all the groups */
14859 +       for (i = 0; i < locked_group; i++) {
14860 +
14861 +               grp = ext4_get_group_info(sb, first_group + i);
14862 +               /* take all groups write allocation
14863 +                * semaphore. This make sure there is
14864 +                * no block allocation going on in any
14865 +                * of that groups
14866 +                */
14867 +               up_write(&grp->alloc_sem);
14868 +       }
14869 +
14870 +}
14871 +
14872 +static int ext4_mb_init_group(struct super_block *sb, ext4_group_t group)
14873 +{
14874 +
14875 +       int ret;
14876 +       void *bitmap;
14877 +       int blocks_per_page;
14878 +       int block, pnum, poff;
14879 +       int num_grp_locked = 0;
14880 +       struct ext4_group_info *this_grp;
14881 +       struct ext4_sb_info *sbi = EXT4_SB(sb);
14882 +       struct inode *inode = sbi->s_buddy_cache;
14883 +       struct page *page = NULL, *bitmap_page = NULL;
14884 +
14885 +       mb_debug("init group %lu\n", group);
14886 +       blocks_per_page = PAGE_CACHE_SIZE / sb->s_blocksize;
14887 +       this_grp = ext4_get_group_info(sb, group);
14888 +       /*
14889 +        * This ensures we don't add group
14890 +        * to this buddy cache via resize
14891 +        */
14892 +       num_grp_locked =  ext4_mb_get_buddy_cache_lock(sb, group);
14893 +       if (!EXT4_MB_GRP_NEED_INIT(this_grp)) {
14894 +               /*
14895 +                * somebody initialized the group
14896 +                * return without doing anything
14897 +                */
14898 +               ret = 0;
14899 +               goto err;
14900 +       }
14901 +       /*
14902 +        * the buddy cache inode stores the block bitmap
14903 +        * and buddy information in consecutive blocks.
14904 +        * So for each group we need two blocks.
14905 +        */
14906 +       block = group * 2;
14907 +       pnum = block / blocks_per_page;
14908 +       poff = block % blocks_per_page;
14909 +       page = find_or_create_page(inode->i_mapping, pnum, GFP_NOFS);
14910 +       if (page) {
14911 +               BUG_ON(page->mapping != inode->i_mapping);
14912 +               ret = ext4_mb_init_cache(page, NULL);
14913 +               if (ret) {
14914 +                       unlock_page(page);
14915 +                       goto err;
14916 +               }
14917 +               unlock_page(page);
14918 +       }
14919 +       if (page == NULL || !PageUptodate(page)) {
14920 +               ret = -EIO;
14921 +               goto err;
14922 +       }
14923 +       mark_page_accessed(page);
14924 +       bitmap_page = page;
14925 +       bitmap = page_address(page) + (poff * sb->s_blocksize);
14926 +
14927 +       /* init buddy cache */
14928 +       block++;
14929 +       pnum = block / blocks_per_page;
14930 +       poff = block % blocks_per_page;
14931 +       page = find_or_create_page(inode->i_mapping, pnum, GFP_NOFS);
14932 +       if (page == bitmap_page) {
14933 +               /*
14934 +                * If both the bitmap and buddy are in
14935 +                * the same page we don't need to force
14936 +                * init the buddy
14937 +                */
14938 +               unlock_page(page);
14939 +       } else if (page) {
14940 +               BUG_ON(page->mapping != inode->i_mapping);
14941 +               ret = ext4_mb_init_cache(page, bitmap);
14942 +               if (ret) {
14943 +                       unlock_page(page);
14944 +                       goto err;
14945 +               }
14946 +               unlock_page(page);
14947 +       }
14948 +       if (page == NULL || !PageUptodate(page)) {
14949 +               ret = -EIO;
14950 +               goto err;
14951 +       }
14952 +       mark_page_accessed(page);
14953 +err:
14954 +       ext4_mb_put_buddy_cache_lock(sb, group, num_grp_locked);
14955 +       if (bitmap_page)
14956 +               page_cache_release(bitmap_page);
14957 +       if (page)
14958 +               page_cache_release(page);
14959 +       return ret;
14960 +}
14961 +
14962  static noinline_for_stack int
14963  ext4_mb_regular_allocator(struct ext4_allocation_context *ac)
14964  {
14965 @@ -1775,7 +2018,7 @@
14966                                 group = 0;
14967
14968                         /* quick check to skip empty groups */
14969 -                       grp = ext4_get_group_info(ac->ac_sb, group);
14970 +                       grp = ext4_get_group_info(sb, group);
14971                         if (grp->bb_free == 0)
14972                                 continue;
14973
14974 @@ -1788,10 +2031,9 @@
14975                                  * we need full data about the group
14976                                  * to make a good selection
14977                                  */
14978 -                               err = ext4_mb_load_buddy(sb, group, &e4b);
14979 +                               err = ext4_mb_init_group(sb, group);
14980                                 if (err)
14981                                         goto out;
14982 -                               ext4_mb_release_desc(&e4b);
14983                         }
14984
14985                         /*
14986 @@ -2300,6 +2542,7 @@
14987         }
14988
14989         INIT_LIST_HEAD(&meta_group_info[i]->bb_prealloc_list);
14990 +       init_rwsem(&meta_group_info[i]->alloc_sem);
14991         meta_group_info[i]->bb_free_root.rb_node = NULL;;
14992
14993  #ifdef DOUBLE_CHECK
14994 @@ -2327,54 +2570,6 @@
14995  } /* ext4_mb_add_groupinfo */
14996
14997  /*
14998 - * Add a group to the existing groups.
14999 - * This function is used for online resize
15000 - */
15001 -int ext4_mb_add_more_groupinfo(struct super_block *sb, ext4_group_t group,
15002 -                              struct ext4_group_desc *desc)
15003 -{
15004 -       struct ext4_sb_info *sbi = EXT4_SB(sb);
15005 -       struct inode *inode = sbi->s_buddy_cache;
15006 -       int blocks_per_page;
15007 -       int block;
15008 -       int pnum;
15009 -       struct page *page;
15010 -       int err;
15011 -
15012 -       /* Add group based on group descriptor*/
15013 -       err = ext4_mb_add_groupinfo(sb, group, desc);
15014 -       if (err)
15015 -               return err;
15016 -
15017 -       /*
15018 -        * Cache pages containing dynamic mb_alloc datas (buddy and bitmap
15019 -        * datas) are set not up to date so that they will be re-initilaized
15020 -        * during the next call to ext4_mb_load_buddy
15021 -        */
15022 -
15023 -       /* Set buddy page as not up to date */
15024 -       blocks_per_page = PAGE_CACHE_SIZE / sb->s_blocksize;
15025 -       block = group * 2;
15026 -       pnum = block / blocks_per_page;
15027 -       page = find_get_page(inode->i_mapping, pnum);
15028 -       if (page != NULL) {
15029 -               ClearPageUptodate(page);
15030 -               page_cache_release(page);
15031 -       }
15032 -
15033 -       /* Set bitmap page as not up to date */
15034 -       block++;
15035 -       pnum = block / blocks_per_page;
15036 -       page = find_get_page(inode->i_mapping, pnum);
15037 -       if (page != NULL) {
15038 -               ClearPageUptodate(page);
15039 -               page_cache_release(page);
15040 -       }
15041 -
15042 -       return 0;
15043 -}
15044 -
15045 -/*
15046   * Update an existing group.
15047   * This function is used for online resize
15048   */
15049 @@ -2493,6 +2688,8 @@
15050         if (sbi->s_mb_offsets == NULL) {
15051                 return -ENOMEM;
15052         }
15053 +
15054 +       i = (sb->s_blocksize_bits + 2) * sizeof(unsigned int);
15055         sbi->s_mb_maxs = kmalloc(i, GFP_KERNEL);
15056         if (sbi->s_mb_maxs == NULL) {
15057                 kfree(sbi->s_mb_maxs);
15058 @@ -2843,8 +3040,8 @@
15059             in_range(block + len - 1, ext4_inode_table(sb, gdp),
15060                      EXT4_SB(sb)->s_itb_per_group)) {
15061                 ext4_error(sb, __func__,
15062 -                          "Allocating block in system zone - block = %llu",
15063 -                          block);
15064 +                          "Allocating block %llu in system zone of %d group\n",
15065 +                          block, ac->ac_b_ex.fe_group);
15066                 /* File system mounted not to panic on error
15067                  * Fix the bitmap and repeat the block allocation
15068                  * We leak some of the blocks here.
15069 @@ -2866,10 +3063,9 @@
15070                 }
15071         }
15072  #endif
15073 -       mb_set_bits(sb_bgl_lock(sbi, ac->ac_b_ex.fe_group), bitmap_bh->b_data,
15074 -                               ac->ac_b_ex.fe_start, ac->ac_b_ex.fe_len);
15075 -
15076         spin_lock(sb_bgl_lock(sbi, ac->ac_b_ex.fe_group));
15077 +       mb_set_bits(NULL, bitmap_bh->b_data,
15078 +                               ac->ac_b_ex.fe_start, ac->ac_b_ex.fe_len);
15079         if (gdp->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT)) {
15080                 gdp->bg_flags &= cpu_to_le16(~EXT4_BG_BLOCK_UNINIT);
15081                 gdp->bg_free_blocks_count =
15082 @@ -3307,6 +3503,32 @@
15083  }
15084
15085  /*
15086 + * the function goes through all block freed in the group
15087 + * but not yet committed and marks them used in in-core bitmap.
15088 + * buddy must be generated from this bitmap
15089 + * Need to be called with ext4 group lock (ext4_lock_group)
15090 + */
15091 +static void ext4_mb_generate_from_freelist(struct super_block *sb, void *bitmap,
15092 +                                               ext4_group_t group)
15093 +{
15094 +       struct rb_node *n;
15095 +       struct ext4_group_info *grp;
15096 +       struct ext4_free_data *entry;
15097 +
15098 +       grp = ext4_get_group_info(sb, group);
15099 +       n = rb_first(&(grp->bb_free_root));
15100 +
15101 +       while (n) {
15102 +               entry = rb_entry(n, struct ext4_free_data, node);
15103 +               mb_set_bits(sb_bgl_lock(EXT4_SB(sb), group),
15104 +                               bitmap, entry->start_blk,
15105 +                               entry->count);
15106 +               n = rb_next(n);
15107 +       }
15108 +       return;
15109 +}
15110 +
15111 +/*
15112   * the function goes through all preallocation in this group and marks them
15113   * used in in-core bitmap. buddy must be generated from this bitmap
15114   * Need to be called with ext4 group lock (ext4_lock_group)
15115 @@ -3468,6 +3690,8 @@
15116         pa->pa_free = pa->pa_len;
15117         atomic_set(&pa->pa_count, 1);
15118         spin_lock_init(&pa->pa_lock);
15119 +       INIT_LIST_HEAD(&pa->pa_inode_list);
15120 +       INIT_LIST_HEAD(&pa->pa_group_list);
15121         pa->pa_deleted = 0;
15122         pa->pa_linear = 0;
15123
15124 @@ -3526,6 +3750,7 @@
15125         atomic_set(&pa->pa_count, 1);
15126         spin_lock_init(&pa->pa_lock);
15127         INIT_LIST_HEAD(&pa->pa_inode_list);
15128 +       INIT_LIST_HEAD(&pa->pa_group_list);
15129         pa->pa_deleted = 0;
15130         pa->pa_linear = 1;
15131
15132 @@ -4068,6 +4293,7 @@
15133         ac->ac_pa = NULL;
15134         ac->ac_bitmap_page = NULL;
15135         ac->ac_buddy_page = NULL;
15136 +       ac->alloc_semp = NULL;
15137         ac->ac_lg = NULL;
15138
15139         /* we have to define context: we'll we work with a file or
15140 @@ -4233,18 +4459,23 @@
15141                         pa->pa_free -= ac->ac_b_ex.fe_len;
15142                         pa->pa_len -= ac->ac_b_ex.fe_len;
15143                         spin_unlock(&pa->pa_lock);
15144 -                       /*
15145 -                        * We want to add the pa to the right bucket.
15146 -                        * Remove it from the list and while adding
15147 -                        * make sure the list to which we are adding
15148 -                        * doesn't grow big.
15149 -                        */
15150 -                       if (likely(pa->pa_free)) {
15151 -                               spin_lock(pa->pa_obj_lock);
15152 -                               list_del_rcu(&pa->pa_inode_list);
15153 -                               spin_unlock(pa->pa_obj_lock);
15154 -                               ext4_mb_add_n_trim(ac);
15155 -                       }
15156 +               }
15157 +       }
15158 +       if (ac->alloc_semp)
15159 +               up_read(ac->alloc_semp);
15160 +       if (pa) {
15161 +               /*
15162 +                * We want to add the pa to the right bucket.
15163 +                * Remove it from the list and while adding
15164 +                * make sure the list to which we are adding
15165 +                * doesn't grow big.  We need to release
15166 +                * alloc_semp before calling ext4_mb_add_n_trim()
15167 +                */
15168 +               if (pa->pa_linear && likely(pa->pa_free)) {
15169 +                       spin_lock(pa->pa_obj_lock);
15170 +                       list_del_rcu(&pa->pa_inode_list);
15171 +                       spin_unlock(pa->pa_obj_lock);
15172 +                       ext4_mb_add_n_trim(ac);
15173                 }
15174                 ext4_mb_put_pa(ac, ac->ac_sb, pa);
15175         }
15176 @@ -4313,7 +4544,7 @@
15177         }
15178         if (ar->len == 0) {
15179                 *errp = -EDQUOT;
15180 -               return 0;
15181 +               goto out3;
15182         }
15183         inquota = ar->len;
15184
15185 @@ -4348,10 +4579,14 @@
15186                                 ac->ac_o_ex.fe_len < ac->ac_b_ex.fe_len)
15187                         ext4_mb_new_preallocation(ac);
15188         }
15189 -
15190         if (likely(ac->ac_status == AC_STATUS_FOUND)) {
15191                 *errp = ext4_mb_mark_diskspace_used(ac, handle, reserv_blks);
15192                 if (*errp ==  -EAGAIN) {
15193 +                       /*
15194 +                        * drop the reference that we took
15195 +                        * in ext4_mb_use_best_found
15196 +                        */
15197 +                       ext4_mb_release_context(ac);
15198                         ac->ac_b_ex.fe_group = 0;
15199                         ac->ac_b_ex.fe_start = 0;
15200                         ac->ac_b_ex.fe_len = 0;
15201 @@ -4382,6 +4617,13 @@
15202  out1:
15203         if (ar->len < inquota)
15204                 DQUOT_FREE_BLOCK(ar->inode, inquota - ar->len);
15205 +out3:
15206 +       if (!ar->len) {
15207 +               if (!EXT4_I(ar->inode)->i_delalloc_reserved_flag)
15208 +                       /* release all the reserved blocks if non delalloc */
15209 +                       percpu_counter_sub(&sbi->s_dirtyblocks_counter,
15210 +                                               reserv_blks);
15211 +       }
15212
15213         return block;
15214  }
15215 @@ -4403,12 +4645,13 @@
15216
15217  static noinline_for_stack int
15218  ext4_mb_free_metadata(handle_t *handle, struct ext4_buddy *e4b,
15219 -                         ext4_group_t group, ext4_grpblk_t block, int count)
15220 +                     struct ext4_free_data *new_entry)
15221  {
15222 +       ext4_grpblk_t block;
15223 +       struct ext4_free_data *entry;
15224         struct ext4_group_info *db = e4b->bd_info;
15225         struct super_block *sb = e4b->bd_sb;
15226         struct ext4_sb_info *sbi = EXT4_SB(sb);
15227 -       struct ext4_free_data *entry, *new_entry;
15228         struct rb_node **n = &db->bb_free_root.rb_node, *node;
15229         struct rb_node *parent = NULL, *new_node;
15230
15231 @@ -4416,14 +4659,9 @@
15232         BUG_ON(e4b->bd_bitmap_page == NULL);
15233         BUG_ON(e4b->bd_buddy_page == NULL);
15234
15235 -       new_entry  = kmem_cache_alloc(ext4_free_ext_cachep, GFP_NOFS);
15236 -       new_entry->start_blk = block;
15237 -       new_entry->group  = group;
15238 -       new_entry->count = count;
15239 -       new_entry->t_tid = handle->h_transaction->t_tid;
15240         new_node = &new_entry->node;
15241 +       block = new_entry->start_blk;
15242
15243 -       ext4_lock_group(sb, group);
15244         if (!*n) {
15245                 /* first free block exent. We need to
15246                    protect buddy cache from being freed,
15247 @@ -4441,7 +4679,6 @@
15248                 else if (block >= (entry->start_blk + entry->count))
15249                         n = &(*n)->rb_right;
15250                 else {
15251 -                       ext4_unlock_group(sb, group);
15252                         ext4_error(sb, __func__,
15253                             "Double free of blocks %d (%d %d)\n",
15254                             block, entry->start_blk, entry->count);
15255 @@ -4483,7 +4720,6 @@
15256         spin_lock(&sbi->s_md_lock);
15257         list_add(&new_entry->list, &handle->h_transaction->t_private_list);
15258         spin_unlock(&sbi->s_md_lock);
15259 -       ext4_unlock_group(sb, group);
15260         return 0;
15261  }
15262
15263 @@ -4581,11 +4817,6 @@
15264         err = ext4_journal_get_write_access(handle, gd_bh);
15265         if (err)
15266                 goto error_return;
15267 -
15268 -       err = ext4_mb_load_buddy(sb, block_group, &e4b);
15269 -       if (err)
15270 -               goto error_return;
15271 -
15272  #ifdef AGGRESSIVE_CHECK
15273         {
15274                 int i;
15275 @@ -4593,13 +4824,6 @@
15276                         BUG_ON(!mb_test_bit(bit + i, bitmap_bh->b_data));
15277         }
15278  #endif
15279 -       mb_clear_bits(sb_bgl_lock(sbi, block_group), bitmap_bh->b_data,
15280 -                       bit, count);
15281 -
15282 -       /* We dirtied the bitmap block */
15283 -       BUFFER_TRACE(bitmap_bh, "dirtied bitmap block");
15284 -       err = ext4_journal_dirty_metadata(handle, bitmap_bh);
15285 -
15286         if (ac) {
15287                 ac->ac_b_ex.fe_group = block_group;
15288                 ac->ac_b_ex.fe_start = bit;
15289 @@ -4607,12 +4831,33 @@
15290                 ext4_mb_store_history(ac);
15291         }
15292
15293 +       err = ext4_mb_load_buddy(sb, block_group, &e4b);
15294 +       if (err)
15295 +               goto error_return;
15296         if (metadata) {
15297 -               /* blocks being freed are metadata. these blocks shouldn't
15298 -                * be used until this transaction is committed */
15299 -               ext4_mb_free_metadata(handle, &e4b, block_group, bit, count);
15300 +               struct ext4_free_data *new_entry;
15301 +               /*
15302 +                * blocks being freed are metadata. these blocks shouldn't
15303 +                * be used until this transaction is committed
15304 +                */
15305 +               new_entry  = kmem_cache_alloc(ext4_free_ext_cachep, GFP_NOFS);
15306 +               new_entry->start_blk = bit;
15307 +               new_entry->group  = block_group;
15308 +               new_entry->count = count;
15309 +               new_entry->t_tid = handle->h_transaction->t_tid;
15310 +               ext4_lock_group(sb, block_group);
15311 +               mb_clear_bits(sb_bgl_lock(sbi, block_group), bitmap_bh->b_data,
15312 +                               bit, count);
15313 +               ext4_mb_free_metadata(handle, &e4b, new_entry);
15314 +               ext4_unlock_group(sb, block_group);
15315         } else {
15316                 ext4_lock_group(sb, block_group);
15317 +               /* need to update group_info->bb_free and bitmap
15318 +                * with group lock held. generate_buddy look at
15319 +                * them with group lock_held
15320 +                */
15321 +               mb_clear_bits(sb_bgl_lock(sbi, block_group), bitmap_bh->b_data,
15322 +                               bit, count);
15323                 mb_free_blocks(inode, &e4b, bit, count);
15324                 ext4_mb_return_to_preallocation(inode, &e4b, block, count);
15325                 ext4_unlock_group(sb, block_group);
15326 @@ -4635,6 +4880,10 @@
15327
15328         *freed += count;
15329
15330 +       /* We dirtied the bitmap block */
15331 +       BUFFER_TRACE(bitmap_bh, "dirtied bitmap block");
15332 +       err = ext4_journal_dirty_metadata(handle, bitmap_bh);
15333 +
15334         /* And the group descriptor block */
15335         BUFFER_TRACE(gd_bh, "dirtied group descriptor block");
15336         ret = ext4_journal_dirty_metadata(handle, gd_bh);
15337 --- kernel-power-2.6.28.orig/fs/ext4/mballoc.h
15338 +++ kernel-power-2.6.28/fs/ext4/mballoc.h
15339 @@ -20,6 +20,7 @@
15340  #include <linux/version.h>
15341  #include <linux/blkdev.h>
15342  #include <linux/marker.h>
15343 +#include <linux/mutex.h>
15344  #include "ext4_jbd2.h"
15345  #include "ext4.h"
15346  #include "group.h"
15347 @@ -98,9 +99,6 @@
15348   */
15349  #define MB_DEFAULT_GROUP_PREALLOC      512
15350
15351 -static struct kmem_cache *ext4_pspace_cachep;
15352 -static struct kmem_cache *ext4_ac_cachep;
15353 -static struct kmem_cache *ext4_free_ext_cachep;
15354
15355  struct ext4_free_data {
15356         /* this links the free block information from group_info */
15357 @@ -130,6 +128,7 @@
15358  #ifdef DOUBLE_CHECK
15359         void            *bb_bitmap;
15360  #endif
15361 +       struct rw_semaphore alloc_sem;
15362         unsigned short  bb_counters[];
15363  };
15364
15365 @@ -217,6 +216,11 @@
15366         __u8 ac_op;             /* operation, for history only */
15367         struct page *ac_bitmap_page;
15368         struct page *ac_buddy_page;
15369 +       /*
15370 +        * pointer to the held semaphore upon successful
15371 +        * block allocation
15372 +        */
15373 +       struct rw_semaphore *alloc_semp;
15374         struct ext4_prealloc_space *ac_pa;
15375         struct ext4_locality_group *ac_lg;
15376  };
15377 @@ -250,6 +254,7 @@
15378         struct super_block *bd_sb;
15379         __u16 bd_blkbits;
15380         ext4_group_t bd_group;
15381 +       struct rw_semaphore *alloc_semp;
15382  };
15383  #define EXT4_MB_BITMAP(e4b)    ((e4b)->bd_bitmap)
15384  #define EXT4_MB_BUDDY(e4b)     ((e4b)->bd_buddy)
15385 @@ -259,25 +264,12 @@
15386  {
15387         return;
15388  }
15389 -#else
15390 -static void ext4_mb_store_history(struct ext4_allocation_context *ac);
15391  #endif
15392
15393  #define in_range(b, first, len)        ((b) >= (first) && (b) <= (first) + (len) - 1)
15394
15395  struct buffer_head *read_block_bitmap(struct super_block *, ext4_group_t);
15396
15397 -static void ext4_mb_generate_from_pa(struct super_block *sb, void *bitmap,
15398 -                                       ext4_group_t group);
15399 -static void ext4_mb_return_to_preallocation(struct inode *inode,
15400 -                                       struct ext4_buddy *e4b, sector_t block,
15401 -                                       int count);
15402 -static void ext4_mb_put_pa(struct ext4_allocation_context *,
15403 -                       struct super_block *, struct ext4_prealloc_space *pa);
15404 -static int ext4_mb_init_per_dev_proc(struct super_block *sb);
15405 -static int ext4_mb_destroy_per_dev_proc(struct super_block *sb);
15406 -static void release_blocks_on_commit(journal_t *journal, transaction_t *txn);
15407 -
15408
15409  static inline void ext4_lock_group(struct super_block *sb, ext4_group_t group)
15410  {
15411 @@ -303,7 +295,7 @@
15412                                                 &(grinfo->bb_state));
15413  }
15414
15415 -static ext4_fsblk_t ext4_grp_offs_to_block(struct super_block *sb,
15416 +static inline ext4_fsblk_t ext4_grp_offs_to_block(struct super_block *sb,
15417                                         struct ext4_free_extent *fex)
15418  {
15419         ext4_fsblk_t block;
15420 --- kernel-power-2.6.28.orig/fs/ext4/migrate.c
15421 +++ kernel-power-2.6.28/fs/ext4/migrate.c
15422 @@ -480,7 +480,7 @@
15423                                         + 1);
15424         if (IS_ERR(handle)) {
15425                 retval = PTR_ERR(handle);
15426 -               goto err_out;
15427 +               return retval;
15428         }
15429         tmp_inode = ext4_new_inode(handle,
15430                                 inode->i_sb->s_root->d_inode,
15431 @@ -488,8 +488,7 @@
15432         if (IS_ERR(tmp_inode)) {
15433                 retval = -ENOMEM;
15434                 ext4_journal_stop(handle);
15435 -               tmp_inode = NULL;
15436 -               goto err_out;
15437 +               return retval;
15438         }
15439         i_size_write(tmp_inode, i_size_read(inode));
15440         /*
15441 @@ -617,8 +616,7 @@
15442
15443         ext4_journal_stop(handle);
15444
15445 -       if (tmp_inode)
15446 -               iput(tmp_inode);
15447 +       iput(tmp_inode);
15448
15449         return retval;
15450  }
15451 --- kernel-power-2.6.28.orig/fs/ext4/namei.c
15452 +++ kernel-power-2.6.28/fs/ext4/namei.c
15453 @@ -372,6 +372,8 @@
15454                 goto fail;
15455         }
15456         hinfo->hash_version = root->info.hash_version;
15457 +       if (hinfo->hash_version <= DX_HASH_TEA)
15458 +               hinfo->hash_version += EXT4_SB(dir->i_sb)->s_hash_unsigned;
15459         hinfo->seed = EXT4_SB(dir->i_sb)->s_hash_seed;
15460         if (d_name)
15461                 ext4fs_dirhash(d_name->name, d_name->len, hinfo);
15462 @@ -641,6 +643,9 @@
15463         dir = dir_file->f_path.dentry->d_inode;
15464         if (!(EXT4_I(dir)->i_flags & EXT4_INDEX_FL)) {
15465                 hinfo.hash_version = EXT4_SB(dir->i_sb)->s_def_hash_version;
15466 +               if (hinfo.hash_version <= DX_HASH_TEA)
15467 +                       hinfo.hash_version +=
15468 +                               EXT4_SB(dir->i_sb)->s_hash_unsigned;
15469                 hinfo.seed = EXT4_SB(dir->i_sb)->s_hash_seed;
15470                 count = htree_dirblock_to_tree(dir_file, dir, 0, &hinfo,
15471                                                start_hash, start_minor_hash);
15472 @@ -1367,7 +1372,7 @@
15473         struct fake_dirent *fde;
15474
15475         blocksize =  dir->i_sb->s_blocksize;
15476 -       dxtrace(printk(KERN_DEBUG "Creating index\n"));
15477 +       dxtrace(printk(KERN_DEBUG "Creating index: inode %lu\n", dir->i_ino));
15478         retval = ext4_journal_get_write_access(handle, bh);
15479         if (retval) {
15480                 ext4_std_error(dir->i_sb, retval);
15481 @@ -1376,6 +1381,20 @@
15482         }
15483         root = (struct dx_root *) bh->b_data;
15484
15485 +       /* The 0th block becomes the root, move the dirents out */
15486 +       fde = &root->dotdot;
15487 +       de = (struct ext4_dir_entry_2 *)((char *)fde +
15488 +               ext4_rec_len_from_disk(fde->rec_len));
15489 +       if ((char *) de >= (((char *) root) + blocksize)) {
15490 +               ext4_error(dir->i_sb, __func__,
15491 +                          "invalid rec_len for '..' in inode %lu",
15492 +                          dir->i_ino);
15493 +               brelse(bh);
15494 +               return -EIO;
15495 +       }
15496 +       len = ((char *) root) + blocksize - (char *) de;
15497 +
15498 +       /* Allocate new block for the 0th block's dirents */
15499         bh2 = ext4_append(handle, dir, &block, &retval);
15500         if (!(bh2)) {
15501                 brelse(bh);
15502 @@ -1384,11 +1403,6 @@
15503         EXT4_I(dir)->i_flags |= EXT4_INDEX_FL;
15504         data1 = bh2->b_data;
15505
15506 -       /* The 0th block becomes the root, move the dirents out */
15507 -       fde = &root->dotdot;
15508 -       de = (struct ext4_dir_entry_2 *)((char *)fde +
15509 -               ext4_rec_len_from_disk(fde->rec_len));
15510 -       len = ((char *) root) + blocksize - (char *) de;
15511         memcpy (data1, de, len);
15512         de = (struct ext4_dir_entry_2 *) data1;
15513         top = data1 + len;
15514 @@ -1408,6 +1422,8 @@
15515
15516         /* Initialize as for dx_probe */
15517         hinfo.hash_version = root->info.hash_version;
15518 +       if (hinfo.hash_version <= DX_HASH_TEA)
15519 +               hinfo.hash_version += EXT4_SB(dir->i_sb)->s_hash_unsigned;
15520         hinfo.seed = EXT4_SB(dir->i_sb)->s_hash_seed;
15521         ext4fs_dirhash(name, namelen, &hinfo);
15522         frame = frames;
15523 @@ -2208,8 +2224,7 @@
15524                  * We have a transaction open.  All is sweetness.  It also sets
15525                  * i_size in generic_commit_write().
15526                  */
15527 -               err = __page_symlink(inode, symname, l,
15528 -                               mapping_gfp_mask(inode->i_mapping) & ~__GFP_FS);
15529 +               err = __page_symlink(inode, symname, l, 1);
15530                 if (err) {
15531                         clear_nlink(inode);
15532                         ext4_mark_inode_dirty(handle, inode);
15533 --- kernel-power-2.6.28.orig/fs/ext4/resize.c
15534 +++ kernel-power-2.6.28/fs/ext4/resize.c
15535 @@ -284,11 +284,9 @@
15536         if ((err = extend_or_restart_transaction(handle, 2, bh)))
15537                 goto exit_bh;
15538
15539 -       mark_bitmap_end(input->blocks_count, EXT4_BLOCKS_PER_GROUP(sb),
15540 -                       bh->b_data);
15541 +       mark_bitmap_end(input->blocks_count, sb->s_blocksize * 8, bh->b_data);
15542         ext4_journal_dirty_metadata(handle, bh);
15543         brelse(bh);
15544 -
15545         /* Mark unused entries in inode bitmap used */
15546         ext4_debug("clear inode bitmap %#04llx (+%llu)\n",
15547                    input->inode_bitmap, input->inode_bitmap - start);
15548 @@ -297,7 +295,7 @@
15549                 goto exit_journal;
15550         }
15551
15552 -       mark_bitmap_end(EXT4_INODES_PER_GROUP(sb), EXT4_BLOCKS_PER_GROUP(sb),
15553 +       mark_bitmap_end(EXT4_INODES_PER_GROUP(sb), sb->s_blocksize * 8,
15554                         bh->b_data);
15555         ext4_journal_dirty_metadata(handle, bh);
15556  exit_bh:
15557 @@ -747,6 +745,7 @@
15558         struct inode *inode = NULL;
15559         handle_t *handle;
15560         int gdb_off, gdb_num;
15561 +       int num_grp_locked = 0;
15562         int err, err2;
15563
15564         gdb_num = input->group / EXT4_DESC_PER_BLOCK(sb);
15565 @@ -787,6 +786,7 @@
15566                 }
15567         }
15568
15569 +
15570         if ((err = verify_group_input(sb, input)))
15571                 goto exit_put;
15572
15573 @@ -855,24 +855,29 @@
15574           * using the new disk blocks.
15575           */
15576
15577 +       num_grp_locked = ext4_mb_get_buddy_cache_lock(sb, input->group);
15578         /* Update group descriptor block for new group */
15579         gdp = (struct ext4_group_desc *)((char *)primary->b_data +
15580                                          gdb_off * EXT4_DESC_SIZE(sb));
15581
15582 +       memset(gdp, 0, EXT4_DESC_SIZE(sb));
15583         ext4_block_bitmap_set(sb, gdp, input->block_bitmap); /* LV FIXME */
15584         ext4_inode_bitmap_set(sb, gdp, input->inode_bitmap); /* LV FIXME */
15585         ext4_inode_table_set(sb, gdp, input->inode_table); /* LV FIXME */
15586         gdp->bg_free_blocks_count = cpu_to_le16(input->free_blocks_count);
15587         gdp->bg_free_inodes_count = cpu_to_le16(EXT4_INODES_PER_GROUP(sb));
15588 +       gdp->bg_flags = cpu_to_le16(EXT4_BG_INODE_ZEROED);
15589         gdp->bg_checksum = ext4_group_desc_csum(sbi, input->group, gdp);
15590
15591         /*
15592          * We can allocate memory for mb_alloc based on the new group
15593          * descriptor
15594          */
15595 -       err = ext4_mb_add_more_groupinfo(sb, input->group, gdp);
15596 -       if (err)
15597 +       err = ext4_mb_add_groupinfo(sb, input->group, gdp);
15598 +       if (err) {
15599 +               ext4_mb_put_buddy_cache_lock(sb, input->group, num_grp_locked);
15600                 goto exit_journal;
15601 +       }
15602
15603         /*
15604          * Make the new blocks and inodes valid next.  We do this before
15605 @@ -914,6 +919,7 @@
15606
15607         /* Update the global fs size fields */
15608         sbi->s_groups_count++;
15609 +       ext4_mb_put_buddy_cache_lock(sb, input->group, num_grp_locked);
15610
15611         ext4_journal_dirty_metadata(handle, primary);
15612
15613 @@ -975,9 +981,7 @@
15614         struct buffer_head *bh;
15615         handle_t *handle;
15616         int err;
15617 -       unsigned long freed_blocks;
15618         ext4_group_t group;
15619 -       struct ext4_group_info *grp;
15620
15621         /* We don't need to worry about locking wrt other resizers just
15622          * yet: we're going to revalidate es->s_blocks_count after
15623 @@ -1076,57 +1080,13 @@
15624         unlock_super(sb);
15625         ext4_debug("freeing blocks %llu through %llu\n", o_blocks_count,
15626                    o_blocks_count + add);
15627 -       ext4_free_blocks_sb(handle, sb, o_blocks_count, add, &freed_blocks);
15628 +       /* We add the blocks to the bitmap and set the group need init bit */
15629 +       ext4_add_groupblocks(handle, sb, o_blocks_count, add);
15630         ext4_debug("freed blocks %llu through %llu\n", o_blocks_count,
15631                    o_blocks_count + add);
15632         if ((err = ext4_journal_stop(handle)))
15633                 goto exit_put;
15634
15635 -       /*
15636 -        * Mark mballoc pages as not up to date so that they will be updated
15637 -        * next time they are loaded by ext4_mb_load_buddy.
15638 -        *
15639 -        * XXX Bad, Bad, BAD!!!  We should not be overloading the
15640 -        * Uptodate flag, particularly on thte bitmap bh, as way of
15641 -        * hinting to ext4_mb_load_buddy() that it needs to be
15642 -        * overloaded.  A user could take a LVM snapshot, then do an
15643 -        * on-line fsck, and clear the uptodate flag, and this would
15644 -        * not be a bug in userspace, but a bug in the kernel.  FIXME!!!
15645 -        */
15646 -       {
15647 -               struct ext4_sb_info *sbi = EXT4_SB(sb);
15648 -               struct inode *inode = sbi->s_buddy_cache;
15649 -               int blocks_per_page;
15650 -               int block;
15651 -               int pnum;
15652 -               struct page *page;
15653 -
15654 -               /* Set buddy page as not up to date */
15655 -               blocks_per_page = PAGE_CACHE_SIZE / sb->s_blocksize;
15656 -               block = group * 2;
15657 -               pnum = block / blocks_per_page;
15658 -               page = find_get_page(inode->i_mapping, pnum);
15659 -               if (page != NULL) {
15660 -                       ClearPageUptodate(page);
15661 -                       page_cache_release(page);
15662 -               }
15663 -
15664 -               /* Set bitmap page as not up to date */
15665 -               block++;
15666 -               pnum = block / blocks_per_page;
15667 -               page = find_get_page(inode->i_mapping, pnum);
15668 -               if (page != NULL) {
15669 -                       ClearPageUptodate(page);
15670 -                       page_cache_release(page);
15671 -               }
15672 -
15673 -               /* Get the info on the last group */
15674 -               grp = ext4_get_group_info(sb, group);
15675 -
15676 -               /* Update free blocks in group info */
15677 -               ext4_mb_update_group_info(grp, add);
15678 -       }
15679 -
15680         if (test_opt(sb, DEBUG))
15681                 printk(KERN_DEBUG "EXT4-fs: extended group to %llu blocks\n",
15682                        ext4_blocks_count(es));
15683 --- kernel-power-2.6.28.orig/fs/ext4/super.c
15684 +++ kernel-power-2.6.28/fs/ext4/super.c
15685 @@ -1445,7 +1445,6 @@
15686         ext4_group_t flex_group_count;
15687         ext4_group_t flex_group;
15688         int groups_per_flex = 0;
15689 -       __u64 block_bitmap = 0;
15690         int i;
15691
15692         if (!sbi->s_es->s_log_groups_per_flex) {
15693 @@ -1468,9 +1467,6 @@
15694                 goto failed;
15695         }
15696
15697 -       gdp = ext4_get_group_desc(sb, 1, &bh);
15698 -       block_bitmap = ext4_block_bitmap(sb, gdp) - 1;
15699 -
15700         for (i = 0; i < sbi->s_groups_count; i++) {
15701                 gdp = ext4_get_group_desc(sb, i, &bh);
15702
15703 @@ -1873,8 +1869,8 @@
15704         char *cp;
15705         int ret = -EINVAL;
15706         int blocksize;
15707 -       int db_count;
15708 -       int i;
15709 +       unsigned int db_count;
15710 +       unsigned int i;
15711         int needs_recovery, has_huge_files;
15712         __le32 features;
15713         __u64 blocks_count;
15714 @@ -2118,6 +2114,18 @@
15715         for (i = 0; i < 4; i++)
15716                 sbi->s_hash_seed[i] = le32_to_cpu(es->s_hash_seed[i]);
15717         sbi->s_def_hash_version = es->s_def_hash_version;
15718 +       i = le32_to_cpu(es->s_flags);
15719 +       if (i & EXT2_FLAGS_UNSIGNED_HASH)
15720 +               sbi->s_hash_unsigned = 3;
15721 +       else if ((i & EXT2_FLAGS_SIGNED_HASH) == 0) {
15722 +#ifdef __CHAR_UNSIGNED__
15723 +               es->s_flags |= cpu_to_le32(EXT2_FLAGS_UNSIGNED_HASH);
15724 +               sbi->s_hash_unsigned = 3;
15725 +#else
15726 +               es->s_flags |= cpu_to_le32(EXT2_FLAGS_SIGNED_HASH);
15727 +#endif
15728 +               mark_sb_dirty(sb);
15729 +       }
15730
15731         if (sbi->s_blocks_per_group > blocksize * 8) {
15732                 printk(KERN_ERR
15733 @@ -2145,20 +2153,30 @@
15734         if (EXT4_BLOCKS_PER_GROUP(sb) == 0)
15735                 goto cantfind_ext4;
15736
15737 -       /* ensure blocks_count calculation below doesn't sign-extend */
15738 -       if (ext4_blocks_count(es) + EXT4_BLOCKS_PER_GROUP(sb) <
15739 -           le32_to_cpu(es->s_first_data_block) + 1) {
15740 -               printk(KERN_WARNING "EXT4-fs: bad geometry: block count %llu, "
15741 -                      "first data block %u, blocks per group %lu\n",
15742 -                       ext4_blocks_count(es),
15743 -                       le32_to_cpu(es->s_first_data_block),
15744 -                       EXT4_BLOCKS_PER_GROUP(sb));
15745 +        /*
15746 +         * It makes no sense for the first data block to be beyond the end
15747 +         * of the filesystem.
15748 +         */
15749 +        if (le32_to_cpu(es->s_first_data_block) >= ext4_blocks_count(es)) {
15750 +                printk(KERN_WARNING "EXT4-fs: bad geometry: first data"
15751 +                      "block %u is beyond end of filesystem (%llu)\n",
15752 +                      le32_to_cpu(es->s_first_data_block),
15753 +                      ext4_blocks_count(es));
15754                 goto failed_mount;
15755         }
15756         blocks_count = (ext4_blocks_count(es) -
15757                         le32_to_cpu(es->s_first_data_block) +
15758                         EXT4_BLOCKS_PER_GROUP(sb) - 1);
15759         do_div(blocks_count, EXT4_BLOCKS_PER_GROUP(sb));
15760 +       if (blocks_count > ((uint64_t)1<<32) - EXT4_DESC_PER_BLOCK(sb)) {
15761 +               printk(KERN_WARNING "EXT4-fs: groups count too large: %u "
15762 +                      "(block count %llu, first data block %u, "
15763 +                      "blocks per group %lu)\n", sbi->s_groups_count,
15764 +                      ext4_blocks_count(es),
15765 +                      le32_to_cpu(es->s_first_data_block),
15766 +                      EXT4_BLOCKS_PER_GROUP(sb));
15767 +               goto failed_mount;
15768 +       }
15769         sbi->s_groups_count = blocks_count;
15770         db_count = (sbi->s_groups_count + EXT4_DESC_PER_BLOCK(sb) - 1) /
15771                    EXT4_DESC_PER_BLOCK(sb);
15772 @@ -2896,15 +2914,15 @@
15773
15774  static int ext4_sync_fs(struct super_block *sb, int wait)
15775  {
15776 -       int ret = 0;
15777 +       tid_t target;
15778
15779         trace_mark(ext4_sync_fs, "dev %s wait %d", sb->s_id, wait);
15780         mark_sb_clean(sb);
15781 -       if (wait)
15782 -               ret = ext4_force_commit(sb);
15783 -       else
15784 -               jbd2_journal_start_commit(EXT4_SB(sb)->s_journal, NULL);
15785 -       return ret;
15786 +       if (jbd2_journal_start_commit(EXT4_SB(sb)->s_journal, &target)) {
15787 +               if (wait)
15788 +                       jbd2_log_wait_commit(EXT4_SB(sb)->s_journal, target);
15789 +       }
15790 +       return 0;
15791  }
15792
15793  /*
15794 --- kernel-power-2.6.28.orig/fs/fcntl.c
15795 +++ kernel-power-2.6.28/fs/fcntl.c
15796 @@ -50,7 +50,7 @@
15797         return res;
15798  }
15799
15800 -asmlinkage long sys_dup3(unsigned int oldfd, unsigned int newfd, int flags)
15801 +SYSCALL_DEFINE3(dup3, unsigned int, oldfd, unsigned int, newfd, int, flags)
15802  {
15803         int err = -EBADF;
15804         struct file * file, *tofree;
15805 @@ -113,7 +113,7 @@
15806         return err;
15807  }
15808
15809 -asmlinkage long sys_dup2(unsigned int oldfd, unsigned int newfd)
15810 +SYSCALL_DEFINE2(dup2, unsigned int, oldfd, unsigned int, newfd)
15811  {
15812         if (unlikely(newfd == oldfd)) { /* corner case */
15813                 struct files_struct *files = current->files;
15814 @@ -126,7 +126,7 @@
15815         return sys_dup3(oldfd, newfd, 0);
15816  }
15817
15818 -asmlinkage long sys_dup(unsigned int fildes)
15819 +SYSCALL_DEFINE1(dup, unsigned int, fildes)
15820  {
15821         int ret = -EBADF;
15822         struct file *file = fget(fildes);
15823 @@ -334,7 +334,7 @@
15824         return err;
15825  }
15826
15827 -asmlinkage long sys_fcntl(unsigned int fd, unsigned int cmd, unsigned long arg)
15828 +SYSCALL_DEFINE3(fcntl, unsigned int, fd, unsigned int, cmd, unsigned long, arg)
15829  {
15830         struct file *filp;
15831         long err = -EBADF;
15832 @@ -357,7 +357,8 @@
15833  }
15834
15835  #if BITS_PER_LONG == 32
15836 -asmlinkage long sys_fcntl64(unsigned int fd, unsigned int cmd, unsigned long arg)
15837 +SYSCALL_DEFINE3(fcntl64, unsigned int, fd, unsigned int, cmd,
15838 +               unsigned long, arg)
15839  {
15840         struct file * filp;
15841         long err;
15842 --- kernel-power-2.6.28.orig/fs/filesystems.c
15843 +++ kernel-power-2.6.28/fs/filesystems.c
15844 @@ -179,7 +179,7 @@
15845  /*
15846   * Whee.. Weird sysv syscall.
15847   */
15848 -asmlinkage long sys_sysfs(int option, unsigned long arg1, unsigned long arg2)
15849 +SYSCALL_DEFINE3(sysfs, int, option, unsigned long, arg1, unsigned long, arg2)
15850  {
15851         int retval = -EINVAL;
15852
15853 --- kernel-power-2.6.28.orig/fs/fs-writeback.c
15854 +++ kernel-power-2.6.28/fs/fs-writeback.c
15855 @@ -315,6 +315,7 @@
15856         int ret;
15857
15858         BUG_ON(inode->i_state & I_SYNC);
15859 +       WARN_ON(inode->i_state & I_NEW);
15860
15861         /* Set I_SYNC, reset I_DIRTY */
15862         dirty = inode->i_state & I_DIRTY;
15863 @@ -339,6 +340,7 @@
15864         }
15865
15866         spin_lock(&inode_lock);
15867 +       WARN_ON(inode->i_state & I_NEW);
15868         inode->i_state &= ~I_SYNC;
15869         if (!(inode->i_state & I_FREEING)) {
15870                 if (!(inode->i_state & I_DIRTY) &&
15871 @@ -462,9 +464,6 @@
15872   * If we're a pdlfush thread, then implement pdflush collision avoidance
15873   * against the entire list.
15874   *
15875 - * WB_SYNC_HOLD is a hack for sys_sync(): reattach the inode to sb->s_dirty so
15876 - * that it can be located for waiting on in __writeback_single_inode().
15877 - *
15878   * If `bdi' is non-zero then we're being asked to writeback a specific queue.
15879   * This function assumes that the blockdev superblock's inodes are backed by
15880   * a variety of queues, so all inodes are searched.  For other superblocks,
15881 @@ -484,6 +483,7 @@
15882                                 struct writeback_control *wbc)
15883  {
15884         const unsigned long start = jiffies;    /* livelock avoidance */
15885 +       int sync = wbc->sync_mode == WB_SYNC_ALL;
15886
15887         spin_lock(&inode_lock);
15888         if (!wbc->for_kupdate || list_empty(&sb->s_io))
15889 @@ -513,6 +513,11 @@
15890                         break;
15891                 }
15892
15893 +               if (inode->i_state & I_NEW) {
15894 +                       requeue_io(inode);
15895 +                       continue;
15896 +               }
15897 +
15898                 if (wbc->nonblocking && bdi_write_congested(bdi)) {
15899                         wbc->encountered_congestion = 1;
15900                         if (!sb_is_blkdev_sb(sb))
15901 @@ -540,10 +545,6 @@
15902                 __iget(inode);
15903                 pages_skipped = wbc->pages_skipped;
15904                 __writeback_single_inode(inode, wbc);
15905 -               if (wbc->sync_mode == WB_SYNC_HOLD) {
15906 -                       inode->dirtied_when = jiffies;
15907 -                       list_move(&inode->i_list, &sb->s_dirty);
15908 -               }
15909                 if (current_is_pdflush())
15910                         writeback_release(bdi);
15911                 if (wbc->pages_skipped != pages_skipped) {
15912 @@ -564,7 +565,50 @@
15913                 if (!list_empty(&sb->s_more_io))
15914                         wbc->more_io = 1;
15915         }
15916 -       spin_unlock(&inode_lock);
15917 +
15918 +       if (sync) {
15919 +               struct inode *inode, *old_inode = NULL;
15920 +
15921 +               /*
15922 +                * Data integrity sync. Must wait for all pages under writeback,
15923 +                * because there may have been pages dirtied before our sync
15924 +                * call, but which had writeout started before we write it out.
15925 +                * In which case, the inode may not be on the dirty list, but
15926 +                * we still have to wait for that writeout.
15927 +                */
15928 +               list_for_each_entry(inode, &sb->s_inodes, i_sb_list) {
15929 +                       struct address_space *mapping;
15930 +
15931 +                       if (inode->i_state &
15932 +                                       (I_FREEING|I_CLEAR|I_WILL_FREE|I_NEW))
15933 +                               continue;
15934 +                       mapping = inode->i_mapping;
15935 +                       if (mapping->nrpages == 0)
15936 +                               continue;
15937 +                       __iget(inode);
15938 +                       spin_unlock(&inode_lock);
15939 +                       /*
15940 +                        * We hold a reference to 'inode' so it couldn't have
15941 +                        * been removed from s_inodes list while we dropped the
15942 +                        * inode_lock.  We cannot iput the inode now as we can
15943 +                        * be holding the last reference and we cannot iput it
15944 +                        * under inode_lock. So we keep the reference and iput
15945 +                        * it later.
15946 +                        */
15947 +                       iput(old_inode);
15948 +                       old_inode = inode;
15949 +
15950 +                       filemap_fdatawait(mapping);
15951 +
15952 +                       cond_resched();
15953 +
15954 +                       spin_lock(&inode_lock);
15955 +               }
15956 +               spin_unlock(&inode_lock);
15957 +               iput(old_inode);
15958 +       } else
15959 +               spin_unlock(&inode_lock);
15960 +
15961         return;         /* Leave any unwritten inodes on s_io */
15962  }
15963  EXPORT_SYMBOL_GPL(generic_sync_sb_inodes);
15964 @@ -629,8 +673,7 @@
15965
15966  /*
15967   * writeback and wait upon the filesystem's dirty inodes.  The caller will
15968 - * do this in two passes - one to write, and one to wait.  WB_SYNC_HOLD is
15969 - * used to park the written inodes on sb->s_dirty for the wait pass.
15970 + * do this in two passes - one to write, and one to wait.
15971   *
15972   * A finite limit is set on the number of pages which will be written.
15973   * To prevent infinite livelock of sys_sync().
15974 @@ -641,30 +684,21 @@
15975  void sync_inodes_sb(struct super_block *sb, int wait)
15976  {
15977         struct writeback_control wbc = {
15978 -               .sync_mode      = wait ? WB_SYNC_ALL : WB_SYNC_HOLD,
15979 +               .sync_mode      = wait ? WB_SYNC_ALL : WB_SYNC_NONE,
15980                 .range_start    = 0,
15981                 .range_end      = LLONG_MAX,
15982         };
15983 -       unsigned long nr_dirty = global_page_state(NR_FILE_DIRTY);
15984 -       unsigned long nr_unstable = global_page_state(NR_UNSTABLE_NFS);
15985
15986 -       wbc.nr_to_write = nr_dirty + nr_unstable +
15987 -                       (inodes_stat.nr_inodes - inodes_stat.nr_unused) +
15988 -                       nr_dirty + nr_unstable;
15989 -       wbc.nr_to_write += wbc.nr_to_write / 2;         /* Bit more for luck */
15990 -       sync_sb_inodes(sb, &wbc);
15991 -}
15992 +       if (!wait) {
15993 +               unsigned long nr_dirty = global_page_state(NR_FILE_DIRTY);
15994 +               unsigned long nr_unstable = global_page_state(NR_UNSTABLE_NFS);
15995 +
15996 +               wbc.nr_to_write = nr_dirty + nr_unstable +
15997 +                       (inodes_stat.nr_inodes - inodes_stat.nr_unused);
15998 +       } else
15999 +               wbc.nr_to_write = LONG_MAX; /* doesn't actually matter */
16000
16001 -/*
16002 - * Rather lame livelock avoidance.
16003 - */
16004 -static void set_sb_syncing(int val)
16005 -{
16006 -       struct super_block *sb;
16007 -       spin_lock(&sb_lock);
16008 -       list_for_each_entry_reverse(sb, &super_blocks, s_list)
16009 -               sb->s_syncing = val;
16010 -       spin_unlock(&sb_lock);
16011 +       sync_sb_inodes(sb, &wbc);
16012  }
16013
16014  /**
16015 @@ -693,9 +727,6 @@
16016         spin_lock(&sb_lock);
16017  restart:
16018         list_for_each_entry(sb, &super_blocks, s_list) {
16019 -               if (sb->s_syncing)
16020 -                       continue;
16021 -               sb->s_syncing = 1;
16022                 sb->s_count++;
16023                 spin_unlock(&sb_lock);
16024                 down_read(&sb->s_umount);
16025 @@ -713,13 +744,10 @@
16026
16027  void sync_inodes(int wait)
16028  {
16029 -       set_sb_syncing(0);
16030         __sync_inodes(0);
16031
16032 -       if (wait) {
16033 -               set_sb_syncing(0);
16034 +       if (wait)
16035                 __sync_inodes(1);
16036 -       }
16037  }
16038
16039  /**
16040 --- kernel-power-2.6.28.orig/fs/fuse/dev.c
16041 +++ kernel-power-2.6.28/fs/fuse/dev.c
16042 @@ -281,7 +281,8 @@
16043                         fc->blocked = 0;
16044                         wake_up_all(&fc->blocked_waitq);
16045                 }
16046 -               if (fc->num_background == FUSE_CONGESTION_THRESHOLD) {
16047 +               if (fc->num_background == FUSE_CONGESTION_THRESHOLD &&
16048 +                   fc->connected) {
16049                         clear_bdi_congested(&fc->bdi, READ);
16050                         clear_bdi_congested(&fc->bdi, WRITE);
16051                 }
16052 --- kernel-power-2.6.28.orig/fs/fuse/file.c
16053 +++ kernel-power-2.6.28/fs/fuse/file.c
16054 @@ -54,7 +54,7 @@
16055                 ff->reserved_req = fuse_request_alloc();
16056                 if (!ff->reserved_req) {
16057                         kfree(ff);
16058 -                       ff = NULL;
16059 +                       return NULL;
16060                 } else {
16061                         INIT_LIST_HEAD(&ff->write_entry);
16062                         atomic_set(&ff->count, 0);
16063 @@ -646,7 +646,7 @@
16064  {
16065         pgoff_t index = pos >> PAGE_CACHE_SHIFT;
16066
16067 -       *pagep = __grab_cache_page(mapping, index);
16068 +       *pagep = grab_cache_page_write_begin(mapping, index, flags);
16069         if (!*pagep)
16070                 return -ENOMEM;
16071         return 0;
16072 @@ -779,7 +779,7 @@
16073                         break;
16074
16075                 err = -ENOMEM;
16076 -               page = __grab_cache_page(mapping, index);
16077 +               page = grab_cache_page_write_begin(mapping, index, 0);
16078                 if (!page)
16079                         break;
16080
16081 --- kernel-power-2.6.28.orig/fs/fuse/inode.c
16082 +++ kernel-power-2.6.28/fs/fuse/inode.c
16083 @@ -292,6 +292,7 @@
16084         list_del(&fc->entry);
16085         fuse_ctl_remove_conn(fc);
16086         mutex_unlock(&fuse_mutex);
16087 +       bdi_destroy(&fc->bdi);
16088         fuse_conn_put(fc);
16089  }
16090
16091 @@ -531,7 +532,6 @@
16092                 if (fc->destroy_req)
16093                         fuse_request_free(fc->destroy_req);
16094                 mutex_destroy(&fc->inst_mutex);
16095 -               bdi_destroy(&fc->bdi);
16096                 kfree(fc);
16097         }
16098  }
16099 @@ -825,12 +825,16 @@
16100         if (!file)
16101                 return -EINVAL;
16102
16103 -       if (file->f_op != &fuse_dev_operations)
16104 +       if (file->f_op != &fuse_dev_operations) {
16105 +               fput(file);
16106                 return -EINVAL;
16107 +       }
16108
16109         fc = new_conn(sb);
16110 -       if (!fc)
16111 +       if (!fc) {
16112 +               fput(file);
16113                 return -ENOMEM;
16114 +       }
16115
16116         fc->flags = d.flags;
16117         fc->user_id = d.user_id;
16118 --- kernel-power-2.6.28.orig/fs/gfs2/ops_address.c
16119 +++ kernel-power-2.6.28/fs/gfs2/ops_address.c
16120 @@ -675,7 +675,7 @@
16121                 goto out_trans_fail;
16122
16123         error = -ENOMEM;
16124 -       page = __grab_cache_page(mapping, index);
16125 +       page = grab_cache_page_write_begin(mapping, index, flags);
16126         *pagep = page;
16127         if (unlikely(!page))
16128                 goto out_endtrans;
16129 --- kernel-power-2.6.28.orig/fs/hostfs/hostfs_kern.c
16130 +++ kernel-power-2.6.28/fs/hostfs/hostfs_kern.c
16131 @@ -501,7 +501,7 @@
16132  {
16133         pgoff_t index = pos >> PAGE_CACHE_SHIFT;
16134
16135 -       *pagep = __grab_cache_page(mapping, index);
16136 +       *pagep = grab_cache_page_write_begin(mapping, index, flags);
16137         if (!*pagep)
16138                 return -ENOMEM;
16139         return 0;
16140 --- kernel-power-2.6.28.orig/fs/hugetlbfs/inode.c
16141 +++ kernel-power-2.6.28/fs/hugetlbfs/inode.c
16142 @@ -26,7 +26,6 @@
16143  #include <linux/pagevec.h>
16144  #include <linux/parser.h>
16145  #include <linux/mman.h>
16146 -#include <linux/quotaops.h>
16147  #include <linux/slab.h>
16148  #include <linux/dnotify.h>
16149  #include <linux/statfs.h>
16150 @@ -838,7 +837,7 @@
16151  bad_val:
16152         printk(KERN_ERR "hugetlbfs: Bad value '%s' for mount option '%s'\n",
16153                args[0].from, p);
16154 -       return 1;
16155 +       return -EINVAL;
16156  }
16157
16158  static int
16159 --- kernel-power-2.6.28.orig/fs/inode.c
16160 +++ kernel-power-2.6.28/fs/inode.c
16161 @@ -339,6 +339,7 @@
16162                 invalidate_inode_buffers(inode);
16163                 if (!atomic_read(&inode->i_count)) {
16164                         list_move(&inode->i_list, dispose);
16165 +                       WARN_ON(inode->i_state & I_NEW);
16166                         inode->i_state |= I_FREEING;
16167                         count++;
16168                         continue;
16169 @@ -440,6 +441,7 @@
16170                                 continue;
16171                 }
16172                 list_move(&inode->i_list, &freeable);
16173 +               WARN_ON(inode->i_state & I_NEW);
16174                 inode->i_state |= I_FREEING;
16175                 nr_pruned++;
16176         }
16177 @@ -595,6 +597,7 @@
16178          * just created it (so there can be no old holders
16179          * that haven't tested I_LOCK).
16180          */
16181 +       WARN_ON((inode->i_state & (I_LOCK|I_NEW)) != (I_LOCK|I_NEW));
16182         inode->i_state &= ~(I_LOCK|I_NEW);
16183         wake_up_inode(inode);
16184  }
16185 @@ -1041,6 +1044,7 @@
16186
16187         list_del_init(&inode->i_list);
16188         list_del_init(&inode->i_sb_list);
16189 +       WARN_ON(inode->i_state & I_NEW);
16190         inode->i_state |= I_FREEING;
16191         inodes_stat.nr_inodes--;
16192         spin_unlock(&inode_lock);
16193 @@ -1082,16 +1086,19 @@
16194                         spin_unlock(&inode_lock);
16195                         return;
16196                 }
16197 +               WARN_ON(inode->i_state & I_NEW);
16198                 inode->i_state |= I_WILL_FREE;
16199                 spin_unlock(&inode_lock);
16200                 write_inode_now(inode, 1);
16201                 spin_lock(&inode_lock);
16202 +               WARN_ON(inode->i_state & I_NEW);
16203                 inode->i_state &= ~I_WILL_FREE;
16204                 inodes_stat.nr_unused--;
16205                 hlist_del_init(&inode->i_hash);
16206         }
16207         list_del_init(&inode->i_list);
16208         list_del_init(&inode->i_sb_list);
16209 +       WARN_ON(inode->i_state & I_NEW);
16210         inode->i_state |= I_FREEING;
16211         inodes_stat.nr_inodes--;
16212         spin_unlock(&inode_lock);
16213 --- kernel-power-2.6.28.orig/fs/inotify.c
16214 +++ kernel-power-2.6.28/fs/inotify.c
16215 @@ -156,7 +156,7 @@
16216         int ret;
16217
16218         do {
16219 -               if (unlikely(!idr_pre_get(&ih->idr, GFP_KERNEL)))
16220 +               if (unlikely(!idr_pre_get(&ih->idr, GFP_NOFS)))
16221                         return -ENOSPC;
16222                 ret = idr_get_new_above(&ih->idr, watch, ih->last_wd+1, &watch->wd);
16223         } while (ret == -EAGAIN);
16224 --- kernel-power-2.6.28.orig/fs/inotify_user.c
16225 +++ kernel-power-2.6.28/fs/inotify_user.c
16226 @@ -427,10 +427,61 @@
16227         return ret;
16228  }
16229
16230 +/*
16231 + * Get an inotify_kernel_event if one exists and is small
16232 + * enough to fit in "count". Return an error pointer if
16233 + * not large enough.
16234 + *
16235 + * Called with the device ev_mutex held.
16236 + */
16237 +static struct inotify_kernel_event *get_one_event(struct inotify_device *dev,
16238 +                                                 size_t count)
16239 +{
16240 +       size_t event_size = sizeof(struct inotify_event);
16241 +       struct inotify_kernel_event *kevent;
16242 +
16243 +       if (list_empty(&dev->events))
16244 +               return NULL;
16245 +
16246 +       kevent = inotify_dev_get_event(dev);
16247 +       if (kevent->name)
16248 +               event_size += kevent->event.len;
16249 +
16250 +       if (event_size > count)
16251 +               return ERR_PTR(-EINVAL);
16252 +
16253 +       remove_kevent(dev, kevent);
16254 +       return kevent;
16255 +}
16256 +
16257 +/*
16258 + * Copy an event to user space, returning how much we copied.
16259 + *
16260 + * We already checked that the event size is smaller than the
16261 + * buffer we had in "get_one_event()" above.
16262 + */
16263 +static ssize_t copy_event_to_user(struct inotify_kernel_event *kevent,
16264 +                                 char __user *buf)
16265 +{
16266 +       size_t event_size = sizeof(struct inotify_event);
16267 +
16268 +       if (copy_to_user(buf, &kevent->event, event_size))
16269 +               return -EFAULT;
16270 +
16271 +       if (kevent->name) {
16272 +               buf += event_size;
16273 +
16274 +               if (copy_to_user(buf, kevent->name, kevent->event.len))
16275 +                       return -EFAULT;
16276 +
16277 +               event_size += kevent->event.len;
16278 +       }
16279 +       return event_size;
16280 +}
16281 +
16282  static ssize_t inotify_read(struct file *file, char __user *buf,
16283                             size_t count, loff_t *pos)
16284  {
16285 -       size_t event_size = sizeof (struct inotify_event);
16286         struct inotify_device *dev;
16287         char __user *start;
16288         int ret;
16289 @@ -440,81 +491,43 @@
16290         dev = file->private_data;
16291
16292         while (1) {
16293 +               struct inotify_kernel_event *kevent;
16294
16295                 prepare_to_wait(&dev->wq, &wait, TASK_INTERRUPTIBLE);
16296
16297                 mutex_lock(&dev->ev_mutex);
16298 -               if (!list_empty(&dev->events)) {
16299 -                       ret = 0;
16300 -                       break;
16301 -               }
16302 +               kevent = get_one_event(dev, count);
16303                 mutex_unlock(&dev->ev_mutex);
16304
16305 -               if (file->f_flags & O_NONBLOCK) {
16306 -                       ret = -EAGAIN;
16307 -                       break;
16308 -               }
16309 -
16310 -               if (signal_pending(current)) {
16311 -                       ret = -EINTR;
16312 -                       break;
16313 +               if (kevent) {
16314 +                       ret = PTR_ERR(kevent);
16315 +                       if (IS_ERR(kevent))
16316 +                               break;
16317 +                       ret = copy_event_to_user(kevent, buf);
16318 +                       free_kevent(kevent);
16319 +                       if (ret < 0)
16320 +                               break;
16321 +                       buf += ret;
16322 +                       count -= ret;
16323 +                       continue;
16324                 }
16325
16326 -               schedule();
16327 -       }
16328 -
16329 -       finish_wait(&dev->wq, &wait);
16330 -       if (ret)
16331 -               return ret;
16332 -
16333 -       while (1) {
16334 -               struct inotify_kernel_event *kevent;
16335 -
16336 -               ret = buf - start;
16337 -               if (list_empty(&dev->events))
16338 +               ret = -EAGAIN;
16339 +               if (file->f_flags & O_NONBLOCK)
16340                         break;
16341 -
16342 -               kevent = inotify_dev_get_event(dev);
16343 -               if (event_size + kevent->event.len > count) {
16344 -                       if (ret == 0 && count > 0) {
16345 -                               /*
16346 -                                * could not get a single event because we
16347 -                                * didn't have enough buffer space.
16348 -                                */
16349 -                               ret = -EINVAL;
16350 -                       }
16351 +               ret = -EINTR;
16352 +               if (signal_pending(current))
16353                         break;
16354 -               }
16355 -               remove_kevent(dev, kevent);
16356
16357 -               /*
16358 -                * Must perform the copy_to_user outside the mutex in order
16359 -                * to avoid a lock order reversal with mmap_sem.
16360 -                */
16361 -               mutex_unlock(&dev->ev_mutex);
16362 -
16363 -               if (copy_to_user(buf, &kevent->event, event_size)) {
16364 -                       ret = -EFAULT;
16365 +               if (start != buf)
16366                         break;
16367 -               }
16368 -               buf += event_size;
16369 -               count -= event_size;
16370 -
16371 -               if (kevent->name) {
16372 -                       if (copy_to_user(buf, kevent->name, kevent->event.len)){
16373 -                               ret = -EFAULT;
16374 -                               break;
16375 -                       }
16376 -                       buf += kevent->event.len;
16377 -                       count -= kevent->event.len;
16378 -               }
16379
16380 -               free_kevent(kevent);
16381 -
16382 -               mutex_lock(&dev->ev_mutex);
16383 +               schedule();
16384         }
16385 -       mutex_unlock(&dev->ev_mutex);
16386
16387 +       finish_wait(&dev->wq, &wait);
16388 +       if (start != buf && ret != -EFAULT)
16389 +               ret = buf - start;
16390         return ret;
16391  }
16392
16393 @@ -576,7 +589,7 @@
16394         .destroy_watch  = free_inotify_user_watch,
16395  };
16396
16397 -asmlinkage long sys_inotify_init1(int flags)
16398 +SYSCALL_DEFINE1(inotify_init1, int, flags)
16399  {
16400         struct inotify_device *dev;
16401         struct inotify_handle *ih;
16402 @@ -655,12 +668,13 @@
16403         return ret;
16404  }
16405
16406 -asmlinkage long sys_inotify_init(void)
16407 +SYSCALL_DEFINE0(inotify_init)
16408  {
16409         return sys_inotify_init1(0);
16410  }
16411
16412 -asmlinkage long sys_inotify_add_watch(int fd, const char __user *pathname, u32 mask)
16413 +SYSCALL_DEFINE3(inotify_add_watch, int, fd, const char __user *, pathname,
16414 +               u32, mask)
16415  {
16416         struct inode *inode;
16417         struct inotify_device *dev;
16418 @@ -704,7 +718,7 @@
16419         return ret;
16420  }
16421
16422 -asmlinkage long sys_inotify_rm_watch(int fd, u32 wd)
16423 +SYSCALL_DEFINE2(inotify_rm_watch, int, fd, __s32, wd)
16424  {
16425         struct file *filp;
16426         struct inotify_device *dev;
16427 --- kernel-power-2.6.28.orig/fs/ioctl.c
16428 +++ kernel-power-2.6.28/fs/ioctl.c
16429 @@ -472,7 +472,7 @@
16430         return error;
16431  }
16432
16433 -asmlinkage long sys_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg)
16434 +SYSCALL_DEFINE3(ioctl, unsigned int, fd, unsigned int, cmd, unsigned long, arg)
16435  {
16436         struct file *filp;
16437         int error = -EBADF;
16438 --- kernel-power-2.6.28.orig/fs/ioprio.c
16439 +++ kernel-power-2.6.28/fs/ioprio.c
16440 @@ -65,7 +65,7 @@
16441         return err;
16442  }
16443
16444 -asmlinkage long sys_ioprio_set(int which, int who, int ioprio)
16445 +SYSCALL_DEFINE3(ioprio_set, int, which, int, who, int, ioprio)
16446  {
16447         int class = IOPRIO_PRIO_CLASS(ioprio);
16448         int data = IOPRIO_PRIO_DATA(ioprio);
16449 @@ -181,7 +181,7 @@
16450                 return aprio;
16451  }
16452
16453 -asmlinkage long sys_ioprio_get(int which, int who)
16454 +SYSCALL_DEFINE2(ioprio_get, int, which, int, who)
16455  {
16456         struct task_struct *g, *p;
16457         struct user_struct *user;
16458 @@ -245,4 +245,3 @@
16459         read_unlock(&tasklist_lock);
16460         return ret;
16461  }
16462 -
16463 --- kernel-power-2.6.28.orig/fs/jbd2/commit.c
16464 +++ kernel-power-2.6.28/fs/jbd2/commit.c
16465 @@ -25,6 +25,7 @@
16466  #include <linux/crc32.h>
16467  #include <linux/writeback.h>
16468  #include <linux/backing-dev.h>
16469 +#include <linux/bio.h>
16470
16471  /*
16472   * Default IO end handler for temporary BJ_IO buffer_heads.
16473 @@ -168,12 +169,34 @@
16474   * This function along with journal_submit_commit_record
16475   * allows to write the commit record asynchronously.
16476   */
16477 -static int journal_wait_on_commit_record(struct buffer_head *bh)
16478 +static int journal_wait_on_commit_record(journal_t *journal,
16479 +                                        struct buffer_head *bh)
16480  {
16481         int ret = 0;
16482
16483 +retry:
16484         clear_buffer_dirty(bh);
16485         wait_on_buffer(bh);
16486 +       if (buffer_eopnotsupp(bh) && (journal->j_flags & JBD2_BARRIER)) {
16487 +               printk(KERN_WARNING
16488 +                      "JBD2: wait_on_commit_record: sync failed on %s - "
16489 +                      "disabling barriers\n", journal->j_devname);
16490 +               spin_lock(&journal->j_state_lock);
16491 +               journal->j_flags &= ~JBD2_BARRIER;
16492 +               spin_unlock(&journal->j_state_lock);
16493 +
16494 +               lock_buffer(bh);
16495 +               clear_buffer_dirty(bh);
16496 +               set_buffer_uptodate(bh);
16497 +               bh->b_end_io = journal_end_buffer_io_sync;
16498 +
16499 +               ret = submit_bh(WRITE_SYNC, bh);
16500 +               if (ret) {
16501 +                       unlock_buffer(bh);
16502 +                       return ret;
16503 +               }
16504 +               goto retry;
16505 +       }
16506
16507         if (unlikely(!buffer_uptodate(bh)))
16508                 ret = -EIO;
16509 @@ -799,7 +822,7 @@
16510                         __jbd2_journal_abort_hard(journal);
16511         }
16512         if (!err && !is_journal_aborted(journal))
16513 -               err = journal_wait_on_commit_record(cbh);
16514 +               err = journal_wait_on_commit_record(journal, cbh);
16515
16516         if (err)
16517                 jbd2_journal_abort(journal, err);
16518 --- kernel-power-2.6.28.orig/fs/jbd2/journal.c
16519 +++ kernel-power-2.6.28/fs/jbd2/journal.c
16520 @@ -430,7 +430,7 @@
16521  }
16522
16523  /*
16524 - * Called under j_state_lock.  Returns true if a transaction was started.
16525 + * Called under j_state_lock.  Returns true if a transaction commit was started.
16526   */
16527  int __jbd2_log_start_commit(journal_t *journal, tid_t target)
16528  {
16529 @@ -498,7 +498,8 @@
16530
16531  /*
16532   * Start a commit of the current running transaction (if any).  Returns true
16533 - * if a transaction was started, and fills its tid in at *ptid
16534 + * if a transaction is going to be committed (or is currently already
16535 + * committing), and fills its tid in at *ptid
16536   */
16537  int jbd2_journal_start_commit(journal_t *journal, tid_t *ptid)
16538  {
16539 @@ -508,15 +509,19 @@
16540         if (journal->j_running_transaction) {
16541                 tid_t tid = journal->j_running_transaction->t_tid;
16542
16543 -               ret = __jbd2_log_start_commit(journal, tid);
16544 -               if (ret && ptid)
16545 +               __jbd2_log_start_commit(journal, tid);
16546 +               /* There's a running transaction and we've just made sure
16547 +                * it's commit has been scheduled. */
16548 +               if (ptid)
16549                         *ptid = tid;
16550 -       } else if (journal->j_committing_transaction && ptid) {
16551 +               ret = 1;
16552 +       } else if (journal->j_committing_transaction) {
16553                 /*
16554                  * If ext3_write_super() recently started a commit, then we
16555                  * have to wait for completion of that transaction
16556                  */
16557 -               *ptid = journal->j_committing_transaction->t_tid;
16558 +               if (ptid)
16559 +                       *ptid = journal->j_committing_transaction->t_tid;
16560                 ret = 1;
16561         }
16562         spin_unlock(&journal->j_state_lock);
16563 --- kernel-power-2.6.28.orig/fs/jbd2/transaction.c
16564 +++ kernel-power-2.6.28/fs/jbd2/transaction.c
16565 @@ -2050,26 +2050,46 @@
16566  }
16567
16568  /*
16569 - * This function must be called when inode is journaled in ordered mode
16570 - * before truncation happens. It starts writeout of truncated part in
16571 - * case it is in the committing transaction so that we stand to ordered
16572 - * mode consistency guarantees.
16573 + * File truncate and transaction commit interact with each other in a
16574 + * non-trivial way.  If a transaction writing data block A is
16575 + * committing, we cannot discard the data by truncate until we have
16576 + * written them.  Otherwise if we crashed after the transaction with
16577 + * write has committed but before the transaction with truncate has
16578 + * committed, we could see stale data in block A.  This function is a
16579 + * helper to solve this problem.  It starts writeout of the truncated
16580 + * part in case it is in the committing transaction.
16581 + *
16582 + * Filesystem code must call this function when inode is journaled in
16583 + * ordered mode before truncation happens and after the inode has been
16584 + * placed on orphan list with the new inode size. The second condition
16585 + * avoids the race that someone writes new data and we start
16586 + * committing the transaction after this function has been called but
16587 + * before a transaction for truncate is started (and furthermore it
16588 + * allows us to optimize the case where the addition to orphan list
16589 + * happens in the same transaction as write --- we don't have to write
16590 + * any data in such case).
16591   */
16592 -int jbd2_journal_begin_ordered_truncate(struct jbd2_inode *inode,
16593 +int jbd2_journal_begin_ordered_truncate(journal_t *journal,
16594 +                                       struct jbd2_inode *jinode,
16595                                         loff_t new_size)
16596  {
16597 -       journal_t *journal;
16598 -       transaction_t *commit_trans;
16599 +       transaction_t *inode_trans, *commit_trans;
16600         int ret = 0;
16601
16602 -       if (!inode->i_transaction && !inode->i_next_transaction)
16603 +       /* This is a quick check to avoid locking if not necessary */
16604 +       if (!jinode->i_transaction)
16605                 goto out;
16606 -       journal = inode->i_transaction->t_journal;
16607 +       /* Locks are here just to force reading of recent values, it is
16608 +        * enough that the transaction was not committing before we started
16609 +        * a transaction adding the inode to orphan list */
16610         spin_lock(&journal->j_state_lock);
16611         commit_trans = journal->j_committing_transaction;
16612         spin_unlock(&journal->j_state_lock);
16613 -       if (inode->i_transaction == commit_trans) {
16614 -               ret = filemap_fdatawrite_range(inode->i_vfs_inode->i_mapping,
16615 +       spin_lock(&journal->j_list_lock);
16616 +       inode_trans = jinode->i_transaction;
16617 +       spin_unlock(&journal->j_list_lock);
16618 +       if (inode_trans == commit_trans) {
16619 +               ret = filemap_fdatawrite_range(jinode->i_vfs_inode->i_mapping,
16620                         new_size, LLONG_MAX);
16621                 if (ret)
16622                         jbd2_journal_abort(journal, ret);
16623 --- kernel-power-2.6.28.orig/fs/jffs2/file.c
16624 +++ kernel-power-2.6.28/fs/jffs2/file.c
16625 @@ -132,7 +132,7 @@
16626         uint32_t pageofs = index << PAGE_CACHE_SHIFT;
16627         int ret = 0;
16628
16629 -       pg = __grab_cache_page(mapping, index);
16630 +       pg = grab_cache_page_write_begin(mapping, index, flags);
16631         if (!pg)
16632                 return -ENOMEM;
16633         *pagep = pg;
16634 --- kernel-power-2.6.28.orig/fs/jffs2/readinode.c
16635 +++ kernel-power-2.6.28/fs/jffs2/readinode.c
16636 @@ -220,7 +220,7 @@
16637                                 struct jffs2_tmp_dnode_info *tn)
16638  {
16639         uint32_t fn_end = tn->fn->ofs + tn->fn->size;
16640 -       struct jffs2_tmp_dnode_info *this;
16641 +       struct jffs2_tmp_dnode_info *this, *ptn;
16642
16643         dbg_readinode("insert fragment %#04x-%#04x, ver %u at %08x\n", tn->fn->ofs, fn_end, tn->version, ref_offset(tn->fn->raw));
16644
16645 @@ -251,11 +251,18 @@
16646         if (this) {
16647                 /* If the node is coincident with another at a lower address,
16648                    back up until the other node is found. It may be relevant */
16649 -               while (this->overlapped)
16650 -                       this = tn_prev(this);
16651 -
16652 -               /* First node should never be marked overlapped */
16653 -               BUG_ON(!this);
16654 +               while (this->overlapped) {
16655 +                       ptn = tn_prev(this);
16656 +                       if (!ptn) {
16657 +                               /*
16658 +                                * We killed a node which set the overlapped
16659 +                                * flags during the scan. Fix it up.
16660 +                                */
16661 +                               this->overlapped = 0;
16662 +                               break;
16663 +                       }
16664 +                       this = ptn;
16665 +               }
16666                 dbg_readinode("'this' found %#04x-%#04x (%s)\n", this->fn->ofs, this->fn->ofs + this->fn->size, this->fn ? "data" : "hole");
16667         }
16668
16669 @@ -360,7 +367,17 @@
16670                         }
16671                         if (!this->overlapped)
16672                                 break;
16673 -                       this = tn_prev(this);
16674 +
16675 +                       ptn = tn_prev(this);
16676 +                       if (!ptn) {
16677 +                               /*
16678 +                                * We killed a node which set the overlapped
16679 +                                * flags during the scan. Fix it up.
16680 +                                */
16681 +                               this->overlapped = 0;
16682 +                               break;
16683 +                       }
16684 +                       this = ptn;
16685                 }
16686         }
16687
16688 @@ -456,8 +473,15 @@
16689                 eat_last(&rii->tn_root, &last->rb);
16690                 ver_insert(&ver_root, last);
16691
16692 -               if (unlikely(last->overlapped))
16693 -                       continue;
16694 +               if (unlikely(last->overlapped)) {
16695 +                       if (pen)
16696 +                               continue;
16697 +                       /*
16698 +                        * We killed a node which set the overlapped
16699 +                        * flags during the scan. Fix it up.
16700 +                        */
16701 +                       last->overlapped = 0;
16702 +               }
16703
16704                 /* Now we have a bunch of nodes in reverse version
16705                    order, in the tree at ver_root. Most of the time,
16706 --- kernel-power-2.6.28.orig/fs/libfs.c
16707 +++ kernel-power-2.6.28/fs/libfs.c
16708 @@ -360,7 +360,7 @@
16709         index = pos >> PAGE_CACHE_SHIFT;
16710         from = pos & (PAGE_CACHE_SIZE - 1);
16711
16712 -       page = __grab_cache_page(mapping, index);
16713 +       page = grab_cache_page_write_begin(mapping, index, flags);
16714         if (!page)
16715                 return -ENOMEM;
16716
16717 --- kernel-power-2.6.28.orig/fs/lockd/svclock.c
16718 +++ kernel-power-2.6.28/fs/lockd/svclock.c
16719 @@ -427,7 +427,7 @@
16720                         goto out;
16721                 case -EAGAIN:
16722                         ret = nlm_lck_denied;
16723 -                       goto out;
16724 +                       break;
16725                 case FILE_LOCK_DEFERRED:
16726                         if (wait)
16727                                 break;
16728 @@ -443,6 +443,10 @@
16729                         goto out;
16730         }
16731
16732 +       ret = nlm_lck_denied;
16733 +       if (!wait)
16734 +               goto out;
16735 +
16736         ret = nlm_lck_blocked;
16737
16738         /* Append to list of blocked */
16739 --- kernel-power-2.6.28.orig/fs/locks.c
16740 +++ kernel-power-2.6.28/fs/locks.c
16741 @@ -1564,7 +1564,7 @@
16742   *     %LOCK_MAND can be combined with %LOCK_READ or %LOCK_WRITE to allow other
16743   *     processes read and write access respectively.
16744   */
16745 -asmlinkage long sys_flock(unsigned int fd, unsigned int cmd)
16746 +SYSCALL_DEFINE2(flock, unsigned int, fd, unsigned int, cmd)
16747  {
16748         struct file *filp;
16749         struct file_lock *lock;
16750 --- kernel-power-2.6.28.orig/fs/minix/dir.c
16751 +++ kernel-power-2.6.28/fs/minix/dir.c
16752 @@ -280,7 +280,7 @@
16753         return -EINVAL;
16754
16755  got_it:
16756 -       pos = (page->index >> PAGE_CACHE_SHIFT) + p - (char*)page_address(page);
16757 +       pos = page_offset(page) + p - (char *)page_address(page);
16758         err = __minix_write_begin(NULL, page->mapping, pos, sbi->s_dirsize,
16759                                         AOP_FLAG_UNINTERRUPTIBLE, &page, NULL);
16760         if (err)
16761 --- kernel-power-2.6.28.orig/fs/namei.c
16762 +++ kernel-power-2.6.28/fs/namei.c
16763 @@ -1970,8 +1970,8 @@
16764         }
16765  }
16766
16767 -asmlinkage long sys_mknodat(int dfd, const char __user *filename, int mode,
16768 -                               unsigned dev)
16769 +SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, int, mode,
16770 +               unsigned, dev)
16771  {
16772         int error;
16773         char *tmp;
16774 @@ -2021,7 +2021,7 @@
16775         return error;
16776  }
16777
16778 -asmlinkage long sys_mknod(const char __user *filename, int mode, unsigned dev)
16779 +SYSCALL_DEFINE3(mknod, const char __user *, filename, int, mode, unsigned, dev)
16780  {
16781         return sys_mknodat(AT_FDCWD, filename, mode, dev);
16782  }
16783 @@ -2048,7 +2048,7 @@
16784         return error;
16785  }
16786
16787 -asmlinkage long sys_mkdirat(int dfd, const char __user *pathname, int mode)
16788 +SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, int, mode)
16789  {
16790         int error = 0;
16791         char * tmp;
16792 @@ -2081,7 +2081,7 @@
16793         return error;
16794  }
16795
16796 -asmlinkage long sys_mkdir(const char __user *pathname, int mode)
16797 +SYSCALL_DEFINE2(mkdir, const char __user *, pathname, int, mode)
16798  {
16799         return sys_mkdirat(AT_FDCWD, pathname, mode);
16800  }
16801 @@ -2191,7 +2191,7 @@
16802         return error;
16803  }
16804
16805 -asmlinkage long sys_rmdir(const char __user *pathname)
16806 +SYSCALL_DEFINE1(rmdir, const char __user *, pathname)
16807  {
16808         return do_rmdir(AT_FDCWD, pathname);
16809  }
16810 @@ -2283,7 +2283,7 @@
16811         goto exit2;
16812  }
16813
16814 -asmlinkage long sys_unlinkat(int dfd, const char __user *pathname, int flag)
16815 +SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag)
16816  {
16817         if ((flag & ~AT_REMOVEDIR) != 0)
16818                 return -EINVAL;
16819 @@ -2294,7 +2294,7 @@
16820         return do_unlinkat(dfd, pathname);
16821  }
16822
16823 -asmlinkage long sys_unlink(const char __user *pathname)
16824 +SYSCALL_DEFINE1(unlink, const char __user *, pathname)
16825  {
16826         return do_unlinkat(AT_FDCWD, pathname);
16827  }
16828 @@ -2320,8 +2320,8 @@
16829         return error;
16830  }
16831
16832 -asmlinkage long sys_symlinkat(const char __user *oldname,
16833 -                             int newdfd, const char __user *newname)
16834 +SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
16835 +               int, newdfd, const char __user *, newname)
16836  {
16837         int error;
16838         char *from;
16839 @@ -2358,7 +2358,7 @@
16840         return error;
16841  }
16842
16843 -asmlinkage long sys_symlink(const char __user *oldname, const char __user *newname)
16844 +SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname)
16845  {
16846         return sys_symlinkat(oldname, AT_FDCWD, newname);
16847  }
16848 @@ -2410,9 +2410,8 @@
16849   * with linux 2.0, and to avoid hard-linking to directories
16850   * and other special files.  --ADM
16851   */
16852 -asmlinkage long sys_linkat(int olddfd, const char __user *oldname,
16853 -                          int newdfd, const char __user *newname,
16854 -                          int flags)
16855 +SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
16856 +               int, newdfd, const char __user *, newname, int, flags)
16857  {
16858         struct dentry *new_dentry;
16859         struct nameidata nd;
16860 @@ -2457,7 +2456,7 @@
16861         return error;
16862  }
16863
16864 -asmlinkage long sys_link(const char __user *oldname, const char __user *newname)
16865 +SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname)
16866  {
16867         return sys_linkat(AT_FDCWD, oldname, AT_FDCWD, newname, 0);
16868  }
16869 @@ -2608,8 +2607,8 @@
16870         return error;
16871  }
16872
16873 -asmlinkage long sys_renameat(int olddfd, const char __user *oldname,
16874 -                            int newdfd, const char __user *newname)
16875 +SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
16876 +               int, newdfd, const char __user *, newname)
16877  {
16878         struct dentry *old_dir, *new_dir;
16879         struct dentry *old_dentry, *new_dentry;
16880 @@ -2697,7 +2696,7 @@
16881         return error;
16882  }
16883
16884 -asmlinkage long sys_rename(const char __user *oldname, const char __user *newname)
16885 +SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname)
16886  {
16887         return sys_renameat(AT_FDCWD, oldname, AT_FDCWD, newname);
16888  }
16889 @@ -2787,18 +2786,23 @@
16890         }
16891  }
16892
16893 -int __page_symlink(struct inode *inode, const char *symname, int len,
16894 -               gfp_t gfp_mask)
16895 +/*
16896 + * The nofs argument instructs pagecache_write_begin to pass AOP_FLAG_NOFS
16897 + */
16898 +int __page_symlink(struct inode *inode, const char *symname, int len, int nofs)
16899  {
16900         struct address_space *mapping = inode->i_mapping;
16901         struct page *page;
16902         void *fsdata;
16903         int err;
16904         char *kaddr;
16905 +       unsigned int flags = AOP_FLAG_UNINTERRUPTIBLE;
16906 +       if (nofs)
16907 +               flags |= AOP_FLAG_NOFS;
16908
16909  retry:
16910         err = pagecache_write_begin(NULL, mapping, 0, len-1,
16911 -                               AOP_FLAG_UNINTERRUPTIBLE, &page, &fsdata);
16912 +                               flags, &page, &fsdata);
16913         if (err)
16914                 goto fail;
16915
16916 @@ -2822,7 +2826,7 @@
16917  int page_symlink(struct inode *inode, const char *symname, int len)
16918  {
16919         return __page_symlink(inode, symname, len,
16920 -                       mapping_gfp_mask(inode->i_mapping));
16921 +                       !(mapping_gfp_mask(inode->i_mapping) & __GFP_FS));
16922  }
16923
16924  const struct inode_operations page_symlink_inode_operations = {
16925 --- kernel-power-2.6.28.orig/fs/namespace.c
16926 +++ kernel-power-2.6.28/fs/namespace.c
16927 @@ -1128,7 +1128,7 @@
16928   * unixes. Our API is identical to OSF/1 to avoid making a mess of AMD
16929   */
16930
16931 -asmlinkage long sys_umount(char __user * name, int flags)
16932 +SYSCALL_DEFINE2(umount, char __user *, name, int, flags)
16933  {
16934         struct path path;
16935         int retval;
16936 @@ -1160,7 +1160,7 @@
16937  /*
16938   *     The 2.0 compatible umount. No flags.
16939   */
16940 -asmlinkage long sys_oldumount(char __user * name)
16941 +SYSCALL_DEFINE1(oldumount, char __user *, name)
16942  {
16943         return sys_umount(name, 0);
16944  }
16945 @@ -2045,9 +2045,8 @@
16946         return new_ns;
16947  }
16948
16949 -asmlinkage long sys_mount(char __user * dev_name, char __user * dir_name,
16950 -                         char __user * type, unsigned long flags,
16951 -                         void __user * data)
16952 +SYSCALL_DEFINE5(mount, char __user *, dev_name, char __user *, dir_name,
16953 +               char __user *, type, unsigned long, flags, void __user *, data)
16954  {
16955         int retval;
16956         unsigned long data_page;
16957 @@ -2172,8 +2171,8 @@
16958   *    though, so you may need to say mount --bind /nfs/my_root /nfs/my_root
16959   *    first.
16960   */
16961 -asmlinkage long sys_pivot_root(const char __user * new_root,
16962 -                              const char __user * put_old)
16963 +SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
16964 +               const char __user *, put_old)
16965  {
16966         struct vfsmount *tmp;
16967         struct path new, old, parent_path, root_parent, root;
16968 --- kernel-power-2.6.28.orig/fs/nfs/file.c
16969 +++ kernel-power-2.6.28/fs/nfs/file.c
16970 @@ -354,7 +354,7 @@
16971                 file->f_path.dentry->d_name.name,
16972                 mapping->host->i_ino, len, (long long) pos);
16973
16974 -       page = __grab_cache_page(mapping, index);
16975 +       page = grab_cache_page_write_begin(mapping, index, flags);
16976         if (!page)
16977                 return -ENOMEM;
16978         *pagep = page;
16979 --- kernel-power-2.6.28.orig/fs/nfs/read.c
16980 +++ kernel-power-2.6.28/fs/nfs/read.c
16981 @@ -533,12 +533,6 @@
16982         unsigned int len;
16983         int error;
16984
16985 -       error = nfs_wb_page(inode, page);
16986 -       if (error)
16987 -               goto out_unlock;
16988 -       if (PageUptodate(page))
16989 -               goto out_unlock;
16990 -
16991         len = nfs_page_length(page);
16992         if (len == 0)
16993                 return nfs_return_empty_page(page);
16994 --- kernel-power-2.6.28.orig/fs/nfsctl.c
16995 +++ kernel-power-2.6.28/fs/nfsctl.c
16996 @@ -82,8 +82,8 @@
16997         },
16998  };
16999
17000 -long
17001 -asmlinkage sys_nfsservctl(int cmd, struct nfsctl_arg __user *arg, void __user *res)
17002 +SYSCALL_DEFINE3(nfsservctl, int, cmd, struct nfsctl_arg __user *, arg,
17003 +               void __user *, res)
17004  {
17005         struct file *file;
17006         void __user *p = &arg->u;
17007 --- kernel-power-2.6.28.orig/fs/nfsd/nfs4state.c
17008 +++ kernel-power-2.6.28/fs/nfsd/nfs4state.c
17009 @@ -2769,6 +2769,25 @@
17010  }
17011
17012  /*
17013 + * The NFSv4 spec allows a client to do a LOCKT without holding an OPEN,
17014 + * so we do a temporary open here just to get an open file to pass to
17015 + * vfs_test_lock.  (Arguably perhaps test_lock should be done with an
17016 + * inode operation.)
17017 + */
17018 +static int nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file_lock *lock)
17019 +{
17020 +       struct file *file;
17021 +       int err;
17022 +
17023 +       err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_READ, &file);
17024 +       if (err)
17025 +               return err;
17026 +       err = vfs_test_lock(file, lock);
17027 +       nfsd_close(file);
17028 +       return err;
17029 +}
17030 +
17031 +/*
17032   * LOCKT operation
17033   */
17034  __be32
17035 @@ -2776,7 +2795,6 @@
17036             struct nfsd4_lockt *lockt)
17037  {
17038         struct inode *inode;
17039 -       struct file file;
17040         struct file_lock file_lock;
17041         int error;
17042         __be32 status;
17043 @@ -2824,7 +2842,6 @@
17044                 file_lock.fl_owner = (fl_owner_t)lockt->lt_stateowner;
17045         file_lock.fl_pid = current->tgid;
17046         file_lock.fl_flags = FL_POSIX;
17047 -       file_lock.fl_lmops = &nfsd_posix_mng_ops;
17048
17049         file_lock.fl_start = lockt->lt_offset;
17050         if ((lockt->lt_length == ~(u64)0) || LOFF_OVERFLOW(lockt->lt_offset, lockt->lt_length))
17051 @@ -2834,16 +2851,8 @@
17052
17053         nfs4_transform_lock_offset(&file_lock);
17054
17055 -       /* vfs_test_lock uses the struct file _only_ to resolve the inode.
17056 -        * since LOCKT doesn't require an OPEN, and therefore a struct
17057 -        * file may not exist, pass vfs_test_lock a struct file with
17058 -        * only the dentry:inode set.
17059 -        */
17060 -       memset(&file, 0, sizeof (struct file));
17061 -       file.f_path.dentry = cstate->current_fh.fh_dentry;
17062 -
17063         status = nfs_ok;
17064 -       error = vfs_test_lock(&file, &file_lock);
17065 +       error = nfsd_test_lock(rqstp, &cstate->current_fh, &file_lock);
17066         if (error) {
17067                 status = nfserrno(error);
17068                 goto out;
17069 --- kernel-power-2.6.28.orig/fs/nfsd/nfs4xdr.c
17070 +++ kernel-power-2.6.28/fs/nfsd/nfs4xdr.c
17071 @@ -2598,6 +2598,7 @@
17072         [OP_LOOKUPP]            = (nfsd4_enc)nfsd4_encode_noop,
17073         [OP_NVERIFY]            = (nfsd4_enc)nfsd4_encode_noop,
17074         [OP_OPEN]               = (nfsd4_enc)nfsd4_encode_open,
17075 +       [OP_OPENATTR]           = (nfsd4_enc)nfsd4_encode_noop,
17076         [OP_OPEN_CONFIRM]       = (nfsd4_enc)nfsd4_encode_open_confirm,
17077         [OP_OPEN_DOWNGRADE]     = (nfsd4_enc)nfsd4_encode_open_downgrade,
17078         [OP_PUTFH]              = (nfsd4_enc)nfsd4_encode_noop,
17079 --- kernel-power-2.6.28.orig/fs/ocfs2/file.c
17080 +++ kernel-power-2.6.28/fs/ocfs2/file.c
17081 @@ -1943,7 +1943,7 @@
17082                    out->f_path.dentry->d_name.len,
17083                    out->f_path.dentry->d_name.name);
17084
17085 -       inode_double_lock(inode, pipe->inode);
17086 +       mutex_lock_nested(&inode->i_mutex, I_MUTEX_PARENT);
17087
17088         ret = ocfs2_rw_lock(inode, 1);
17089         if (ret < 0) {
17090 @@ -1958,12 +1958,16 @@
17091                 goto out_unlock;
17092         }
17093
17094 +       if (pipe->inode)
17095 +               mutex_lock_nested(&pipe->inode->i_mutex, I_MUTEX_CHILD);
17096         ret = generic_file_splice_write_nolock(pipe, out, ppos, len, flags);
17097 +       if (pipe->inode)
17098 +               mutex_unlock(&pipe->inode->i_mutex);
17099
17100  out_unlock:
17101         ocfs2_rw_unlock(inode, 1);
17102  out:
17103 -       inode_double_unlock(inode, pipe->inode);
17104 +       mutex_unlock(&inode->i_mutex);
17105
17106         mlog_exit(ret);
17107         return ret;
17108 --- kernel-power-2.6.28.orig/fs/ocfs2/journal.h
17109 +++ kernel-power-2.6.28/fs/ocfs2/journal.h
17110 @@ -445,8 +445,10 @@
17111  static inline int ocfs2_begin_ordered_truncate(struct inode *inode,
17112                                                loff_t new_size)
17113  {
17114 -       return jbd2_journal_begin_ordered_truncate(&OCFS2_I(inode)->ip_jinode,
17115 -                                                  new_size);
17116 +       return jbd2_journal_begin_ordered_truncate(
17117 +                               OCFS2_SB(inode->i_sb)->journal->j_journal,
17118 +                               &OCFS2_I(inode)->ip_jinode,
17119 +                               new_size);
17120  }
17121
17122  #endif /* OCFS2_JOURNAL_H */
17123 --- kernel-power-2.6.28.orig/fs/open.c
17124 +++ kernel-power-2.6.28/fs/open.c
17125 @@ -122,7 +122,7 @@
17126         return 0;
17127  }
17128
17129 -asmlinkage long sys_statfs(const char __user *pathname, struct statfs __user * buf)
17130 +SYSCALL_DEFINE2(statfs, const char __user *, pathname, struct statfs __user *, buf)
17131  {
17132         struct path path;
17133         int error;
17134 @@ -138,8 +138,7 @@
17135         return error;
17136  }
17137
17138 -
17139 -asmlinkage long sys_statfs64(const char __user *pathname, size_t sz, struct statfs64 __user *buf)
17140 +SYSCALL_DEFINE3(statfs64, const char __user *, pathname, size_t, sz, struct statfs64 __user *, buf)
17141  {
17142         struct path path;
17143         long error;
17144 @@ -157,8 +156,7 @@
17145         return error;
17146  }
17147
17148 -
17149 -asmlinkage long sys_fstatfs(unsigned int fd, struct statfs __user * buf)
17150 +SYSCALL_DEFINE2(fstatfs, unsigned int, fd, struct statfs __user *, buf)
17151  {
17152         struct file * file;
17153         struct statfs tmp;
17154 @@ -176,7 +174,7 @@
17155         return error;
17156  }
17157
17158 -asmlinkage long sys_fstatfs64(unsigned int fd, size_t sz, struct statfs64 __user *buf)
17159 +SYSCALL_DEFINE3(fstatfs64, unsigned int, fd, size_t, sz, struct statfs64 __user *, buf)
17160  {
17161         struct file * file;
17162         struct statfs64 tmp;
17163 @@ -287,7 +285,7 @@
17164         return error;
17165  }
17166
17167 -asmlinkage long sys_truncate(const char __user * path, unsigned long length)
17168 +SYSCALL_DEFINE2(truncate, const char __user *, path, unsigned long, length)
17169  {
17170         /* on 32-bit boxen it will cut the range 2^31--2^32-1 off */
17171         return do_sys_truncate(path, (long)length);
17172 @@ -336,7 +334,7 @@
17173         return error;
17174  }
17175
17176 -asmlinkage long sys_ftruncate(unsigned int fd, unsigned long length)
17177 +SYSCALL_DEFINE2(ftruncate, unsigned int, fd, unsigned long, length)
17178  {
17179         long ret = do_sys_ftruncate(fd, length, 1);
17180         /* avoid REGPARM breakage on x86: */
17181 @@ -346,21 +344,35 @@
17182
17183  /* LFS versions of truncate are only needed on 32 bit machines */
17184  #if BITS_PER_LONG == 32
17185 -asmlinkage long sys_truncate64(const char __user * path, loff_t length)
17186 +SYSCALL_DEFINE(truncate64)(const char __user * path, loff_t length)
17187  {
17188         return do_sys_truncate(path, length);
17189  }
17190 +#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
17191 +asmlinkage long SyS_truncate64(long path, loff_t length)
17192 +{
17193 +       return SYSC_truncate64((const char __user *) path, length);
17194 +}
17195 +SYSCALL_ALIAS(sys_truncate64, SyS_truncate64);
17196 +#endif
17197
17198 -asmlinkage long sys_ftruncate64(unsigned int fd, loff_t length)
17199 +SYSCALL_DEFINE(ftruncate64)(unsigned int fd, loff_t length)
17200  {
17201         long ret = do_sys_ftruncate(fd, length, 0);
17202         /* avoid REGPARM breakage on x86: */
17203         asmlinkage_protect(2, ret, fd, length);
17204         return ret;
17205  }
17206 +#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
17207 +asmlinkage long SyS_ftruncate64(long fd, loff_t length)
17208 +{
17209 +       return SYSC_ftruncate64((unsigned int) fd, length);
17210 +}
17211 +SYSCALL_ALIAS(sys_ftruncate64, SyS_ftruncate64);
17212  #endif
17213 +#endif /* BITS_PER_LONG == 32 */
17214
17215 -asmlinkage long sys_fallocate(int fd, int mode, loff_t offset, loff_t len)
17216 +SYSCALL_DEFINE(fallocate)(int fd, int mode, loff_t offset, loff_t len)
17217  {
17218         struct file *file;
17219         struct inode *inode;
17220 @@ -417,13 +429,20 @@
17221  out:
17222         return ret;
17223  }
17224 +#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
17225 +asmlinkage long SyS_fallocate(long fd, long mode, loff_t offset, loff_t len)
17226 +{
17227 +       return SYSC_fallocate((int)fd, (int)mode, offset, len);
17228 +}
17229 +SYSCALL_ALIAS(sys_fallocate, SyS_fallocate);
17230 +#endif
17231
17232  /*
17233   * access() needs to use the real uid/gid, not the effective uid/gid.
17234   * We do this by temporarily clearing all FS-related capabilities and
17235   * switching the fsuid/fsgid around to the real ones.
17236   */
17237 -asmlinkage long sys_faccessat(int dfd, const char __user *filename, int mode)
17238 +SYSCALL_DEFINE3(faccessat, int, dfd, const char __user *, filename, int, mode)
17239  {
17240         struct path path;
17241         struct inode *inode;
17242 @@ -503,12 +522,12 @@
17243         return res;
17244  }
17245
17246 -asmlinkage long sys_access(const char __user *filename, int mode)
17247 +SYSCALL_DEFINE2(access, const char __user *, filename, int, mode)
17248  {
17249         return sys_faccessat(AT_FDCWD, filename, mode);
17250  }
17251
17252 -asmlinkage long sys_chdir(const char __user * filename)
17253 +SYSCALL_DEFINE1(chdir, const char __user *, filename)
17254  {
17255         struct path path;
17256         int error;
17257 @@ -529,7 +548,7 @@
17258         return error;
17259  }
17260
17261 -asmlinkage long sys_fchdir(unsigned int fd)
17262 +SYSCALL_DEFINE1(fchdir, unsigned int, fd)
17263  {
17264         struct file *file;
17265         struct inode *inode;
17266 @@ -555,7 +574,7 @@
17267         return error;
17268  }
17269
17270 -asmlinkage long sys_chroot(const char __user * filename)
17271 +SYSCALL_DEFINE1(chroot, const char __user *, filename)
17272  {
17273         struct path path;
17274         int error;
17275 @@ -580,7 +599,7 @@
17276         return error;
17277  }
17278
17279 -asmlinkage long sys_fchmod(unsigned int fd, mode_t mode)
17280 +SYSCALL_DEFINE2(fchmod, unsigned int, fd, mode_t, mode)
17281  {
17282         struct inode * inode;
17283         struct dentry * dentry;
17284 @@ -614,8 +633,7 @@
17285         return err;
17286  }
17287
17288 -asmlinkage long sys_fchmodat(int dfd, const char __user *filename,
17289 -                            mode_t mode)
17290 +SYSCALL_DEFINE3(fchmodat, int, dfd, const char __user *, filename, mode_t, mode)
17291  {
17292         struct path path;
17293         struct inode *inode;
17294 @@ -644,7 +662,7 @@
17295         return error;
17296  }
17297
17298 -asmlinkage long sys_chmod(const char __user *filename, mode_t mode)
17299 +SYSCALL_DEFINE2(chmod, const char __user *, filename, mode_t, mode)
17300  {
17301         return sys_fchmodat(AT_FDCWD, filename, mode);
17302  }
17303 @@ -674,7 +692,7 @@
17304         return error;
17305  }
17306
17307 -asmlinkage long sys_chown(const char __user * filename, uid_t user, gid_t group)
17308 +SYSCALL_DEFINE3(chown, const char __user *, filename, uid_t, user, gid_t, group)
17309  {
17310         struct path path;
17311         int error;
17312 @@ -693,8 +711,8 @@
17313         return error;
17314  }
17315
17316 -asmlinkage long sys_fchownat(int dfd, const char __user *filename, uid_t user,
17317 -                            gid_t group, int flag)
17318 +SYSCALL_DEFINE5(fchownat, int, dfd, const char __user *, filename, uid_t, user,
17319 +               gid_t, group, int, flag)
17320  {
17321         struct path path;
17322         int error = -EINVAL;
17323 @@ -718,7 +736,7 @@
17324         return error;
17325  }
17326
17327 -asmlinkage long sys_lchown(const char __user * filename, uid_t user, gid_t group)
17328 +SYSCALL_DEFINE3(lchown, const char __user *, filename, uid_t, user, gid_t, group)
17329  {
17330         struct path path;
17331         int error;
17332 @@ -737,8 +755,7 @@
17333         return error;
17334  }
17335
17336 -
17337 -asmlinkage long sys_fchown(unsigned int fd, uid_t user, gid_t group)
17338 +SYSCALL_DEFINE3(fchown, unsigned int, fd, uid_t, user, gid_t, group)
17339  {
17340         struct file * file;
17341         int error = -EBADF;
17342 @@ -1029,7 +1046,7 @@
17343         return fd;
17344  }
17345
17346 -asmlinkage long sys_open(const char __user *filename, int flags, int mode)
17347 +SYSCALL_DEFINE3(open, const char __user *, filename, int, flags, int, mode)
17348  {
17349         long ret;
17350
17351 @@ -1042,8 +1059,8 @@
17352         return ret;
17353  }
17354
17355 -asmlinkage long sys_openat(int dfd, const char __user *filename, int flags,
17356 -                          int mode)
17357 +SYSCALL_DEFINE4(openat, int, dfd, const char __user *, filename, int, flags,
17358 +               int, mode)
17359  {
17360         long ret;
17361
17362 @@ -1062,7 +1079,7 @@
17363   * For backward compatibility?  Maybe this should be moved
17364   * into arch/i386 instead?
17365   */
17366 -asmlinkage long sys_creat(const char __user * pathname, int mode)
17367 +SYSCALL_DEFINE2(creat, const char __user *, pathname, int, mode)
17368  {
17369         return sys_open(pathname, O_CREAT | O_WRONLY | O_TRUNC, mode);
17370  }
17371 @@ -1098,7 +1115,7 @@
17372   * releasing the fd. This ensures that one clone task can't release
17373   * an fd while another clone is opening it.
17374   */
17375 -asmlinkage long sys_close(unsigned int fd)
17376 +SYSCALL_DEFINE1(close, unsigned int, fd)
17377  {
17378         struct file * filp;
17379         struct files_struct *files = current->files;
17380 @@ -1131,14 +1148,13 @@
17381         spin_unlock(&files->file_lock);
17382         return -EBADF;
17383  }
17384 -
17385  EXPORT_SYMBOL(sys_close);
17386
17387  /*
17388   * This routine simulates a hangup on the tty, to arrange that users
17389   * are given clean terminals at login time.
17390   */
17391 -asmlinkage long sys_vhangup(void)
17392 +SYSCALL_DEFINE0(vhangup)
17393  {
17394         if (capable(CAP_SYS_TTY_CONFIG)) {
17395                 tty_vhangup_self();
17396 --- kernel-power-2.6.28.orig/fs/pipe.c
17397 +++ kernel-power-2.6.28/fs/pipe.c
17398 @@ -699,12 +699,12 @@
17399         int retval;
17400
17401         mutex_lock(&inode->i_mutex);
17402 -
17403         retval = fasync_helper(fd, filp, on, &pipe->fasync_readers);
17404 -
17405 -       if (retval >= 0)
17406 +       if (retval >= 0) {
17407                 retval = fasync_helper(fd, filp, on, &pipe->fasync_writers);
17408 -
17409 +               if (retval < 0) /* this can happen only if on == T */
17410 +                       fasync_helper(-1, filp, 0, &pipe->fasync_readers);
17411 +       }
17412         mutex_unlock(&inode->i_mutex);
17413
17414         if (retval < 0)
17415 @@ -1048,7 +1048,7 @@
17416   * sys_pipe() is the normal C calling standard for creating
17417   * a pipe. It's not the way Unix traditionally does this, though.
17418   */
17419 -asmlinkage long __weak sys_pipe2(int __user *fildes, int flags)
17420 +SYSCALL_DEFINE2(pipe2, int __user *, fildes, int, flags)
17421  {
17422         int fd[2];
17423         int error;
17424 @@ -1064,7 +1064,7 @@
17425         return error;
17426  }
17427
17428 -asmlinkage long __weak sys_pipe(int __user *fildes)
17429 +SYSCALL_DEFINE1(pipe, int __user *, fildes)
17430  {
17431         return sys_pipe2(fildes, 0);
17432  }
17433 --- kernel-power-2.6.28.orig/fs/proc/base.c
17434 +++ kernel-power-2.6.28/fs/proc/base.c
17435 @@ -148,15 +148,22 @@
17436         return count;
17437  }
17438
17439 -static struct fs_struct *get_fs_struct(struct task_struct *task)
17440 +static int get_fs_path(struct task_struct *task, struct path *path, bool root)
17441  {
17442         struct fs_struct *fs;
17443 +       int result = -ENOENT;
17444 +
17445         task_lock(task);
17446         fs = task->fs;
17447 -       if(fs)
17448 -               atomic_inc(&fs->count);
17449 +       if (fs) {
17450 +               read_lock(&fs->lock);
17451 +               *path = root ? fs->root : fs->pwd;
17452 +               path_get(path);
17453 +               read_unlock(&fs->lock);
17454 +               result = 0;
17455 +       }
17456         task_unlock(task);
17457 -       return fs;
17458 +       return result;
17459  }
17460
17461  static int get_nr_threads(struct task_struct *tsk)
17462 @@ -174,42 +181,24 @@
17463  static int proc_cwd_link(struct inode *inode, struct path *path)
17464  {
17465         struct task_struct *task = get_proc_task(inode);
17466 -       struct fs_struct *fs = NULL;
17467         int result = -ENOENT;
17468
17469         if (task) {
17470 -               fs = get_fs_struct(task);
17471 +               result = get_fs_path(task, path, 0);
17472                 put_task_struct(task);
17473         }
17474 -       if (fs) {
17475 -               read_lock(&fs->lock);
17476 -               *path = fs->pwd;
17477 -               path_get(&fs->pwd);
17478 -               read_unlock(&fs->lock);
17479 -               result = 0;
17480 -               put_fs_struct(fs);
17481 -       }
17482         return result;
17483  }
17484
17485  static int proc_root_link(struct inode *inode, struct path *path)
17486  {
17487         struct task_struct *task = get_proc_task(inode);
17488 -       struct fs_struct *fs = NULL;
17489         int result = -ENOENT;
17490
17491         if (task) {
17492 -               fs = get_fs_struct(task);
17493 +               result = get_fs_path(task, path, 1);
17494                 put_task_struct(task);
17495         }
17496 -       if (fs) {
17497 -               read_lock(&fs->lock);
17498 -               *path = fs->root;
17499 -               path_get(&fs->root);
17500 -               read_unlock(&fs->lock);
17501 -               result = 0;
17502 -               put_fs_struct(fs);
17503 -       }
17504         return result;
17505  }
17506
17507 @@ -567,7 +556,6 @@
17508         struct task_struct *task = get_proc_task(inode);
17509         struct nsproxy *nsp;
17510         struct mnt_namespace *ns = NULL;
17511 -       struct fs_struct *fs = NULL;
17512         struct path root;
17513         struct proc_mounts *p;
17514         int ret = -EINVAL;
17515 @@ -581,22 +569,16 @@
17516                                 get_mnt_ns(ns);
17517                 }
17518                 rcu_read_unlock();
17519 -               if (ns)
17520 -                       fs = get_fs_struct(task);
17521 +               if (ns && get_fs_path(task, &root, 1) == 0)
17522 +                       ret = 0;
17523                 put_task_struct(task);
17524         }
17525
17526         if (!ns)
17527                 goto err;
17528 -       if (!fs)
17529 +       if (ret)
17530                 goto err_put_ns;
17531
17532 -       read_lock(&fs->lock);
17533 -       root = fs->root;
17534 -       path_get(&root);
17535 -       read_unlock(&fs->lock);
17536 -       put_fs_struct(fs);
17537 -
17538         ret = -ENOMEM;
17539         p = kmalloc(sizeof(struct proc_mounts), GFP_KERNEL);
17540         if (!p)
17541 --- kernel-power-2.6.28.orig/fs/proc/page.c
17542 +++ kernel-power-2.6.28/fs/proc/page.c
17543 @@ -80,7 +80,7 @@
17544  #define KPF_RECLAIM    9
17545  #define KPF_BUDDY     10
17546
17547 -#define kpf_copy_bit(flags, srcpos, dstpos) (((flags >> srcpos) & 1) << dstpos)
17548 +#define kpf_copy_bit(flags, dstpos, srcpos) (((flags >> srcpos) & 1) << dstpos)
17549
17550  static ssize_t kpageflags_read(struct file *file, char __user *buf,
17551                              size_t count, loff_t *ppos)
17552 @@ -107,7 +107,7 @@
17553                 else
17554                         kflags = ppage->flags;
17555
17556 -               uflags = kpf_copy_bit(KPF_LOCKED, PG_locked, kflags) |
17557 +               uflags = kpf_copy_bit(kflags, KPF_LOCKED, PG_locked) |
17558                         kpf_copy_bit(kflags, KPF_ERROR, PG_error) |
17559                         kpf_copy_bit(kflags, KPF_REFERENCED, PG_referenced) |
17560                         kpf_copy_bit(kflags, KPF_UPTODATE, PG_uptodate) |
17561 --- kernel-power-2.6.28.orig/fs/quota.c
17562 +++ kernel-power-2.6.28/fs/quota.c
17563 @@ -368,7 +368,8 @@
17564   * calls. Maybe we need to add the process quotas etc. in the future,
17565   * but we probably should use rlimits for that.
17566   */
17567 -asmlinkage long sys_quotactl(unsigned int cmd, const char __user *special, qid_t id, void __user *addr)
17568 +SYSCALL_DEFINE4(quotactl, unsigned int, cmd, const char __user *, special,
17569 +               qid_t, id, void __user *, addr)
17570  {
17571         uint cmds, type;
17572         struct super_block *sb = NULL;
17573 --- kernel-power-2.6.28.orig/fs/read_write.c
17574 +++ kernel-power-2.6.28/fs/read_write.c
17575 @@ -134,7 +134,7 @@
17576  }
17577  EXPORT_SYMBOL(vfs_llseek);
17578
17579 -asmlinkage off_t sys_lseek(unsigned int fd, off_t offset, unsigned int origin)
17580 +SYSCALL_DEFINE3(lseek, unsigned int, fd, off_t, offset, unsigned int, origin)
17581  {
17582         off_t retval;
17583         struct file * file;
17584 @@ -158,9 +158,9 @@
17585  }
17586
17587  #ifdef __ARCH_WANT_SYS_LLSEEK
17588 -asmlinkage long sys_llseek(unsigned int fd, unsigned long offset_high,
17589 -                          unsigned long offset_low, loff_t __user * result,
17590 -                          unsigned int origin)
17591 +SYSCALL_DEFINE5(llseek, unsigned int, fd, unsigned long, offset_high,
17592 +               unsigned long, offset_low, loff_t __user *, result,
17593 +               unsigned int, origin)
17594  {
17595         int retval;
17596         struct file * file;
17597 @@ -356,7 +356,7 @@
17598         file->f_pos = pos;
17599  }
17600
17601 -asmlinkage ssize_t sys_read(unsigned int fd, char __user * buf, size_t count)
17602 +SYSCALL_DEFINE3(read, unsigned int, fd, char __user *, buf, size_t, count)
17603  {
17604         struct file *file;
17605         ssize_t ret = -EBADF;
17606 @@ -373,7 +373,8 @@
17607         return ret;
17608  }
17609
17610 -asmlinkage ssize_t sys_write(unsigned int fd, const char __user * buf, size_t count)
17611 +SYSCALL_DEFINE3(write, unsigned int, fd, const char __user *, buf,
17612 +               size_t, count)
17613  {
17614         struct file *file;
17615         ssize_t ret = -EBADF;
17616 @@ -390,8 +391,8 @@
17617         return ret;
17618  }
17619
17620 -asmlinkage ssize_t sys_pread64(unsigned int fd, char __user *buf,
17621 -                            size_t count, loff_t pos)
17622 +SYSCALL_DEFINE(pread64)(unsigned int fd, char __user *buf,
17623 +                       size_t count, loff_t pos)
17624  {
17625         struct file *file;
17626         ssize_t ret = -EBADF;
17627 @@ -410,9 +411,17 @@
17628
17629         return ret;
17630  }
17631 +#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
17632 +asmlinkage long SyS_pread64(long fd, long buf, long count, loff_t pos)
17633 +{
17634 +       return SYSC_pread64((unsigned int) fd, (char __user *) buf,
17635 +                           (size_t) count, pos);
17636 +}
17637 +SYSCALL_ALIAS(sys_pread64, SyS_pread64);
17638 +#endif
17639
17640 -asmlinkage ssize_t sys_pwrite64(unsigned int fd, const char __user *buf,
17641 -                             size_t count, loff_t pos)
17642 +SYSCALL_DEFINE(pwrite64)(unsigned int fd, const char __user *buf,
17643 +                        size_t count, loff_t pos)
17644  {
17645         struct file *file;
17646         ssize_t ret = -EBADF;
17647 @@ -431,6 +440,14 @@
17648
17649         return ret;
17650  }
17651 +#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
17652 +asmlinkage long SyS_pwrite64(long fd, long buf, long count, loff_t pos)
17653 +{
17654 +       return SYSC_pwrite64((unsigned int) fd, (const char __user *) buf,
17655 +                            (size_t) count, pos);
17656 +}
17657 +SYSCALL_ALIAS(sys_pwrite64, SyS_pwrite64);
17658 +#endif
17659
17660  /*
17661   * Reduce an iovec's length in-place.  Return the resulting number of segments
17662 @@ -659,8 +676,8 @@
17663
17664  EXPORT_SYMBOL(vfs_writev);
17665
17666 -asmlinkage ssize_t
17667 -sys_readv(unsigned long fd, const struct iovec __user *vec, unsigned long vlen)
17668 +SYSCALL_DEFINE3(readv, unsigned long, fd, const struct iovec __user *, vec,
17669 +               unsigned long, vlen)
17670  {
17671         struct file *file;
17672         ssize_t ret = -EBADF;
17673 @@ -680,8 +697,8 @@
17674         return ret;
17675  }
17676
17677 -asmlinkage ssize_t
17678 -sys_writev(unsigned long fd, const struct iovec __user *vec, unsigned long vlen)
17679 +SYSCALL_DEFINE3(writev, unsigned long, fd, const struct iovec __user *, vec,
17680 +               unsigned long, vlen)
17681  {
17682         struct file *file;
17683         ssize_t ret = -EBADF;
17684 @@ -799,7 +816,7 @@
17685         return retval;
17686  }
17687
17688 -asmlinkage ssize_t sys_sendfile(int out_fd, int in_fd, off_t __user *offset, size_t count)
17689 +SYSCALL_DEFINE4(sendfile, int, out_fd, int, in_fd, off_t __user *, offset, size_t, count)
17690  {
17691         loff_t pos;
17692         off_t off;
17693 @@ -818,7 +835,7 @@
17694         return do_sendfile(out_fd, in_fd, NULL, count, 0);
17695  }
17696
17697 -asmlinkage ssize_t sys_sendfile64(int out_fd, int in_fd, loff_t __user *offset, size_t count)
17698 +SYSCALL_DEFINE4(sendfile64, int, out_fd, int, in_fd, loff_t __user *, offset, size_t, count)
17699  {
17700         loff_t pos;
17701         ssize_t ret;
17702 --- kernel-power-2.6.28.orig/fs/readdir.c
17703 +++ kernel-power-2.6.28/fs/readdir.c
17704 @@ -102,7 +102,8 @@
17705         return -EFAULT;
17706  }
17707
17708 -asmlinkage long old_readdir(unsigned int fd, struct old_linux_dirent __user * dirent, unsigned int count)
17709 +SYSCALL_DEFINE3(old_readdir, unsigned int, fd,
17710 +               struct old_linux_dirent __user *, dirent, unsigned int, count)
17711  {
17712         int error;
17713         struct file * file;
17714 @@ -187,7 +188,8 @@
17715         return -EFAULT;
17716  }
17717
17718 -asmlinkage long sys_getdents(unsigned int fd, struct linux_dirent __user * dirent, unsigned int count)
17719 +SYSCALL_DEFINE3(getdents, unsigned int, fd,
17720 +               struct linux_dirent __user *, dirent, unsigned int, count)
17721  {
17722         struct file * file;
17723         struct linux_dirent __user * lastdirent;
17724 @@ -268,7 +270,8 @@
17725         return -EFAULT;
17726  }
17727
17728 -asmlinkage long sys_getdents64(unsigned int fd, struct linux_dirent64 __user * dirent, unsigned int count)
17729 +SYSCALL_DEFINE3(getdents64, unsigned int, fd,
17730 +               struct linux_dirent64 __user *, dirent, unsigned int, count)
17731  {
17732         struct file * file;
17733         struct linux_dirent64 __user * lastdirent;
17734 --- kernel-power-2.6.28.orig/fs/reiserfs/inode.c
17735 +++ kernel-power-2.6.28/fs/reiserfs/inode.c
17736 @@ -2556,7 +2556,7 @@
17737         }
17738
17739         index = pos >> PAGE_CACHE_SHIFT;
17740 -       page = __grab_cache_page(mapping, index);
17741 +       page = grab_cache_page_write_begin(mapping, index, flags);
17742         if (!page)
17743                 return -ENOMEM;
17744         *pagep = page;
17745 --- kernel-power-2.6.28.orig/fs/select.c
17746 +++ kernel-power-2.6.28/fs/select.c
17747 @@ -507,8 +507,8 @@
17748         return ret;
17749  }
17750
17751 -asmlinkage long sys_select(int n, fd_set __user *inp, fd_set __user *outp,
17752 -                       fd_set __user *exp, struct timeval __user *tvp)
17753 +SYSCALL_DEFINE5(select, int, n, fd_set __user *, inp, fd_set __user *, outp,
17754 +               fd_set __user *, exp, struct timeval __user *, tvp)
17755  {
17756         struct timespec end_time, *to = NULL;
17757         struct timeval tv;
17758 @@ -532,9 +532,9 @@
17759  }
17760
17761  #ifdef HAVE_SET_RESTORE_SIGMASK
17762 -asmlinkage long sys_pselect7(int n, fd_set __user *inp, fd_set __user *outp,
17763 -               fd_set __user *exp, struct timespec __user *tsp,
17764 -               const sigset_t __user *sigmask, size_t sigsetsize)
17765 +static long do_pselect(int n, fd_set __user *inp, fd_set __user *outp,
17766 +                      fd_set __user *exp, struct timespec __user *tsp,
17767 +                      const sigset_t __user *sigmask, size_t sigsetsize)
17768  {
17769         sigset_t ksigmask, sigsaved;
17770         struct timespec ts, end_time, *to = NULL;
17771 @@ -560,7 +560,7 @@
17772                 sigprocmask(SIG_SETMASK, &ksigmask, &sigsaved);
17773         }
17774
17775 -       ret = core_sys_select(n, inp, outp, exp, &end_time);
17776 +       ret = core_sys_select(n, inp, outp, exp, to);
17777         ret = poll_select_copy_remaining(&end_time, tsp, 0, ret);
17778
17779         if (ret == -ERESTARTNOHAND) {
17780 @@ -586,8 +586,9 @@
17781   * which has a pointer to the sigset_t itself followed by a size_t containing
17782   * the sigset size.
17783   */
17784 -asmlinkage long sys_pselect6(int n, fd_set __user *inp, fd_set __user *outp,
17785 -       fd_set __user *exp, struct timespec __user *tsp, void __user *sig)
17786 +SYSCALL_DEFINE6(pselect6, int, n, fd_set __user *, inp, fd_set __user *, outp,
17787 +               fd_set __user *, exp, struct timespec __user *, tsp,
17788 +               void __user *, sig)
17789  {
17790         size_t sigsetsize = 0;
17791         sigset_t __user *up = NULL;
17792 @@ -600,7 +601,7 @@
17793                         return -EFAULT;
17794         }
17795
17796 -       return sys_pselect7(n, inp, outp, exp, tsp, up, sigsetsize);
17797 +       return do_pselect(n, inp, outp, exp, tsp, up, sigsetsize);
17798  }
17799  #endif /* HAVE_SET_RESTORE_SIGMASK */
17800
17801 @@ -806,8 +807,8 @@
17802         return ret;
17803  }
17804
17805 -asmlinkage long sys_poll(struct pollfd __user *ufds, unsigned int nfds,
17806 -                       long timeout_msecs)
17807 +SYSCALL_DEFINE3(poll, struct pollfd __user *, ufds, unsigned int, nfds,
17808 +               long, timeout_msecs)
17809  {
17810         struct timespec end_time, *to = NULL;
17811         int ret;
17812 @@ -841,9 +842,9 @@
17813  }
17814
17815  #ifdef HAVE_SET_RESTORE_SIGMASK
17816 -asmlinkage long sys_ppoll(struct pollfd __user *ufds, unsigned int nfds,
17817 -       struct timespec __user *tsp, const sigset_t __user *sigmask,
17818 -       size_t sigsetsize)
17819 +SYSCALL_DEFINE5(ppoll, struct pollfd __user *, ufds, unsigned int, nfds,
17820 +               struct timespec __user *, tsp, const sigset_t __user *, sigmask,
17821 +               size_t, sigsetsize)
17822  {
17823         sigset_t ksigmask, sigsaved;
17824         struct timespec ts, end_time, *to = NULL;
17825 --- kernel-power-2.6.28.orig/fs/seq_file.c
17826 +++ kernel-power-2.6.28/fs/seq_file.c
17827 @@ -48,12 +48,78 @@
17828          */
17829         file->f_version = 0;
17830
17831 -       /* SEQ files support lseek, but not pread/pwrite */
17832 -       file->f_mode &= ~(FMODE_PREAD | FMODE_PWRITE);
17833 +       /*
17834 +        * seq_files support lseek() and pread().  They do not implement
17835 +        * write() at all, but we clear FMODE_PWRITE here for historical
17836 +        * reasons.
17837 +        *
17838 +        * If a client of seq_files a) implements file.write() and b) wishes to
17839 +        * support pwrite() then that client will need to implement its own
17840 +        * file.open() which calls seq_open() and then sets FMODE_PWRITE.
17841 +        */
17842 +       file->f_mode &= ~FMODE_PWRITE;
17843         return 0;
17844  }
17845  EXPORT_SYMBOL(seq_open);
17846
17847 +static int traverse(struct seq_file *m, loff_t offset)
17848 +{
17849 +       loff_t pos = 0, index;
17850 +       int error = 0;
17851 +       void *p;
17852 +
17853 +       m->version = 0;
17854 +       index = 0;
17855 +       m->count = m->from = 0;
17856 +       if (!offset) {
17857 +               m->index = index;
17858 +               return 0;
17859 +       }
17860 +       if (!m->buf) {
17861 +               m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
17862 +               if (!m->buf)
17863 +                       return -ENOMEM;
17864 +       }
17865 +       p = m->op->start(m, &index);
17866 +       while (p) {
17867 +               error = PTR_ERR(p);
17868 +               if (IS_ERR(p))
17869 +                       break;
17870 +               error = m->op->show(m, p);
17871 +               if (error < 0)
17872 +                       break;
17873 +               if (unlikely(error)) {
17874 +                       error = 0;
17875 +                       m->count = 0;
17876 +               }
17877 +               if (m->count == m->size)
17878 +                       goto Eoverflow;
17879 +               if (pos + m->count > offset) {
17880 +                       m->from = offset - pos;
17881 +                       m->count -= m->from;
17882 +                       m->index = index;
17883 +                       break;
17884 +               }
17885 +               pos += m->count;
17886 +               m->count = 0;
17887 +               if (pos == offset) {
17888 +                       index++;
17889 +                       m->index = index;
17890 +                       break;
17891 +               }
17892 +               p = m->op->next(m, p, &index);
17893 +       }
17894 +       m->op->stop(m, p);
17895 +       m->index = index;
17896 +       return error;
17897 +
17898 +Eoverflow:
17899 +       m->op->stop(m, p);
17900 +       kfree(m->buf);
17901 +       m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
17902 +       return !m->buf ? -ENOMEM : -EAGAIN;
17903 +}
17904 +
17905  /**
17906   *     seq_read -      ->read() method for sequential files.
17907   *     @file: the file to read from
17908 @@ -73,6 +139,22 @@
17909         int err = 0;
17910
17911         mutex_lock(&m->lock);
17912 +
17913 +       /* Don't assume *ppos is where we left it */
17914 +       if (unlikely(*ppos != m->read_pos)) {
17915 +               m->read_pos = *ppos;
17916 +               while ((err = traverse(m, *ppos)) == -EAGAIN)
17917 +                       ;
17918 +               if (err) {
17919 +                       /* With prejudice... */
17920 +                       m->read_pos = 0;
17921 +                       m->version = 0;
17922 +                       m->index = 0;
17923 +                       m->count = 0;
17924 +                       goto Done;
17925 +               }
17926 +       }
17927 +
17928         /*
17929          * seq_file->op->..m_start/m_stop/m_next may do special actions
17930          * or optimisations based on the file->f_version, so we want to
17931 @@ -172,8 +254,10 @@
17932  Done:
17933         if (!copied)
17934                 copied = err;
17935 -       else
17936 +       else {
17937                 *ppos += copied;
17938 +               m->read_pos += copied;
17939 +       }
17940         file->f_version = m->version;
17941         mutex_unlock(&m->lock);
17942         return copied;
17943 @@ -186,63 +270,6 @@
17944  }
17945  EXPORT_SYMBOL(seq_read);
17946
17947 -static int traverse(struct seq_file *m, loff_t offset)
17948 -{
17949 -       loff_t pos = 0, index;
17950 -       int error = 0;
17951 -       void *p;
17952 -
17953 -       m->version = 0;
17954 -       index = 0;
17955 -       m->count = m->from = 0;
17956 -       if (!offset) {
17957 -               m->index = index;
17958 -               return 0;
17959 -       }
17960 -       if (!m->buf) {
17961 -               m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
17962 -               if (!m->buf)
17963 -                       return -ENOMEM;
17964 -       }
17965 -       p = m->op->start(m, &index);
17966 -       while (p) {
17967 -               error = PTR_ERR(p);
17968 -               if (IS_ERR(p))
17969 -                       break;
17970 -               error = m->op->show(m, p);
17971 -               if (error < 0)
17972 -                       break;
17973 -               if (unlikely(error)) {
17974 -                       error = 0;
17975 -                       m->count = 0;
17976 -               }
17977 -               if (m->count == m->size)
17978 -                       goto Eoverflow;
17979 -               if (pos + m->count > offset) {
17980 -                       m->from = offset - pos;
17981 -                       m->count -= m->from;
17982 -                       m->index = index;
17983 -                       break;
17984 -               }
17985 -               pos += m->count;
17986 -               m->count = 0;
17987 -               if (pos == offset) {
17988 -                       index++;
17989 -                       m->index = index;
17990 -                       break;
17991 -               }
17992 -               p = m->op->next(m, p, &index);
17993 -       }
17994 -       m->op->stop(m, p);
17995 -       return error;
17996 -
17997 -Eoverflow:
17998 -       m->op->stop(m, p);
17999 -       kfree(m->buf);
18000 -       m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
18001 -       return !m->buf ? -ENOMEM : -EAGAIN;
18002 -}
18003 -
18004  /**
18005   *     seq_lseek -     ->llseek() method for sequential files.
18006   *     @file: the file in question
18007 @@ -265,16 +292,18 @@
18008                         if (offset < 0)
18009                                 break;
18010                         retval = offset;
18011 -                       if (offset != file->f_pos) {
18012 +                       if (offset != m->read_pos) {
18013                                 while ((retval=traverse(m, offset)) == -EAGAIN)
18014                                         ;
18015                                 if (retval) {
18016                                         /* with extreme prejudice... */
18017                                         file->f_pos = 0;
18018 +                                       m->read_pos = 0;
18019                                         m->version = 0;
18020                                         m->index = 0;
18021                                         m->count = 0;
18022                                 } else {
18023 +                                       m->read_pos = offset;
18024                                         retval = file->f_pos = offset;
18025                                 }
18026                         }
18027 --- kernel-power-2.6.28.orig/fs/signalfd.c
18028 +++ kernel-power-2.6.28/fs/signalfd.c
18029 @@ -205,8 +205,8 @@
18030         .read           = signalfd_read,
18031  };
18032
18033 -asmlinkage long sys_signalfd4(int ufd, sigset_t __user *user_mask,
18034 -                             size_t sizemask, int flags)
18035 +SYSCALL_DEFINE4(signalfd4, int, ufd, sigset_t __user *, user_mask,
18036 +               size_t, sizemask, int, flags)
18037  {
18038         sigset_t sigmask;
18039         struct signalfd_ctx *ctx;
18040 @@ -259,8 +259,8 @@
18041         return ufd;
18042  }
18043
18044 -asmlinkage long sys_signalfd(int ufd, sigset_t __user *user_mask,
18045 -                            size_t sizemask)
18046 +SYSCALL_DEFINE3(signalfd, int, ufd, sigset_t __user *, user_mask,
18047 +               size_t, sizemask)
18048  {
18049         return sys_signalfd4(ufd, user_mask, sizemask, 0);
18050  }
18051 --- kernel-power-2.6.28.orig/fs/smbfs/file.c
18052 +++ kernel-power-2.6.28/fs/smbfs/file.c
18053 @@ -297,7 +297,7 @@
18054                         struct page **pagep, void **fsdata)
18055  {
18056         pgoff_t index = pos >> PAGE_CACHE_SHIFT;
18057 -       *pagep = __grab_cache_page(mapping, index);
18058 +       *pagep = grab_cache_page_write_begin(mapping, index, flags);
18059         if (!*pagep)
18060                 return -ENOMEM;
18061         return 0;
18062 --- kernel-power-2.6.28.orig/fs/splice.c
18063 +++ kernel-power-2.6.28/fs/splice.c
18064 @@ -735,10 +735,19 @@
18065          * ->write_end. Most of the time, these expect i_mutex to
18066          * be held. Since this may result in an ABBA deadlock with
18067          * pipe->inode, we have to order lock acquiry here.
18068 +        *
18069 +        * Outer lock must be inode->i_mutex, as pipe_wait() will
18070 +        * release and reacquire pipe->inode->i_mutex, AND inode must
18071 +        * never be a pipe.
18072          */
18073 -       inode_double_lock(inode, pipe->inode);
18074 +       WARN_ON(S_ISFIFO(inode->i_mode));
18075 +       mutex_lock_nested(&inode->i_mutex, I_MUTEX_PARENT);
18076 +       if (pipe->inode)
18077 +               mutex_lock_nested(&pipe->inode->i_mutex, I_MUTEX_CHILD);
18078         ret = __splice_from_pipe(pipe, &sd, actor);
18079 -       inode_double_unlock(inode, pipe->inode);
18080 +       if (pipe->inode)
18081 +               mutex_unlock(&pipe->inode->i_mutex);
18082 +       mutex_unlock(&inode->i_mutex);
18083
18084         return ret;
18085  }
18086 @@ -829,11 +838,17 @@
18087         };
18088         ssize_t ret;
18089
18090 -       inode_double_lock(inode, pipe->inode);
18091 +       WARN_ON(S_ISFIFO(inode->i_mode));
18092 +       mutex_lock_nested(&inode->i_mutex, I_MUTEX_PARENT);
18093         ret = file_remove_suid(out);
18094 -       if (likely(!ret))
18095 +       if (likely(!ret)) {
18096 +               if (pipe->inode)
18097 +                       mutex_lock_nested(&pipe->inode->i_mutex, I_MUTEX_CHILD);
18098                 ret = __splice_from_pipe(pipe, &sd, pipe_to_file);
18099 -       inode_double_unlock(inode, pipe->inode);
18100 +               if (pipe->inode)
18101 +                       mutex_unlock(&pipe->inode->i_mutex);
18102 +       }
18103 +       mutex_unlock(&inode->i_mutex);
18104         if (ret > 0) {
18105                 unsigned long nr_pages;
18106
18107 @@ -1436,8 +1451,8 @@
18108   * Currently we punt and implement it as a normal copy, see pipe_to_user().
18109   *
18110   */
18111 -asmlinkage long sys_vmsplice(int fd, const struct iovec __user *iov,
18112 -                            unsigned long nr_segs, unsigned int flags)
18113 +SYSCALL_DEFINE4(vmsplice, int, fd, const struct iovec __user *, iov,
18114 +               unsigned long, nr_segs, unsigned int, flags)
18115  {
18116         struct file *file;
18117         long error;
18118 @@ -1462,9 +1477,9 @@
18119         return error;
18120  }
18121
18122 -asmlinkage long sys_splice(int fd_in, loff_t __user *off_in,
18123 -                          int fd_out, loff_t __user *off_out,
18124 -                          size_t len, unsigned int flags)
18125 +SYSCALL_DEFINE6(splice, int, fd_in, loff_t __user *, off_in,
18126 +               int, fd_out, loff_t __user *, off_out,
18127 +               size_t, len, unsigned int, flags)
18128  {
18129         long error;
18130         struct file *in, *out;
18131 @@ -1686,7 +1701,7 @@
18132         return ret;
18133  }
18134
18135 -asmlinkage long sys_tee(int fdin, int fdout, size_t len, unsigned int flags)
18136 +SYSCALL_DEFINE4(tee, int, fdin, int, fdout, size_t, len, unsigned int, flags)
18137  {
18138         struct file *in;
18139         int error, fput_in;
18140 --- kernel-power-2.6.28.orig/fs/stat.c
18141 +++ kernel-power-2.6.28/fs/stat.c
18142 @@ -152,7 +152,7 @@
18143         return copy_to_user(statbuf,&tmp,sizeof(tmp)) ? -EFAULT : 0;
18144  }
18145
18146 -asmlinkage long sys_stat(char __user * filename, struct __old_kernel_stat __user * statbuf)
18147 +SYSCALL_DEFINE2(stat, char __user *, filename, struct __old_kernel_stat __user *, statbuf)
18148  {
18149         struct kstat stat;
18150         int error = vfs_stat_fd(AT_FDCWD, filename, &stat);
18151 @@ -162,7 +162,8 @@
18152
18153         return error;
18154  }
18155 -asmlinkage long sys_lstat(char __user * filename, struct __old_kernel_stat __user * statbuf)
18156 +
18157 +SYSCALL_DEFINE2(lstat, char __user *, filename, struct __old_kernel_stat __user *, statbuf)
18158  {
18159         struct kstat stat;
18160         int error = vfs_lstat_fd(AT_FDCWD, filename, &stat);
18161 @@ -172,7 +173,8 @@
18162
18163         return error;
18164  }
18165 -asmlinkage long sys_fstat(unsigned int fd, struct __old_kernel_stat __user * statbuf)
18166 +
18167 +SYSCALL_DEFINE2(fstat, unsigned int, fd, struct __old_kernel_stat __user *, statbuf)
18168  {
18169         struct kstat stat;
18170         int error = vfs_fstat(fd, &stat);
18171 @@ -235,7 +237,7 @@
18172         return copy_to_user(statbuf,&tmp,sizeof(tmp)) ? -EFAULT : 0;
18173  }
18174
18175 -asmlinkage long sys_newstat(char __user *filename, struct stat __user *statbuf)
18176 +SYSCALL_DEFINE2(newstat, char __user *, filename, struct stat __user *, statbuf)
18177  {
18178         struct kstat stat;
18179         int error = vfs_stat_fd(AT_FDCWD, filename, &stat);
18180 @@ -246,7 +248,7 @@
18181         return error;
18182  }
18183
18184 -asmlinkage long sys_newlstat(char __user *filename, struct stat __user *statbuf)
18185 +SYSCALL_DEFINE2(newlstat, char __user *, filename, struct stat __user *, statbuf)
18186  {
18187         struct kstat stat;
18188         int error = vfs_lstat_fd(AT_FDCWD, filename, &stat);
18189 @@ -258,8 +260,8 @@
18190  }
18191
18192  #if !defined(__ARCH_WANT_STAT64) || defined(__ARCH_WANT_SYS_NEWFSTATAT)
18193 -asmlinkage long sys_newfstatat(int dfd, char __user *filename,
18194 -                               struct stat __user *statbuf, int flag)
18195 +SYSCALL_DEFINE4(newfstatat, int, dfd, char __user *, filename,
18196 +               struct stat __user *, statbuf, int, flag)
18197  {
18198         struct kstat stat;
18199         int error = -EINVAL;
18200 @@ -280,7 +282,7 @@
18201  }
18202  #endif
18203
18204 -asmlinkage long sys_newfstat(unsigned int fd, struct stat __user *statbuf)
18205 +SYSCALL_DEFINE2(newfstat, unsigned int, fd, struct stat __user *, statbuf)
18206  {
18207         struct kstat stat;
18208         int error = vfs_fstat(fd, &stat);
18209 @@ -291,8 +293,8 @@
18210         return error;
18211  }
18212
18213 -asmlinkage long sys_readlinkat(int dfd, const char __user *pathname,
18214 -                               char __user *buf, int bufsiz)
18215 +SYSCALL_DEFINE4(readlinkat, int, dfd, const char __user *, pathname,
18216 +               char __user *, buf, int, bufsiz)
18217  {
18218         struct path path;
18219         int error;
18220 @@ -318,8 +320,8 @@
18221         return error;
18222  }
18223
18224 -asmlinkage long sys_readlink(const char __user *path, char __user *buf,
18225 -                               int bufsiz)
18226 +SYSCALL_DEFINE3(readlink, const char __user *, path, char __user *, buf,
18227 +               int, bufsiz)
18228  {
18229         return sys_readlinkat(AT_FDCWD, path, buf, bufsiz);
18230  }
18231 @@ -365,7 +367,7 @@
18232         return copy_to_user(statbuf,&tmp,sizeof(tmp)) ? -EFAULT : 0;
18233  }
18234
18235 -asmlinkage long sys_stat64(char __user * filename, struct stat64 __user * statbuf)
18236 +SYSCALL_DEFINE2(stat64, char __user *, filename, struct stat64 __user *, statbuf)
18237  {
18238         struct kstat stat;
18239         int error = vfs_stat(filename, &stat);
18240 @@ -375,7 +377,8 @@
18241
18242         return error;
18243  }
18244 -asmlinkage long sys_lstat64(char __user * filename, struct stat64 __user * statbuf)
18245 +
18246 +SYSCALL_DEFINE2(lstat64, char __user *, filename, struct stat64 __user *, statbuf)
18247  {
18248         struct kstat stat;
18249         int error = vfs_lstat(filename, &stat);
18250 @@ -385,7 +388,8 @@
18251
18252         return error;
18253  }
18254 -asmlinkage long sys_fstat64(unsigned long fd, struct stat64 __user * statbuf)
18255 +
18256 +SYSCALL_DEFINE2(fstat64, unsigned long, fd, struct stat64 __user *, statbuf)
18257  {
18258         struct kstat stat;
18259         int error = vfs_fstat(fd, &stat);
18260 @@ -396,8 +400,8 @@
18261         return error;
18262  }
18263
18264 -asmlinkage long sys_fstatat64(int dfd, char __user *filename,
18265 -                              struct stat64 __user *statbuf, int flag)
18266 +SYSCALL_DEFINE4(fstatat64, int, dfd, char __user *, filename,
18267 +               struct stat64 __user *, statbuf, int, flag)
18268  {
18269         struct kstat stat;
18270         int error = -EINVAL;
18271 --- kernel-power-2.6.28.orig/fs/super.c
18272 +++ kernel-power-2.6.28/fs/super.c
18273 @@ -534,7 +534,7 @@
18274         return NULL;
18275  }
18276
18277 -asmlinkage long sys_ustat(unsigned dev, struct ustat __user * ubuf)
18278 +SYSCALL_DEFINE2(ustat, unsigned, dev, struct ustat __user *, ubuf)
18279  {
18280          struct super_block *s;
18281          struct ustat tmp;
18282 --- kernel-power-2.6.28.orig/fs/sync.c
18283 +++ kernel-power-2.6.28/fs/sync.c
18284 @@ -36,7 +36,7 @@
18285                 laptop_sync_completion();
18286  }
18287
18288 -asmlinkage long sys_sync(void)
18289 +SYSCALL_DEFINE0(sync)
18290  {
18291         do_sync(1);
18292         return 0;
18293 @@ -118,12 +118,12 @@
18294         return ret;
18295  }
18296
18297 -asmlinkage long sys_fsync(unsigned int fd)
18298 +SYSCALL_DEFINE1(fsync, unsigned int, fd)
18299  {
18300         return __do_fsync(fd, 0);
18301  }
18302
18303 -asmlinkage long sys_fdatasync(unsigned int fd)
18304 +SYSCALL_DEFINE1(fdatasync, unsigned int, fd)
18305  {
18306         return __do_fsync(fd, 1);
18307  }
18308 @@ -175,8 +175,8 @@
18309   * already-instantiated disk blocks, there are no guarantees here that the data
18310   * will be available after a crash.
18311   */
18312 -asmlinkage long sys_sync_file_range(int fd, loff_t offset, loff_t nbytes,
18313 -                                       unsigned int flags)
18314 +SYSCALL_DEFINE(sync_file_range)(int fd, loff_t offset, loff_t nbytes,
18315 +                               unsigned int flags)
18316  {
18317         int ret;
18318         struct file *file;
18319 @@ -236,14 +236,32 @@
18320  out:
18321         return ret;
18322  }
18323 +#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
18324 +asmlinkage long SyS_sync_file_range(long fd, loff_t offset, loff_t nbytes,
18325 +                                   long flags)
18326 +{
18327 +       return SYSC_sync_file_range((int) fd, offset, nbytes,
18328 +                                   (unsigned int) flags);
18329 +}
18330 +SYSCALL_ALIAS(sys_sync_file_range, SyS_sync_file_range);
18331 +#endif
18332
18333  /* It would be nice if people remember that not all the world's an i386
18334     when they introduce new system calls */
18335 -asmlinkage long sys_sync_file_range2(int fd, unsigned int flags,
18336 -                                    loff_t offset, loff_t nbytes)
18337 +SYSCALL_DEFINE(sync_file_range2)(int fd, unsigned int flags,
18338 +                                loff_t offset, loff_t nbytes)
18339  {
18340         return sys_sync_file_range(fd, offset, nbytes, flags);
18341  }
18342 +#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
18343 +asmlinkage long SyS_sync_file_range2(long fd, long flags,
18344 +                                    loff_t offset, loff_t nbytes)
18345 +{
18346 +       return SYSC_sync_file_range2((int) fd, (unsigned int) flags,
18347 +                                    offset, nbytes);
18348 +}
18349 +SYSCALL_ALIAS(sys_sync_file_range2, SyS_sync_file_range2);
18350 +#endif
18351
18352  /*
18353   * `endbyte' is inclusive
18354 @@ -269,7 +287,7 @@
18355
18356         if (flags & SYNC_FILE_RANGE_WRITE) {
18357                 ret = __filemap_fdatawrite_range(mapping, offset, endbyte,
18358 -                                               WB_SYNC_NONE);
18359 +                                               WB_SYNC_ALL);
18360                 if (ret < 0)
18361                         goto out;
18362         }
18363 --- kernel-power-2.6.28.orig/fs/sysfs/bin.c
18364 +++ kernel-power-2.6.28/fs/sysfs/bin.c
18365 @@ -63,6 +63,9 @@
18366         int count = min_t(size_t, bytes, PAGE_SIZE);
18367         char *temp;
18368
18369 +       if (!bytes)
18370 +               return 0;
18371 +
18372         if (size) {
18373                 if (offs > size)
18374                         return 0;
18375 @@ -131,6 +134,9 @@
18376         int count = min_t(size_t, bytes, PAGE_SIZE);
18377         char *temp;
18378
18379 +       if (!bytes)
18380 +               return 0;
18381 +
18382         if (size) {
18383                 if (offs > size)
18384                         return 0;
18385 --- kernel-power-2.6.28.orig/fs/timerfd.c
18386 +++ kernel-power-2.6.28/fs/timerfd.c
18387 @@ -177,7 +177,7 @@
18388         return file;
18389  }
18390
18391 -asmlinkage long sys_timerfd_create(int clockid, int flags)
18392 +SYSCALL_DEFINE2(timerfd_create, int, clockid, int, flags)
18393  {
18394         int ufd;
18395         struct timerfd_ctx *ctx;
18396 @@ -186,10 +186,9 @@
18397         BUILD_BUG_ON(TFD_CLOEXEC != O_CLOEXEC);
18398         BUILD_BUG_ON(TFD_NONBLOCK != O_NONBLOCK);
18399
18400 -       if (flags & ~(TFD_CLOEXEC | TFD_NONBLOCK))
18401 -               return -EINVAL;
18402 -       if (clockid != CLOCK_MONOTONIC &&
18403 -           clockid != CLOCK_REALTIME)
18404 +       if ((flags & ~TFD_CREATE_FLAGS) ||
18405 +           (clockid != CLOCK_MONOTONIC &&
18406 +            clockid != CLOCK_REALTIME))
18407                 return -EINVAL;
18408
18409         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
18410 @@ -201,16 +200,16 @@
18411         hrtimer_init(&ctx->tmr, clockid, HRTIMER_MODE_ABS);
18412
18413         ufd = anon_inode_getfd("[timerfd]", &timerfd_fops, ctx,
18414 -                              flags & (O_CLOEXEC | O_NONBLOCK));
18415 +                              flags & TFD_SHARED_FCNTL_FLAGS);
18416         if (ufd < 0)
18417                 kfree(ctx);
18418
18419         return ufd;
18420  }
18421
18422 -asmlinkage long sys_timerfd_settime(int ufd, int flags,
18423 -                                   const struct itimerspec __user *utmr,
18424 -                                   struct itimerspec __user *otmr)
18425 +SYSCALL_DEFINE4(timerfd_settime, int, ufd, int, flags,
18426 +               const struct itimerspec __user *, utmr,
18427 +               struct itimerspec __user *, otmr)
18428  {
18429         struct file *file;
18430         struct timerfd_ctx *ctx;
18431 @@ -219,7 +218,8 @@
18432         if (copy_from_user(&ktmr, utmr, sizeof(ktmr)))
18433                 return -EFAULT;
18434
18435 -       if (!timespec_valid(&ktmr.it_value) ||
18436 +       if ((flags & ~TFD_SETTIME_FLAGS) ||
18437 +           !timespec_valid(&ktmr.it_value) ||
18438             !timespec_valid(&ktmr.it_interval))
18439                 return -EINVAL;
18440
18441 @@ -265,7 +265,7 @@
18442         return 0;
18443  }
18444
18445 -asmlinkage long sys_timerfd_gettime(int ufd, struct itimerspec __user *otmr)
18446 +SYSCALL_DEFINE2(timerfd_gettime, int, ufd, struct itimerspec __user *, otmr)
18447  {
18448         struct file *file;
18449         struct timerfd_ctx *ctx;
18450 --- kernel-power-2.6.28.orig/fs/ubifs/file.c
18451 +++ kernel-power-2.6.28/fs/ubifs/file.c
18452 @@ -219,7 +219,8 @@
18453  }
18454
18455  static int write_begin_slow(struct address_space *mapping,
18456 -                           loff_t pos, unsigned len, struct page **pagep)
18457 +                           loff_t pos, unsigned len, struct page **pagep,
18458 +                           unsigned flags)
18459  {
18460         struct inode *inode = mapping->host;
18461         struct ubifs_info *c = inode->i_sb->s_fs_info;
18462 @@ -247,7 +248,7 @@
18463         if (unlikely(err))
18464                 return err;
18465
18466 -       page = __grab_cache_page(mapping, index);
18467 +       page = grab_cache_page_write_begin(mapping, index, flags);
18468         if (unlikely(!page)) {
18469                 ubifs_release_budget(c, &req);
18470                 return -ENOMEM;
18471 @@ -438,7 +439,7 @@
18472                 return -EROFS;
18473
18474         /* Try out the fast-path part first */
18475 -       page = __grab_cache_page(mapping, index);
18476 +       page = grab_cache_page_write_begin(mapping, index, flags);
18477         if (unlikely(!page))
18478                 return -ENOMEM;
18479
18480 @@ -492,7 +493,7 @@
18481                 unlock_page(page);
18482                 page_cache_release(page);
18483
18484 -               return write_begin_slow(mapping, pos, len, pagep);
18485 +               return write_begin_slow(mapping, pos, len, pagep, flags);
18486         }
18487
18488         /*
18489 --- kernel-power-2.6.28.orig/fs/utimes.c
18490 +++ kernel-power-2.6.28/fs/utimes.c
18491 @@ -24,7 +24,7 @@
18492   * must be owner or have write permission.
18493   * Else, update from *times, must be owner or super user.
18494   */
18495 -asmlinkage long sys_utime(char __user *filename, struct utimbuf __user *times)
18496 +SYSCALL_DEFINE2(utime, char __user *, filename, struct utimbuf __user *, times)
18497  {
18498         struct timespec tv[2];
18499
18500 @@ -170,7 +170,8 @@
18501         return error;
18502  }
18503
18504 -asmlinkage long sys_utimensat(int dfd, char __user *filename, struct timespec __user *utimes, int flags)
18505 +SYSCALL_DEFINE4(utimensat, int, dfd, char __user *, filename,
18506 +               struct timespec __user *, utimes, int, flags)
18507  {
18508         struct timespec tstimes[2];
18509
18510 @@ -187,7 +188,8 @@
18511         return do_utimes(dfd, filename, utimes ? tstimes : NULL, flags);
18512  }
18513
18514 -asmlinkage long sys_futimesat(int dfd, char __user *filename, struct timeval __user *utimes)
18515 +SYSCALL_DEFINE3(futimesat, int, dfd, char __user *, filename,
18516 +               struct timeval __user *, utimes)
18517  {
18518         struct timeval times[2];
18519         struct timespec tstimes[2];
18520 @@ -214,7 +216,8 @@
18521         return do_utimes(dfd, filename, utimes ? tstimes : NULL, 0);
18522  }
18523
18524 -asmlinkage long sys_utimes(char __user *filename, struct timeval __user *utimes)
18525 +SYSCALL_DEFINE2(utimes, char __user *, filename,
18526 +               struct timeval __user *, utimes)
18527  {
18528         return sys_futimesat(AT_FDCWD, filename, utimes);
18529  }
18530 --- kernel-power-2.6.28.orig/fs/xattr.c
18531 +++ kernel-power-2.6.28/fs/xattr.c
18532 @@ -251,9 +251,9 @@
18533         return error;
18534  }
18535
18536 -asmlinkage long
18537 -sys_setxattr(const char __user *pathname, const char __user *name,
18538 -            const void __user *value, size_t size, int flags)
18539 +SYSCALL_DEFINE5(setxattr, const char __user *, pathname,
18540 +               const char __user *, name, const void __user *, value,
18541 +               size_t, size, int, flags)
18542  {
18543         struct path path;
18544         int error;
18545 @@ -270,9 +270,9 @@
18546         return error;
18547  }
18548
18549 -asmlinkage long
18550 -sys_lsetxattr(const char __user *pathname, const char __user *name,
18551 -             const void __user *value, size_t size, int flags)
18552 +SYSCALL_DEFINE5(lsetxattr, const char __user *, pathname,
18553 +               const char __user *, name, const void __user *, value,
18554 +               size_t, size, int, flags)
18555  {
18556         struct path path;
18557         int error;
18558 @@ -289,9 +289,8 @@
18559         return error;
18560  }
18561
18562 -asmlinkage long
18563 -sys_fsetxattr(int fd, const char __user *name, const void __user *value,
18564 -             size_t size, int flags)
18565 +SYSCALL_DEFINE5(fsetxattr, int, fd, const char __user *, name,
18566 +               const void __user *,value, size_t, size, int, flags)
18567  {
18568         struct file *f;
18569         struct dentry *dentry;
18570 @@ -349,9 +348,8 @@
18571         return error;
18572  }
18573
18574 -asmlinkage ssize_t
18575 -sys_getxattr(const char __user *pathname, const char __user *name,
18576 -            void __user *value, size_t size)
18577 +SYSCALL_DEFINE4(getxattr, const char __user *, pathname,
18578 +               const char __user *, name, void __user *, value, size_t, size)
18579  {
18580         struct path path;
18581         ssize_t error;
18582 @@ -364,9 +362,8 @@
18583         return error;
18584  }
18585
18586 -asmlinkage ssize_t
18587 -sys_lgetxattr(const char __user *pathname, const char __user *name, void __user *value,
18588 -             size_t size)
18589 +SYSCALL_DEFINE4(lgetxattr, const char __user *, pathname,
18590 +               const char __user *, name, void __user *, value, size_t, size)
18591  {
18592         struct path path;
18593         ssize_t error;
18594 @@ -379,8 +376,8 @@
18595         return error;
18596  }
18597
18598 -asmlinkage ssize_t
18599 -sys_fgetxattr(int fd, const char __user *name, void __user *value, size_t size)
18600 +SYSCALL_DEFINE4(fgetxattr, int, fd, const char __user *, name,
18601 +               void __user *, value, size_t, size)
18602  {
18603         struct file *f;
18604         ssize_t error = -EBADF;
18605 @@ -424,8 +421,8 @@
18606         return error;
18607  }
18608
18609 -asmlinkage ssize_t
18610 -sys_listxattr(const char __user *pathname, char __user *list, size_t size)
18611 +SYSCALL_DEFINE3(listxattr, const char __user *, pathname, char __user *, list,
18612 +               size_t, size)
18613  {
18614         struct path path;
18615         ssize_t error;
18616 @@ -438,8 +435,8 @@
18617         return error;
18618  }
18619
18620 -asmlinkage ssize_t
18621 -sys_llistxattr(const char __user *pathname, char __user *list, size_t size)
18622 +SYSCALL_DEFINE3(llistxattr, const char __user *, pathname, char __user *, list,
18623 +               size_t, size)
18624  {
18625         struct path path;
18626         ssize_t error;
18627 @@ -452,8 +449,7 @@
18628         return error;
18629  }
18630
18631 -asmlinkage ssize_t
18632 -sys_flistxattr(int fd, char __user *list, size_t size)
18633 +SYSCALL_DEFINE3(flistxattr, int, fd, char __user *, list, size_t, size)
18634  {
18635         struct file *f;
18636         ssize_t error = -EBADF;
18637 @@ -485,8 +481,8 @@
18638         return vfs_removexattr(d, kname);
18639  }
18640
18641 -asmlinkage long
18642 -sys_removexattr(const char __user *pathname, const char __user *name)
18643 +SYSCALL_DEFINE2(removexattr, const char __user *, pathname,
18644 +               const char __user *, name)
18645  {
18646         struct path path;
18647         int error;
18648 @@ -503,8 +499,8 @@
18649         return error;
18650  }
18651
18652 -asmlinkage long
18653 -sys_lremovexattr(const char __user *pathname, const char __user *name)
18654 +SYSCALL_DEFINE2(lremovexattr, const char __user *, pathname,
18655 +               const char __user *, name)
18656  {
18657         struct path path;
18658         int error;
18659 @@ -521,8 +517,7 @@
18660         return error;
18661  }
18662
18663 -asmlinkage long
18664 -sys_fremovexattr(int fd, const char __user *name)
18665 +SYSCALL_DEFINE2(fremovexattr, int, fd, const char __user *, name)
18666  {
18667         struct file *f;
18668         struct dentry *dentry;
18669 --- kernel-power-2.6.28.orig/fs/xfs/linux-2.6/xfs_buf.c
18670 +++ kernel-power-2.6.28/fs/xfs/linux-2.6/xfs_buf.c
18671 @@ -1114,8 +1114,7 @@
18672         unsigned int            blocksize = bp->b_target->bt_bsize;
18673         struct bio_vec          *bvec = bio->bi_io_vec + bio->bi_vcnt - 1;
18674
18675 -       if (!test_bit(BIO_UPTODATE, &bio->bi_flags))
18676 -               bp->b_error = EIO;
18677 +       xfs_buf_ioerror(bp, -error);
18678
18679         do {
18680                 struct page     *page = bvec->bv_page;
18681 --- kernel-power-2.6.28.orig/fs/xfs/xfs_dir2_block.c
18682 +++ kernel-power-2.6.28/fs/xfs/xfs_dir2_block.c
18683 @@ -517,9 +517,9 @@
18684                 /*
18685                  * If it didn't fit, set the final offset to here & return.
18686                  */
18687 -               if (filldir(dirent, dep->name, dep->namelen, cook,
18688 +               if (filldir(dirent, dep->name, dep->namelen, cook & 0x7fffffff,
18689                             ino, DT_UNKNOWN)) {
18690 -                       *offset = cook;
18691 +                       *offset = cook & 0x7fffffff;
18692                         xfs_da_brelse(NULL, bp);
18693                         return 0;
18694                 }
18695 @@ -529,7 +529,8 @@
18696          * Reached the end of the block.
18697          * Set the offset to a non-existent block 1 and return.
18698          */
18699 -       *offset = xfs_dir2_db_off_to_dataptr(mp, mp->m_dirdatablk + 1, 0);
18700 +       *offset = xfs_dir2_db_off_to_dataptr(mp, mp->m_dirdatablk + 1, 0) &
18701 +                       0x7fffffff;
18702         xfs_da_brelse(NULL, bp);
18703         return 0;
18704  }
18705 --- kernel-power-2.6.28.orig/fs/xfs/xfs_dir2_leaf.c
18706 +++ kernel-power-2.6.28/fs/xfs/xfs_dir2_leaf.c
18707 @@ -1092,7 +1092,7 @@
18708                  * Won't fit.  Return to caller.
18709                  */
18710                 if (filldir(dirent, dep->name, dep->namelen,
18711 -                           xfs_dir2_byte_to_dataptr(mp, curoff),
18712 +                           xfs_dir2_byte_to_dataptr(mp, curoff) & 0x7fffffff,
18713                             ino, DT_UNKNOWN))
18714                         break;
18715
18716 @@ -1108,9 +1108,9 @@
18717          * All done.  Set output offset value to current offset.
18718          */
18719         if (curoff > xfs_dir2_dataptr_to_byte(mp, XFS_DIR2_MAX_DATAPTR))
18720 -               *offset = XFS_DIR2_MAX_DATAPTR;
18721 +               *offset = XFS_DIR2_MAX_DATAPTR & 0x7fffffff;
18722         else
18723 -               *offset = xfs_dir2_byte_to_dataptr(mp, curoff);
18724 +               *offset = xfs_dir2_byte_to_dataptr(mp, curoff) & 0x7fffffff;
18725         kmem_free(map);
18726         if (bp)
18727                 xfs_da_brelse(NULL, bp);
18728 --- kernel-power-2.6.28.orig/fs/xfs/xfs_dir2_sf.c
18729 +++ kernel-power-2.6.28/fs/xfs/xfs_dir2_sf.c
18730 @@ -752,8 +752,8 @@
18731  #if XFS_BIG_INUMS
18732                 ino += mp->m_inoadd;
18733  #endif
18734 -               if (filldir(dirent, ".", 1, dot_offset, ino, DT_DIR)) {
18735 -                       *offset = dot_offset;
18736 +               if (filldir(dirent, ".", 1, dot_offset & 0x7fffffff, ino, DT_DIR)) {
18737 +                       *offset = dot_offset & 0x7fffffff;
18738                         return 0;
18739                 }
18740         }
18741 @@ -766,8 +766,8 @@
18742  #if XFS_BIG_INUMS
18743                 ino += mp->m_inoadd;
18744  #endif
18745 -               if (filldir(dirent, "..", 2, dotdot_offset, ino, DT_DIR)) {
18746 -                       *offset = dotdot_offset;
18747 +               if (filldir(dirent, "..", 2, dotdot_offset & 0x7fffffff, ino, DT_DIR)) {
18748 +                       *offset = dotdot_offset & 0x7fffffff;
18749                         return 0;
18750                 }
18751         }
18752 @@ -791,14 +791,15 @@
18753  #endif
18754
18755                 if (filldir(dirent, sfep->name, sfep->namelen,
18756 -                                           off, ino, DT_UNKNOWN)) {
18757 -                       *offset = off;
18758 +                           off & 0x7fffffff, ino, DT_UNKNOWN)) {
18759 +                       *offset = off & 0x7fffffff;
18760                         return 0;
18761                 }
18762                 sfep = xfs_dir2_sf_nextentry(sfp, sfep);
18763         }
18764
18765 -       *offset = xfs_dir2_db_off_to_dataptr(mp, mp->m_dirdatablk + 1, 0);
18766 +       *offset = xfs_dir2_db_off_to_dataptr(mp, mp->m_dirdatablk + 1, 0) &
18767 +                       0x7fffffff;
18768         return 0;
18769  }
18770
18771 --- kernel-power-2.6.28.orig/include/acpi/pdc_intel.h
18772 +++ kernel-power-2.6.28/include/acpi/pdc_intel.h
18773 @@ -14,6 +14,7 @@
18774  #define ACPI_PDC_SMP_T_SWCOORD         (0x0080)
18775  #define ACPI_PDC_C_C1_FFH              (0x0100)
18776  #define ACPI_PDC_C_C2C3_FFH            (0x0200)
18777 +#define ACPI_PDC_SMP_P_HWCOORD         (0x0800)
18778
18779  #define ACPI_PDC_EST_CAPABILITY_SMP    (ACPI_PDC_SMP_C1PT | \
18780                                          ACPI_PDC_C_C1_HALT | \
18781 @@ -22,6 +23,7 @@
18782  #define ACPI_PDC_EST_CAPABILITY_SWSMP  (ACPI_PDC_SMP_C1PT | \
18783                                          ACPI_PDC_C_C1_HALT | \
18784                                          ACPI_PDC_SMP_P_SWCOORD | \
18785 +                                        ACPI_PDC_SMP_P_HWCOORD | \
18786                                          ACPI_PDC_P_FFH)
18787
18788  #define ACPI_PDC_C_CAPABILITY_SMP      (ACPI_PDC_SMP_C2C3  | \
18789 --- kernel-power-2.6.28.orig/include/drm/i915_drm.h
18790 +++ kernel-power-2.6.28/include/drm/i915_drm.h
18791 @@ -177,6 +177,8 @@
18792  #define DRM_IOCTL_I915_SET_VBLANK_PIPE DRM_IOW( DRM_COMMAND_BASE + DRM_I915_SET_VBLANK_PIPE, drm_i915_vblank_pipe_t)
18793  #define DRM_IOCTL_I915_GET_VBLANK_PIPE DRM_IOR( DRM_COMMAND_BASE + DRM_I915_GET_VBLANK_PIPE, drm_i915_vblank_pipe_t)
18794  #define DRM_IOCTL_I915_VBLANK_SWAP     DRM_IOWR(DRM_COMMAND_BASE + DRM_I915_VBLANK_SWAP, drm_i915_vblank_swap_t)
18795 +#define DRM_IOCTL_I915_GEM_INIT                DRM_IOW(DRM_COMMAND_BASE + DRM_I915_GEM_INIT, struct drm_i915_gem_init)
18796 +#define DRM_IOCTL_I915_GEM_EXECBUFFER  DRM_IOW(DRM_COMMAND_BASE + DRM_I915_GEM_EXECBUFFER, struct drm_i915_gem_execbuffer)
18797  #define DRM_IOCTL_I915_GEM_PIN         DRM_IOWR(DRM_COMMAND_BASE + DRM_I915_GEM_PIN, struct drm_i915_gem_pin)
18798  #define DRM_IOCTL_I915_GEM_UNPIN       DRM_IOW(DRM_COMMAND_BASE + DRM_I915_GEM_UNPIN, struct drm_i915_gem_unpin)
18799  #define DRM_IOCTL_I915_GEM_BUSY                DRM_IOWR(DRM_COMMAND_BASE + DRM_I915_GEM_BUSY, struct drm_i915_gem_busy)
18800 --- kernel-power-2.6.28.orig/include/linux/Kbuild
18801 +++ kernel-power-2.6.28/include/linux/Kbuild
18802 @@ -41,6 +41,7 @@
18803  header-y += bfs_fs.h
18804  header-y += blkpg.h
18805  header-y += bpqether.h
18806 +header-y += bsg.h
18807  header-y += can.h
18808  header-y += cdk.h
18809  header-y += chio.h
18810 @@ -91,7 +92,6 @@
18811  header-y += if_slip.h
18812  header-y += if_strip.h
18813  header-y += if_tun.h
18814 -header-y += if_tunnel.h
18815  header-y += in_route.h
18816  header-y += ioctl.h
18817  header-y += ip6_tunnel.h
18818 @@ -240,6 +240,7 @@
18819  unifdef-y += if_pppol2tp.h
18820  unifdef-y += if_pppox.h
18821  unifdef-y += if_tr.h
18822 +unifdef-y += if_tunnel.h
18823  unifdef-y += if_vlan.h
18824  unifdef-y += igmp.h
18825  unifdef-y += inet_diag.h
18826 --- kernel-power-2.6.28.orig/include/linux/ata.h
18827 +++ kernel-power-2.6.28/include/linux/ata.h
18828 @@ -731,12 +731,17 @@
18829
18830  static inline int ata_id_is_cfa(const u16 *id)
18831  {
18832 -       if (id[ATA_ID_CONFIG] == 0x848A)        /* Standard CF */
18833 +       if (id[ATA_ID_CONFIG] == 0x848A)        /* Traditional CF */
18834                 return 1;
18835 -       /* Could be CF hiding as standard ATA */
18836 -       if (ata_id_major_version(id) >= 3 &&
18837 -           id[ATA_ID_COMMAND_SET_1] != 0xFFFF &&
18838 -          (id[ATA_ID_COMMAND_SET_1] & (1 << 2)))
18839 +       /*
18840 +        * CF specs don't require specific value in the word 0 anymore and yet
18841 +        * they forbid to report the ATA version in the word 80 and require the
18842 +        * CFA feature set support to be indicated in the word 83 in this case.
18843 +        * Unfortunately, some cards only follow either of this requirements,
18844 +        * and while those that don't indicate CFA feature support need some
18845 +        * sort of quirk list, it seems impractical for the ones that do...
18846 +        */
18847 +       if ((id[ATA_ID_COMMAND_SET_2] & 0xC004) == 0x4004)
18848                 return 1;
18849         return 0;
18850  }
18851 --- kernel-power-2.6.28.orig/include/linux/capability.h
18852 +++ kernel-power-2.6.28/include/linux/capability.h
18853 @@ -366,7 +366,21 @@
18854  #define CAP_FOR_EACH_U32(__capi)  \
18855         for (__capi = 0; __capi < _KERNEL_CAPABILITY_U32S; ++__capi)
18856
18857 +/*
18858 + * CAP_FS_MASK and CAP_NFSD_MASKS:
18859 + *
18860 + * The fs mask is all the privileges that fsuid==0 historically meant.
18861 + * At one time in the past, that included CAP_MKNOD and CAP_LINUX_IMMUTABLE.
18862 + *
18863 + * It has never meant setting security.* and trusted.* xattrs.
18864 + *
18865 + * We could also define fsmask as follows:
18866 + *   1. CAP_FS_MASK is the privilege to bypass all fs-related DAC permissions
18867 + *   2. The security.* and trusted.* xattrs are fs-related MAC permissions
18868 + */
18869 +
18870  # define CAP_FS_MASK_B0     (CAP_TO_MASK(CAP_CHOWN)            \
18871 +                           | CAP_TO_MASK(CAP_MKNOD)            \
18872                             | CAP_TO_MASK(CAP_DAC_OVERRIDE)     \
18873                             | CAP_TO_MASK(CAP_DAC_READ_SEARCH)  \
18874                             | CAP_TO_MASK(CAP_FOWNER)           \
18875 @@ -381,9 +395,12 @@
18876  # define CAP_EMPTY_SET    ((kernel_cap_t){{ 0, 0 }})
18877  # define CAP_FULL_SET     ((kernel_cap_t){{ ~0, ~0 }})
18878  # define CAP_INIT_EFF_SET ((kernel_cap_t){{ ~CAP_TO_MASK(CAP_SETPCAP), ~0 }})
18879 -# define CAP_FS_SET       ((kernel_cap_t){{ CAP_FS_MASK_B0, CAP_FS_MASK_B1 } })
18880 -# define CAP_NFSD_SET     ((kernel_cap_t){{ CAP_FS_MASK_B0|CAP_TO_MASK(CAP_SYS_RESOURCE), \
18881 -                                       CAP_FS_MASK_B1 } })
18882 +# define CAP_FS_SET       ((kernel_cap_t){{ CAP_FS_MASK_B0 \
18883 +                                   | CAP_TO_MASK(CAP_LINUX_IMMUTABLE), \
18884 +                                   CAP_FS_MASK_B1 } })
18885 +# define CAP_NFSD_SET     ((kernel_cap_t){{ CAP_FS_MASK_B0 \
18886 +                                   | CAP_TO_MASK(CAP_SYS_RESOURCE), \
18887 +                                   CAP_FS_MASK_B1 } })
18888
18889  #endif /* _KERNEL_CAPABILITY_U32S != 2 */
18890
18891 --- kernel-power-2.6.28.orig/include/linux/compat.h
18892 +++ kernel-power-2.6.28/include/linux/compat.h
18893 @@ -280,5 +280,18 @@
18894  asmlinkage long compat_sys_timerfd_gettime(int ufd,
18895                                    struct compat_itimerspec __user *otmr);
18896
18897 +asmlinkage long compat_sys_move_pages(pid_t pid, unsigned long nr_page,
18898 +                                     __u32 __user *pages,
18899 +                                     const int __user *nodes,
18900 +                                     int __user *status,
18901 +                                     int flags);
18902 +asmlinkage long compat_sys_futimesat(unsigned int dfd, char __user *filename,
18903 +                                    struct compat_timeval __user *t);
18904 +asmlinkage long compat_sys_newfstatat(unsigned int dfd, char __user * filename,
18905 +                                     struct compat_stat __user *statbuf,
18906 +                                     int flag);
18907 +asmlinkage long compat_sys_openat(unsigned int dfd, const char __user *filename,
18908 +                                 int flags, int mode);
18909 +
18910  #endif /* CONFIG_COMPAT */
18911  #endif /* _LINUX_COMPAT_H */
18912 --- kernel-power-2.6.28.orig/include/linux/fs.h
18913 +++ kernel-power-2.6.28/include/linux/fs.h
18914 @@ -63,24 +63,30 @@
18915  #define MAY_ACCESS 16
18916  #define MAY_OPEN 32
18917
18918 +/*
18919 + * flags in file.f_mode.  Note that FMODE_READ and FMODE_WRITE must correspond
18920 + * to O_WRONLY and O_RDWR via the strange trick in __dentry_open()
18921 + */
18922 +
18923  /* file is open for reading */
18924  #define FMODE_READ             ((__force fmode_t)1)
18925  /* file is open for writing */
18926  #define FMODE_WRITE            ((__force fmode_t)2)
18927  /* file is seekable */
18928  #define FMODE_LSEEK            ((__force fmode_t)4)
18929 -/* file can be accessed using pread/pwrite */
18930 +/* file can be accessed using pread */
18931  #define FMODE_PREAD            ((__force fmode_t)8)
18932 -#define FMODE_PWRITE           FMODE_PREAD     /* These go hand in hand */
18933 +/* file can be accessed using pwrite */
18934 +#define FMODE_PWRITE           ((__force fmode_t)16)
18935  /* File is opened for execution with sys_execve / sys_uselib */
18936 -#define FMODE_EXEC             ((__force fmode_t)16)
18937 +#define FMODE_EXEC             ((__force fmode_t)32)
18938  /* File is opened with O_NDELAY (only set for block devices) */
18939 -#define FMODE_NDELAY           ((__force fmode_t)32)
18940 +#define FMODE_NDELAY           ((__force fmode_t)64)
18941  /* File is opened with O_EXCL (only set for block devices) */
18942 -#define FMODE_EXCL             ((__force fmode_t)64)
18943 +#define FMODE_EXCL             ((__force fmode_t)128)
18944  /* File is opened using open(.., 3, ..) and is writeable only for ioctls
18945     (specialy hack for floppy.c) */
18946 -#define FMODE_WRITE_IOCTL      ((__force fmode_t)128)
18947 +#define FMODE_WRITE_IOCTL      ((__force fmode_t)256)
18948
18949  #define RW_MASK                1
18950  #define RWA_MASK       2
18951 @@ -414,6 +420,9 @@
18952
18953  #define AOP_FLAG_UNINTERRUPTIBLE       0x0001 /* will not do a short write */
18954  #define AOP_FLAG_CONT_EXPAND           0x0002 /* called from cont_expand */
18955 +#define AOP_FLAG_NOFS                  0x0004 /* used by filesystem to direct
18956 +                                               * helper code (eg buffer layer)
18957 +                                               * to clear GFP_FS from alloc */
18958
18959  /*
18960   * oh the beauties of C type declarations.
18961 @@ -1121,7 +1130,6 @@
18962         struct rw_semaphore     s_umount;
18963         struct mutex            s_lock;
18964         int                     s_count;
18965 -       int                     s_syncing;
18966         int                     s_need_sync_fs;
18967         atomic_t                s_active;
18968  #ifdef CONFIG_SECURITY
18969 @@ -2036,7 +2044,7 @@
18970  extern void *page_follow_link_light(struct dentry *, struct nameidata *);
18971  extern void page_put_link(struct dentry *, struct nameidata *, void *);
18972  extern int __page_symlink(struct inode *inode, const char *symname, int len,
18973 -               gfp_t gfp_mask);
18974 +               int nofs);
18975  extern int page_symlink(struct inode *inode, const char *symname, int len);
18976  extern const struct inode_operations page_symlink_inode_operations;
18977  extern int generic_readlink(struct dentry *, char __user *, int);
18978 --- kernel-power-2.6.28.orig/include/linux/genhd.h
18979 +++ kernel-power-2.6.28/include/linux/genhd.h
18980 @@ -213,6 +213,7 @@
18981  #define DISK_PITER_REVERSE     (1 << 0) /* iterate in the reverse direction */
18982  #define DISK_PITER_INCL_EMPTY  (1 << 1) /* include 0-sized parts */
18983  #define DISK_PITER_INCL_PART0  (1 << 2) /* include partition 0 */
18984 +#define DISK_PITER_INCL_EMPTY_PART0 (1 << 3) /* include empty partition 0 */
18985
18986  struct disk_part_iter {
18987         struct gendisk          *disk;
18988 --- kernel-power-2.6.28.orig/include/linux/if_tunnel.h
18989 +++ kernel-power-2.6.28/include/linux/if_tunnel.h
18990 @@ -2,7 +2,10 @@
18991  #define _IF_TUNNEL_H_
18992
18993  #include <linux/types.h>
18994 +
18995 +#ifdef __KERNEL__
18996  #include <linux/ip.h>
18997 +#endif
18998
18999  #define SIOCGETTUNNEL   (SIOCDEVPRIVATE + 0)
19000  #define SIOCADDTUNNEL   (SIOCDEVPRIVATE + 1)
19001 --- kernel-power-2.6.28.orig/include/linux/jbd2.h
19002 +++ kernel-power-2.6.28/include/linux/jbd2.h
19003 @@ -308,7 +308,8 @@
19004                 int val = (expr);                                            \
19005                 if (!val) {                                                  \
19006                         printk(KERN_ERR                                      \
19007 -                               "EXT3-fs unexpected failure: %s;\n",# expr); \
19008 +                              "JBD2 unexpected failure: %s: %s;\n",         \
19009 +                              __func__, #expr);                             \
19010                         printk(KERN_ERR why "\n");                           \
19011                 }                                                            \
19012                 val;                                                         \
19013 @@ -329,6 +330,7 @@
19014         BH_State,               /* Pins most journal_head state */
19015         BH_JournalHead,         /* Pins bh->b_private and jh->b_bh */
19016         BH_Unshadow,            /* Dummy bit, for BJ_Shadow wakeup filtering */
19017 +       BH_JBDPrivateStart,     /* First bit available for private use by FS */
19018  };
19019
19020  BUFFER_FNS(JBD, jbd)
19021 @@ -1085,7 +1087,8 @@
19022  extern int        jbd2_journal_bmap(journal_t *, unsigned long, unsigned long long *);
19023  extern int        jbd2_journal_force_commit(journal_t *);
19024  extern int        jbd2_journal_file_inode(handle_t *handle, struct jbd2_inode *inode);
19025 -extern int        jbd2_journal_begin_ordered_truncate(struct jbd2_inode *inode, loff_t new_size);
19026 +extern int        jbd2_journal_begin_ordered_truncate(journal_t *journal,
19027 +                               struct jbd2_inode *inode, loff_t new_size);
19028  extern void       jbd2_journal_init_jbd_inode(struct jbd2_inode *jinode, struct inode *inode);
19029  extern void       jbd2_journal_release_jbd_inode(journal_t *journal, struct jbd2_inode *jinode);
19030
19031 --- kernel-power-2.6.28.orig/include/linux/klist.h
19032 +++ kernel-power-2.6.28/include/linux/klist.h
19033 @@ -23,7 +23,7 @@
19034         struct list_head        k_list;
19035         void                    (*get)(struct klist_node *);
19036         void                    (*put)(struct klist_node *);
19037 -};
19038 +} __attribute__ ((aligned (4)));
19039
19040  #define KLIST_INIT(_name, _get, _put)                                  \
19041         { .k_lock       = __SPIN_LOCK_UNLOCKED(_name.k_lock),           \
19042 --- kernel-power-2.6.28.orig/include/linux/kvm.h
19043 +++ kernel-power-2.6.28/include/linux/kvm.h
19044 @@ -387,6 +387,8 @@
19045  #define KVM_CAP_DEVICE_ASSIGNMENT 17
19046  #endif
19047  #define KVM_CAP_IOMMU 18
19048 +/* Bug in KVM_SET_USER_MEMORY_REGION fixed: */
19049 +#define KVM_CAP_DESTROY_MEMORY_REGION_WORKS 21
19050
19051  /*
19052   * ioctls for VM fds
19053 --- kernel-power-2.6.28.orig/include/linux/mm.h
19054 +++ kernel-power-2.6.28/include/linux/mm.h
19055 @@ -253,7 +253,6 @@
19056   */
19057  static inline int get_page_unless_zero(struct page *page)
19058  {
19059 -       VM_BUG_ON(PageTail(page));
19060         return atomic_inc_not_zero(&page->_count);
19061  }
19062
19063 @@ -1028,10 +1027,23 @@
19064  typedef int (*work_fn_t)(unsigned long, unsigned long, void *);
19065  extern void work_with_active_regions(int nid, work_fn_t work_fn, void *data);
19066  extern void sparse_memory_present_with_active_regions(int nid);
19067 -#ifndef CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID
19068 -extern int early_pfn_to_nid(unsigned long pfn);
19069 -#endif /* CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID */
19070  #endif /* CONFIG_ARCH_POPULATES_NODE_MAP */
19071 +
19072 +#if !defined(CONFIG_ARCH_POPULATES_NODE_MAP) && \
19073 +    !defined(CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID)
19074 +static inline int __early_pfn_to_nid(unsigned long pfn)
19075 +{
19076 +       return 0;
19077 +}
19078 +#else
19079 +/* please see mm/page_alloc.c */
19080 +extern int __meminit early_pfn_to_nid(unsigned long pfn);
19081 +#ifdef CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID
19082 +/* there is a per-arch backend function. */
19083 +extern int __meminit __early_pfn_to_nid(unsigned long pfn);
19084 +#endif /* CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID */
19085 +#endif
19086 +
19087  extern void set_dma_reserve(unsigned long new_dma_reserve);
19088  extern void memmap_init_zone(unsigned long, int, unsigned long,
19089                                 unsigned long, enum memmap_context);
19090 --- kernel-power-2.6.28.orig/include/linux/mmzone.h
19091 +++ kernel-power-2.6.28/include/linux/mmzone.h
19092 @@ -1067,7 +1067,7 @@
19093  #endif /* CONFIG_SPARSEMEM */
19094
19095  #ifdef CONFIG_NODES_SPAN_OTHER_NODES
19096 -#define early_pfn_in_nid(pfn, nid)     (early_pfn_to_nid(pfn) == (nid))
19097 +bool early_pfn_in_nid(unsigned long pfn, int nid);
19098  #else
19099  #define early_pfn_in_nid(pfn, nid)     (1)
19100  #endif
19101 --- kernel-power-2.6.28.orig/include/linux/mod_devicetable.h
19102 +++ kernel-power-2.6.28/include/linux/mod_devicetable.h
19103 @@ -443,6 +443,13 @@
19104         struct dmi_strmatch matches[4];
19105         void *driver_data;
19106  };
19107 +/*
19108 + * struct dmi_device_id appears during expansion of
19109 + * "MODULE_DEVICE_TABLE(dmi, x)". Compiler doesn't look inside it
19110 + * but this is enough for gcc 3.4.6 to error out:
19111 + *     error: storage size of '__mod_dmi_device_table' isn't known
19112 + */
19113 +#define dmi_device_id dmi_system_id
19114  #endif
19115
19116  #define DMI_MATCH(a, b)        { a, b }
19117 --- kernel-power-2.6.28.orig/include/linux/module.h
19118 +++ kernel-power-2.6.28/include/linux/module.h
19119 @@ -391,7 +391,6 @@
19120  static inline void __module_get(struct module *module)
19121  {
19122         if (module) {
19123 -               BUG_ON(module_refcount(module) == 0);
19124                 local_inc(&module->ref[get_cpu()].count);
19125                 put_cpu();
19126         }
19127 --- kernel-power-2.6.28.orig/include/linux/pagemap.h
19128 +++ kernel-power-2.6.28/include/linux/pagemap.h
19129 @@ -18,9 +18,14 @@
19130   * Bits in mapping->flags.  The lower __GFP_BITS_SHIFT bits are the page
19131   * allocation mode flags.
19132   */
19133 -#define        AS_EIO          (__GFP_BITS_SHIFT + 0)  /* IO error on async write */
19134 -#define AS_ENOSPC      (__GFP_BITS_SHIFT + 1)  /* ENOSPC on async write */
19135 -#define AS_MM_ALL_LOCKS        (__GFP_BITS_SHIFT + 2)  /* under mm_take_all_locks() */
19136 +enum mapping_flags {
19137 +       AS_EIO          = __GFP_BITS_SHIFT + 0, /* IO error on async write */
19138 +       AS_ENOSPC       = __GFP_BITS_SHIFT + 1, /* ENOSPC on async write */
19139 +       AS_MM_ALL_LOCKS = __GFP_BITS_SHIFT + 2, /* under mm_take_all_locks() */
19140 +#ifdef CONFIG_UNEVICTABLE_LRU
19141 +       AS_UNEVICTABLE  = __GFP_BITS_SHIFT + 3, /* e.g., ramdisk, SHM_LOCK */
19142 +#endif
19143 +};
19144
19145  static inline void mapping_set_error(struct address_space *mapping, int error)
19146  {
19147 @@ -33,7 +38,6 @@
19148  }
19149
19150  #ifdef CONFIG_UNEVICTABLE_LRU
19151 -#define AS_UNEVICTABLE (__GFP_BITS_SHIFT + 2)  /* e.g., ramdisk, SHM_LOCK */
19152
19153  static inline void mapping_set_unevictable(struct address_space *mapping)
19154  {
19155 @@ -241,7 +245,8 @@
19156  unsigned find_get_pages_tag(struct address_space *mapping, pgoff_t *index,
19157                         int tag, unsigned int nr_pages, struct page **pages);
19158
19159 -struct page *__grab_cache_page(struct address_space *mapping, pgoff_t index);
19160 +struct page *grab_cache_page_write_begin(struct address_space *mapping,
19161 +                       pgoff_t index, unsigned flags);
19162
19163  /*
19164   * Returns locked page at given index in given cache, creating it if needed.
19165 --- kernel-power-2.6.28.orig/include/linux/pci.h
19166 +++ kernel-power-2.6.28/include/linux/pci.h
19167 @@ -651,7 +651,7 @@
19168  void pci_disable_rom(struct pci_dev *pdev);
19169  void __iomem __must_check *pci_map_rom(struct pci_dev *pdev, size_t *size);
19170  void pci_unmap_rom(struct pci_dev *pdev, void __iomem *rom);
19171 -size_t pci_get_rom_size(void __iomem *rom, size_t size);
19172 +size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size);
19173
19174  /* Power management related routines */
19175  int pci_save_state(struct pci_dev *dev);
19176 --- kernel-power-2.6.28.orig/include/linux/pci_ids.h
19177 +++ kernel-power-2.6.28/include/linux/pci_ids.h
19178 @@ -1312,6 +1312,7 @@
19179  #define PCI_DEVICE_ID_VIA_VT3351       0x0351
19180  #define PCI_DEVICE_ID_VIA_VT3364       0x0364
19181  #define PCI_DEVICE_ID_VIA_8371_0       0x0391
19182 +#define PCI_DEVICE_ID_VIA_6415         0x0415
19183  #define PCI_DEVICE_ID_VIA_8501_0       0x0501
19184  #define PCI_DEVICE_ID_VIA_82C561       0x0561
19185  #define PCI_DEVICE_ID_VIA_82C586_1     0x0571
19186 @@ -1357,6 +1358,7 @@
19187  #define PCI_DEVICE_ID_VIA_8783_0       0x3208
19188  #define PCI_DEVICE_ID_VIA_8237         0x3227
19189  #define PCI_DEVICE_ID_VIA_8251         0x3287
19190 +#define PCI_DEVICE_ID_VIA_8261         0x3402
19191  #define PCI_DEVICE_ID_VIA_8237A                0x3337
19192  #define PCI_DEVICE_ID_VIA_8237S                0x3372
19193  #define PCI_DEVICE_ID_VIA_SATA_EIDE    0x5324
19194 @@ -1366,10 +1368,13 @@
19195  #define PCI_DEVICE_ID_VIA_CX700                0x8324
19196  #define PCI_DEVICE_ID_VIA_CX700_IDE    0x0581
19197  #define PCI_DEVICE_ID_VIA_VX800                0x8353
19198 +#define PCI_DEVICE_ID_VIA_VX855                0x8409
19199  #define PCI_DEVICE_ID_VIA_8371_1       0x8391
19200  #define PCI_DEVICE_ID_VIA_82C598_1     0x8598
19201  #define PCI_DEVICE_ID_VIA_838X_1       0xB188
19202  #define PCI_DEVICE_ID_VIA_83_87XX_1    0xB198
19203 +#define PCI_DEVICE_ID_VIA_C409_IDE     0XC409
19204 +#define PCI_DEVICE_ID_VIA_ANON         0xFFFF
19205
19206  #define PCI_VENDOR_ID_SIEMENS           0x110A
19207  #define PCI_DEVICE_ID_SIEMENS_DSCC4     0x2102
19208 @@ -1440,6 +1445,7 @@
19209  #define PCI_DEVICE_ID_DIGI_DF_M_E      0x0071
19210  #define PCI_DEVICE_ID_DIGI_DF_M_IOM2_A 0x0072
19211  #define PCI_DEVICE_ID_DIGI_DF_M_A      0x0073
19212 +#define PCI_DEVICE_ID_DIGI_NEO_8       0x00B1
19213  #define PCI_DEVICE_ID_NEO_2DB9          0x00C8
19214  #define PCI_DEVICE_ID_NEO_2DB9PRI       0x00C9
19215  #define PCI_DEVICE_ID_NEO_2RJ45         0x00CA
19216 @@ -1766,6 +1772,7 @@
19217  #define PCI_DEVICE_ID_SIIG_8S_20x_650  0x2081
19218  #define PCI_DEVICE_ID_SIIG_8S_20x_850  0x2082
19219  #define PCI_SUBDEVICE_ID_SIIG_QUARTET_SERIAL   0x2050
19220 +#define PCI_SUBDEVICE_ID_SIIG_DUAL_SERIAL      0x2530
19221
19222  #define PCI_VENDOR_ID_RADISYS          0x1331
19223
19224 @@ -1795,6 +1802,7 @@
19225  #define PCI_DEVICE_ID_SEALEVEL_UCOMM232        0x7202
19226  #define PCI_DEVICE_ID_SEALEVEL_COMM4   0x7401
19227  #define PCI_DEVICE_ID_SEALEVEL_COMM8   0x7801
19228 +#define PCI_DEVICE_ID_SEALEVEL_7803    0x7803
19229  #define PCI_DEVICE_ID_SEALEVEL_UCOMM8  0x7804
19230
19231  #define PCI_VENDOR_ID_HYPERCOPE                0x1365
19232 @@ -2171,6 +2179,7 @@
19233  #define PCI_DEVICE_ID_RDC_R6040                0x6040
19234  #define PCI_DEVICE_ID_RDC_R6060                0x6060
19235  #define PCI_DEVICE_ID_RDC_R6061                0x6061
19236 +#define PCI_DEVICE_ID_RDC_D1010                0x1010
19237
19238  #define PCI_VENDOR_ID_LENOVO           0x17aa
19239
19240 @@ -2309,6 +2318,9 @@
19241  #define PCI_DEVICE_ID_INTEL_82378      0x0484
19242  #define PCI_DEVICE_ID_INTEL_I960       0x0960
19243  #define PCI_DEVICE_ID_INTEL_I960RM     0x0962
19244 +#define PCI_DEVICE_ID_INTEL_8257X_SOL  0x1062
19245 +#define PCI_DEVICE_ID_INTEL_82573E_SOL 0x1085
19246 +#define PCI_DEVICE_ID_INTEL_82573L_SOL 0x108F
19247  #define PCI_DEVICE_ID_INTEL_82815_MC   0x1130
19248  #define PCI_DEVICE_ID_INTEL_82815_CGC  0x1132
19249  #define PCI_DEVICE_ID_INTEL_82092AA_0  0x1221
19250 @@ -2412,6 +2424,7 @@
19251  #define PCI_DEVICE_ID_INTEL_ICH7_0     0x27b8
19252  #define PCI_DEVICE_ID_INTEL_ICH7_1     0x27b9
19253  #define PCI_DEVICE_ID_INTEL_ICH7_30    0x27b0
19254 +#define PCI_DEVICE_ID_INTEL_TGP_LPC    0x27bc
19255  #define PCI_DEVICE_ID_INTEL_ICH7_31    0x27bd
19256  #define PCI_DEVICE_ID_INTEL_ICH7_17    0x27da
19257  #define PCI_DEVICE_ID_INTEL_ICH7_19    0x27dd
19258 --- kernel-power-2.6.28.orig/include/linux/pci_regs.h
19259 +++ kernel-power-2.6.28/include/linux/pci_regs.h
19260 @@ -234,7 +234,7 @@
19261  #define  PCI_PM_CAP_PME_SHIFT  11      /* Start of the PME Mask in PMC */
19262  #define PCI_PM_CTRL            4       /* PM control and status register */
19263  #define  PCI_PM_CTRL_STATE_MASK        0x0003  /* Current power state (D0 to D3) */
19264 -#define  PCI_PM_CTRL_NO_SOFT_RESET     0x0004  /* No reset for D3hot->D0 */
19265 +#define  PCI_PM_CTRL_NO_SOFT_RESET     0x0008  /* No reset for D3hot->D0 */
19266  #define  PCI_PM_CTRL_PME_ENABLE        0x0100  /* PME pin enable */
19267  #define  PCI_PM_CTRL_DATA_SEL_MASK     0x1e00  /* Data select (??) */
19268  #define  PCI_PM_CTRL_DATA_SCALE_MASK   0x6000  /* Data scale (??) */
19269 --- kernel-power-2.6.28.orig/include/linux/pid.h
19270 +++ kernel-power-2.6.28/include/linux/pid.h
19271 @@ -123,6 +123,24 @@
19272  extern void free_pid(struct pid *pid);
19273
19274  /*
19275 + * ns_of_pid() returns the pid namespace in which the specified pid was
19276 + * allocated.
19277 + *
19278 + * NOTE:
19279 + *     ns_of_pid() is expected to be called for a process (task) that has
19280 + *     an attached 'struct pid' (see attach_pid(), detach_pid()) i.e @pid
19281 + *     is expected to be non-NULL. If @pid is NULL, caller should handle
19282 + *     the resulting NULL pid-ns.
19283 + */
19284 +static inline struct pid_namespace *ns_of_pid(struct pid *pid)
19285 +{
19286 +       struct pid_namespace *ns = NULL;
19287 +       if (pid)
19288 +               ns = pid->numbers[pid->level].ns;
19289 +       return ns;
19290 +}
19291 +
19292 +/*
19293   * the helpers to get the pid's id seen from different namespaces
19294   *
19295   * pid_nr()    : global id, i.e. the id seen from the init namespace;
19296 --- kernel-power-2.6.28.orig/include/linux/radix-tree.h
19297 +++ kernel-power-2.6.28/include/linux/radix-tree.h
19298 @@ -136,7 +136,7 @@
19299   */
19300  static inline void *radix_tree_deref_slot(void **pslot)
19301  {
19302 -       void *ret = *pslot;
19303 +       void *ret = rcu_dereference(*pslot);
19304         if (unlikely(radix_tree_is_indirect_ptr(ret)))
19305                 ret = RADIX_TREE_RETRY;
19306         return ret;
19307 --- kernel-power-2.6.28.orig/include/linux/raid/md_k.h
19308 +++ kernel-power-2.6.28/include/linux/raid/md_k.h
19309 @@ -245,6 +245,8 @@
19310                                                          * file in sysfs.
19311                                                          */
19312
19313 +       struct work_struct del_work;    /* used for delayed sysfs removal */
19314 +
19315         spinlock_t                      write_lock;
19316         wait_queue_head_t               sb_wait;        /* for waiting on superblock updates */
19317         atomic_t                        pending_writes; /* number of active superblock writes */
19318 --- kernel-power-2.6.28.orig/include/linux/sched.h
19319 +++ kernel-power-2.6.28/include/linux/sched.h
19320 @@ -201,7 +201,8 @@
19321  #define task_is_stopped_or_traced(task)        \
19322                         ((task->state & (__TASK_STOPPED | __TASK_TRACED)) != 0)
19323  #define task_contributes_to_load(task) \
19324 -                               ((task->state & TASK_UNINTERRUPTIBLE) != 0)
19325 +                               ((task->state & TASK_UNINTERRUPTIBLE) != 0 && \
19326 +                                (task->flags & PF_FROZEN) == 0)
19327
19328  #define __set_task_state(tsk, state_value)             \
19329         do { (tsk)->state = (state_value); } while (0)
19330 --- kernel-power-2.6.28.orig/include/linux/seq_file.h
19331 +++ kernel-power-2.6.28/include/linux/seq_file.h
19332 @@ -19,6 +19,7 @@
19333         size_t from;
19334         size_t count;
19335         loff_t index;
19336 +       loff_t read_pos;
19337         u64 version;
19338         struct mutex lock;
19339         const struct seq_operations *op;
19340 --- kernel-power-2.6.28.orig/include/linux/serial_core.h
19341 +++ kernel-power-2.6.28/include/linux/serial_core.h
19342 @@ -288,6 +288,7 @@
19343  #define UPF_HARDPPS_CD         ((__force upf_t) (1 << 11))
19344  #define UPF_LOW_LATENCY                ((__force upf_t) (1 << 13))
19345  #define UPF_BUGGY_UART         ((__force upf_t) (1 << 14))
19346 +#define UPF_NO_TXEN_TEST       ((__force upf_t) (1 << 15))
19347  #define UPF_MAGIC_MULTIPLIER   ((__force upf_t) (1 << 16))
19348  #define UPF_CONS_FLOW          ((__force upf_t) (1 << 23))
19349  #define UPF_SHARE_IRQ          ((__force upf_t) (1 << 24))
19350 --- kernel-power-2.6.28.orig/include/linux/skbuff.h
19351 +++ kernel-power-2.6.28/include/linux/skbuff.h
19352 @@ -411,15 +411,6 @@
19353                                      void *here);
19354  extern void          skb_under_panic(struct sk_buff *skb, int len,
19355                                       void *here);
19356 -extern void          skb_truesize_bug(struct sk_buff *skb);
19357 -
19358 -static inline void skb_truesize_check(struct sk_buff *skb)
19359 -{
19360 -       int len = sizeof(struct sk_buff) + skb->len;
19361 -
19362 -       if (unlikely((int)skb->truesize < len))
19363 -               skb_truesize_bug(skb);
19364 -}
19365
19366  extern int skb_append_datato_frags(struct sock *sk, struct sk_buff *skb,
19367                         int getfrag(void *from, char *to, int offset,
19368 --- kernel-power-2.6.28.orig/include/linux/slab_def.h
19369 +++ kernel-power-2.6.28/include/linux/slab_def.h
19370 @@ -43,10 +43,7 @@
19371                         i++;
19372  #include <linux/kmalloc_sizes.h>
19373  #undef CACHE
19374 -               {
19375 -                       extern void __you_cannot_kmalloc_that_much(void);
19376 -                       __you_cannot_kmalloc_that_much();
19377 -               }
19378 +               return NULL;
19379  found:
19380  #ifdef CONFIG_ZONE_DMA
19381                 if (flags & GFP_DMA)
19382 @@ -77,10 +74,7 @@
19383                         i++;
19384  #include <linux/kmalloc_sizes.h>
19385  #undef CACHE
19386 -               {
19387 -                       extern void __you_cannot_kmalloc_that_much(void);
19388 -                       __you_cannot_kmalloc_that_much();
19389 -               }
19390 +               return NULL;
19391  found:
19392  #ifdef CONFIG_ZONE_DMA
19393                 if (flags & GFP_DMA)
19394 --- kernel-power-2.6.28.orig/include/linux/syscalls.h
19395 +++ kernel-power-2.6.28/include/linux/syscalls.h
19396 @@ -54,6 +54,7 @@
19397  struct compat_timeval;
19398  struct robust_list_head;
19399  struct getcpu_cache;
19400 +struct old_linux_dirent;
19401
19402  #include <linux/types.h>
19403  #include <linux/aio_abi.h>
19404 @@ -65,6 +66,74 @@
19405  #include <linux/quota.h>
19406  #include <linux/key.h>
19407
19408 +#define __SC_DECL1(t1, a1)     t1 a1
19409 +#define __SC_DECL2(t2, a2, ...) t2 a2, __SC_DECL1(__VA_ARGS__)
19410 +#define __SC_DECL3(t3, a3, ...) t3 a3, __SC_DECL2(__VA_ARGS__)
19411 +#define __SC_DECL4(t4, a4, ...) t4 a4, __SC_DECL3(__VA_ARGS__)
19412 +#define __SC_DECL5(t5, a5, ...) t5 a5, __SC_DECL4(__VA_ARGS__)
19413 +#define __SC_DECL6(t6, a6, ...) t6 a6, __SC_DECL5(__VA_ARGS__)
19414 +
19415 +#define __SC_LONG1(t1, a1)     long a1
19416 +#define __SC_LONG2(t2, a2, ...) long a2, __SC_LONG1(__VA_ARGS__)
19417 +#define __SC_LONG3(t3, a3, ...) long a3, __SC_LONG2(__VA_ARGS__)
19418 +#define __SC_LONG4(t4, a4, ...) long a4, __SC_LONG3(__VA_ARGS__)
19419 +#define __SC_LONG5(t5, a5, ...) long a5, __SC_LONG4(__VA_ARGS__)
19420 +#define __SC_LONG6(t6, a6, ...) long a6, __SC_LONG5(__VA_ARGS__)
19421 +
19422 +#define __SC_CAST1(t1, a1)     (t1) a1
19423 +#define __SC_CAST2(t2, a2, ...) (t2) a2, __SC_CAST1(__VA_ARGS__)
19424 +#define __SC_CAST3(t3, a3, ...) (t3) a3, __SC_CAST2(__VA_ARGS__)
19425 +#define __SC_CAST4(t4, a4, ...) (t4) a4, __SC_CAST3(__VA_ARGS__)
19426 +#define __SC_CAST5(t5, a5, ...) (t5) a5, __SC_CAST4(__VA_ARGS__)
19427 +#define __SC_CAST6(t6, a6, ...) (t6) a6, __SC_CAST5(__VA_ARGS__)
19428 +
19429 +#define __SC_TEST(type)                BUILD_BUG_ON(sizeof(type) > sizeof(long))
19430 +#define __SC_TEST1(t1, a1)     __SC_TEST(t1)
19431 +#define __SC_TEST2(t2, a2, ...)        __SC_TEST(t2); __SC_TEST1(__VA_ARGS__)
19432 +#define __SC_TEST3(t3, a3, ...)        __SC_TEST(t3); __SC_TEST2(__VA_ARGS__)
19433 +#define __SC_TEST4(t4, a4, ...)        __SC_TEST(t4); __SC_TEST3(__VA_ARGS__)
19434 +#define __SC_TEST5(t5, a5, ...)        __SC_TEST(t5); __SC_TEST4(__VA_ARGS__)
19435 +#define __SC_TEST6(t6, a6, ...)        __SC_TEST(t6); __SC_TEST5(__VA_ARGS__)
19436 +
19437 +#define SYSCALL_DEFINE0(name)     asmlinkage long sys_##name(void)
19438 +#define SYSCALL_DEFINE1(name, ...) SYSCALL_DEFINEx(1, _##name, __VA_ARGS__)
19439 +#define SYSCALL_DEFINE2(name, ...) SYSCALL_DEFINEx(2, _##name, __VA_ARGS__)
19440 +#define SYSCALL_DEFINE3(name, ...) SYSCALL_DEFINEx(3, _##name, __VA_ARGS__)
19441 +#define SYSCALL_DEFINE4(name, ...) SYSCALL_DEFINEx(4, _##name, __VA_ARGS__)
19442 +#define SYSCALL_DEFINE5(name, ...) SYSCALL_DEFINEx(5, _##name, __VA_ARGS__)
19443 +#define SYSCALL_DEFINE6(name, ...) SYSCALL_DEFINEx(6, _##name, __VA_ARGS__)
19444 +
19445 +#ifdef CONFIG_PPC64
19446 +#define SYSCALL_ALIAS(alias, name)                                     \
19447 +       asm ("\t.globl " #alias "\n\t.set " #alias ", " #name "\n"      \
19448 +            "\t.globl ." #alias "\n\t.set ." #alias ", ." #name)
19449 +#else
19450 +#define SYSCALL_ALIAS(alias, name)                                     \
19451 +       asm ("\t.globl " #alias "\n\t.set " #alias ", " #name)
19452 +#endif
19453 +
19454 +#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
19455 +
19456 +#define SYSCALL_DEFINE(name) static inline long SYSC_##name
19457 +#define SYSCALL_DEFINEx(x, name, ...)                                  \
19458 +       asmlinkage long sys##name(__SC_DECL##x(__VA_ARGS__));           \
19459 +       static inline long SYSC##name(__SC_DECL##x(__VA_ARGS__));       \
19460 +       asmlinkage long SyS##name(__SC_LONG##x(__VA_ARGS__))            \
19461 +       {                                                               \
19462 +               __SC_TEST##x(__VA_ARGS__);                              \
19463 +               return (long) SYSC##name(__SC_CAST##x(__VA_ARGS__));    \
19464 +       }                                                               \
19465 +       SYSCALL_ALIAS(sys##name, SyS##name);                            \
19466 +       static inline long SYSC##name(__SC_DECL##x(__VA_ARGS__))
19467 +
19468 +#else /* CONFIG_HAVE_SYSCALL_WRAPPERS */
19469 +
19470 +#define SYSCALL_DEFINE(name) asmlinkage long sys_##name
19471 +#define SYSCALL_DEFINEx(x, name, ...)                                  \
19472 +       asmlinkage long sys##name(__SC_DECL##x(__VA_ARGS__))
19473 +
19474 +#endif /* CONFIG_HAVE_SYSCALL_WRAPPERS */
19475 +
19476  asmlinkage long sys_time(time_t __user *tloc);
19477  asmlinkage long sys_stime(time_t __user *tptr);
19478  asmlinkage long sys_gettimeofday(struct timeval __user *tv,
19479 @@ -77,7 +146,7 @@
19480
19481  asmlinkage long sys_gettid(void);
19482  asmlinkage long sys_nanosleep(struct timespec __user *rqtp, struct timespec __user *rmtp);
19483 -asmlinkage unsigned long sys_alarm(unsigned int seconds);
19484 +asmlinkage long sys_alarm(unsigned int seconds);
19485  asmlinkage long sys_getpid(void);
19486  asmlinkage long sys_getppid(void);
19487  asmlinkage long sys_getuid(void);
19488 @@ -166,7 +235,7 @@
19489                                 unsigned long flags);
19490
19491  asmlinkage long sys_exit(int error_code);
19492 -asmlinkage void sys_exit_group(int error_code);
19493 +asmlinkage long sys_exit_group(int error_code);
19494  asmlinkage long sys_wait4(pid_t pid, int __user *stat_addr,
19495                                 int options, struct rusage __user *ru);
19496  asmlinkage long sys_waitid(int which, pid_t pid,
19497 @@ -196,7 +265,7 @@
19498  asmlinkage long sys_rt_sigqueueinfo(int pid, int sig, siginfo_t __user *uinfo);
19499  asmlinkage long sys_sgetmask(void);
19500  asmlinkage long sys_ssetmask(int newmask);
19501 -asmlinkage unsigned long sys_signal(int sig, __sighandler_t handler);
19502 +asmlinkage long sys_signal(int sig, __sighandler_t handler);
19503  asmlinkage long sys_pause(void);
19504
19505  asmlinkage long sys_sync(void);
19506 @@ -246,29 +315,29 @@
19507                               const void __user *value, size_t size, int flags);
19508  asmlinkage long sys_fsetxattr(int fd, const char __user *name,
19509                               const void __user *value, size_t size, int flags);
19510 -asmlinkage ssize_t sys_getxattr(const char __user *path, const char __user *name,
19511 -                               void __user *value, size_t size);
19512 -asmlinkage ssize_t sys_lgetxattr(const char __user *path, const char __user *name,
19513 -                               void __user *value, size_t size);
19514 -asmlinkage ssize_t sys_fgetxattr(int fd, const char __user *name,
19515 -                               void __user *value, size_t size);
19516 -asmlinkage ssize_t sys_listxattr(const char __user *path, char __user *list,
19517 -                               size_t size);
19518 -asmlinkage ssize_t sys_llistxattr(const char __user *path, char __user *list,
19519 -                               size_t size);
19520 -asmlinkage ssize_t sys_flistxattr(int fd, char __user *list, size_t size);
19521 +asmlinkage long sys_getxattr(const char __user *path, const char __user *name,
19522 +                            void __user *value, size_t size);
19523 +asmlinkage long sys_lgetxattr(const char __user *path, const char __user *name,
19524 +                             void __user *value, size_t size);
19525 +asmlinkage long sys_fgetxattr(int fd, const char __user *name,
19526 +                             void __user *value, size_t size);
19527 +asmlinkage long sys_listxattr(const char __user *path, char __user *list,
19528 +                             size_t size);
19529 +asmlinkage long sys_llistxattr(const char __user *path, char __user *list,
19530 +                              size_t size);
19531 +asmlinkage long sys_flistxattr(int fd, char __user *list, size_t size);
19532  asmlinkage long sys_removexattr(const char __user *path,
19533                                 const char __user *name);
19534  asmlinkage long sys_lremovexattr(const char __user *path,
19535                                  const char __user *name);
19536  asmlinkage long sys_fremovexattr(int fd, const char __user *name);
19537
19538 -asmlinkage unsigned long sys_brk(unsigned long brk);
19539 +asmlinkage long sys_brk(unsigned long brk);
19540  asmlinkage long sys_mprotect(unsigned long start, size_t len,
19541                                 unsigned long prot);
19542 -asmlinkage unsigned long sys_mremap(unsigned long addr,
19543 -                               unsigned long old_len, unsigned long new_len,
19544 -                               unsigned long flags, unsigned long new_addr);
19545 +asmlinkage long sys_mremap(unsigned long addr,
19546 +                          unsigned long old_len, unsigned long new_len,
19547 +                          unsigned long flags, unsigned long new_addr);
19548  asmlinkage long sys_remap_file_pages(unsigned long start, unsigned long size,
19549                         unsigned long prot, unsigned long pgoff,
19550                         unsigned long flags);
19551 @@ -321,10 +390,10 @@
19552                                 struct iocb __user * __user *);
19553  asmlinkage long sys_io_cancel(aio_context_t ctx_id, struct iocb __user *iocb,
19554                               struct io_event __user *result);
19555 -asmlinkage ssize_t sys_sendfile(int out_fd, int in_fd,
19556 -                               off_t __user *offset, size_t count);
19557 -asmlinkage ssize_t sys_sendfile64(int out_fd, int in_fd,
19558 -                               loff_t __user *offset, size_t count);
19559 +asmlinkage long sys_sendfile(int out_fd, int in_fd,
19560 +                            off_t __user *offset, size_t count);
19561 +asmlinkage long sys_sendfile64(int out_fd, int in_fd,
19562 +                              loff_t __user *offset, size_t count);
19563  asmlinkage long sys_readlink(const char __user *path,
19564                                 char __user *buf, int bufsiz);
19565  asmlinkage long sys_creat(const char __user *pathname, int mode);
19566 @@ -368,26 +437,25 @@
19567                                 struct utimbuf __user *times);
19568  asmlinkage long sys_utimes(char __user *filename,
19569                                 struct timeval __user *utimes);
19570 -asmlinkage off_t sys_lseek(unsigned int fd, off_t offset,
19571 -                               unsigned int origin);
19572 +asmlinkage long sys_lseek(unsigned int fd, off_t offset,
19573 +                         unsigned int origin);
19574  asmlinkage long sys_llseek(unsigned int fd, unsigned long offset_high,
19575                         unsigned long offset_low, loff_t __user *result,
19576                         unsigned int origin);
19577 -asmlinkage ssize_t sys_read(unsigned int fd, char __user *buf,
19578 -                               size_t count);
19579 -asmlinkage ssize_t sys_readahead(int fd, loff_t offset, size_t count);
19580 -asmlinkage ssize_t sys_readv(unsigned long fd,
19581 -                               const struct iovec __user *vec,
19582 -                               unsigned long vlen);
19583 -asmlinkage ssize_t sys_write(unsigned int fd, const char __user *buf,
19584 -                               size_t count);
19585 -asmlinkage ssize_t sys_writev(unsigned long fd,
19586 -                               const struct iovec __user *vec,
19587 -                               unsigned long vlen);
19588 -asmlinkage ssize_t sys_pread64(unsigned int fd, char __user *buf,
19589 -                               size_t count, loff_t pos);
19590 -asmlinkage ssize_t sys_pwrite64(unsigned int fd, const char __user *buf,
19591 -                               size_t count, loff_t pos);
19592 +asmlinkage long sys_read(unsigned int fd, char __user *buf, size_t count);
19593 +asmlinkage long sys_readahead(int fd, loff_t offset, size_t count);
19594 +asmlinkage long sys_readv(unsigned long fd,
19595 +                         const struct iovec __user *vec,
19596 +                         unsigned long vlen);
19597 +asmlinkage long sys_write(unsigned int fd, const char __user *buf,
19598 +                         size_t count);
19599 +asmlinkage long sys_writev(unsigned long fd,
19600 +                          const struct iovec __user *vec,
19601 +                          unsigned long vlen);
19602 +asmlinkage long sys_pread64(unsigned int fd, char __user *buf,
19603 +                           size_t count, loff_t pos);
19604 +asmlinkage long sys_pwrite64(unsigned int fd, const char __user *buf,
19605 +                            size_t count, loff_t pos);
19606  asmlinkage long sys_getcwd(char __user *buf, unsigned long size);
19607  asmlinkage long sys_mkdir(const char __user *pathname, int mode);
19608  asmlinkage long sys_chdir(const char __user *filename);
19609 @@ -476,7 +544,7 @@
19610  asmlinkage long sys_mq_open(const char __user *name, int oflag, mode_t mode, struct mq_attr __user *attr);
19611  asmlinkage long sys_mq_unlink(const char __user *name);
19612  asmlinkage long sys_mq_timedsend(mqd_t mqdes, const char __user *msg_ptr, size_t msg_len, unsigned int msg_prio, const struct timespec __user *abs_timeout);
19613 -asmlinkage ssize_t sys_mq_timedreceive(mqd_t mqdes, char __user *msg_ptr, size_t msg_len, unsigned int __user *msg_prio, const struct timespec __user *abs_timeout);
19614 +asmlinkage long sys_mq_timedreceive(mqd_t mqdes, char __user *msg_ptr, size_t msg_len, unsigned int __user *msg_prio, const struct timespec __user *abs_timeout);
19615  asmlinkage long sys_mq_notify(mqd_t mqdes, const struct sigevent __user *notification);
19616  asmlinkage long sys_mq_getsetattr(mqd_t mqdes, const struct mq_attr __user *mqstat, struct mq_attr __user *omqstat);
19617
19618 @@ -530,11 +598,6 @@
19619                                 const int __user *nodes,
19620                                 int __user *status,
19621                                 int flags);
19622 -asmlinkage long compat_sys_move_pages(pid_t pid, unsigned long nr_page,
19623 -                               __u32 __user *pages,
19624 -                               const int __user *nodes,
19625 -                               int __user *status,
19626 -                               int flags);
19627  asmlinkage long sys_mbind(unsigned long start, unsigned long len,
19628                                 unsigned long mode,
19629                                 unsigned long __user *nmask,
19630 @@ -549,7 +612,7 @@
19631  asmlinkage long sys_inotify_init1(int flags);
19632  asmlinkage long sys_inotify_add_watch(int fd, const char __user *path,
19633                                         u32 mask);
19634 -asmlinkage long sys_inotify_rm_watch(int fd, u32 wd);
19635 +asmlinkage long sys_inotify_rm_watch(int fd, __s32 wd);
19636
19637  asmlinkage long sys_spu_run(int fd, __u32 __user *unpc,
19638                                  __u32 __user *ustatus);
19639 @@ -583,13 +646,6 @@
19640                                int bufsiz);
19641  asmlinkage long sys_utimensat(int dfd, char __user *filename,
19642                                 struct timespec __user *utimes, int flags);
19643 -asmlinkage long compat_sys_futimesat(unsigned int dfd, char __user *filename,
19644 -                                    struct compat_timeval __user *t);
19645 -asmlinkage long compat_sys_newfstatat(unsigned int dfd, char __user * filename,
19646 -                                     struct compat_stat __user *statbuf,
19647 -                                     int flag);
19648 -asmlinkage long compat_sys_openat(unsigned int dfd, const char __user *filename,
19649 -                                  int flags, int mode);
19650  asmlinkage long sys_unshare(unsigned long unshare_flags);
19651
19652  asmlinkage long sys_splice(int fd_in, loff_t __user *off_in,
19653 @@ -621,6 +677,15 @@
19654  asmlinkage long sys_eventfd(unsigned int count);
19655  asmlinkage long sys_eventfd2(unsigned int count, int flags);
19656  asmlinkage long sys_fallocate(int fd, int mode, loff_t offset, loff_t len);
19657 +asmlinkage long sys_old_readdir(unsigned int, struct old_linux_dirent __user *, unsigned int);
19658 +asmlinkage long sys_pselect6(int, fd_set __user *, fd_set __user *,
19659 +                            fd_set __user *, struct timespec __user *,
19660 +                            void __user *);
19661 +asmlinkage long sys_ppoll(struct pollfd __user *, unsigned int,
19662 +                         struct timespec __user *, const sigset_t __user *,
19663 +                         size_t);
19664 +asmlinkage long sys_pipe2(int __user *, int);
19665 +asmlinkage long sys_pipe(int __user *);
19666
19667  int kernel_execve(const char *filename, char *const argv[], char *const envp[]);
19668
19669 --- kernel-power-2.6.28.orig/include/linux/time.h
19670 +++ kernel-power-2.6.28/include/linux/time.h
19671 @@ -105,6 +105,7 @@
19672  extern int update_persistent_clock(struct timespec now);
19673  extern int no_sync_cmos_clock __read_mostly;
19674  void timekeeping_init(void);
19675 +extern int timekeeping_suspended;
19676
19677  unsigned long get_seconds(void);
19678  struct timespec current_kernel_time(void);
19679 --- kernel-power-2.6.28.orig/include/linux/timerfd.h
19680 +++ kernel-power-2.6.28/include/linux/timerfd.h
19681 @@ -11,13 +11,21 @@
19682  /* For O_CLOEXEC and O_NONBLOCK */
19683  #include <linux/fcntl.h>
19684
19685 -/* Flags for timerfd_settime.  */
19686 +/*
19687 + * CAREFUL: Check include/asm-generic/fcntl.h when defining
19688 + * new flags, since they might collide with O_* ones. We want
19689 + * to re-use O_* flags that couldn't possibly have a meaning
19690 + * from eventfd, in order to leave a free define-space for
19691 + * shared O_* flags.
19692 + */
19693  #define TFD_TIMER_ABSTIME (1 << 0)
19694 -
19695 -/* Flags for timerfd_create.  */
19696  #define TFD_CLOEXEC O_CLOEXEC
19697  #define TFD_NONBLOCK O_NONBLOCK
19698
19699 +#define TFD_SHARED_FCNTL_FLAGS (TFD_CLOEXEC | TFD_NONBLOCK)
19700 +/* Flags for timerfd_create.  */
19701 +#define TFD_CREATE_FLAGS TFD_SHARED_FCNTL_FLAGS
19702 +/* Flags for timerfd_settime.  */
19703 +#define TFD_SETTIME_FLAGS TFD_TIMER_ABSTIME
19704
19705  #endif /* _LINUX_TIMERFD_H */
19706 -
19707 --- kernel-power-2.6.28.orig/include/linux/usb/quirks.h
19708 +++ kernel-power-2.6.28/include/linux/usb/quirks.h
19709 @@ -16,4 +16,7 @@
19710  /* device can't handle Set-Interface requests */
19711  #define USB_QUIRK_NO_SET_INTF          0x00000004
19712
19713 +/* device can't handle its Configuration or Interface strings */
19714 +#define USB_QUIRK_CONFIG_INTF_STRINGS  0x00000008
19715 +
19716  #endif /* __LINUX_USB_QUIRKS_H */
19717 --- kernel-power-2.6.28.orig/include/linux/usb_usual.h
19718 +++ kernel-power-2.6.28/include/linux/usb_usual.h
19719 @@ -52,8 +52,9 @@
19720         US_FLAG(MAX_SECTORS_MIN,0x00002000)                     \
19721                 /* Sets max_sectors to arch min */              \
19722         US_FLAG(BULK_IGNORE_TAG,0x00004000)                     \
19723 -               /* Ignore tag mismatch in bulk operations */
19724 -
19725 +               /* Ignore tag mismatch in bulk operations */    \
19726 +       US_FLAG(CAPACITY_OK,    0x00010000)                     \
19727 +               /* READ CAPACITY response is correct */
19728
19729  #define US_FLAG(name, value)   US_FL_##name = value ,
19730  enum { US_DO_ALL_FLAGS };
19731 --- kernel-power-2.6.28.orig/include/linux/wait.h
19732 +++ kernel-power-2.6.28/include/linux/wait.h
19733 @@ -132,6 +132,8 @@
19734         list_del(&old->task_list);
19735  }
19736
19737 +void __wake_up_common(wait_queue_head_t *q, unsigned int mode,
19738 +                       int nr_exclusive, int sync, void *key);
19739  void __wake_up(wait_queue_head_t *q, unsigned int mode, int nr, void *key);
19740  extern void __wake_up_locked(wait_queue_head_t *q, unsigned int mode);
19741  extern void __wake_up_sync(wait_queue_head_t *q, unsigned int mode, int nr);
19742 @@ -333,16 +335,19 @@
19743         for (;;) {                                                      \
19744                 prepare_to_wait_exclusive(&wq, &__wait,                 \
19745                                         TASK_INTERRUPTIBLE);            \
19746 -               if (condition)                                          \
19747 +               if (condition) {                                        \
19748 +                       finish_wait(&wq, &__wait);                      \
19749                         break;                                          \
19750 +               }                                                       \
19751                 if (!signal_pending(current)) {                         \
19752                         schedule();                                     \
19753                         continue;                                       \
19754                 }                                                       \
19755                 ret = -ERESTARTSYS;                                     \
19756 +               abort_exclusive_wait(&wq, &__wait,                      \
19757 +                               TASK_INTERRUPTIBLE, NULL);              \
19758                 break;                                                  \
19759         }                                                               \
19760 -       finish_wait(&wq, &__wait);                                      \
19761  } while (0)
19762
19763  #define wait_event_interruptible_exclusive(wq, condition)              \
19764 @@ -431,6 +436,8 @@
19765  void prepare_to_wait(wait_queue_head_t *q, wait_queue_t *wait, int state);
19766  void prepare_to_wait_exclusive(wait_queue_head_t *q, wait_queue_t *wait, int state);
19767  void finish_wait(wait_queue_head_t *q, wait_queue_t *wait);
19768 +void abort_exclusive_wait(wait_queue_head_t *q, wait_queue_t *wait,
19769 +                       unsigned int mode, void *key);
19770  int autoremove_wake_function(wait_queue_t *wait, unsigned mode, int sync, void *key);
19771  int wake_bit_function(wait_queue_t *wait, unsigned mode, int sync, void *key);
19772
19773 --- kernel-power-2.6.28.orig/include/linux/writeback.h
19774 +++ kernel-power-2.6.28/include/linux/writeback.h
19775 @@ -30,7 +30,6 @@
19776  enum writeback_sync_modes {
19777         WB_SYNC_NONE,   /* Don't wait on anything */
19778         WB_SYNC_ALL,    /* Wait on every mapping */
19779 -       WB_SYNC_HOLD,   /* Hold the inode on sb_dirty for sys_sync() */
19780  };
19781
19782  /*
19783 --- kernel-power-2.6.28.orig/include/net/sctp/checksum.h
19784 +++ kernel-power-2.6.28/include/net/sctp/checksum.h
19785 @@ -79,5 +79,5 @@
19786
19787  static inline __be32 sctp_end_cksum(__be32 crc32)
19788  {
19789 -       return ~crc32;
19790 +       return (__force __be32)~cpu_to_le32((__force u32)crc32);
19791  }
19792 --- kernel-power-2.6.28.orig/include/net/sock.h
19793 +++ kernel-power-2.6.28/include/net/sock.h
19794 @@ -784,7 +784,6 @@
19795
19796  static inline void sk_wmem_free_skb(struct sock *sk, struct sk_buff *skb)
19797  {
19798 -       skb_truesize_check(skb);
19799         sock_set_flag(sk, SOCK_QUEUE_SHRUNK);
19800         sk->sk_wmem_queued -= skb->truesize;
19801         sk_mem_uncharge(sk, skb->truesize);
19802 --- kernel-power-2.6.28.orig/init/Kconfig
19803 +++ kernel-power-2.6.28/init/Kconfig
19804 @@ -538,6 +538,9 @@
19805  config SYSCTL
19806         bool
19807
19808 +config ANON_INODES
19809 +       bool
19810 +
19811  menuconfig EMBEDDED
19812         bool "Configure standard kernel features (for small systems)"
19813         help
19814 @@ -643,18 +646,6 @@
19815            This option allows to disable the internal PC-Speaker
19816            support, saving some memory.
19817
19818 -config COMPAT_BRK
19819 -       bool "Disable heap randomization"
19820 -       default y
19821 -       help
19822 -         Randomizing heap placement makes heap exploits harder, but it
19823 -         also breaks ancient binaries (including anything libc5 based).
19824 -         This option changes the bootup default to heap randomization
19825 -         disabled, and can be overriden runtime by setting
19826 -         /proc/sys/kernel/randomize_va_space to 2.
19827 -
19828 -         On non-ancient distros (post-2000 ones) N is usually a safe choice.
19829 -
19830  config BASE_FULL
19831         default y
19832         bool "Enable full-sized data structures for core" if EMBEDDED
19833 @@ -672,9 +663,6 @@
19834           support for "fast userspace mutexes".  The resulting kernel may not
19835           run glibc-based applications correctly.
19836
19837 -config ANON_INODES
19838 -       bool
19839 -
19840  config EPOLL
19841         bool "Enable eventpoll support" if EMBEDDED
19842         default y
19843 @@ -760,6 +748,18 @@
19844           SLUB sysfs support. /sys/slab will not exist and there will be
19845           no support for cache validation etc.
19846
19847 +config COMPAT_BRK
19848 +       bool "Disable heap randomization"
19849 +       default y
19850 +       help
19851 +         Randomizing heap placement makes heap exploits harder, but it
19852 +         also breaks ancient binaries (including anything libc5 based).
19853 +         This option changes the bootup default to heap randomization
19854 +         disabled, and can be overriden runtime by setting
19855 +         /proc/sys/kernel/randomize_va_space to 2.
19856 +
19857 +         On non-ancient distros (post-2000 ones) N is usually a safe choice.
19858 +
19859  choice
19860         prompt "Choose SLAB allocator"
19861         default SLUB
19862 --- kernel-power-2.6.28.orig/ipc/mqueue.c
19863 +++ kernel-power-2.6.28/ipc/mqueue.c
19864 @@ -506,7 +506,8 @@
19865                         sig_i.si_errno = 0;
19866                         sig_i.si_code = SI_MESGQ;
19867                         sig_i.si_value = info->notify.sigev_value;
19868 -                       sig_i.si_pid = task_tgid_vnr(current);
19869 +                       sig_i.si_pid = task_tgid_nr_ns(current,
19870 +                                               ns_of_pid(info->notify_owner));
19871                         sig_i.si_uid = current->uid;
19872
19873                         kill_pid_info(info->notify.sigev_signo,
19874 @@ -655,8 +656,8 @@
19875         return dentry_open(dentry, mqueue_mnt, oflag);
19876  }
19877
19878 -asmlinkage long sys_mq_open(const char __user *u_name, int oflag, mode_t mode,
19879 -                               struct mq_attr __user *u_attr)
19880 +SYSCALL_DEFINE4(mq_open, const char __user *, u_name, int, oflag, mode_t, mode,
19881 +               struct mq_attr __user *, u_attr)
19882  {
19883         struct dentry *dentry;
19884         struct file *filp;
19885 @@ -723,7 +724,7 @@
19886         return fd;
19887  }
19888
19889 -asmlinkage long sys_mq_unlink(const char __user *u_name)
19890 +SYSCALL_DEFINE1(mq_unlink, const char __user *, u_name)
19891  {
19892         int err;
19893         char *name;
19894 @@ -816,9 +817,9 @@
19895         sender->state = STATE_READY;
19896  }
19897
19898 -asmlinkage long sys_mq_timedsend(mqd_t mqdes, const char __user *u_msg_ptr,
19899 -       size_t msg_len, unsigned int msg_prio,
19900 -       const struct timespec __user *u_abs_timeout)
19901 +SYSCALL_DEFINE5(mq_timedsend, mqd_t, mqdes, const char __user *, u_msg_ptr,
19902 +               size_t, msg_len, unsigned int, msg_prio,
19903 +               const struct timespec __user *, u_abs_timeout)
19904  {
19905         struct file *filp;
19906         struct inode *inode;
19907 @@ -904,9 +905,9 @@
19908         return ret;
19909  }
19910
19911 -asmlinkage ssize_t sys_mq_timedreceive(mqd_t mqdes, char __user *u_msg_ptr,
19912 -       size_t msg_len, unsigned int __user *u_msg_prio,
19913 -       const struct timespec __user *u_abs_timeout)
19914 +SYSCALL_DEFINE5(mq_timedreceive, mqd_t, mqdes, char __user *, u_msg_ptr,
19915 +               size_t, msg_len, unsigned int __user *, u_msg_prio,
19916 +               const struct timespec __user *, u_abs_timeout)
19917  {
19918         long timeout;
19919         ssize_t ret;
19920 @@ -989,8 +990,8 @@
19921   * and he isn't currently owner of notification, will be silently discarded.
19922   * It isn't explicitly defined in the POSIX.
19923   */
19924 -asmlinkage long sys_mq_notify(mqd_t mqdes,
19925 -                               const struct sigevent __user *u_notification)
19926 +SYSCALL_DEFINE2(mq_notify, mqd_t, mqdes,
19927 +               const struct sigevent __user *, u_notification)
19928  {
19929         int ret;
19930         struct file *filp;
19931 @@ -1115,9 +1116,9 @@
19932         return ret;
19933  }
19934
19935 -asmlinkage long sys_mq_getsetattr(mqd_t mqdes,
19936 -                       const struct mq_attr __user *u_mqstat,
19937 -                       struct mq_attr __user *u_omqstat)
19938 +SYSCALL_DEFINE3(mq_getsetattr, mqd_t, mqdes,
19939 +               const struct mq_attr __user *, u_mqstat,
19940 +               struct mq_attr __user *, u_omqstat)
19941  {
19942         int ret;
19943         struct mq_attr mqstat, omqstat;
19944 --- kernel-power-2.6.28.orig/ipc/msg.c
19945 +++ kernel-power-2.6.28/ipc/msg.c
19946 @@ -309,7 +309,7 @@
19947         return security_msg_queue_associate(msq, msgflg);
19948  }
19949
19950 -asmlinkage long sys_msgget(key_t key, int msgflg)
19951 +SYSCALL_DEFINE2(msgget, key_t, key, int, msgflg)
19952  {
19953         struct ipc_namespace *ns;
19954         struct ipc_ops msg_ops;
19955 @@ -466,7 +466,7 @@
19956         return err;
19957  }
19958
19959 -asmlinkage long sys_msgctl(int msqid, int cmd, struct msqid_ds __user *buf)
19960 +SYSCALL_DEFINE3(msgctl, int, msqid, int, cmd, struct msqid_ds __user *, buf)
19961  {
19962         struct msg_queue *msq;
19963         int err, version;
19964 @@ -723,8 +723,8 @@
19965         return err;
19966  }
19967
19968 -asmlinkage long
19969 -sys_msgsnd(int msqid, struct msgbuf __user *msgp, size_t msgsz, int msgflg)
19970 +SYSCALL_DEFINE4(msgsnd, int, msqid, struct msgbuf __user *, msgp, size_t, msgsz,
19971 +               int, msgflg)
19972  {
19973         long mtype;
19974
19975 @@ -904,8 +904,8 @@
19976         return msgsz;
19977  }
19978
19979 -asmlinkage long sys_msgrcv(int msqid, struct msgbuf __user *msgp, size_t msgsz,
19980 -                          long msgtyp, int msgflg)
19981 +SYSCALL_DEFINE5(msgrcv, int, msqid, struct msgbuf __user *, msgp, size_t, msgsz,
19982 +               long, msgtyp, int, msgflg)
19983  {
19984         long err, mtype;
19985
19986 --- kernel-power-2.6.28.orig/ipc/sem.c
19987 +++ kernel-power-2.6.28/ipc/sem.c
19988 @@ -308,7 +308,7 @@
19989         return 0;
19990  }
19991
19992 -asmlinkage long sys_semget(key_t key, int nsems, int semflg)
19993 +SYSCALL_DEFINE3(semget, key_t, key, int, nsems, int, semflg)
19994  {
19995         struct ipc_namespace *ns;
19996         struct ipc_ops sem_ops;
19997 @@ -887,7 +887,7 @@
19998         return err;
19999  }
20000
20001 -asmlinkage long sys_semctl (int semid, int semnum, int cmd, union semun arg)
20002 +SYSCALL_DEFINE(semctl)(int semid, int semnum, int cmd, union semun arg)
20003  {
20004         int err = -EINVAL;
20005         int version;
20006 @@ -923,6 +923,13 @@
20007                 return -EINVAL;
20008         }
20009  }
20010 +#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
20011 +asmlinkage long SyS_semctl(int semid, int semnum, int cmd, union semun arg)
20012 +{
20013 +       return SYSC_semctl((int) semid, (int) semnum, (int) cmd, arg);
20014 +}
20015 +SYSCALL_ALIAS(sys_semctl, SyS_semctl);
20016 +#endif
20017
20018  /* If the task doesn't already have a undo_list, then allocate one
20019   * here.  We guarantee there is only one thread using this undo list,
20020 @@ -1048,8 +1055,8 @@
20021         return un;
20022  }
20023
20024 -asmlinkage long sys_semtimedop(int semid, struct sembuf __user *tsops,
20025 -                       unsigned nsops, const struct timespec __user *timeout)
20026 +SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops,
20027 +               unsigned, nsops, const struct timespec __user *, timeout)
20028  {
20029         int error = -EINVAL;
20030         struct sem_array *sma;
20031 @@ -1226,7 +1233,8 @@
20032         return error;
20033  }
20034
20035 -asmlinkage long sys_semop (int semid, struct sembuf __user *tsops, unsigned nsops)
20036 +SYSCALL_DEFINE3(semop, int, semid, struct sembuf __user *, tsops,
20037 +               unsigned, nsops)
20038  {
20039         return sys_semtimedop(semid, tsops, nsops, NULL);
20040  }
20041 --- kernel-power-2.6.28.orig/ipc/shm.c
20042 +++ kernel-power-2.6.28/ipc/shm.c
20043 @@ -440,7 +440,7 @@
20044         return 0;
20045  }
20046
20047 -asmlinkage long sys_shmget (key_t key, size_t size, int shmflg)
20048 +SYSCALL_DEFINE3(shmget, key_t, key, size_t, size, int, shmflg)
20049  {
20050         struct ipc_namespace *ns;
20051         struct ipc_ops shm_ops;
20052 @@ -565,11 +565,15 @@
20053                         struct hstate *h = hstate_file(shp->shm_file);
20054                         *rss += pages_per_huge_page(h) * mapping->nrpages;
20055                 } else {
20056 +#ifdef CONFIG_SHMEM
20057                         struct shmem_inode_info *info = SHMEM_I(inode);
20058                         spin_lock(&info->lock);
20059                         *rss += inode->i_mapping->nrpages;
20060                         *swp += info->swapped;
20061                         spin_unlock(&info->lock);
20062 +#else
20063 +                       *rss += inode->i_mapping->nrpages;
20064 +#endif
20065                 }
20066
20067                 total++;
20068 @@ -621,7 +625,7 @@
20069         return err;
20070  }
20071
20072 -asmlinkage long sys_shmctl(int shmid, int cmd, struct shmid_ds __user *buf)
20073 +SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf)
20074  {
20075         struct shmid_kernel *shp;
20076         int err, version;
20077 @@ -945,7 +949,7 @@
20078         goto out_nattch;
20079  }
20080
20081 -asmlinkage long sys_shmat(int shmid, char __user *shmaddr, int shmflg)
20082 +SYSCALL_DEFINE3(shmat, int, shmid, char __user *, shmaddr, int, shmflg)
20083  {
20084         unsigned long ret;
20085         long err;
20086 @@ -961,7 +965,7 @@
20087   * detach and kill segment if marked destroyed.
20088   * The work is done in shm_close.
20089   */
20090 -asmlinkage long sys_shmdt(char __user *shmaddr)
20091 +SYSCALL_DEFINE1(shmdt, char __user *, shmaddr)
20092  {
20093         struct mm_struct *mm = current->mm;
20094         struct vm_area_struct *vma, *next;
20095 --- kernel-power-2.6.28.orig/kernel/acct.c
20096 +++ kernel-power-2.6.28/kernel/acct.c
20097 @@ -277,7 +277,7 @@
20098   * should be written. If the filename is NULL, accounting will be
20099   * shutdown.
20100   */
20101 -asmlinkage long sys_acct(const char __user *name)
20102 +SYSCALL_DEFINE1(acct, const char __user *, name)
20103  {
20104         int error;
20105
20106 --- kernel-power-2.6.28.orig/kernel/capability.c
20107 +++ kernel-power-2.6.28/kernel/capability.c
20108 @@ -348,7 +348,7 @@
20109   *
20110   * Returns 0 on success and < 0 on error.
20111   */
20112 -asmlinkage long sys_capget(cap_user_header_t header, cap_user_data_t dataptr)
20113 +SYSCALL_DEFINE2(capget, cap_user_header_t, header, cap_user_data_t, dataptr)
20114  {
20115         int ret = 0;
20116         pid_t pid;
20117 @@ -425,7 +425,7 @@
20118   *
20119   * Returns 0 on success and < 0 on error.
20120   */
20121 -asmlinkage long sys_capset(cap_user_header_t header, const cap_user_data_t data)
20122 +SYSCALL_DEFINE2(capset, cap_user_header_t, header, const cap_user_data_t, data)
20123  {
20124         struct __user_cap_data_struct kdata[_KERNEL_CAPABILITY_U32S];
20125         unsigned i, tocopy;
20126 --- kernel-power-2.6.28.orig/kernel/exec_domain.c
20127 +++ kernel-power-2.6.28/kernel/exec_domain.c
20128 @@ -209,8 +209,7 @@
20129  module_init(proc_execdomains_init);
20130  #endif
20131
20132 -asmlinkage long
20133 -sys_personality(u_long personality)
20134 +SYSCALL_DEFINE1(personality, u_long, personality)
20135  {
20136         u_long old = current->personality;
20137
20138 --- kernel-power-2.6.28.orig/kernel/exit.c
20139 +++ kernel-power-2.6.28/kernel/exit.c
20140 @@ -942,8 +942,7 @@
20141          */
20142         if (tsk->exit_signal != SIGCHLD && !task_detached(tsk) &&
20143             (tsk->parent_exec_id != tsk->real_parent->self_exec_id ||
20144 -            tsk->self_exec_id != tsk->parent_exec_id) &&
20145 -           !capable(CAP_KILL))
20146 +            tsk->self_exec_id != tsk->parent_exec_id))
20147                 tsk->exit_signal = SIGCHLD;
20148
20149         signal = tracehook_notify_death(tsk, &cookie, group_dead);
20150 @@ -1143,7 +1142,7 @@
20151
20152  EXPORT_SYMBOL(complete_and_exit);
20153
20154 -asmlinkage long sys_exit(int error_code)
20155 +SYSCALL_DEFINE1(exit, int, error_code)
20156  {
20157         do_exit((error_code&0xff)<<8);
20158  }
20159 @@ -1184,9 +1183,11 @@
20160   * wait4()-ing process will get the correct exit code - even if this
20161   * thread is not the thread group leader.
20162   */
20163 -asmlinkage void sys_exit_group(int error_code)
20164 +SYSCALL_DEFINE1(exit_group, int, error_code)
20165  {
20166         do_group_exit((error_code & 0xff) << 8);
20167 +       /* NOTREACHED */
20168 +       return 0;
20169  }
20170
20171  static struct pid *task_pid_type(struct task_struct *task, enum pid_type type)
20172 @@ -1753,9 +1754,8 @@
20173         return retval;
20174  }
20175
20176 -asmlinkage long sys_waitid(int which, pid_t upid,
20177 -                          struct siginfo __user *infop, int options,
20178 -                          struct rusage __user *ru)
20179 +SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *,
20180 +               infop, int, options, struct rusage __user *, ru)
20181  {
20182         struct pid *pid = NULL;
20183         enum pid_type type;
20184 @@ -1794,8 +1794,8 @@
20185         return ret;
20186  }
20187
20188 -asmlinkage long sys_wait4(pid_t upid, int __user *stat_addr,
20189 -                         int options, struct rusage __user *ru)
20190 +SYSCALL_DEFINE4(wait4, pid_t, upid, int __user *, stat_addr,
20191 +               int, options, struct rusage __user *, ru)
20192  {
20193         struct pid *pid = NULL;
20194         enum pid_type type;
20195 @@ -1832,7 +1832,7 @@
20196   * sys_waitpid() remains for compatibility. waitpid() should be
20197   * implemented by calling sys_wait4() from libc.a.
20198   */
20199 -asmlinkage long sys_waitpid(pid_t pid, int __user *stat_addr, int options)
20200 +SYSCALL_DEFINE3(waitpid, pid_t, pid, int __user *, stat_addr, int, options)
20201  {
20202         return sys_wait4(pid, stat_addr, options, NULL);
20203  }
20204 --- kernel-power-2.6.28.orig/kernel/fork.c
20205 +++ kernel-power-2.6.28/kernel/fork.c
20206 @@ -894,7 +894,7 @@
20207         clear_freeze_flag(p);
20208  }
20209
20210 -asmlinkage long sys_set_tid_address(int __user *tidptr)
20211 +SYSCALL_DEFINE1(set_tid_address, int __user *, tidptr)
20212  {
20213         current->clear_child_tid = tidptr;
20214
20215 @@ -1176,10 +1176,6 @@
20216  #endif
20217         clear_all_latency_tracing(p);
20218
20219 -       /* Our parent execution domain becomes current domain
20220 -          These must match for thread signalling to apply */
20221 -       p->parent_exec_id = p->self_exec_id;
20222 -
20223         /* ok, now we should be set up.. */
20224         p->exit_signal = (clone_flags & CLONE_THREAD) ? -1 : (clone_flags & CSIGNAL);
20225         p->pdeath_signal = 0;
20226 @@ -1217,10 +1213,13 @@
20227                 set_task_cpu(p, smp_processor_id());
20228
20229         /* CLONE_PARENT re-uses the old parent */
20230 -       if (clone_flags & (CLONE_PARENT|CLONE_THREAD))
20231 +       if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) {
20232                 p->real_parent = current->real_parent;
20233 -       else
20234 +               p->parent_exec_id = current->parent_exec_id;
20235 +       } else {
20236                 p->real_parent = current;
20237 +               p->parent_exec_id = current->self_exec_id;
20238 +       }
20239
20240         spin_lock(&current->sighand->siglock);
20241
20242 @@ -1589,7 +1588,7 @@
20243   * constructed. Here we are modifying the current, active,
20244   * task_struct.
20245   */
20246 -asmlinkage long sys_unshare(unsigned long unshare_flags)
20247 +SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
20248  {
20249         int err = 0;
20250         struct fs_struct *fs, *new_fs = NULL;
20251 --- kernel-power-2.6.28.orig/kernel/futex.c
20252 +++ kernel-power-2.6.28/kernel/futex.c
20253 @@ -1800,9 +1800,8 @@
20254   * @head: pointer to the list-head
20255   * @len: length of the list-head, as userspace expects
20256   */
20257 -asmlinkage long
20258 -sys_set_robust_list(struct robust_list_head __user *head,
20259 -                   size_t len)
20260 +SYSCALL_DEFINE2(set_robust_list, struct robust_list_head __user *, head,
20261 +               size_t, len)
20262  {
20263         if (!futex_cmpxchg_enabled)
20264                 return -ENOSYS;
20265 @@ -1823,9 +1822,9 @@
20266   * @head_ptr: pointer to a list-head pointer, the kernel fills it in
20267   * @len_ptr: pointer to a length field, the kernel fills in the header size
20268   */
20269 -asmlinkage long
20270 -sys_get_robust_list(int pid, struct robust_list_head __user * __user *head_ptr,
20271 -                   size_t __user *len_ptr)
20272 +SYSCALL_DEFINE3(get_robust_list, int, pid,
20273 +               struct robust_list_head __user * __user *, head_ptr,
20274 +               size_t __user *, len_ptr)
20275  {
20276         struct robust_list_head __user *head;
20277         unsigned long ret;
20278 @@ -2039,9 +2038,9 @@
20279  }
20280
20281
20282 -asmlinkage long sys_futex(u32 __user *uaddr, int op, u32 val,
20283 -                         struct timespec __user *utime, u32 __user *uaddr2,
20284 -                         u32 val3)
20285 +SYSCALL_DEFINE6(futex, u32 __user *, uaddr, int, op, u32, val,
20286 +               struct timespec __user *, utime, u32 __user *, uaddr2,
20287 +               u32, val3)
20288  {
20289         struct timespec ts;
20290         ktime_t t, *tp = NULL;
20291 --- kernel-power-2.6.28.orig/kernel/hrtimer.c
20292 +++ kernel-power-2.6.28/kernel/hrtimer.c
20293 @@ -1630,8 +1630,8 @@
20294         return ret;
20295  }
20296
20297 -asmlinkage long
20298 -sys_nanosleep(struct timespec __user *rqtp, struct timespec __user *rmtp)
20299 +SYSCALL_DEFINE2(nanosleep, struct timespec __user *, rqtp,
20300 +               struct timespec __user *, rmtp)
20301  {
20302         struct timespec tu;
20303
20304 --- kernel-power-2.6.28.orig/kernel/itimer.c
20305 +++ kernel-power-2.6.28/kernel/itimer.c
20306 @@ -100,7 +100,7 @@
20307         return 0;
20308  }
20309
20310 -asmlinkage long sys_getitimer(int which, struct itimerval __user *value)
20311 +SYSCALL_DEFINE2(getitimer, int, which, struct itimerval __user *, value)
20312  {
20313         int error = -EFAULT;
20314         struct itimerval get_buffer;
20315 @@ -260,9 +260,8 @@
20316         return it_old.it_value.tv_sec;
20317  }
20318
20319 -asmlinkage long sys_setitimer(int which,
20320 -                             struct itimerval __user *value,
20321 -                             struct itimerval __user *ovalue)
20322 +SYSCALL_DEFINE3(setitimer, int, which, struct itimerval __user *, value,
20323 +               struct itimerval __user *, ovalue)
20324  {
20325         struct itimerval set_buffer, get_buffer;
20326         int error;
20327 --- kernel-power-2.6.28.orig/kernel/kexec.c
20328 +++ kernel-power-2.6.28/kernel/kexec.c
20329 @@ -934,9 +934,8 @@
20330
20331  static DEFINE_MUTEX(kexec_mutex);
20332
20333 -asmlinkage long sys_kexec_load(unsigned long entry, unsigned long nr_segments,
20334 -                               struct kexec_segment __user *segments,
20335 -                               unsigned long flags)
20336 +SYSCALL_DEFINE4(kexec_load, unsigned long, entry, unsigned long, nr_segments,
20337 +               struct kexec_segment __user *, segments, unsigned long, flags)
20338  {
20339         struct kimage **dest_image, *image;
20340         int result;
20341 --- kernel-power-2.6.28.orig/kernel/kprobes.c
20342 +++ kernel-power-2.6.28/kernel/kprobes.c
20343 @@ -901,10 +901,8 @@
20344                 ri->rp = rp;
20345                 ri->task = current;
20346
20347 -               if (rp->entry_handler && rp->entry_handler(ri, regs)) {
20348 -                       spin_unlock_irqrestore(&rp->lock, flags);
20349 +               if (rp->entry_handler && rp->entry_handler(ri, regs))
20350                         return 0;
20351 -               }
20352
20353                 arch_prepare_kretprobe(ri, regs);
20354
20355 --- kernel-power-2.6.28.orig/kernel/module.c
20356 +++ kernel-power-2.6.28/kernel/module.c
20357 @@ -743,8 +743,8 @@
20358         mutex_lock(&module_mutex);
20359  }
20360
20361 -asmlinkage long
20362 -sys_delete_module(const char __user *name_user, unsigned int flags)
20363 +SYSCALL_DEFINE2(delete_module, const char __user *, name_user,
20364 +               unsigned int, flags)
20365  {
20366         struct module *mod;
20367         char name[MODULE_NAME_LEN];
20368 @@ -2288,10 +2288,8 @@
20369  }
20370
20371  /* This is where the real work happens */
20372 -asmlinkage long
20373 -sys_init_module(void __user *umod,
20374 -               unsigned long len,
20375 -               const char __user *uargs)
20376 +SYSCALL_DEFINE3(init_module, void __user *, umod,
20377 +               unsigned long, len, const char __user *, uargs)
20378  {
20379         struct module *mod;
20380         int ret = 0;
20381 --- kernel-power-2.6.28.orig/kernel/posix-cpu-timers.c
20382 +++ kernel-power-2.6.28/kernel/posix-cpu-timers.c
20383 @@ -294,7 +294,7 @@
20384                 cpu->cpu = virt_ticks(p);
20385                 break;
20386         case CPUCLOCK_SCHED:
20387 -               cpu->sched = p->se.sum_exec_runtime + task_delta_exec(p);
20388 +               cpu->sched = task_sched_runtime(p);
20389                 break;
20390         }
20391         return 0;
20392 @@ -310,18 +310,19 @@
20393  {
20394         struct task_cputime cputime;
20395
20396 -       thread_group_cputime(p, &cputime);
20397         switch (CPUCLOCK_WHICH(which_clock)) {
20398         default:
20399                 return -EINVAL;
20400         case CPUCLOCK_PROF:
20401 +               thread_group_cputime(p, &cputime);
20402                 cpu->cpu = cputime_add(cputime.utime, cputime.stime);
20403                 break;
20404         case CPUCLOCK_VIRT:
20405 +               thread_group_cputime(p, &cputime);
20406                 cpu->cpu = cputime.utime;
20407                 break;
20408         case CPUCLOCK_SCHED:
20409 -               cpu->sched = cputime.sum_exec_runtime + task_delta_exec(p);
20410 +               cpu->sched = thread_group_sched_runtime(p);
20411                 break;
20412         }
20413         return 0;
20414 --- kernel-power-2.6.28.orig/kernel/posix-timers.c
20415 +++ kernel-power-2.6.28/kernel/posix-timers.c
20416 @@ -477,10 +477,9 @@
20417
20418  /* Create a POSIX.1b interval timer. */
20419
20420 -asmlinkage long
20421 -sys_timer_create(const clockid_t which_clock,
20422 -                struct sigevent __user *timer_event_spec,
20423 -                timer_t __user * created_timer_id)
20424 +SYSCALL_DEFINE3(timer_create, const clockid_t, which_clock,
20425 +               struct sigevent __user *, timer_event_spec,
20426 +               timer_t __user *, created_timer_id)
20427  {
20428         struct k_itimer *new_timer;
20429         int error, new_timer_id;
20430 @@ -666,8 +665,8 @@
20431  }
20432
20433  /* Get the time remaining on a POSIX.1b interval timer. */
20434 -asmlinkage long
20435 -sys_timer_gettime(timer_t timer_id, struct itimerspec __user *setting)
20436 +SYSCALL_DEFINE2(timer_gettime, timer_t, timer_id,
20437 +               struct itimerspec __user *, setting)
20438  {
20439         struct k_itimer *timr;
20440         struct itimerspec cur_setting;
20441 @@ -696,8 +695,7 @@
20442   * the call back to do_schedule_next_timer().  So all we need to do is
20443   * to pick up the frozen overrun.
20444   */
20445 -asmlinkage long
20446 -sys_timer_getoverrun(timer_t timer_id)
20447 +SYSCALL_DEFINE1(timer_getoverrun, timer_t, timer_id)
20448  {
20449         struct k_itimer *timr;
20450         int overrun;
20451 @@ -765,10 +763,9 @@
20452  }
20453
20454  /* Set a POSIX.1b interval timer */
20455 -asmlinkage long
20456 -sys_timer_settime(timer_t timer_id, int flags,
20457 -                 const struct itimerspec __user *new_setting,
20458 -                 struct itimerspec __user *old_setting)
20459 +SYSCALL_DEFINE4(timer_settime, timer_t, timer_id, int, flags,
20460 +               const struct itimerspec __user *, new_setting,
20461 +               struct itimerspec __user *, old_setting)
20462  {
20463         struct k_itimer *timr;
20464         struct itimerspec new_spec, old_spec;
20465 @@ -821,8 +818,7 @@
20466  }
20467
20468  /* Delete a POSIX.1b interval timer. */
20469 -asmlinkage long
20470 -sys_timer_delete(timer_t timer_id)
20471 +SYSCALL_DEFINE1(timer_delete, timer_t, timer_id)
20472  {
20473         struct k_itimer *timer;
20474         unsigned long flags;
20475 @@ -910,8 +906,8 @@
20476  }
20477  EXPORT_SYMBOL_GPL(do_posix_clock_nonanosleep);
20478
20479 -asmlinkage long sys_clock_settime(const clockid_t which_clock,
20480 -                                 const struct timespec __user *tp)
20481 +SYSCALL_DEFINE2(clock_settime, const clockid_t, which_clock,
20482 +               const struct timespec __user *, tp)
20483  {
20484         struct timespec new_tp;
20485
20486 @@ -923,8 +919,8 @@
20487         return CLOCK_DISPATCH(which_clock, clock_set, (which_clock, &new_tp));
20488  }
20489
20490 -asmlinkage long
20491 -sys_clock_gettime(const clockid_t which_clock, struct timespec __user *tp)
20492 +SYSCALL_DEFINE2(clock_gettime, const clockid_t, which_clock,
20493 +               struct timespec __user *,tp)
20494  {
20495         struct timespec kernel_tp;
20496         int error;
20497 @@ -940,8 +936,8 @@
20498
20499  }
20500
20501 -asmlinkage long
20502 -sys_clock_getres(const clockid_t which_clock, struct timespec __user *tp)
20503 +SYSCALL_DEFINE2(clock_getres, const clockid_t, which_clock,
20504 +               struct timespec __user *, tp)
20505  {
20506         struct timespec rtn_tp;
20507         int error;
20508 @@ -970,10 +966,9 @@
20509                                  which_clock);
20510  }
20511
20512 -asmlinkage long
20513 -sys_clock_nanosleep(const clockid_t which_clock, int flags,
20514 -                   const struct timespec __user *rqtp,
20515 -                   struct timespec __user *rmtp)
20516 +SYSCALL_DEFINE4(clock_nanosleep, const clockid_t, which_clock, int, flags,
20517 +               const struct timespec __user *, rqtp,
20518 +               struct timespec __user *, rmtp)
20519  {
20520         struct timespec t;
20521
20522 --- kernel-power-2.6.28.orig/kernel/printk.c
20523 +++ kernel-power-2.6.28/kernel/printk.c
20524 @@ -386,7 +386,7 @@
20525         return error;
20526  }
20527
20528 -asmlinkage long sys_syslog(int type, char __user *buf, int len)
20529 +SYSCALL_DEFINE3(syslog, int, type, char __user *, buf, int, len)
20530  {
20531         return do_syslog(type, buf, len);
20532  }
20533 @@ -749,11 +749,6 @@
20534
20535  #else
20536
20537 -asmlinkage long sys_syslog(int type, char __user *buf, int len)
20538 -{
20539 -       return -ENOSYS;
20540 -}
20541 -
20542  static void call_console_drivers(unsigned start, unsigned end)
20543  {
20544  }
20545 --- kernel-power-2.6.28.orig/kernel/ptrace.c
20546 +++ kernel-power-2.6.28/kernel/ptrace.c
20547 @@ -545,7 +545,7 @@
20548  #define arch_ptrace_attach(child)      do { } while (0)
20549  #endif
20550
20551 -asmlinkage long sys_ptrace(long request, long pid, long addr, long data)
20552 +SYSCALL_DEFINE4(ptrace, long, request, long, pid, long, addr, long, data)
20553  {
20554         struct task_struct *child;
20555         long ret;
20556 --- kernel-power-2.6.28.orig/kernel/relay.c
20557 +++ kernel-power-2.6.28/kernel/relay.c
20558 @@ -663,8 +663,10 @@
20559
20560         mutex_lock(&relay_channels_mutex);
20561         /* Is chan already set up? */
20562 -       if (unlikely(chan->has_base_filename))
20563 +       if (unlikely(chan->has_base_filename)) {
20564 +               mutex_unlock(&relay_channels_mutex);
20565                 return -EEXIST;
20566 +       }
20567         chan->has_base_filename = 1;
20568         chan->parent = parent;
20569         curr_cpu = get_cpu();
20570 --- kernel-power-2.6.28.orig/kernel/resource.c
20571 +++ kernel-power-2.6.28/kernel/resource.c
20572 @@ -853,6 +853,15 @@
20573                 if (PFN_DOWN(p->start) <= PFN_DOWN(addr) &&
20574                     PFN_DOWN(p->end) >= PFN_DOWN(addr + size - 1))
20575                         continue;
20576 +               /*
20577 +                * if a resource is "BUSY", it's not a hardware resource
20578 +                * but a driver mapping of such a resource; we don't want
20579 +                * to warn for those; some drivers legitimately map only
20580 +                * partial hardware resources. (example: vesafb)
20581 +                */
20582 +               if (p->flags & IORESOURCE_BUSY)
20583 +                       continue;
20584 +
20585                 printk(KERN_WARNING "resource map sanity check conflict: "
20586                        "0x%llx 0x%llx 0x%llx 0x%llx %s\n",
20587                        (unsigned long long)addr,
20588 --- kernel-power-2.6.28.orig/kernel/sched.c
20589 +++ kernel-power-2.6.28/kernel/sched.c
20590 @@ -4064,9 +4064,25 @@
20591  EXPORT_PER_CPU_SYMBOL(kstat);
20592
20593  /*
20594 - * Return any ns on the sched_clock that have not yet been banked in
20595 + * Return any ns on the sched_clock that have not yet been accounted in
20596   * @p in case that task is currently running.
20597 + *
20598 + * Called with task_rq_lock() held on @rq.
20599   */
20600 +static u64 do_task_delta_exec(struct task_struct *p, struct rq *rq)
20601 +{
20602 +       u64 ns = 0;
20603 +
20604 +       if (task_current(rq, p)) {
20605 +               update_rq_clock(rq);
20606 +               ns = rq->clock - p->se.exec_start;
20607 +               if ((s64)ns < 0)
20608 +                       ns = 0;
20609 +       }
20610 +
20611 +       return ns;
20612 +}
20613 +
20614  unsigned long long task_delta_exec(struct task_struct *p)
20615  {
20616         unsigned long flags;
20617 @@ -4074,16 +4090,49 @@
20618         u64 ns = 0;
20619
20620         rq = task_rq_lock(p, &flags);
20621 +       ns = do_task_delta_exec(p, rq);
20622 +       task_rq_unlock(rq, &flags);
20623
20624 -       if (task_current(rq, p)) {
20625 -               u64 delta_exec;
20626 +       return ns;
20627 +}
20628
20629 -               update_rq_clock(rq);
20630 -               delta_exec = rq->clock - p->se.exec_start;
20631 -               if ((s64)delta_exec > 0)
20632 -                       ns = delta_exec;
20633 -       }
20634 +/*
20635 + * Return accounted runtime for the task.
20636 + * In case the task is currently running, return the runtime plus current's
20637 + * pending runtime that have not been accounted yet.
20638 + */
20639 +unsigned long long task_sched_runtime(struct task_struct *p)
20640 +{
20641 +       unsigned long flags;
20642 +       struct rq *rq;
20643 +       u64 ns = 0;
20644 +
20645 +       rq = task_rq_lock(p, &flags);
20646 +       ns = p->se.sum_exec_runtime + do_task_delta_exec(p, rq);
20647 +       task_rq_unlock(rq, &flags);
20648 +
20649 +       return ns;
20650 +}
20651
20652 +/*
20653 + * Return sum_exec_runtime for the thread group.
20654 + * In case the task is currently running, return the sum plus current's
20655 + * pending runtime that have not been accounted yet.
20656 + *
20657 + * Note that the thread group might have other running tasks as well,
20658 + * so the return value not includes other pending runtime that other
20659 + * running tasks might have.
20660 + */
20661 +unsigned long long thread_group_sched_runtime(struct task_struct *p)
20662 +{
20663 +       struct task_cputime totals;
20664 +       unsigned long flags;
20665 +       struct rq *rq;
20666 +       u64 ns;
20667 +
20668 +       rq = task_rq_lock(p, &flags);
20669 +       thread_group_cputime(p, &totals);
20670 +       ns = totals.sum_exec_runtime + do_task_delta_exec(p, rq);
20671         task_rq_unlock(rq, &flags);
20672
20673         return ns;
20674 @@ -4586,8 +4635,8 @@
20675   * started to run but is not in state TASK_RUNNING. try_to_wake_up() returns
20676   * zero in this (rare) case, and we handle it by continuing to scan the queue.
20677   */
20678 -static void __wake_up_common(wait_queue_head_t *q, unsigned int mode,
20679 -                            int nr_exclusive, int sync, void *key)
20680 +void __wake_up_common(wait_queue_head_t *q, unsigned int mode,
20681 +                       int nr_exclusive, int sync, void *key)
20682  {
20683         wait_queue_t *curr, *next;
20684
20685 @@ -5025,7 +5074,7 @@
20686   * sys_setpriority is a more generic, but much slower function that
20687   * does similar things.
20688   */
20689 -asmlinkage long sys_nice(int increment)
20690 +SYSCALL_DEFINE1(nice, int, increment)
20691  {
20692         long nice, retval;
20693
20694 @@ -5317,8 +5366,8 @@
20695   * @policy: new policy.
20696   * @param: structure containing the new RT priority.
20697   */
20698 -asmlinkage long
20699 -sys_sched_setscheduler(pid_t pid, int policy, struct sched_param __user *param)
20700 +SYSCALL_DEFINE3(sched_setscheduler, pid_t, pid, int, policy,
20701 +               struct sched_param __user *, param)
20702  {
20703         /* negative values for policy are not valid */
20704         if (policy < 0)
20705 @@ -5332,7 +5381,7 @@
20706   * @pid: the pid in question.
20707   * @param: structure containing the new RT priority.
20708   */
20709 -asmlinkage long sys_sched_setparam(pid_t pid, struct sched_param __user *param)
20710 +SYSCALL_DEFINE2(sched_setparam, pid_t, pid, struct sched_param __user *, param)
20711  {
20712         return do_sched_setscheduler(pid, -1, param);
20713  }
20714 @@ -5341,7 +5390,7 @@
20715   * sys_sched_getscheduler - get the policy (scheduling class) of a thread
20716   * @pid: the pid in question.
20717   */
20718 -asmlinkage long sys_sched_getscheduler(pid_t pid)
20719 +SYSCALL_DEFINE1(sched_getscheduler, pid_t, pid)
20720  {
20721         struct task_struct *p;
20722         int retval;
20723 @@ -5366,7 +5415,7 @@
20724   * @pid: the pid in question.
20725   * @param: structure containing the RT priority.
20726   */
20727 -asmlinkage long sys_sched_getparam(pid_t pid, struct sched_param __user *param)
20728 +SYSCALL_DEFINE2(sched_getparam, pid_t, pid, struct sched_param __user *, param)
20729  {
20730         struct sched_param lp;
20731         struct task_struct *p;
20732 @@ -5474,8 +5523,8 @@
20733   * @len: length in bytes of the bitmask pointed to by user_mask_ptr
20734   * @user_mask_ptr: user-space pointer to the new cpu mask
20735   */
20736 -asmlinkage long sys_sched_setaffinity(pid_t pid, unsigned int len,
20737 -                                     unsigned long __user *user_mask_ptr)
20738 +SYSCALL_DEFINE3(sched_setaffinity, pid_t, pid, unsigned int, len,
20739 +               unsigned long __user *, user_mask_ptr)
20740  {
20741         cpumask_t new_mask;
20742         int retval;
20743 @@ -5519,8 +5568,8 @@
20744   * @len: length in bytes of the bitmask pointed to by user_mask_ptr
20745   * @user_mask_ptr: user-space pointer to hold the current cpu mask
20746   */
20747 -asmlinkage long sys_sched_getaffinity(pid_t pid, unsigned int len,
20748 -                                     unsigned long __user *user_mask_ptr)
20749 +SYSCALL_DEFINE3(sched_getaffinity, pid_t, pid, unsigned int, len,
20750 +               unsigned long __user *, user_mask_ptr)
20751  {
20752         int ret;
20753         cpumask_t mask;
20754 @@ -5544,7 +5593,7 @@
20755   * This function yields the current CPU to other tasks. If there are no
20756   * other threads running on this CPU then this function will return.
20757   */
20758 -asmlinkage long sys_sched_yield(void)
20759 +SYSCALL_DEFINE0(sched_yield)
20760  {
20761         struct rq *rq = this_rq_lock();
20762
20763 @@ -5685,7 +5734,7 @@
20764   * this syscall returns the maximum rt_priority that can be used
20765   * by a given scheduling class.
20766   */
20767 -asmlinkage long sys_sched_get_priority_max(int policy)
20768 +SYSCALL_DEFINE1(sched_get_priority_max, int, policy)
20769  {
20770         int ret = -EINVAL;
20771
20772 @@ -5710,7 +5759,7 @@
20773   * this syscall returns the minimum rt_priority that can be used
20774   * by a given scheduling class.
20775   */
20776 -asmlinkage long sys_sched_get_priority_min(int policy)
20777 +SYSCALL_DEFINE1(sched_get_priority_min, int, policy)
20778  {
20779         int ret = -EINVAL;
20780
20781 @@ -5735,8 +5784,8 @@
20782   * this syscall writes the default timeslice value of a given process
20783   * into the user-space timespec buffer. A value of '0' means infinity.
20784   */
20785 -asmlinkage
20786 -long sys_sched_rr_get_interval(pid_t pid, struct timespec __user *interval)
20787 +SYSCALL_DEFINE2(sched_rr_get_interval, pid_t, pid,
20788 +               struct timespec __user *, interval)
20789  {
20790         struct task_struct *p;
20791         unsigned int time_slice;
20792 --- kernel-power-2.6.28.orig/kernel/sched_clock.c
20793 +++ kernel-power-2.6.28/kernel/sched_clock.c
20794 @@ -124,7 +124,7 @@
20795
20796         clock = scd->tick_gtod + delta;
20797         min_clock = wrap_max(scd->tick_gtod, scd->clock);
20798 -       max_clock = scd->tick_gtod + TICK_NSEC;
20799 +       max_clock = wrap_max(scd->clock, scd->tick_gtod + TICK_NSEC);
20800
20801         clock = wrap_max(clock, min_clock);
20802         clock = wrap_min(clock, max_clock);
20803 @@ -227,6 +227,9 @@
20804   */
20805  void sched_clock_idle_wakeup_event(u64 delta_ns)
20806  {
20807 +       if (timekeeping_suspended)
20808 +               return;
20809 +
20810         sched_clock_tick();
20811         touch_softlockup_watchdog();
20812  }
20813 --- kernel-power-2.6.28.orig/kernel/sched_fair.c
20814 +++ kernel-power-2.6.28/kernel/sched_fair.c
20815 @@ -283,7 +283,7 @@
20816                                                    struct sched_entity,
20817                                                    run_node);
20818
20819 -               if (vruntime == cfs_rq->min_vruntime)
20820 +               if (!cfs_rq->curr)
20821                         vruntime = se->vruntime;
20822                 else
20823                         vruntime = min_vruntime(vruntime, se->vruntime);
20824 @@ -681,9 +681,13 @@
20825                         unsigned long thresh = sysctl_sched_latency;
20826
20827                         /*
20828 -                        * convert the sleeper threshold into virtual time
20829 +                        * Convert the sleeper threshold into virtual time.
20830 +                        * SCHED_IDLE is a special sub-class.  We care about
20831 +                        * fairness only relative to other SCHED_IDLE tasks,
20832 +                        * all of which have the same weight.
20833                          */
20834 -                       if (sched_feat(NORMALIZED_SLEEPER))
20835 +                       if (sched_feat(NORMALIZED_SLEEPER) &&
20836 +                                       task_of(se)->policy != SCHED_IDLE)
20837                                 thresh = calc_delta_fair(thresh, se);
20838
20839                         vruntime -= thresh;
20840 @@ -1328,14 +1332,18 @@
20841
20842  static void set_last_buddy(struct sched_entity *se)
20843  {
20844 -       for_each_sched_entity(se)
20845 -               cfs_rq_of(se)->last = se;
20846 +       if (likely(task_of(se)->policy != SCHED_IDLE)) {
20847 +               for_each_sched_entity(se)
20848 +                       cfs_rq_of(se)->last = se;
20849 +       }
20850  }
20851
20852  static void set_next_buddy(struct sched_entity *se)
20853  {
20854 -       for_each_sched_entity(se)
20855 -               cfs_rq_of(se)->next = se;
20856 +       if (likely(task_of(se)->policy != SCHED_IDLE)) {
20857 +               for_each_sched_entity(se)
20858 +                       cfs_rq_of(se)->next = se;
20859 +       }
20860  }
20861
20862  /*
20863 @@ -1382,12 +1390,18 @@
20864                 return;
20865
20866         /*
20867 -        * Batch tasks do not preempt (their preemption is driven by
20868 +        * Batch and idle tasks do not preempt (their preemption is driven by
20869          * the tick):
20870          */
20871 -       if (unlikely(p->policy == SCHED_BATCH))
20872 +       if (unlikely(p->policy != SCHED_NORMAL))
20873                 return;
20874
20875 +       /* Idle tasks are by definition preempted by everybody. */
20876 +       if (unlikely(curr->policy == SCHED_IDLE)) {
20877 +               resched_task(curr);
20878 +               return;
20879 +       }
20880 +
20881         if (!sched_feat(WAKEUP_PREEMPT))
20882                 return;
20883
20884 --- kernel-power-2.6.28.orig/kernel/seccomp.c
20885 +++ kernel-power-2.6.28/kernel/seccomp.c
20886 @@ -8,6 +8,7 @@
20887
20888  #include <linux/seccomp.h>
20889  #include <linux/sched.h>
20890 +#include <linux/compat.h>
20891
20892  /* #define SECCOMP_DEBUG 1 */
20893  #define NR_SECCOMP_MODES 1
20894 @@ -22,7 +23,7 @@
20895         0, /* null terminated */
20896  };
20897
20898 -#ifdef TIF_32BIT
20899 +#ifdef CONFIG_COMPAT
20900  static int mode1_syscalls_32[] = {
20901         __NR_seccomp_read_32, __NR_seccomp_write_32, __NR_seccomp_exit_32, __NR_seccomp_sigreturn_32,
20902         0, /* null terminated */
20903 @@ -37,8 +38,8 @@
20904         switch (mode) {
20905         case 1:
20906                 syscall = mode1_syscalls;
20907 -#ifdef TIF_32BIT
20908 -               if (test_thread_flag(TIF_32BIT))
20909 +#ifdef CONFIG_COMPAT
20910 +               if (is_compat_task())
20911                         syscall = mode1_syscalls_32;
20912  #endif
20913                 do {
20914 --- kernel-power-2.6.28.orig/kernel/signal.c
20915 +++ kernel-power-2.6.28/kernel/signal.c
20916 @@ -1552,7 +1552,15 @@
20917         read_lock(&tasklist_lock);
20918         if (may_ptrace_stop()) {
20919                 do_notify_parent_cldstop(current, CLD_TRAPPED);
20920 +               /*
20921 +                * Don't want to allow preemption here, because
20922 +                * sys_ptrace() needs this task to be inactive.
20923 +                *
20924 +                * XXX: implement read_unlock_no_resched().
20925 +                */
20926 +               preempt_disable();
20927                 read_unlock(&tasklist_lock);
20928 +               preempt_enable_no_resched();
20929                 schedule();
20930         } else {
20931                 /*
20932 @@ -1940,7 +1948,7 @@
20933   * System call entry points.
20934   */
20935
20936 -asmlinkage long sys_restart_syscall(void)
20937 +SYSCALL_DEFINE0(restart_syscall)
20938  {
20939         struct restart_block *restart = &current_thread_info()->restart_block;
20940         return restart->fn(restart);
20941 @@ -1993,8 +2001,8 @@
20942         return error;
20943  }
20944
20945 -asmlinkage long
20946 -sys_rt_sigprocmask(int how, sigset_t __user *set, sigset_t __user *oset, size_t sigsetsize)
20947 +SYSCALL_DEFINE4(rt_sigprocmask, int, how, sigset_t __user *, set,
20948 +               sigset_t __user *, oset, size_t, sigsetsize)
20949  {
20950         int error = -EINVAL;
20951         sigset_t old_set, new_set;
20952 @@ -2053,8 +2061,7 @@
20953         return error;
20954  }
20955
20956 -asmlinkage long
20957 -sys_rt_sigpending(sigset_t __user *set, size_t sigsetsize)
20958 +SYSCALL_DEFINE2(rt_sigpending, sigset_t __user *, set, size_t, sigsetsize)
20959  {
20960         return do_sigpending(set, sigsetsize);
20961  }
20962 @@ -2125,11 +2132,9 @@
20963
20964  #endif
20965
20966 -asmlinkage long
20967 -sys_rt_sigtimedwait(const sigset_t __user *uthese,
20968 -                   siginfo_t __user *uinfo,
20969 -                   const struct timespec __user *uts,
20970 -                   size_t sigsetsize)
20971 +SYSCALL_DEFINE4(rt_sigtimedwait, const sigset_t __user *, uthese,
20972 +               siginfo_t __user *, uinfo, const struct timespec __user *, uts,
20973 +               size_t, sigsetsize)
20974  {
20975         int ret, sig;
20976         sigset_t these;
20977 @@ -2202,8 +2207,7 @@
20978         return ret;
20979  }
20980
20981 -asmlinkage long
20982 -sys_kill(pid_t pid, int sig)
20983 +SYSCALL_DEFINE2(kill, pid_t, pid, int, sig)
20984  {
20985         struct siginfo info;
20986
20987 @@ -2262,7 +2266,7 @@
20988   *  exists but it's not belonging to the target process anymore. This
20989   *  method solves the problem of threads exiting and PIDs getting reused.
20990   */
20991 -asmlinkage long sys_tgkill(pid_t tgid, pid_t pid, int sig)
20992 +SYSCALL_DEFINE3(tgkill, pid_t, tgid, pid_t, pid, int, sig)
20993  {
20994         /* This is only valid for single tasks */
20995         if (pid <= 0 || tgid <= 0)
20996 @@ -2274,8 +2278,7 @@
20997  /*
20998   *  Send a signal to only one task, even if it's a CLONE_THREAD task.
20999   */
21000 -asmlinkage long
21001 -sys_tkill(pid_t pid, int sig)
21002 +SYSCALL_DEFINE2(tkill, pid_t, pid, int, sig)
21003  {
21004         /* This is only valid for single tasks */
21005         if (pid <= 0)
21006 @@ -2284,8 +2287,8 @@
21007         return do_tkill(0, pid, sig);
21008  }
21009
21010 -asmlinkage long
21011 -sys_rt_sigqueueinfo(pid_t pid, int sig, siginfo_t __user *uinfo)
21012 +SYSCALL_DEFINE3(rt_sigqueueinfo, pid_t, pid, int, sig,
21013 +               siginfo_t __user *, uinfo)
21014  {
21015         siginfo_t info;
21016
21017 @@ -2413,8 +2416,7 @@
21018
21019  #ifdef __ARCH_WANT_SYS_SIGPENDING
21020
21021 -asmlinkage long
21022 -sys_sigpending(old_sigset_t __user *set)
21023 +SYSCALL_DEFINE1(sigpending, old_sigset_t __user *, set)
21024  {
21025         return do_sigpending(set, sizeof(*set));
21026  }
21027 @@ -2425,8 +2427,8 @@
21028  /* Some platforms have their own version with special arguments others
21029     support only sys_rt_sigprocmask.  */
21030
21031 -asmlinkage long
21032 -sys_sigprocmask(int how, old_sigset_t __user *set, old_sigset_t __user *oset)
21033 +SYSCALL_DEFINE3(sigprocmask, int, how, old_sigset_t __user *, set,
21034 +               old_sigset_t __user *, oset)
21035  {
21036         int error;
21037         old_sigset_t old_set, new_set;
21038 @@ -2476,11 +2478,10 @@
21039  #endif /* __ARCH_WANT_SYS_SIGPROCMASK */
21040
21041  #ifdef __ARCH_WANT_SYS_RT_SIGACTION
21042 -asmlinkage long
21043 -sys_rt_sigaction(int sig,
21044 -                const struct sigaction __user *act,
21045 -                struct sigaction __user *oact,
21046 -                size_t sigsetsize)
21047 +SYSCALL_DEFINE4(rt_sigaction, int, sig,
21048 +               const struct sigaction __user *, act,
21049 +               struct sigaction __user *, oact,
21050 +               size_t, sigsetsize)
21051  {
21052         struct k_sigaction new_sa, old_sa;
21053         int ret = -EINVAL;
21054 @@ -2510,15 +2511,13 @@
21055  /*
21056   * For backwards compatibility.  Functionality superseded by sigprocmask.
21057   */
21058 -asmlinkage long
21059 -sys_sgetmask(void)
21060 +SYSCALL_DEFINE0(sgetmask)
21061  {
21062         /* SMP safe */
21063         return current->blocked.sig[0];
21064  }
21065
21066 -asmlinkage long
21067 -sys_ssetmask(int newmask)
21068 +SYSCALL_DEFINE1(ssetmask, int, newmask)
21069  {
21070         int old;
21071
21072 @@ -2538,8 +2537,7 @@
21073  /*
21074   * For backwards compatibility.  Functionality superseded by sigaction.
21075   */
21076 -asmlinkage unsigned long
21077 -sys_signal(int sig, __sighandler_t handler)
21078 +SYSCALL_DEFINE2(signal, int, sig, __sighandler_t, handler)
21079  {
21080         struct k_sigaction new_sa, old_sa;
21081         int ret;
21082 @@ -2556,8 +2554,7 @@
21083
21084  #ifdef __ARCH_WANT_SYS_PAUSE
21085
21086 -asmlinkage long
21087 -sys_pause(void)
21088 +SYSCALL_DEFINE0(pause)
21089  {
21090         current->state = TASK_INTERRUPTIBLE;
21091         schedule();
21092 @@ -2567,7 +2564,7 @@
21093  #endif
21094
21095  #ifdef __ARCH_WANT_SYS_RT_SIGSUSPEND
21096 -asmlinkage long sys_rt_sigsuspend(sigset_t __user *unewset, size_t sigsetsize)
21097 +SYSCALL_DEFINE2(rt_sigsuspend, sigset_t __user *, unewset, size_t, sigsetsize)
21098  {
21099         sigset_t newset;
21100
21101 --- kernel-power-2.6.28.orig/kernel/sys.c
21102 +++ kernel-power-2.6.28/kernel/sys.c
21103 @@ -137,7 +137,7 @@
21104         return error;
21105  }
21106
21107 -asmlinkage long sys_setpriority(int which, int who, int niceval)
21108 +SYSCALL_DEFINE3(setpriority, int, which, int, who, int, niceval)
21109  {
21110         struct task_struct *g, *p;
21111         struct user_struct *user;
21112 @@ -201,7 +201,7 @@
21113   * has been offset by 20 (ie it returns 40..1 instead of -20..19)
21114   * to stay compatible.
21115   */
21116 -asmlinkage long sys_getpriority(int which, int who)
21117 +SYSCALL_DEFINE2(getpriority, int, which, int, who)
21118  {
21119         struct task_struct *g, *p;
21120         struct user_struct *user;
21121 @@ -347,7 +347,8 @@
21122   *
21123   * reboot doesn't sync: do that yourself before calling this.
21124   */
21125 -asmlinkage long sys_reboot(int magic1, int magic2, unsigned int cmd, void __user * arg)
21126 +SYSCALL_DEFINE4(reboot, int, magic1, int, magic2, unsigned int, cmd,
21127 +               void __user *, arg)
21128  {
21129         char buffer[256];
21130
21131 @@ -470,7 +471,7 @@
21132   * SMP: There are not races, the GIDs are checked only by filesystem
21133   *      operations (as far as semantic preservation is concerned).
21134   */
21135 -asmlinkage long sys_setregid(gid_t rgid, gid_t egid)
21136 +SYSCALL_DEFINE2(setregid, gid_t, rgid, gid_t, egid)
21137  {
21138         int old_rgid = current->gid;
21139         int old_egid = current->egid;
21140 @@ -519,7 +520,7 @@
21141   *
21142   * SMP: Same implicit races as above.
21143   */
21144 -asmlinkage long sys_setgid(gid_t gid)
21145 +SYSCALL_DEFINE1(setgid, gid_t, gid)
21146  {
21147         int old_egid = current->egid;
21148         int retval;
21149 @@ -589,7 +590,7 @@
21150   * 100% compatible with BSD.  A program which uses just setuid() will be
21151   * 100% compatible with POSIX with saved IDs.
21152   */
21153 -asmlinkage long sys_setreuid(uid_t ruid, uid_t euid)
21154 +SYSCALL_DEFINE2(setreuid, uid_t, ruid, uid_t, euid)
21155  {
21156         int old_ruid, old_euid, old_suid, new_ruid, new_euid;
21157         int retval;
21158 @@ -651,7 +652,7 @@
21159   * will allow a root program to temporarily drop privileges and be able to
21160   * regain them by swapping the real and effective uid.
21161   */
21162 -asmlinkage long sys_setuid(uid_t uid)
21163 +SYSCALL_DEFINE1(setuid, uid_t, uid)
21164  {
21165         int old_euid = current->euid;
21166         int old_ruid, old_suid, new_suid;
21167 @@ -690,7 +691,7 @@
21168   * This function implements a generic ability to update ruid, euid,
21169   * and suid.  This allows you to implement the 4.4 compatible seteuid().
21170   */
21171 -asmlinkage long sys_setresuid(uid_t ruid, uid_t euid, uid_t suid)
21172 +SYSCALL_DEFINE3(setresuid, uid_t, ruid, uid_t, euid, uid_t, suid)
21173  {
21174         int old_ruid = current->uid;
21175         int old_euid = current->euid;
21176 @@ -733,7 +734,7 @@
21177         return security_task_post_setuid(old_ruid, old_euid, old_suid, LSM_SETID_RES);
21178  }
21179
21180 -asmlinkage long sys_getresuid(uid_t __user *ruid, uid_t __user *euid, uid_t __user *suid)
21181 +SYSCALL_DEFINE3(getresuid, uid_t __user *, ruid, uid_t __user *, euid, uid_t __user *, suid)
21182  {
21183         int retval;
21184
21185 @@ -747,7 +748,7 @@
21186  /*
21187   * Same as above, but for rgid, egid, sgid.
21188   */
21189 -asmlinkage long sys_setresgid(gid_t rgid, gid_t egid, gid_t sgid)
21190 +SYSCALL_DEFINE3(setresgid, gid_t, rgid, gid_t, egid, gid_t, sgid)
21191  {
21192         int retval;
21193
21194 @@ -784,7 +785,7 @@
21195         return 0;
21196  }
21197
21198 -asmlinkage long sys_getresgid(gid_t __user *rgid, gid_t __user *egid, gid_t __user *sgid)
21199 +SYSCALL_DEFINE3(getresgid, gid_t __user *, rgid, gid_t __user *, egid, gid_t __user *, sgid)
21200  {
21201         int retval;
21202
21203 @@ -802,7 +803,7 @@
21204   * whatever uid it wants to). It normally shadows "euid", except when
21205   * explicitly set by setfsuid() or for access..
21206   */
21207 -asmlinkage long sys_setfsuid(uid_t uid)
21208 +SYSCALL_DEFINE1(setfsuid, uid_t, uid)
21209  {
21210         int old_fsuid;
21211
21212 @@ -831,7 +832,7 @@
21213  /*
21214   * Samma på svenska..
21215   */
21216 -asmlinkage long sys_setfsgid(gid_t gid)
21217 +SYSCALL_DEFINE1(setfsgid, gid_t, gid)
21218  {
21219         int old_fsgid;
21220
21221 @@ -869,7 +870,7 @@
21222         tms->tms_cstime = cputime_to_clock_t(cstime);
21223  }
21224
21225 -asmlinkage long sys_times(struct tms __user * tbuf)
21226 +SYSCALL_DEFINE1(times, struct tms __user *, tbuf)
21227  {
21228         if (tbuf) {
21229                 struct tms tmp;
21230 @@ -893,7 +894,7 @@
21231   * Auch. Had to add the 'did_exec' flag to conform completely to POSIX.
21232   * LBT 04.03.94
21233   */
21234 -asmlinkage long sys_setpgid(pid_t pid, pid_t pgid)
21235 +SYSCALL_DEFINE2(setpgid, pid_t, pid, pid_t, pgid)
21236  {
21237         struct task_struct *p;
21238         struct task_struct *group_leader = current->group_leader;
21239 @@ -964,7 +965,7 @@
21240         return err;
21241  }
21242
21243 -asmlinkage long sys_getpgid(pid_t pid)
21244 +SYSCALL_DEFINE1(getpgid, pid_t, pid)
21245  {
21246         struct task_struct *p;
21247         struct pid *grp;
21248 @@ -994,14 +995,14 @@
21249
21250  #ifdef __ARCH_WANT_SYS_GETPGRP
21251
21252 -asmlinkage long sys_getpgrp(void)
21253 +SYSCALL_DEFINE0(getpgrp)
21254  {
21255         return sys_getpgid(0);
21256  }
21257
21258  #endif
21259
21260 -asmlinkage long sys_getsid(pid_t pid)
21261 +SYSCALL_DEFINE1(getsid, pid_t, pid)
21262  {
21263         struct task_struct *p;
21264         struct pid *sid;
21265 @@ -1029,7 +1030,7 @@
21266         return retval;
21267  }
21268
21269 -asmlinkage long sys_setsid(void)
21270 +SYSCALL_DEFINE0(setsid)
21271  {
21272         struct task_struct *group_leader = current->group_leader;
21273         struct pid *sid = task_pid(group_leader);
21274 @@ -1233,7 +1234,7 @@
21275
21276  EXPORT_SYMBOL(set_current_groups);
21277
21278 -asmlinkage long sys_getgroups(int gidsetsize, gid_t __user *grouplist)
21279 +SYSCALL_DEFINE2(getgroups, int, gidsetsize, gid_t __user *, grouplist)
21280  {
21281         int i = 0;
21282
21283 @@ -1266,7 +1267,7 @@
21284   *     without another task interfering.
21285   */
21286
21287 -asmlinkage long sys_setgroups(int gidsetsize, gid_t __user *grouplist)
21288 +SYSCALL_DEFINE2(setgroups, int, gidsetsize, gid_t __user *, grouplist)
21289  {
21290         struct group_info *group_info;
21291         int retval;
21292 @@ -1316,7 +1317,7 @@
21293
21294  DECLARE_RWSEM(uts_sem);
21295
21296 -asmlinkage long sys_newuname(struct new_utsname __user * name)
21297 +SYSCALL_DEFINE1(newuname, struct new_utsname __user *, name)
21298  {
21299         int errno = 0;
21300
21301 @@ -1327,7 +1328,7 @@
21302         return errno;
21303  }
21304
21305 -asmlinkage long sys_sethostname(char __user *name, int len)
21306 +SYSCALL_DEFINE2(sethostname, char __user *, name, int, len)
21307  {
21308         int errno;
21309         char tmp[__NEW_UTS_LEN];
21310 @@ -1351,7 +1352,7 @@
21311
21312  #ifdef __ARCH_WANT_SYS_GETHOSTNAME
21313
21314 -asmlinkage long sys_gethostname(char __user *name, int len)
21315 +SYSCALL_DEFINE2(gethostname, char __user *, name, int, len)
21316  {
21317         int i, errno;
21318         struct new_utsname *u;
21319 @@ -1376,7 +1377,7 @@
21320   * Only setdomainname; getdomainname can be implemented by calling
21321   * uname()
21322   */
21323 -asmlinkage long sys_setdomainname(char __user *name, int len)
21324 +SYSCALL_DEFINE2(setdomainname, char __user *, name, int, len)
21325  {
21326         int errno;
21327         char tmp[__NEW_UTS_LEN];
21328 @@ -1399,7 +1400,7 @@
21329         return errno;
21330  }
21331
21332 -asmlinkage long sys_getrlimit(unsigned int resource, struct rlimit __user *rlim)
21333 +SYSCALL_DEFINE2(getrlimit, unsigned int, resource, struct rlimit __user *, rlim)
21334  {
21335         if (resource >= RLIM_NLIMITS)
21336                 return -EINVAL;
21337 @@ -1418,7 +1419,8 @@
21338   *     Back compatibility for getrlimit. Needed for some apps.
21339   */
21340
21341 -asmlinkage long sys_old_getrlimit(unsigned int resource, struct rlimit __user *rlim)
21342 +SYSCALL_DEFINE2(old_getrlimit, unsigned int, resource,
21343 +               struct rlimit __user *, rlim)
21344  {
21345         struct rlimit x;
21346         if (resource >= RLIM_NLIMITS)
21347 @@ -1436,7 +1438,7 @@
21348
21349  #endif
21350
21351 -asmlinkage long sys_setrlimit(unsigned int resource, struct rlimit __user *rlim)
21352 +SYSCALL_DEFINE2(setrlimit, unsigned int, resource, struct rlimit __user *, rlim)
21353  {
21354         struct rlimit new_rlim, *old_rlim;
21355         int retval;
21356 @@ -1445,22 +1447,14 @@
21357                 return -EINVAL;
21358         if (copy_from_user(&new_rlim, rlim, sizeof(*rlim)))
21359                 return -EFAULT;
21360 +       if (new_rlim.rlim_cur > new_rlim.rlim_max)
21361 +               return -EINVAL;
21362         old_rlim = current->signal->rlim + resource;
21363         if ((new_rlim.rlim_max > old_rlim->rlim_max) &&
21364             !capable(CAP_SYS_RESOURCE))
21365                 return -EPERM;
21366 -
21367 -       if (resource == RLIMIT_NOFILE) {
21368 -               if (new_rlim.rlim_max == RLIM_INFINITY)
21369 -                       new_rlim.rlim_max = sysctl_nr_open;
21370 -               if (new_rlim.rlim_cur == RLIM_INFINITY)
21371 -                       new_rlim.rlim_cur = sysctl_nr_open;
21372 -               if (new_rlim.rlim_max > sysctl_nr_open)
21373 -                       return -EPERM;
21374 -       }
21375 -
21376 -       if (new_rlim.rlim_cur > new_rlim.rlim_max)
21377 -               return -EINVAL;
21378 +       if (resource == RLIMIT_NOFILE && new_rlim.rlim_max > sysctl_nr_open)
21379 +               return -EPERM;
21380
21381         retval = security_task_setrlimit(resource, &new_rlim);
21382         if (retval)
21383 @@ -1551,6 +1545,8 @@
21384         utime = stime = cputime_zero;
21385
21386         if (who == RUSAGE_THREAD) {
21387 +               utime = task_utime(current);
21388 +               stime = task_stime(current);
21389                 accumulate_thread_rusage(p, r);
21390                 goto out;
21391         }
21392 @@ -1607,7 +1603,7 @@
21393         return copy_to_user(ru, &r, sizeof(r)) ? -EFAULT : 0;
21394  }
21395
21396 -asmlinkage long sys_getrusage(int who, struct rusage __user *ru)
21397 +SYSCALL_DEFINE2(getrusage, int, who, struct rusage __user *, ru)
21398  {
21399         if (who != RUSAGE_SELF && who != RUSAGE_CHILDREN &&
21400             who != RUSAGE_THREAD)
21401 @@ -1615,14 +1611,14 @@
21402         return getrusage(current, who, ru);
21403  }
21404
21405 -asmlinkage long sys_umask(int mask)
21406 +SYSCALL_DEFINE1(umask, int, mask)
21407  {
21408         mask = xchg(&current->fs->umask, mask & S_IRWXUGO);
21409         return mask;
21410  }
21411
21412 -asmlinkage long sys_prctl(int option, unsigned long arg2, unsigned long arg3,
21413 -                         unsigned long arg4, unsigned long arg5)
21414 +SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
21415 +               unsigned long, arg4, unsigned long, arg5)
21416  {
21417         long error = 0;
21418
21419 @@ -1733,8 +1729,8 @@
21420         return error;
21421  }
21422
21423 -asmlinkage long sys_getcpu(unsigned __user *cpup, unsigned __user *nodep,
21424 -                          struct getcpu_cache __user *unused)
21425 +SYSCALL_DEFINE3(getcpu, unsigned __user *, cpup, unsigned __user *, nodep,
21426 +               struct getcpu_cache __user *, unused)
21427  {
21428         int err = 0;
21429         int cpu = raw_smp_processor_id();
21430 --- kernel-power-2.6.28.orig/kernel/sys_ni.c
21431 +++ kernel-power-2.6.28/kernel/sys_ni.c
21432 @@ -131,6 +131,7 @@
21433  cond_syscall(sys_io_submit);
21434  cond_syscall(sys_io_cancel);
21435  cond_syscall(sys_io_getevents);
21436 +cond_syscall(sys_syslog);
21437
21438  /* arch-specific weak syscall entries */
21439  cond_syscall(sys_pciconfig_read);
21440 --- kernel-power-2.6.28.orig/kernel/sysctl.c
21441 +++ kernel-power-2.6.28/kernel/sysctl.c
21442 @@ -1623,7 +1623,7 @@
21443         return error;
21444  }
21445
21446 -asmlinkage long sys_sysctl(struct __sysctl_args __user *args)
21447 +SYSCALL_DEFINE1(sysctl, struct __sysctl_args __user *, args)
21448  {
21449         struct __sysctl_args tmp;
21450         int error;
21451 @@ -2924,7 +2924,7 @@
21452  #else /* CONFIG_SYSCTL_SYSCALL */
21453
21454
21455 -asmlinkage long sys_sysctl(struct __sysctl_args __user *args)
21456 +SYSCALL_DEFINE1(sysctl, struct __sysctl_args __user *, args)
21457  {
21458         struct __sysctl_args tmp;
21459         int error;
21460 --- kernel-power-2.6.28.orig/kernel/time.c
21461 +++ kernel-power-2.6.28/kernel/time.c
21462 @@ -59,7 +59,7 @@
21463   * why not move it into the appropriate arch directory (for those
21464   * architectures that need it).
21465   */
21466 -asmlinkage long sys_time(time_t __user * tloc)
21467 +SYSCALL_DEFINE1(time, time_t __user *, tloc)
21468  {
21469         time_t i = get_seconds();
21470
21471 @@ -77,7 +77,7 @@
21472   * architectures that need it).
21473   */
21474
21475 -asmlinkage long sys_stime(time_t __user *tptr)
21476 +SYSCALL_DEFINE1(stime, time_t __user *, tptr)
21477  {
21478         struct timespec tv;
21479         int err;
21480 @@ -97,8 +97,8 @@
21481
21482  #endif /* __ARCH_WANT_SYS_TIME */
21483
21484 -asmlinkage long sys_gettimeofday(struct timeval __user *tv,
21485 -                                struct timezone __user *tz)
21486 +SYSCALL_DEFINE2(gettimeofday, struct timeval __user *, tv,
21487 +               struct timezone __user *, tz)
21488  {
21489         if (likely(tv != NULL)) {
21490                 struct timeval ktv;
21491 @@ -182,8 +182,8 @@
21492         return 0;
21493  }
21494
21495 -asmlinkage long sys_settimeofday(struct timeval __user *tv,
21496 -                               struct timezone __user *tz)
21497 +SYSCALL_DEFINE2(settimeofday, struct timeval __user *, tv,
21498 +               struct timezone __user *, tz)
21499  {
21500         struct timeval user_tv;
21501         struct timespec new_ts;
21502 @@ -203,7 +203,7 @@
21503         return do_sys_settimeofday(tv ? &new_ts : NULL, tz ? &new_tz : NULL);
21504  }
21505
21506 -asmlinkage long sys_adjtimex(struct timex __user *txc_p)
21507 +SYSCALL_DEFINE1(adjtimex, struct timex __user *, txc_p)
21508  {
21509         struct timex txc;               /* Local copy of parameter */
21510         int ret;
21511 --- kernel-power-2.6.28.orig/kernel/time/timekeeping.c
21512 +++ kernel-power-2.6.28/kernel/time/timekeeping.c
21513 @@ -46,6 +46,9 @@
21514  struct timespec wall_to_monotonic __attribute__ ((aligned (16)));
21515  static unsigned long total_sleep_time;         /* seconds */
21516
21517 +/* flag for if timekeeping is suspended */
21518 +int __read_mostly timekeeping_suspended;
21519 +
21520  static struct timespec xtime_cache __attribute__ ((aligned (16)));
21521  void update_xtime_cache(u64 nsec)
21522  {
21523 @@ -92,6 +95,8 @@
21524         unsigned long seq;
21525         s64 nsecs;
21526
21527 +       WARN_ON(timekeeping_suspended);
21528 +
21529         do {
21530                 seq = read_seqbegin(&xtime_lock);
21531
21532 @@ -299,8 +304,6 @@
21533         write_sequnlock_irqrestore(&xtime_lock, flags);
21534  }
21535
21536 -/* flag for if timekeeping is suspended */
21537 -static int timekeeping_suspended;
21538  /* time in seconds when suspend began */
21539  static unsigned long timekeeping_suspend_time;
21540
21541 --- kernel-power-2.6.28.orig/kernel/timer.c
21542 +++ kernel-power-2.6.28/kernel/timer.c
21543 @@ -1147,7 +1147,7 @@
21544   * For backwards compatibility?  This can be done in libc so Alpha
21545   * and all newer ports shouldn't need it.
21546   */
21547 -asmlinkage unsigned long sys_alarm(unsigned int seconds)
21548 +SYSCALL_DEFINE1(alarm, unsigned int, seconds)
21549  {
21550         return alarm_setitimer(seconds);
21551  }
21552 @@ -1170,7 +1170,7 @@
21553   *
21554   * This is SMP safe as current->tgid does not change.
21555   */
21556 -asmlinkage long sys_getpid(void)
21557 +SYSCALL_DEFINE0(getpid)
21558  {
21559         return task_tgid_vnr(current);
21560  }
21561 @@ -1181,7 +1181,7 @@
21562   * value of ->real_parent under rcu_read_lock(), see
21563   * release_task()->call_rcu(delayed_put_task_struct).
21564   */
21565 -asmlinkage long sys_getppid(void)
21566 +SYSCALL_DEFINE0(getppid)
21567  {
21568         int pid;
21569
21570 @@ -1192,25 +1192,25 @@
21571         return pid;
21572  }
21573
21574 -asmlinkage long sys_getuid(void)
21575 +SYSCALL_DEFINE0(getuid)
21576  {
21577         /* Only we change this so SMP safe */
21578         return current->uid;
21579  }
21580
21581 -asmlinkage long sys_geteuid(void)
21582 +SYSCALL_DEFINE0(geteuid)
21583  {
21584         /* Only we change this so SMP safe */
21585         return current->euid;
21586  }
21587
21588 -asmlinkage long sys_getgid(void)
21589 +SYSCALL_DEFINE0(getgid)
21590  {
21591         /* Only we change this so SMP safe */
21592         return current->gid;
21593  }
21594
21595 -asmlinkage long sys_getegid(void)
21596 +SYSCALL_DEFINE0(getegid)
21597  {
21598         /* Only we change this so SMP safe */
21599         return  current->egid;
21600 @@ -1326,7 +1326,7 @@
21601  EXPORT_SYMBOL(schedule_timeout_uninterruptible);
21602
21603  /* Thread ID - the internal kernel "pid" */
21604 -asmlinkage long sys_gettid(void)
21605 +SYSCALL_DEFINE0(gettid)
21606  {
21607         return task_pid_vnr(current);
21608  }
21609 @@ -1418,7 +1418,7 @@
21610         return 0;
21611  }
21612
21613 -asmlinkage long sys_sysinfo(struct sysinfo __user *info)
21614 +SYSCALL_DEFINE1(sysinfo, struct sysinfo __user *, info)
21615  {
21616         struct sysinfo val;
21617
21618 --- kernel-power-2.6.28.orig/kernel/trace/ring_buffer.c
21619 +++ kernel-power-2.6.28/kernel/trace/ring_buffer.c
21620 @@ -769,6 +769,7 @@
21621          * back to us). This allows us to do a simple loop to
21622          * assign the commit to the tail.
21623          */
21624 + again:
21625         while (cpu_buffer->commit_page != cpu_buffer->tail_page) {
21626                 cpu_buffer->commit_page->commit =
21627                         cpu_buffer->commit_page->write;
21628 @@ -783,6 +784,17 @@
21629                         cpu_buffer->commit_page->write;
21630                 barrier();
21631         }
21632 +
21633 +       /* again, keep gcc from optimizing */
21634 +       barrier();
21635 +
21636 +       /*
21637 +        * If an interrupt came in just after the first while loop
21638 +        * and pushed the tail page forward, we will be left with
21639 +        * a dangling commit that will never go forward.
21640 +        */
21641 +       if (unlikely(cpu_buffer->commit_page != cpu_buffer->tail_page))
21642 +               goto again;
21643  }
21644
21645  static void rb_reset_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
21646 @@ -880,12 +892,15 @@
21647  __rb_reserve_next(struct ring_buffer_per_cpu *cpu_buffer,
21648                   unsigned type, unsigned long length, u64 *ts)
21649  {
21650 -       struct buffer_page *tail_page, *head_page, *reader_page;
21651 +       struct buffer_page *tail_page, *head_page, *reader_page, *commit_page;
21652         unsigned long tail, write;
21653         struct ring_buffer *buffer = cpu_buffer->buffer;
21654         struct ring_buffer_event *event;
21655         unsigned long flags;
21656
21657 +       commit_page = cpu_buffer->commit_page;
21658 +       /* we just need to protect against interrupts */
21659 +       barrier();
21660         tail_page = cpu_buffer->tail_page;
21661         write = local_add_return(length, &tail_page->write);
21662         tail = write - length;
21663 @@ -909,7 +924,7 @@
21664                  * it all the way around the buffer, bail, and warn
21665                  * about it.
21666                  */
21667 -               if (unlikely(next_page == cpu_buffer->commit_page)) {
21668 +               if (unlikely(next_page == commit_page)) {
21669                         WARN_ON_ONCE(1);
21670                         goto out_unlock;
21671                 }
21672 --- kernel-power-2.6.28.orig/kernel/tsacct.c
21673 +++ kernel-power-2.6.28/kernel/tsacct.c
21674 @@ -120,8 +120,10 @@
21675         if (likely(tsk->mm)) {
21676                 cputime_t time, dtime;
21677                 struct timeval value;
21678 +               unsigned long flags;
21679                 u64 delta;
21680
21681 +               local_irq_save(flags);
21682                 time = tsk->stime + tsk->utime;
21683                 dtime = cputime_sub(time, tsk->acct_timexpd);
21684                 jiffies_to_timeval(cputime_to_jiffies(dtime), &value);
21685 @@ -129,10 +131,12 @@
21686                 delta = delta * USEC_PER_SEC + value.tv_usec;
21687
21688                 if (delta == 0)
21689 -                       return;
21690 +                       goto out;
21691                 tsk->acct_timexpd = time;
21692                 tsk->acct_rss_mem1 += delta * get_mm_rss(tsk->mm);
21693                 tsk->acct_vm_mem1 += delta * tsk->mm->total_vm;
21694 +       out:
21695 +               local_irq_restore(flags);
21696         }
21697  }
21698
21699 --- kernel-power-2.6.28.orig/kernel/uid16.c
21700 +++ kernel-power-2.6.28/kernel/uid16.c
21701 @@ -17,7 +17,7 @@
21702
21703  #include <asm/uaccess.h>
21704
21705 -asmlinkage long sys_chown16(const char __user * filename, old_uid_t user, old_gid_t group)
21706 +SYSCALL_DEFINE3(chown16, const char __user *, filename, old_uid_t, user, old_gid_t, group)
21707  {
21708         long ret = sys_chown(filename, low2highuid(user), low2highgid(group));
21709         /* avoid REGPARM breakage on x86: */
21710 @@ -25,7 +25,7 @@
21711         return ret;
21712  }
21713
21714 -asmlinkage long sys_lchown16(const char __user * filename, old_uid_t user, old_gid_t group)
21715 +SYSCALL_DEFINE3(lchown16, const char __user *, filename, old_uid_t, user, old_gid_t, group)
21716  {
21717         long ret = sys_lchown(filename, low2highuid(user), low2highgid(group));
21718         /* avoid REGPARM breakage on x86: */
21719 @@ -33,7 +33,7 @@
21720         return ret;
21721  }
21722
21723 -asmlinkage long sys_fchown16(unsigned int fd, old_uid_t user, old_gid_t group)
21724 +SYSCALL_DEFINE3(fchown16, unsigned int, fd, old_uid_t, user, old_gid_t, group)
21725  {
21726         long ret = sys_fchown(fd, low2highuid(user), low2highgid(group));
21727         /* avoid REGPARM breakage on x86: */
21728 @@ -41,7 +41,7 @@
21729         return ret;
21730  }
21731
21732 -asmlinkage long sys_setregid16(old_gid_t rgid, old_gid_t egid)
21733 +SYSCALL_DEFINE2(setregid16, old_gid_t, rgid, old_gid_t, egid)
21734  {
21735         long ret = sys_setregid(low2highgid(rgid), low2highgid(egid));
21736         /* avoid REGPARM breakage on x86: */
21737 @@ -49,7 +49,7 @@
21738         return ret;
21739  }
21740
21741 -asmlinkage long sys_setgid16(old_gid_t gid)
21742 +SYSCALL_DEFINE1(setgid16, old_gid_t, gid)
21743  {
21744         long ret = sys_setgid(low2highgid(gid));
21745         /* avoid REGPARM breakage on x86: */
21746 @@ -57,7 +57,7 @@
21747         return ret;
21748  }
21749
21750 -asmlinkage long sys_setreuid16(old_uid_t ruid, old_uid_t euid)
21751 +SYSCALL_DEFINE2(setreuid16, old_uid_t, ruid, old_uid_t, euid)
21752  {
21753         long ret = sys_setreuid(low2highuid(ruid), low2highuid(euid));
21754         /* avoid REGPARM breakage on x86: */
21755 @@ -65,7 +65,7 @@
21756         return ret;
21757  }
21758
21759 -asmlinkage long sys_setuid16(old_uid_t uid)
21760 +SYSCALL_DEFINE1(setuid16, old_uid_t, uid)
21761  {
21762         long ret = sys_setuid(low2highuid(uid));
21763         /* avoid REGPARM breakage on x86: */
21764 @@ -73,7 +73,7 @@
21765         return ret;
21766  }
21767
21768 -asmlinkage long sys_setresuid16(old_uid_t ruid, old_uid_t euid, old_uid_t suid)
21769 +SYSCALL_DEFINE3(setresuid16, old_uid_t, ruid, old_uid_t, euid, old_uid_t, suid)
21770  {
21771         long ret = sys_setresuid(low2highuid(ruid), low2highuid(euid),
21772                                  low2highuid(suid));
21773 @@ -82,7 +82,7 @@
21774         return ret;
21775  }
21776
21777 -asmlinkage long sys_getresuid16(old_uid_t __user *ruid, old_uid_t __user *euid, old_uid_t __user *suid)
21778 +SYSCALL_DEFINE3(getresuid16, old_uid_t __user *, ruid, old_uid_t __user *, euid, old_uid_t __user *, suid)
21779  {
21780         int retval;
21781
21782 @@ -93,7 +93,7 @@
21783         return retval;
21784  }
21785
21786 -asmlinkage long sys_setresgid16(old_gid_t rgid, old_gid_t egid, old_gid_t sgid)
21787 +SYSCALL_DEFINE3(setresgid16, old_gid_t, rgid, old_gid_t, egid, old_gid_t, sgid)
21788  {
21789         long ret = sys_setresgid(low2highgid(rgid), low2highgid(egid),
21790                                  low2highgid(sgid));
21791 @@ -102,7 +102,8 @@
21792         return ret;
21793  }
21794
21795 -asmlinkage long sys_getresgid16(old_gid_t __user *rgid, old_gid_t __user *egid, old_gid_t __user *sgid)
21796 +
21797 +SYSCALL_DEFINE3(getresgid16, old_gid_t __user *, rgid, old_gid_t __user *, egid, old_gid_t __user *, sgid)
21798  {
21799         int retval;
21800
21801 @@ -113,7 +114,7 @@
21802         return retval;
21803  }
21804
21805 -asmlinkage long sys_setfsuid16(old_uid_t uid)
21806 +SYSCALL_DEFINE1(setfsuid16, old_uid_t, uid)
21807  {
21808         long ret = sys_setfsuid(low2highuid(uid));
21809         /* avoid REGPARM breakage on x86: */
21810 @@ -121,7 +122,7 @@
21811         return ret;
21812  }
21813
21814 -asmlinkage long sys_setfsgid16(old_gid_t gid)
21815 +SYSCALL_DEFINE1(setfsgid16, old_gid_t, gid)
21816  {
21817         long ret = sys_setfsgid(low2highgid(gid));
21818         /* avoid REGPARM breakage on x86: */
21819 @@ -159,7 +160,7 @@
21820         return 0;
21821  }
21822
21823 -asmlinkage long sys_getgroups16(int gidsetsize, old_gid_t __user *grouplist)
21824 +SYSCALL_DEFINE2(getgroups16, int, gidsetsize, old_gid_t __user *, grouplist)
21825  {
21826         int i = 0;
21827
21828 @@ -183,7 +184,7 @@
21829         return i;
21830  }
21831
21832 -asmlinkage long sys_setgroups16(int gidsetsize, old_gid_t __user *grouplist)
21833 +SYSCALL_DEFINE2(setgroups16, int, gidsetsize, old_gid_t __user *, grouplist)
21834  {
21835         struct group_info *group_info;
21836         int retval;
21837 @@ -208,22 +209,22 @@
21838         return retval;
21839  }
21840
21841 -asmlinkage long sys_getuid16(void)
21842 +SYSCALL_DEFINE0(getuid16)
21843  {
21844         return high2lowuid(current->uid);
21845  }
21846
21847 -asmlinkage long sys_geteuid16(void)
21848 +SYSCALL_DEFINE0(geteuid16)
21849  {
21850         return high2lowuid(current->euid);
21851  }
21852
21853 -asmlinkage long sys_getgid16(void)
21854 +SYSCALL_DEFINE0(getgid16)
21855  {
21856         return high2lowgid(current->gid);
21857  }
21858
21859 -asmlinkage long sys_getegid16(void)
21860 +SYSCALL_DEFINE0(getegid16)
21861  {
21862         return high2lowgid(current->egid);
21863  }
21864 --- kernel-power-2.6.28.orig/kernel/wait.c
21865 +++ kernel-power-2.6.28/kernel/wait.c
21866 @@ -91,6 +91,15 @@
21867  }
21868  EXPORT_SYMBOL(prepare_to_wait_exclusive);
21869
21870 +/*
21871 + * finish_wait - clean up after waiting in a queue
21872 + * @q: waitqueue waited on
21873 + * @wait: wait descriptor
21874 + *
21875 + * Sets current thread back to running state and removes
21876 + * the wait descriptor from the given waitqueue if still
21877 + * queued.
21878 + */
21879  void finish_wait(wait_queue_head_t *q, wait_queue_t *wait)
21880  {
21881         unsigned long flags;
21882 @@ -117,6 +126,39 @@
21883  }
21884  EXPORT_SYMBOL(finish_wait);
21885
21886 +/*
21887 + * abort_exclusive_wait - abort exclusive waiting in a queue
21888 + * @q: waitqueue waited on
21889 + * @wait: wait descriptor
21890 + * @state: runstate of the waiter to be woken
21891 + * @key: key to identify a wait bit queue or %NULL
21892 + *
21893 + * Sets current thread back to running state and removes
21894 + * the wait descriptor from the given waitqueue if still
21895 + * queued.
21896 + *
21897 + * Wakes up the next waiter if the caller is concurrently
21898 + * woken up through the queue.
21899 + *
21900 + * This prevents waiter starvation where an exclusive waiter
21901 + * aborts and is woken up concurrently and noone wakes up
21902 + * the next waiter.
21903 + */
21904 +void abort_exclusive_wait(wait_queue_head_t *q, wait_queue_t *wait,
21905 +                       unsigned int mode, void *key)
21906 +{
21907 +       unsigned long flags;
21908 +
21909 +       __set_current_state(TASK_RUNNING);
21910 +       spin_lock_irqsave(&q->lock, flags);
21911 +       if (!list_empty(&wait->task_list))
21912 +               list_del_init(&wait->task_list);
21913 +       else if (waitqueue_active(q))
21914 +               __wake_up_common(q, mode, 1, 0, key);
21915 +       spin_unlock_irqrestore(&q->lock, flags);
21916 +}
21917 +EXPORT_SYMBOL(abort_exclusive_wait);
21918 +
21919  int autoremove_wake_function(wait_queue_t *wait, unsigned mode, int sync, void *key)
21920  {
21921         int ret = default_wake_function(wait, mode, sync, key);
21922 @@ -177,17 +219,20 @@
21923  __wait_on_bit_lock(wait_queue_head_t *wq, struct wait_bit_queue *q,
21924                         int (*action)(void *), unsigned mode)
21925  {
21926 -       int ret = 0;
21927 -
21928         do {
21929 +               int ret;
21930 +
21931                 prepare_to_wait_exclusive(wq, &q->wait, mode);
21932 -               if (test_bit(q->key.bit_nr, q->key.flags)) {
21933 -                       if ((ret = (*action)(q->key.flags)))
21934 -                               break;
21935 -               }
21936 +               if (!test_bit(q->key.bit_nr, q->key.flags))
21937 +                       continue;
21938 +               ret = action(q->key.flags);
21939 +               if (!ret)
21940 +                       continue;
21941 +               abort_exclusive_wait(wq, &q->wait, mode, &q->key);
21942 +               return ret;
21943         } while (test_and_set_bit(q->key.bit_nr, q->key.flags));
21944         finish_wait(wq, &q->wait);
21945 -       return ret;
21946 +       return 0;
21947  }
21948  EXPORT_SYMBOL(__wait_on_bit_lock);
21949
21950 --- kernel-power-2.6.28.orig/lib/idr.c
21951 +++ kernel-power-2.6.28/lib/idr.c
21952 @@ -121,7 +121,7 @@
21953  {
21954         while (idp->id_free_cnt < IDR_FREE_MAX) {
21955                 struct idr_layer *new;
21956 -               new = kmem_cache_alloc(idr_layer_cache, gfp_mask);
21957 +               new = kmem_cache_zalloc(idr_layer_cache, gfp_mask);
21958                 if (new == NULL)
21959                         return (0);
21960                 move_to_free_list(idp, new);
21961 @@ -623,16 +623,10 @@
21962  }
21963  EXPORT_SYMBOL(idr_replace);
21964
21965 -static void idr_cache_ctor(void *idr_layer)
21966 -{
21967 -       memset(idr_layer, 0, sizeof(struct idr_layer));
21968 -}
21969 -
21970  void __init idr_init_cache(void)
21971  {
21972         idr_layer_cache = kmem_cache_create("idr_layer_cache",
21973 -                               sizeof(struct idr_layer), 0, SLAB_PANIC,
21974 -                               idr_cache_ctor);
21975 +                               sizeof(struct idr_layer), 0, SLAB_PANIC, NULL);
21976  }
21977
21978  /**
21979 --- kernel-power-2.6.28.orig/mm/fadvise.c
21980 +++ kernel-power-2.6.28/mm/fadvise.c
21981 @@ -24,7 +24,7 @@
21982   * POSIX_FADV_WILLNEED could set PG_Referenced, and POSIX_FADV_NOREUSE could
21983   * deactivate the pages and clear PG_Referenced.
21984   */
21985 -asmlinkage long sys_fadvise64_64(int fd, loff_t offset, loff_t len, int advice)
21986 +SYSCALL_DEFINE(fadvise64_64)(int fd, loff_t offset, loff_t len, int advice)
21987  {
21988         struct file *file = fget(fd);
21989         struct address_space *mapping;
21990 @@ -126,12 +126,26 @@
21991         fput(file);
21992         return ret;
21993  }
21994 +#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
21995 +asmlinkage long SyS_fadvise64_64(long fd, loff_t offset, loff_t len, long advice)
21996 +{
21997 +       return SYSC_fadvise64_64((int) fd, offset, len, (int) advice);
21998 +}
21999 +SYSCALL_ALIAS(sys_fadvise64_64, SyS_fadvise64_64);
22000 +#endif
22001
22002  #ifdef __ARCH_WANT_SYS_FADVISE64
22003
22004 -asmlinkage long sys_fadvise64(int fd, loff_t offset, size_t len, int advice)
22005 +SYSCALL_DEFINE(fadvise64)(int fd, loff_t offset, size_t len, int advice)
22006  {
22007         return sys_fadvise64_64(fd, offset, len, advice);
22008  }
22009 +#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
22010 +asmlinkage long SyS_fadvise64(long fd, loff_t offset, long len, long advice)
22011 +{
22012 +       return SYSC_fadvise64((int) fd, offset, (size_t)len, (int)advice);
22013 +}
22014 +SYSCALL_ALIAS(sys_fadvise64, SyS_fadvise64);
22015 +#endif
22016
22017  #endif
22018 --- kernel-power-2.6.28.orig/mm/filemap.c
22019 +++ kernel-power-2.6.28/mm/filemap.c
22020 @@ -210,7 +210,7 @@
22021         int ret;
22022         struct writeback_control wbc = {
22023                 .sync_mode = sync_mode,
22024 -               .nr_to_write = mapping->nrpages * 2,
22025 +               .nr_to_write = LONG_MAX,
22026                 .range_start = start,
22027                 .range_end = end,
22028         };
22029 @@ -1317,7 +1317,8 @@
22030                         goto out; /* skip atime */
22031                 size = i_size_read(inode);
22032                 if (pos < size) {
22033 -                       retval = filemap_write_and_wait(mapping);
22034 +                       retval = filemap_write_and_wait_range(mapping, pos,
22035 +                                       pos + iov_length(iov, nr_segs) - 1);
22036                         if (!retval) {
22037                                 retval = mapping->a_ops->direct_IO(READ, iocb,
22038                                                         iov, pos, nr_segs);
22039 @@ -1366,7 +1367,7 @@
22040         return 0;
22041  }
22042
22043 -asmlinkage ssize_t sys_readahead(int fd, loff_t offset, size_t count)
22044 +SYSCALL_DEFINE(readahead)(int fd, loff_t offset, size_t count)
22045  {
22046         ssize_t ret;
22047         struct file *file;
22048 @@ -1385,6 +1386,13 @@
22049         }
22050         return ret;
22051  }
22052 +#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
22053 +asmlinkage long SyS_readahead(long fd, loff_t offset, long count)
22054 +{
22055 +       return SYSC_readahead((int) fd, offset, (size_t) count);
22056 +}
22057 +SYSCALL_ALIAS(sys_readahead, SyS_readahead);
22058 +#endif
22059
22060  #ifdef CONFIG_MMU
22061  /**
22062 @@ -2060,18 +2068,10 @@
22063         if (count != ocount)
22064                 *nr_segs = iov_shorten((struct iovec *)iov, *nr_segs, count);
22065
22066 -       /*
22067 -        * Unmap all mmappings of the file up-front.
22068 -        *
22069 -        * This will cause any pte dirty bits to be propagated into the
22070 -        * pageframes for the subsequent filemap_write_and_wait().
22071 -        */
22072         write_len = iov_length(iov, *nr_segs);
22073         end = (pos + write_len - 1) >> PAGE_CACHE_SHIFT;
22074 -       if (mapping_mapped(mapping))
22075 -               unmap_mapping_range(mapping, pos, write_len, 0);
22076
22077 -       written = filemap_write_and_wait(mapping);
22078 +       written = filemap_write_and_wait_range(mapping, pos, pos + write_len - 1);
22079         if (written)
22080                 goto out;
22081
22082 @@ -2140,19 +2140,24 @@
22083   * Find or create a page at the given pagecache position. Return the locked
22084   * page. This function is specifically for buffered writes.
22085   */
22086 -struct page *__grab_cache_page(struct address_space *mapping, pgoff_t index)
22087 +struct page *grab_cache_page_write_begin(struct address_space *mapping,
22088 +                                       pgoff_t index, unsigned flags)
22089  {
22090         int status;
22091         struct page *page;
22092 +       gfp_t gfp_notmask = 0;
22093 +       if (flags & AOP_FLAG_NOFS)
22094 +               gfp_notmask = __GFP_FS;
22095  repeat:
22096         page = find_lock_page(mapping, index);
22097         if (likely(page))
22098                 return page;
22099
22100 -       page = page_cache_alloc(mapping);
22101 +       page = __page_cache_alloc(mapping_gfp_mask(mapping) & ~gfp_notmask);
22102         if (!page)
22103                 return NULL;
22104 -       status = add_to_page_cache_lru(page, mapping, index, GFP_KERNEL);
22105 +       status = add_to_page_cache_lru(page, mapping, index,
22106 +                                               GFP_KERNEL & ~gfp_notmask);
22107         if (unlikely(status)) {
22108                 page_cache_release(page);
22109                 if (status == -EEXIST)
22110 @@ -2161,7 +2166,7 @@
22111         }
22112         return page;
22113  }
22114 -EXPORT_SYMBOL(__grab_cache_page);
22115 +EXPORT_SYMBOL(grab_cache_page_write_begin);
22116
22117  static ssize_t generic_perform_write(struct file *file,
22118                                 struct iov_iter *i, loff_t pos)
22119 @@ -2286,7 +2291,8 @@
22120          * the file data here, to try to honour O_DIRECT expectations.
22121          */
22122         if (unlikely(file->f_flags & O_DIRECT) && written)
22123 -               status = filemap_write_and_wait(mapping);
22124 +               status = filemap_write_and_wait_range(mapping,
22125 +                                       pos, pos + written - 1);
22126
22127         return written ? written : status;
22128  }
22129 --- kernel-power-2.6.28.orig/mm/filemap_xip.c
22130 +++ kernel-power-2.6.28/mm/filemap_xip.c
22131 @@ -89,8 +89,8 @@
22132                         }
22133                 }
22134                 nr = nr - offset;
22135 -               if (nr > len)
22136 -                       nr = len;
22137 +               if (nr > len - copied)
22138 +                       nr = len - copied;
22139
22140                 error = mapping->a_ops->get_xip_mem(mapping, index, 0,
22141                                                         &xip_mem, &xip_pfn);
22142 --- kernel-power-2.6.28.orig/mm/fremap.c
22143 +++ kernel-power-2.6.28/mm/fremap.c
22144 @@ -120,8 +120,8 @@
22145   * and the vma's default protection is used. Arbitrary protections
22146   * might be implemented in the future.
22147   */
22148 -asmlinkage long sys_remap_file_pages(unsigned long start, unsigned long size,
22149 -       unsigned long prot, unsigned long pgoff, unsigned long flags)
22150 +SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
22151 +               unsigned long, prot, unsigned long, pgoff, unsigned long, flags)
22152  {
22153         struct mm_struct *mm = current->mm;
22154         struct address_space *mapping;
22155 --- kernel-power-2.6.28.orig/mm/madvise.c
22156 +++ kernel-power-2.6.28/mm/madvise.c
22157 @@ -281,7 +281,7 @@
22158   *  -EBADF  - map exists, but area maps something that isn't a file.
22159   *  -EAGAIN - a kernel resource was temporarily unavailable.
22160   */
22161 -asmlinkage long sys_madvise(unsigned long start, size_t len_in, int behavior)
22162 +SYSCALL_DEFINE3(madvise, unsigned long, start, size_t, len_in, int, behavior)
22163  {
22164         unsigned long end, tmp;
22165         struct vm_area_struct * vma, *prev;
22166 --- kernel-power-2.6.28.orig/mm/memory.c
22167 +++ kernel-power-2.6.28/mm/memory.c
22168 @@ -1882,7 +1882,7 @@
22169          * Don't let another task, with possibly unlocked vma,
22170          * keep the mlocked page.
22171          */
22172 -       if (vma->vm_flags & VM_LOCKED) {
22173 +       if ((vma->vm_flags & VM_LOCKED) && old_page) {
22174                 lock_page(old_page);    /* for LRU manipulation */
22175                 clear_page_mlock(old_page);
22176                 unlock_page(old_page);
22177 --- kernel-power-2.6.28.orig/mm/mempolicy.c
22178 +++ kernel-power-2.6.28/mm/mempolicy.c
22179 @@ -1068,10 +1068,9 @@
22180         return copy_to_user(mask, nodes_addr(*nodes), copy) ? -EFAULT : 0;
22181  }
22182
22183 -asmlinkage long sys_mbind(unsigned long start, unsigned long len,
22184 -                       unsigned long mode,
22185 -                       unsigned long __user *nmask, unsigned long maxnode,
22186 -                       unsigned flags)
22187 +SYSCALL_DEFINE6(mbind, unsigned long, start, unsigned long, len,
22188 +               unsigned long, mode, unsigned long __user *, nmask,
22189 +               unsigned long, maxnode, unsigned, flags)
22190  {
22191         nodemask_t nodes;
22192         int err;
22193 @@ -1091,8 +1090,8 @@
22194  }
22195
22196  /* Set the process memory policy */
22197 -asmlinkage long sys_set_mempolicy(int mode, unsigned long __user *nmask,
22198 -               unsigned long maxnode)
22199 +SYSCALL_DEFINE3(set_mempolicy, int, mode, unsigned long __user *, nmask,
22200 +               unsigned long, maxnode)
22201  {
22202         int err;
22203         nodemask_t nodes;
22204 @@ -1110,9 +1109,9 @@
22205         return do_set_mempolicy(mode, flags, &nodes);
22206  }
22207
22208 -asmlinkage long sys_migrate_pages(pid_t pid, unsigned long maxnode,
22209 -               const unsigned long __user *old_nodes,
22210 -               const unsigned long __user *new_nodes)
22211 +SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
22212 +               const unsigned long __user *, old_nodes,
22213 +               const unsigned long __user *, new_nodes)
22214  {
22215         struct mm_struct *mm;
22216         struct task_struct *task;
22217 @@ -1180,10 +1179,9 @@
22218
22219
22220  /* Retrieve NUMA policy */
22221 -asmlinkage long sys_get_mempolicy(int __user *policy,
22222 -                               unsigned long __user *nmask,
22223 -                               unsigned long maxnode,
22224 -                               unsigned long addr, unsigned long flags)
22225 +SYSCALL_DEFINE5(get_mempolicy, int __user *, policy,
22226 +               unsigned long __user *, nmask, unsigned long, maxnode,
22227 +               unsigned long, addr, unsigned long, flags)
22228  {
22229         int err;
22230         int uninitialized_var(pval);
22231 --- kernel-power-2.6.28.orig/mm/migrate.c
22232 +++ kernel-power-2.6.28/mm/migrate.c
22233 @@ -1070,10 +1070,10 @@
22234   * Move a list of pages in the address space of the currently executing
22235   * process.
22236   */
22237 -asmlinkage long sys_move_pages(pid_t pid, unsigned long nr_pages,
22238 -                       const void __user * __user *pages,
22239 -                       const int __user *nodes,
22240 -                       int __user *status, int flags)
22241 +SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
22242 +               const void __user * __user *, pages,
22243 +               const int __user *, nodes,
22244 +               int __user *, status, int, flags)
22245  {
22246         struct task_struct *task;
22247         struct mm_struct *mm;
22248 --- kernel-power-2.6.28.orig/mm/mincore.c
22249 +++ kernel-power-2.6.28/mm/mincore.c
22250 @@ -177,8 +177,8 @@
22251   *             mapped
22252   *  -EAGAIN - A kernel resource was temporarily unavailable.
22253   */
22254 -asmlinkage long sys_mincore(unsigned long start, size_t len,
22255 -       unsigned char __user * vec)
22256 +SYSCALL_DEFINE3(mincore, unsigned long, start, size_t, len,
22257 +               unsigned char __user *, vec)
22258  {
22259         long retval;
22260         unsigned long pages;
22261 --- kernel-power-2.6.28.orig/mm/mlock.c
22262 +++ kernel-power-2.6.28/mm/mlock.c
22263 @@ -293,14 +293,10 @@
22264   *
22265   * return number of pages [> 0] to be removed from locked_vm on success
22266   * of "special" vmas.
22267 - *
22268 - * return negative error if vma spanning @start-@range disappears while
22269 - * mmap semaphore is dropped.  Unlikely?
22270   */
22271  long mlock_vma_pages_range(struct vm_area_struct *vma,
22272                         unsigned long start, unsigned long end)
22273  {
22274 -       struct mm_struct *mm = vma->vm_mm;
22275         int nr_pages = (end - start) / PAGE_SIZE;
22276         BUG_ON(!(vma->vm_flags & VM_LOCKED));
22277
22278 @@ -313,20 +309,11 @@
22279         if (!((vma->vm_flags & (VM_DONTEXPAND | VM_RESERVED)) ||
22280                         is_vm_hugetlb_page(vma) ||
22281                         vma == get_gate_vma(current))) {
22282 -               long error;
22283 -               downgrade_write(&mm->mmap_sem);
22284 -
22285 -               error = __mlock_vma_pages_range(vma, start, end, 1);
22286
22287 -               up_read(&mm->mmap_sem);
22288 -               /* vma can change or disappear */
22289 -               down_write(&mm->mmap_sem);
22290 -               vma = find_vma(mm, start);
22291 -               /* non-NULL vma must contain @start, but need to check @end */
22292 -               if (!vma ||  end > vma->vm_end)
22293 -                       return -ENOMEM;
22294 +               __mlock_vma_pages_range(vma, start, end, 1);
22295
22296 -               return 0;       /* hide other errors from mmap(), et al */
22297 +               /* Hide errors from mmap() and other callers */
22298 +               return 0;
22299         }
22300
22301         /*
22302 @@ -437,41 +424,14 @@
22303         vma->vm_flags = newflags;
22304
22305         if (lock) {
22306 -               /*
22307 -                * mmap_sem is currently held for write.  Downgrade the write
22308 -                * lock to a read lock so that other faults, mmap scans, ...
22309 -                * while we fault in all pages.
22310 -                */
22311 -               downgrade_write(&mm->mmap_sem);
22312 -
22313                 ret = __mlock_vma_pages_range(vma, start, end, 1);
22314
22315 -               /*
22316 -                * Need to reacquire mmap sem in write mode, as our callers
22317 -                * expect this.  We have no support for atomically upgrading
22318 -                * a sem to write, so we need to check for ranges while sem
22319 -                * is unlocked.
22320 -                */
22321 -               up_read(&mm->mmap_sem);
22322 -               /* vma can change or disappear */
22323 -               down_write(&mm->mmap_sem);
22324 -               *prev = find_vma(mm, start);
22325 -               /* non-NULL *prev must contain @start, but need to check @end */
22326 -               if (!(*prev) || end > (*prev)->vm_end)
22327 -                       ret = -ENOMEM;
22328 -               else if (ret > 0) {
22329 +               if (ret > 0) {
22330                         mm->locked_vm -= ret;
22331                         ret = 0;
22332                 } else
22333                         ret = __mlock_posix_error_return(ret); /* translate if needed */
22334         } else {
22335 -               /*
22336 -                * TODO:  for unlocking, pages will already be resident, so
22337 -                * we don't need to wait for allocations/reclaim/pagein, ...
22338 -                * However, unlocking a very large region can still take a
22339 -                * while.  Should we downgrade the semaphore for both lock
22340 -                * AND unlock ?
22341 -                */
22342                 __mlock_vma_pages_range(vma, start, end, 0);
22343         }
22344
22345 @@ -529,7 +489,7 @@
22346         return error;
22347  }
22348
22349 -asmlinkage long sys_mlock(unsigned long start, size_t len)
22350 +SYSCALL_DEFINE2(mlock, unsigned long, start, size_t, len)
22351  {
22352         unsigned long locked;
22353         unsigned long lock_limit;
22354 @@ -557,7 +517,7 @@
22355         return error;
22356  }
22357
22358 -asmlinkage long sys_munlock(unsigned long start, size_t len)
22359 +SYSCALL_DEFINE2(munlock, unsigned long, start, size_t, len)
22360  {
22361         int ret;
22362
22363 @@ -594,7 +554,7 @@
22364         return 0;
22365  }
22366
22367 -asmlinkage long sys_mlockall(int flags)
22368 +SYSCALL_DEFINE1(mlockall, int, flags)
22369  {
22370         unsigned long lock_limit;
22371         int ret = -EINVAL;
22372 @@ -622,7 +582,7 @@
22373         return ret;
22374  }
22375
22376 -asmlinkage long sys_munlockall(void)
22377 +SYSCALL_DEFINE0(munlockall)
22378  {
22379         int ret;
22380
22381 --- kernel-power-2.6.28.orig/mm/mmap.c
22382 +++ kernel-power-2.6.28/mm/mmap.c
22383 @@ -245,7 +245,7 @@
22384         return next;
22385  }
22386
22387 -asmlinkage unsigned long sys_brk(unsigned long brk)
22388 +SYSCALL_DEFINE1(brk, unsigned long, brk)
22389  {
22390         unsigned long rlim, retval;
22391         unsigned long newbrk, oldbrk;
22392 @@ -1095,6 +1095,7 @@
22393  {
22394         struct mm_struct *mm = current->mm;
22395         struct vm_area_struct *vma, *prev;
22396 +       struct vm_area_struct *merged_vma;
22397         int correct_wcount = 0;
22398         int error;
22399         struct rb_node **rb_link, *rb_parent;
22400 @@ -1207,13 +1208,17 @@
22401         if (vma_wants_writenotify(vma))
22402                 vma->vm_page_prot = vm_get_page_prot(vm_flags & ~VM_SHARED);
22403
22404 -       if (file && vma_merge(mm, prev, addr, vma->vm_end,
22405 -                       vma->vm_flags, NULL, file, pgoff, vma_policy(vma))) {
22406 +       merged_vma = NULL;
22407 +       if (file)
22408 +               merged_vma = vma_merge(mm, prev, addr, vma->vm_end,
22409 +                       vma->vm_flags, NULL, file, pgoff, vma_policy(vma));
22410 +       if (merged_vma) {
22411                 mpol_put(vma_policy(vma));
22412                 kmem_cache_free(vm_area_cachep, vma);
22413                 fput(file);
22414                 if (vm_flags & VM_EXECUTABLE)
22415                         removed_exe_file_vma(mm);
22416 +               vma = merged_vma;
22417         } else {
22418                 vma_link(mm, vma, prev, rb_link, rb_parent);
22419                 file = vma->vm_file;
22420 @@ -1575,7 +1580,7 @@
22421          * Overcommit..  This must be the final test, as it will
22422          * update security statistics.
22423          */
22424 -       if (security_vm_enough_memory(grow))
22425 +       if (security_vm_enough_memory_mm(mm, grow))
22426                 return -ENOMEM;
22427
22428         /* Ok, everything looks good - let it rip */
22429 @@ -1949,7 +1954,7 @@
22430
22431  EXPORT_SYMBOL(do_munmap);
22432
22433 -asmlinkage long sys_munmap(unsigned long addr, size_t len)
22434 +SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
22435  {
22436         int ret;
22437         struct mm_struct *mm = current->mm;
22438 @@ -2088,7 +2093,6 @@
22439         unsigned long end;
22440
22441         /* mm's last user has gone, and its about to be pulled down */
22442 -       arch_exit_mmap(mm);
22443         mmu_notifier_release(mm);
22444
22445         if (mm->locked_vm) {
22446 @@ -2099,7 +2103,13 @@
22447                         vma = vma->vm_next;
22448                 }
22449         }
22450 +
22451 +       arch_exit_mmap(mm);
22452 +
22453         vma = mm->mmap;
22454 +       if (!vma)       /* Can happen if dup_mmap() received an OOM */
22455 +               return;
22456 +
22457         lru_add_drain();
22458         flush_cache_mm(mm);
22459         tlb = tlb_gather_mmu(mm, 1);
22460 --- kernel-power-2.6.28.orig/mm/mprotect.c
22461 +++ kernel-power-2.6.28/mm/mprotect.c
22462 @@ -219,8 +219,8 @@
22463         return error;
22464  }
22465
22466 -asmlinkage long
22467 -sys_mprotect(unsigned long start, size_t len, unsigned long prot)
22468 +SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
22469 +               unsigned long, prot)
22470  {
22471         unsigned long vm_flags, nstart, end, tmp, reqprot;
22472         struct vm_area_struct *vma, *prev;
22473 --- kernel-power-2.6.28.orig/mm/mremap.c
22474 +++ kernel-power-2.6.28/mm/mremap.c
22475 @@ -420,9 +420,9 @@
22476         return ret;
22477  }
22478
22479 -asmlinkage unsigned long sys_mremap(unsigned long addr,
22480 -       unsigned long old_len, unsigned long new_len,
22481 -       unsigned long flags, unsigned long new_addr)
22482 +SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len,
22483 +               unsigned long, new_len, unsigned long, flags,
22484 +               unsigned long, new_addr)
22485  {
22486         unsigned long ret;
22487
22488 --- kernel-power-2.6.28.orig/mm/msync.c
22489 +++ kernel-power-2.6.28/mm/msync.c
22490 @@ -28,7 +28,7 @@
22491   * So by _not_ starting I/O in MS_ASYNC we provide complete flexibility to
22492   * applications.
22493   */
22494 -asmlinkage long sys_msync(unsigned long start, size_t len, int flags)
22495 +SYSCALL_DEFINE3(msync, unsigned long, start, size_t, len, int, flags)
22496  {
22497         unsigned long end;
22498         struct mm_struct *mm = current->mm;
22499 --- kernel-power-2.6.28.orig/mm/nommu.c
22500 +++ kernel-power-2.6.28/mm/nommu.c
22501 @@ -377,7 +377,7 @@
22502   *  to a regular file.  in this case, the unmapping will need
22503   *  to invoke file system routines that need the global lock.
22504   */
22505 -asmlinkage unsigned long sys_brk(unsigned long brk)
22506 +SYSCALL_DEFINE1(brk, unsigned long, brk)
22507  {
22508         struct mm_struct *mm = current->mm;
22509
22510 @@ -1192,7 +1192,7 @@
22511  }
22512  EXPORT_SYMBOL(do_munmap);
22513
22514 -asmlinkage long sys_munmap(unsigned long addr, size_t len)
22515 +SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
22516  {
22517         int ret;
22518         struct mm_struct *mm = current->mm;
22519 @@ -1283,9 +1283,9 @@
22520  }
22521  EXPORT_SYMBOL(do_mremap);
22522
22523 -asmlinkage unsigned long sys_mremap(unsigned long addr,
22524 -       unsigned long old_len, unsigned long new_len,
22525 -       unsigned long flags, unsigned long new_addr)
22526 +SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len,
22527 +               unsigned long, new_len, unsigned long, flags,
22528 +               unsigned long, new_addr)
22529  {
22530         unsigned long ret;
22531
22532 --- kernel-power-2.6.28.orig/mm/page-writeback.c
22533 +++ kernel-power-2.6.28/mm/page-writeback.c
22534 @@ -980,9 +980,11 @@
22535         int done = 0;
22536         struct pagevec pvec;
22537         int nr_pages;
22538 +       pgoff_t uninitialized_var(writeback_index);
22539         pgoff_t index;
22540         pgoff_t end;            /* Inclusive */
22541 -       int scanned = 0;
22542 +       pgoff_t done_index;
22543 +       int cycled;
22544         int range_whole = 0;
22545         long nr_to_write = wbc->nr_to_write;
22546
22547 @@ -993,83 +995,146 @@
22548
22549         pagevec_init(&pvec, 0);
22550         if (wbc->range_cyclic) {
22551 -               index = mapping->writeback_index; /* Start from prev offset */
22552 +               writeback_index = mapping->writeback_index; /* prev offset */
22553 +               index = writeback_index;
22554 +               if (index == 0)
22555 +                       cycled = 1;
22556 +               else
22557 +                       cycled = 0;
22558                 end = -1;
22559         } else {
22560                 index = wbc->range_start >> PAGE_CACHE_SHIFT;
22561                 end = wbc->range_end >> PAGE_CACHE_SHIFT;
22562                 if (wbc->range_start == 0 && wbc->range_end == LLONG_MAX)
22563                         range_whole = 1;
22564 -               scanned = 1;
22565 +               cycled = 1; /* ignore range_cyclic tests */
22566         }
22567  retry:
22568 -       while (!done && (index <= end) &&
22569 -              (nr_pages = pagevec_lookup_tag(&pvec, mapping, &index,
22570 -                                             PAGECACHE_TAG_DIRTY,
22571 -                                             min(end - index, (pgoff_t)PAGEVEC_SIZE-1) + 1))) {
22572 -               unsigned i;
22573 +       done_index = index;
22574 +       while (!done && (index <= end)) {
22575 +               int i;
22576 +
22577 +               nr_pages = pagevec_lookup_tag(&pvec, mapping, &index,
22578 +                             PAGECACHE_TAG_DIRTY,
22579 +                             min(end - index, (pgoff_t)PAGEVEC_SIZE-1) + 1);
22580 +               if (nr_pages == 0)
22581 +                       break;
22582
22583 -               scanned = 1;
22584                 for (i = 0; i < nr_pages; i++) {
22585                         struct page *page = pvec.pages[i];
22586
22587                         /*
22588 -                        * At this point we hold neither mapping->tree_lock nor
22589 -                        * lock on the page itself: the page may be truncated or
22590 -                        * invalidated (changing page->mapping to NULL), or even
22591 -                        * swizzled back from swapper_space to tmpfs file
22592 -                        * mapping
22593 +                        * At this point, the page may be truncated or
22594 +                        * invalidated (changing page->mapping to NULL), or
22595 +                        * even swizzled back from swapper_space to tmpfs file
22596 +                        * mapping. However, page->index will not change
22597 +                        * because we have a reference on the page.
22598                          */
22599 +                       if (page->index > end) {
22600 +                               /*
22601 +                                * can't be range_cyclic (1st pass) because
22602 +                                * end == -1 in that case.
22603 +                                */
22604 +                               done = 1;
22605 +                               break;
22606 +                       }
22607 +
22608 +                       done_index = page->index + 1;
22609 +
22610                         lock_page(page);
22611
22612 +                       /*
22613 +                        * Page truncated or invalidated. We can freely skip it
22614 +                        * then, even for data integrity operations: the page
22615 +                        * has disappeared concurrently, so there could be no
22616 +                        * real expectation of this data interity operation
22617 +                        * even if there is now a new, dirty page at the same
22618 +                        * pagecache address.
22619 +                        */
22620                         if (unlikely(page->mapping != mapping)) {
22621 +continue_unlock:
22622                                 unlock_page(page);
22623                                 continue;
22624                         }
22625
22626 -                       if (!wbc->range_cyclic && page->index > end) {
22627 -                               done = 1;
22628 -                               unlock_page(page);
22629 -                               continue;
22630 +                       if (!PageDirty(page)) {
22631 +                               /* someone wrote it for us */
22632 +                               goto continue_unlock;
22633                         }
22634
22635 -                       if (wbc->sync_mode != WB_SYNC_NONE)
22636 -                               wait_on_page_writeback(page);
22637 -
22638 -                       if (PageWriteback(page) ||
22639 -                           !clear_page_dirty_for_io(page)) {
22640 -                               unlock_page(page);
22641 -                               continue;
22642 +                       if (PageWriteback(page)) {
22643 +                               if (wbc->sync_mode != WB_SYNC_NONE)
22644 +                                       wait_on_page_writeback(page);
22645 +                               else
22646 +                                       goto continue_unlock;
22647                         }
22648
22649 -                       ret = (*writepage)(page, wbc, data);
22650 +                       BUG_ON(PageWriteback(page));
22651 +                       if (!clear_page_dirty_for_io(page))
22652 +                               goto continue_unlock;
22653
22654 -                       if (unlikely(ret == AOP_WRITEPAGE_ACTIVATE)) {
22655 -                               unlock_page(page);
22656 -                               ret = 0;
22657 +                       ret = (*writepage)(page, wbc, data);
22658 +                       if (unlikely(ret)) {
22659 +                               if (ret == AOP_WRITEPAGE_ACTIVATE) {
22660 +                                       unlock_page(page);
22661 +                                       ret = 0;
22662 +                               } else {
22663 +                                       /*
22664 +                                        * done_index is set past this page,
22665 +                                        * so media errors will not choke
22666 +                                        * background writeout for the entire
22667 +                                        * file. This has consequences for
22668 +                                        * range_cyclic semantics (ie. it may
22669 +                                        * not be suitable for data integrity
22670 +                                        * writeout).
22671 +                                        */
22672 +                                       done = 1;
22673 +                                       break;
22674 +                               }
22675 +                       }
22676 +
22677 +                       if (nr_to_write > 0) {
22678 +                               nr_to_write--;
22679 +                               if (nr_to_write == 0 &&
22680 +                                   wbc->sync_mode == WB_SYNC_NONE) {
22681 +                                       /*
22682 +                                        * We stop writing back only if we are
22683 +                                        * not doing integrity sync. In case of
22684 +                                        * integrity sync we have to keep going
22685 +                                        * because someone may be concurrently
22686 +                                        * dirtying pages, and we might have
22687 +                                        * synced a lot of newly appeared dirty
22688 +                                        * pages, but have not synced all of the
22689 +                                        * old dirty pages.
22690 +                                        */
22691 +                                       done = 1;
22692 +                                       break;
22693 +                               }
22694                         }
22695 -                       if (ret || (--nr_to_write <= 0))
22696 -                               done = 1;
22697 +
22698                         if (wbc->nonblocking && bdi_write_congested(bdi)) {
22699                                 wbc->encountered_congestion = 1;
22700                                 done = 1;
22701 +                               break;
22702                         }
22703                 }
22704                 pagevec_release(&pvec);
22705                 cond_resched();
22706         }
22707 -       if (!scanned && !done) {
22708 +       if (!cycled && !done) {
22709                 /*
22710 +                * range_cyclic:
22711                  * We hit the last page and there is more work to be done: wrap
22712                  * back to the start of the file
22713                  */
22714 -               scanned = 1;
22715 +               cycled = 1;
22716                 index = 0;
22717 +               end = writeback_index - 1;
22718                 goto retry;
22719         }
22720         if (!wbc->no_nrwrite_index_update) {
22721                 if (wbc->range_cyclic || (range_whole && nr_to_write > 0))
22722 -                       mapping->writeback_index = index;
22723 +                       mapping->writeback_index = done_index;
22724                 wbc->nr_to_write = nr_to_write;
22725         }
22726
22727 --- kernel-power-2.6.28.orig/mm/page_alloc.c
22728 +++ kernel-power-2.6.28/mm/page_alloc.c
22729 @@ -2974,7 +2974,7 @@
22730   * was used and there are no special requirements, this is a convenient
22731   * alternative
22732   */
22733 -int __meminit early_pfn_to_nid(unsigned long pfn)
22734 +int __meminit __early_pfn_to_nid(unsigned long pfn)
22735  {
22736         int i;
22737
22738 @@ -2985,10 +2985,33 @@
22739                 if (start_pfn <= pfn && pfn < end_pfn)
22740                         return early_node_map[i].nid;
22741         }
22742 +       /* This is a memory hole */
22743 +       return -1;
22744 +}
22745 +#endif /* CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID */
22746 +
22747 +int __meminit early_pfn_to_nid(unsigned long pfn)
22748 +{
22749 +       int nid;
22750
22751 +       nid = __early_pfn_to_nid(pfn);
22752 +       if (nid >= 0)
22753 +               return nid;
22754 +       /* just returns 0 */
22755         return 0;
22756  }
22757 -#endif /* CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID */
22758 +
22759 +#ifdef CONFIG_NODES_SPAN_OTHER_NODES
22760 +bool __meminit early_pfn_in_nid(unsigned long pfn, int node)
22761 +{
22762 +       int nid;
22763 +
22764 +       nid = __early_pfn_to_nid(pfn);
22765 +       if (nid >= 0 && nid != node)
22766 +               return false;
22767 +       return true;
22768 +}
22769 +#endif
22770
22771  /* Basic iterator support to walk early_node_map[] */
22772  #define for_each_active_range_index_in_nid(i, nid) \
22773 --- kernel-power-2.6.28.orig/mm/swapfile.c
22774 +++ kernel-power-2.6.28/mm/swapfile.c
22775 @@ -1352,7 +1352,7 @@
22776  }
22777  #endif
22778
22779 -asmlinkage long sys_swapoff(const char __user * specialfile)
22780 +SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
22781  {
22782         struct swap_info_struct * p = NULL;
22783         unsigned short *swap_map;
22784 @@ -1597,7 +1597,7 @@
22785   *
22786   * The swapon system call
22787   */
22788 -asmlinkage long sys_swapon(const char __user * specialfile, int swap_flags)
22789 +SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
22790  {
22791         struct swap_info_struct * p;
22792         char *name = NULL;
22793 --- kernel-power-2.6.28.orig/mm/vmalloc.c
22794 +++ kernel-power-2.6.28/mm/vmalloc.c
22795 @@ -23,6 +23,7 @@
22796  #include <linux/rbtree.h>
22797  #include <linux/radix-tree.h>
22798  #include <linux/rcupdate.h>
22799 +#include <linux/bootmem.h>
22800
22801  #include <asm/atomic.h>
22802  #include <asm/uaccess.h>
22803 @@ -151,11 +152,12 @@
22804   *
22805   * Ie. pte at addr+N*PAGE_SIZE shall point to pfn corresponding to pages[N]
22806   */
22807 -static int vmap_page_range(unsigned long addr, unsigned long end,
22808 +static int vmap_page_range(unsigned long start, unsigned long end,
22809                                 pgprot_t prot, struct page **pages)
22810  {
22811         pgd_t *pgd;
22812         unsigned long next;
22813 +       unsigned long addr = start;
22814         int err = 0;
22815         int nr = 0;
22816
22817 @@ -167,7 +169,7 @@
22818                 if (err)
22819                         break;
22820         } while (pgd++, addr = next, addr != end);
22821 -       flush_cache_vmap(addr, end);
22822 +       flush_cache_vmap(start, end);
22823
22824         if (unlikely(err))
22825                 return err;
22826 @@ -321,6 +323,7 @@
22827         unsigned long addr;
22828         int purged = 0;
22829
22830 +       BUG_ON(!size);
22831         BUG_ON(size & ~PAGE_MASK);
22832
22833         va = kmalloc_node(sizeof(struct vmap_area),
22834 @@ -332,6 +335,9 @@
22835         addr = ALIGN(vstart, align);
22836
22837         spin_lock(&vmap_area_lock);
22838 +       if (addr + size - 1 < addr)
22839 +               goto overflow;
22840 +
22841         /* XXX: could have a last_hole cache */
22842         n = vmap_area_root.rb_node;
22843         if (n) {
22844 @@ -363,6 +369,8 @@
22845
22846                 while (addr + size > first->va_start && addr + size <= vend) {
22847                         addr = ALIGN(first->va_end + PAGE_SIZE, align);
22848 +                       if (addr + size - 1 < addr)
22849 +                               goto overflow;
22850
22851                         n = rb_next(&first->rb_node);
22852                         if (n)
22853 @@ -373,6 +381,7 @@
22854         }
22855  found:
22856         if (addr + size > vend) {
22857 +overflow:
22858                 spin_unlock(&vmap_area_lock);
22859                 if (!purged) {
22860                         purge_vmap_area_lazy();
22861 @@ -474,6 +483,7 @@
22862         static DEFINE_SPINLOCK(purge_lock);
22863         LIST_HEAD(valist);
22864         struct vmap_area *va;
22865 +       struct vmap_area *n_va;
22866         int nr = 0;
22867
22868         /*
22869 @@ -513,7 +523,7 @@
22870
22871         if (nr) {
22872                 spin_lock(&vmap_area_lock);
22873 -               list_for_each_entry(va, &valist, purge_list)
22874 +               list_for_each_entry_safe(va, n_va, &valist, purge_list)
22875                         __free_vmap_area(va);
22876                 spin_unlock(&vmap_area_lock);
22877         }
22878 @@ -959,6 +969,8 @@
22879
22880  void __init vmalloc_init(void)
22881  {
22882 +       struct vmap_area *va;
22883 +       struct vm_struct *tmp;
22884         int i;
22885
22886         for_each_possible_cpu(i) {
22887 @@ -971,12 +983,22 @@
22888                 vbq->nr_dirty = 0;
22889         }
22890
22891 +       /* Import existing vmlist entries. */
22892 +       for (tmp = vmlist; tmp; tmp = tmp->next) {
22893 +               va = alloc_bootmem(sizeof(struct vmap_area));
22894 +               va->flags = tmp->flags | VM_VM_AREA;
22895 +               va->va_start = (unsigned long)tmp->addr;
22896 +               va->va_end = va->va_start + tmp->size;
22897 +               __insert_vmap_area(va);
22898 +       }
22899         vmap_initialized = true;
22900  }
22901
22902  void unmap_kernel_range(unsigned long addr, unsigned long size)
22903  {
22904         unsigned long end = addr + size;
22905 +
22906 +       flush_cache_vunmap(addr, end);
22907         vunmap_page_range(addr, end);
22908         flush_tlb_kernel_range(addr, end);
22909  }
22910 --- kernel-power-2.6.28.orig/net/bridge/br_if.c
22911 +++ kernel-power-2.6.28/net/bridge/br_if.c
22912 @@ -426,7 +426,6 @@
22913  err1:
22914         kobject_del(&p->kobj);
22915  err0:
22916 -       kobject_put(&p->kobj);
22917         dev_set_promiscuity(dev, -1);
22918  put_back:
22919         dev_put(dev);
22920 --- kernel-power-2.6.28.orig/net/bridge/netfilter/ebtables.c
22921 +++ kernel-power-2.6.28/net/bridge/netfilter/ebtables.c
22922 @@ -80,7 +80,7 @@
22923  {
22924         par->match     = m->u.match;
22925         par->matchinfo = m->data;
22926 -       return m->u.match->match(skb, par);
22927 +       return m->u.match->match(skb, par) ? EBT_MATCH : EBT_NOMATCH;
22928  }
22929
22930  static inline int ebt_dev_check(char *entry, const struct net_device *device)
22931 --- kernel-power-2.6.28.orig/net/core/net_namespace.c
22932 +++ kernel-power-2.6.28/net/core/net_namespace.c
22933 @@ -342,8 +342,8 @@
22934         rv = register_pernet_operations(first_device, ops);
22935         if (rv < 0)
22936                 ida_remove(&net_generic_ids, *id);
22937 -       mutex_unlock(&net_mutex);
22938  out:
22939 +       mutex_unlock(&net_mutex);
22940         return rv;
22941  }
22942  EXPORT_SYMBOL_GPL(register_pernet_gen_subsys);
22943 --- kernel-power-2.6.28.orig/net/core/skbuff.c
22944 +++ kernel-power-2.6.28/net/core/skbuff.c
22945 @@ -73,17 +73,13 @@
22946  static void sock_pipe_buf_release(struct pipe_inode_info *pipe,
22947                                   struct pipe_buffer *buf)
22948  {
22949 -       struct sk_buff *skb = (struct sk_buff *) buf->private;
22950 -
22951 -       kfree_skb(skb);
22952 +       put_page(buf->page);
22953  }
22954
22955  static void sock_pipe_buf_get(struct pipe_inode_info *pipe,
22956                                 struct pipe_buffer *buf)
22957  {
22958 -       struct sk_buff *skb = (struct sk_buff *) buf->private;
22959 -
22960 -       skb_get(skb);
22961 +       get_page(buf->page);
22962  }
22963
22964  static int sock_pipe_buf_steal(struct pipe_inode_info *pipe,
22965 @@ -147,14 +143,6 @@
22966         BUG();
22967  }
22968
22969 -void skb_truesize_bug(struct sk_buff *skb)
22970 -{
22971 -       WARN(net_ratelimit(), KERN_ERR "SKB BUG: Invalid truesize (%u) "
22972 -              "len=%u, sizeof(sk_buff)=%Zd\n",
22973 -              skb->truesize, skb->len, sizeof(struct sk_buff));
22974 -}
22975 -EXPORT_SYMBOL(skb_truesize_bug);
22976 -
22977  /*     Allocate a new skbuff. We do this ourselves so we can fill in a few
22978   *     'private' fields and also do memory statistics to find all the
22979   *     [BEEP] leaks.
22980 @@ -1333,9 +1321,19 @@
22981   */
22982  static void sock_spd_release(struct splice_pipe_desc *spd, unsigned int i)
22983  {
22984 -       struct sk_buff *skb = (struct sk_buff *) spd->partial[i].private;
22985 +       put_page(spd->pages[i]);
22986 +}
22987
22988 -       kfree_skb(skb);
22989 +static inline struct page *linear_to_page(struct page *page, unsigned int len,
22990 +                                         unsigned int offset)
22991 +{
22992 +       struct page *p = alloc_pages(GFP_KERNEL, 0);
22993 +
22994 +       if (!p)
22995 +               return NULL;
22996 +       memcpy(page_address(p) + offset, page_address(page) + offset, len);
22997 +
22998 +       return p;
22999  }
23000
23001  /*
23002 @@ -1343,16 +1341,23 @@
23003   */
23004  static inline int spd_fill_page(struct splice_pipe_desc *spd, struct page *page,
23005                                 unsigned int len, unsigned int offset,
23006 -                               struct sk_buff *skb)
23007 +                               struct sk_buff *skb, int linear)
23008  {
23009         if (unlikely(spd->nr_pages == PIPE_BUFFERS))
23010                 return 1;
23011
23012 +       if (linear) {
23013 +               page = linear_to_page(page, len, offset);
23014 +               if (!page)
23015 +                       return 1;
23016 +       } else
23017 +               get_page(page);
23018 +
23019         spd->pages[spd->nr_pages] = page;
23020         spd->partial[spd->nr_pages].len = len;
23021         spd->partial[spd->nr_pages].offset = offset;
23022 -       spd->partial[spd->nr_pages].private = (unsigned long) skb_get(skb);
23023         spd->nr_pages++;
23024 +
23025         return 0;
23026  }
23027
23028 @@ -1368,7 +1373,7 @@
23029  static inline int __splice_segment(struct page *page, unsigned int poff,
23030                                    unsigned int plen, unsigned int *off,
23031                                    unsigned int *len, struct sk_buff *skb,
23032 -                                  struct splice_pipe_desc *spd)
23033 +                                  struct splice_pipe_desc *spd, int linear)
23034  {
23035         if (!*len)
23036                 return 1;
23037 @@ -1391,7 +1396,7 @@
23038                 /* the linear region may spread across several pages  */
23039                 flen = min_t(unsigned int, flen, PAGE_SIZE - poff);
23040
23041 -               if (spd_fill_page(spd, page, flen, poff, skb))
23042 +               if (spd_fill_page(spd, page, flen, poff, skb, linear))
23043                         return 1;
23044
23045                 __segment_seek(&page, &poff, &plen, flen);
23046 @@ -1418,7 +1423,7 @@
23047         if (__splice_segment(virt_to_page(skb->data),
23048                              (unsigned long) skb->data & (PAGE_SIZE - 1),
23049                              skb_headlen(skb),
23050 -                            offset, len, skb, spd))
23051 +                            offset, len, skb, spd, 1))
23052                 return 1;
23053
23054         /*
23055 @@ -1428,7 +1433,7 @@
23056                 const skb_frag_t *f = &skb_shinfo(skb)->frags[seg];
23057
23058                 if (__splice_segment(f->page, f->page_offset, f->size,
23059 -                                    offset, len, skb, spd))
23060 +                                    offset, len, skb, spd, 0))
23061                         return 1;
23062         }
23063
23064 @@ -1441,7 +1446,7 @@
23065   * the frag list, if such a thing exists. We'd probably need to recurse to
23066   * handle that cleanly.
23067   */
23068 -int skb_splice_bits(struct sk_buff *__skb, unsigned int offset,
23069 +int skb_splice_bits(struct sk_buff *skb, unsigned int offset,
23070                     struct pipe_inode_info *pipe, unsigned int tlen,
23071                     unsigned int flags)
23072  {
23073 @@ -1454,16 +1459,6 @@
23074                 .ops = &sock_pipe_buf_ops,
23075                 .spd_release = sock_spd_release,
23076         };
23077 -       struct sk_buff *skb;
23078 -
23079 -       /*
23080 -        * I'd love to avoid the clone here, but tcp_read_sock()
23081 -        * ignores reference counts and unconditonally kills the sk_buff
23082 -        * on return from the actor.
23083 -        */
23084 -       skb = skb_clone(__skb, GFP_KERNEL);
23085 -       if (unlikely(!skb))
23086 -               return -ENOMEM;
23087
23088         /*
23089          * __skb_splice_bits() only fails if the output has no room left,
23090 @@ -1487,15 +1482,9 @@
23091         }
23092
23093  done:
23094 -       /*
23095 -        * drop our reference to the clone, the pipe consumption will
23096 -        * drop the rest.
23097 -        */
23098 -       kfree_skb(skb);
23099 -
23100         if (spd.nr_pages) {
23101 +               struct sock *sk = skb->sk;
23102                 int ret;
23103 -               struct sock *sk = __skb->sk;
23104
23105                 /*
23106                  * Drop the socket lock, otherwise we have reverse
23107 @@ -2072,10 +2061,10 @@
23108                 return 0;
23109
23110  next_skb:
23111 -       block_limit = skb_headlen(st->cur_skb);
23112 +       block_limit = skb_headlen(st->cur_skb) + st->stepped_offset;
23113
23114         if (abs_offset < block_limit) {
23115 -               *data = st->cur_skb->data + abs_offset;
23116 +               *data = st->cur_skb->data + (abs_offset - st->stepped_offset);
23117                 return block_limit - abs_offset;
23118         }
23119
23120 @@ -2110,13 +2099,14 @@
23121                 st->frag_data = NULL;
23122         }
23123
23124 -       if (st->cur_skb->next) {
23125 -               st->cur_skb = st->cur_skb->next;
23126 +       if (st->root_skb == st->cur_skb &&
23127 +           skb_shinfo(st->root_skb)->frag_list) {
23128 +               st->cur_skb = skb_shinfo(st->root_skb)->frag_list;
23129                 st->frag_idx = 0;
23130                 goto next_skb;
23131 -       } else if (st->root_skb == st->cur_skb &&
23132 -                  skb_shinfo(st->root_skb)->frag_list) {
23133 -               st->cur_skb = skb_shinfo(st->root_skb)->frag_list;
23134 +       } else if (st->cur_skb->next) {
23135 +               st->cur_skb = st->cur_skb->next;
23136 +               st->frag_idx = 0;
23137                 goto next_skb;
23138         }
23139
23140 --- kernel-power-2.6.28.orig/net/core/sock.c
23141 +++ kernel-power-2.6.28/net/core/sock.c
23142 @@ -696,6 +696,8 @@
23143         if (len < 0)
23144                 return -EINVAL;
23145
23146 +       memset(&v, 0, sizeof(v));
23147 +
23148         switch(optname) {
23149         case SO_DEBUG:
23150                 v.val = sock_flag(sk, SOCK_DBG);
23151 @@ -1150,7 +1152,6 @@
23152  {
23153         struct sock *sk = skb->sk;
23154
23155 -       skb_truesize_check(skb);
23156         atomic_sub(skb->truesize, &sk->sk_rmem_alloc);
23157         sk_mem_uncharge(skb->sk, skb->truesize);
23158  }
23159 --- kernel-power-2.6.28.orig/net/ipv4/ipconfig.c
23160 +++ kernel-power-2.6.28/net/ipv4/ipconfig.c
23161 @@ -1272,6 +1272,9 @@
23162  static int __init ip_auto_config(void)
23163  {
23164         __be32 addr;
23165 +#ifdef IPCONFIG_DYNAMIC
23166 +       int retries = CONF_OPEN_RETRIES;
23167 +#endif
23168
23169  #ifdef CONFIG_PROC_FS
23170         proc_net_fops_create(&init_net, "pnp", S_IRUGO, &pnp_seq_fops);
23171 @@ -1308,9 +1311,6 @@
23172  #endif
23173             ic_first_dev->next) {
23174  #ifdef IPCONFIG_DYNAMIC
23175 -
23176 -               int retries = CONF_OPEN_RETRIES;
23177 -
23178                 if (ic_dynamic() < 0) {
23179                         ic_close_devs();
23180
23181 --- kernel-power-2.6.28.orig/net/ipv4/netfilter/arp_tables.c
23182 +++ kernel-power-2.6.28/net/ipv4/netfilter/arp_tables.c
23183 @@ -374,7 +374,9 @@
23184                             && unconditional(&e->arp)) || visited) {
23185                                 unsigned int oldpos, size;
23186
23187 -                               if (t->verdict < -NF_MAX_VERDICT - 1) {
23188 +                               if ((strcmp(t->target.u.user.name,
23189 +                                           ARPT_STANDARD_TARGET) == 0) &&
23190 +                                   t->verdict < -NF_MAX_VERDICT - 1) {
23191                                         duprintf("mark_source_chains: bad "
23192                                                 "negative verdict (%i)\n",
23193                                                                 t->verdict);
23194 --- kernel-power-2.6.28.orig/net/ipv4/netfilter/ip_tables.c
23195 +++ kernel-power-2.6.28/net/ipv4/netfilter/ip_tables.c
23196 @@ -500,7 +500,9 @@
23197                             && unconditional(&e->ip)) || visited) {
23198                                 unsigned int oldpos, size;
23199
23200 -                               if (t->verdict < -NF_MAX_VERDICT - 1) {
23201 +                               if ((strcmp(t->target.u.user.name,
23202 +                                           IPT_STANDARD_TARGET) == 0) &&
23203 +                                   t->verdict < -NF_MAX_VERDICT - 1) {
23204                                         duprintf("mark_source_chains: bad "
23205                                                 "negative verdict (%i)\n",
23206                                                                 t->verdict);
23207 --- kernel-power-2.6.28.orig/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
23208 +++ kernel-power-2.6.28/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
23209 @@ -20,7 +20,7 @@
23210  #include <net/netfilter/nf_conntrack_core.h>
23211  #include <net/netfilter/nf_log.h>
23212
23213 -static unsigned long nf_ct_icmp_timeout __read_mostly = 30*HZ;
23214 +static unsigned int nf_ct_icmp_timeout __read_mostly = 30*HZ;
23215
23216  static bool icmp_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff,
23217                               struct nf_conntrack_tuple *tuple)
23218 --- kernel-power-2.6.28.orig/net/ipv4/tcp.c
23219 +++ kernel-power-2.6.28/net/ipv4/tcp.c
23220 @@ -520,8 +520,13 @@
23221                                 unsigned int offset, size_t len)
23222  {
23223         struct tcp_splice_state *tss = rd_desc->arg.data;
23224 +       int ret;
23225
23226 -       return skb_splice_bits(skb, offset, tss->pipe, tss->len, tss->flags);
23227 +       ret = skb_splice_bits(skb, offset, tss->pipe, min(rd_desc->count, len),
23228 +                             tss->flags);
23229 +       if (ret > 0)
23230 +               rd_desc->count -= ret;
23231 +       return ret;
23232  }
23233
23234  static int __tcp_splice_read(struct sock *sk, struct tcp_splice_state *tss)
23235 @@ -529,6 +534,7 @@
23236         /* Store TCP splice context information in read_descriptor_t. */
23237         read_descriptor_t rd_desc = {
23238                 .arg.data = tss,
23239 +               .count    = tss->len,
23240         };
23241
23242         return tcp_read_sock(sk, &rd_desc, tcp_splice_data_recv);
23243 @@ -578,10 +584,6 @@
23244                 else if (!ret) {
23245                         if (spliced)
23246                                 break;
23247 -                       if (flags & SPLICE_F_NONBLOCK) {
23248 -                               ret = -EAGAIN;
23249 -                               break;
23250 -                       }
23251                         if (sock_flag(sk, SOCK_DONE))
23252                                 break;
23253                         if (sk->sk_err) {
23254 @@ -599,6 +601,10 @@
23255                                         ret = -ENOTCONN;
23256                                 break;
23257                         }
23258 +                       if (flags & SPLICE_F_NONBLOCK) {
23259 +                               ret = -EAGAIN;
23260 +                               break;
23261 +                       }
23262                         if (!timeo) {
23263                                 ret = -EAGAIN;
23264                                 break;
23265 @@ -613,11 +619,13 @@
23266                 tss.len -= ret;
23267                 spliced += ret;
23268
23269 +               if (!timeo)
23270 +                       break;
23271                 release_sock(sk);
23272                 lock_sock(sk);
23273
23274                 if (sk->sk_err || sk->sk_state == TCP_CLOSE ||
23275 -                   (sk->sk_shutdown & RCV_SHUTDOWN) || !timeo ||
23276 +                   (sk->sk_shutdown & RCV_SHUTDOWN) ||
23277                     signal_pending(current))
23278                         break;
23279         }
23280 --- kernel-power-2.6.28.orig/net/ipv4/udp.c
23281 +++ kernel-power-2.6.28/net/ipv4/udp.c
23282 @@ -942,9 +942,11 @@
23283
23284         if ((rc = sock_queue_rcv_skb(sk, skb)) < 0) {
23285                 /* Note that an ENOMEM error is charged twice */
23286 -               if (rc == -ENOMEM)
23287 +               if (rc == -ENOMEM) {
23288                         UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
23289                                          is_udplite);
23290 +                       atomic_inc(&sk->sk_drops);
23291 +               }
23292                 goto drop;
23293         }
23294
23295 @@ -1155,7 +1157,7 @@
23296                    int proto)
23297  {
23298         struct sock *sk;
23299 -       struct udphdr *uh = udp_hdr(skb);
23300 +       struct udphdr *uh;
23301         unsigned short ulen;
23302         struct rtable *rt = (struct rtable*)skb->dst;
23303         __be32 saddr = ip_hdr(skb)->saddr;
23304 @@ -1168,6 +1170,7 @@
23305         if (!pskb_may_pull(skb, sizeof(struct udphdr)))
23306                 goto drop;              /* No space for header. */
23307
23308 +       uh   = udp_hdr(skb);
23309         ulen = ntohs(uh->len);
23310         if (ulen > skb->len)
23311                 goto short_packet;
23312 --- kernel-power-2.6.28.orig/net/ipv6/inet6_hashtables.c
23313 +++ kernel-power-2.6.28/net/ipv6/inet6_hashtables.c
23314 @@ -210,11 +210,11 @@
23315
23316         if (twp != NULL) {
23317                 *twp = tw;
23318 -               NET_INC_STATS_BH(twsk_net(tw), LINUX_MIB_TIMEWAITRECYCLED);
23319 +               NET_INC_STATS_BH(net, LINUX_MIB_TIMEWAITRECYCLED);
23320         } else if (tw != NULL) {
23321                 /* Silly. Should hash-dance instead... */
23322                 inet_twsk_deschedule(tw, death_row);
23323 -               NET_INC_STATS_BH(twsk_net(tw), LINUX_MIB_TIMEWAITRECYCLED);
23324 +               NET_INC_STATS_BH(net, LINUX_MIB_TIMEWAITRECYCLED);
23325
23326                 inet_twsk_put(tw);
23327         }
23328 --- kernel-power-2.6.28.orig/net/ipv6/ip6_fib.c
23329 +++ kernel-power-2.6.28/net/ipv6/ip6_fib.c
23330 @@ -298,6 +298,10 @@
23331         struct fib6_walker_t *w = (void*)cb->args[2];
23332
23333         if (w) {
23334 +               if (cb->args[4]) {
23335 +                       cb->args[4] = 0;
23336 +                       fib6_walker_unlink(w);
23337 +               }
23338                 cb->args[2] = 0;
23339                 kfree(w);
23340         }
23341 @@ -330,15 +334,12 @@
23342                 read_lock_bh(&table->tb6_lock);
23343                 res = fib6_walk_continue(w);
23344                 read_unlock_bh(&table->tb6_lock);
23345 -               if (res != 0) {
23346 -                       if (res < 0)
23347 -                               fib6_walker_unlink(w);
23348 -                       goto end;
23349 +               if (res <= 0) {
23350 +                       fib6_walker_unlink(w);
23351 +                       cb->args[4] = 0;
23352                 }
23353 -               fib6_walker_unlink(w);
23354 -               cb->args[4] = 0;
23355         }
23356 -end:
23357 +
23358         return res;
23359  }
23360
23361 --- kernel-power-2.6.28.orig/net/ipv6/ip6_flowlabel.c
23362 +++ kernel-power-2.6.28/net/ipv6/ip6_flowlabel.c
23363 @@ -323,17 +323,21 @@
23364  fl_create(struct net *net, struct in6_flowlabel_req *freq, char __user *optval,
23365           int optlen, int *err_p)
23366  {
23367 -       struct ip6_flowlabel *fl;
23368 +       struct ip6_flowlabel *fl = NULL;
23369         int olen;
23370         int addr_type;
23371         int err;
23372
23373 +       olen = optlen - CMSG_ALIGN(sizeof(*freq));
23374 +       err = -EINVAL;
23375 +       if (olen > 64 * 1024)
23376 +               goto done;
23377 +
23378         err = -ENOMEM;
23379         fl = kzalloc(sizeof(*fl), GFP_KERNEL);
23380         if (fl == NULL)
23381                 goto done;
23382
23383 -       olen = optlen - CMSG_ALIGN(sizeof(*freq));
23384         if (olen > 0) {
23385                 struct msghdr msg;
23386                 struct flowi flowi;
23387 --- kernel-power-2.6.28.orig/net/ipv6/ip6_input.c
23388 +++ kernel-power-2.6.28/net/ipv6/ip6_input.c
23389 @@ -75,8 +75,7 @@
23390         if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL ||
23391             !idev || unlikely(idev->cnf.disable_ipv6)) {
23392                 IP6_INC_STATS_BH(net, idev, IPSTATS_MIB_INDISCARDS);
23393 -               rcu_read_unlock();
23394 -               goto out;
23395 +               goto drop;
23396         }
23397
23398         memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
23399 @@ -147,7 +146,6 @@
23400  drop:
23401         rcu_read_unlock();
23402         kfree_skb(skb);
23403 -out:
23404         return 0;
23405  }
23406
23407 --- kernel-power-2.6.28.orig/net/ipv6/ip6_output.c
23408 +++ kernel-power-2.6.28/net/ipv6/ip6_output.c
23409 @@ -1104,6 +1104,18 @@
23410         return err;
23411  }
23412
23413 +static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
23414 +                                              gfp_t gfp)
23415 +{
23416 +       return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
23417 +}
23418 +
23419 +static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
23420 +                                               gfp_t gfp)
23421 +{
23422 +       return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
23423 +}
23424 +
23425  int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
23426         int offset, int len, int odd, struct sk_buff *skb),
23427         void *from, int length, int transhdrlen,
23428 @@ -1129,17 +1141,37 @@
23429                  * setup for corking
23430                  */
23431                 if (opt) {
23432 -                       if (np->cork.opt == NULL) {
23433 -                               np->cork.opt = kmalloc(opt->tot_len,
23434 -                                                      sk->sk_allocation);
23435 -                               if (unlikely(np->cork.opt == NULL))
23436 -                                       return -ENOBUFS;
23437 -                       } else if (np->cork.opt->tot_len < opt->tot_len) {
23438 -                               printk(KERN_DEBUG "ip6_append_data: invalid option length\n");
23439 +                       if (WARN_ON(np->cork.opt))
23440                                 return -EINVAL;
23441 -                       }
23442 -                       memcpy(np->cork.opt, opt, opt->tot_len);
23443 -                       inet->cork.flags |= IPCORK_OPT;
23444 +
23445 +                       np->cork.opt = kmalloc(opt->tot_len, sk->sk_allocation);
23446 +                       if (unlikely(np->cork.opt == NULL))
23447 +                               return -ENOBUFS;
23448 +
23449 +                       np->cork.opt->tot_len = opt->tot_len;
23450 +                       np->cork.opt->opt_flen = opt->opt_flen;
23451 +                       np->cork.opt->opt_nflen = opt->opt_nflen;
23452 +
23453 +                       np->cork.opt->dst0opt = ip6_opt_dup(opt->dst0opt,
23454 +                                                           sk->sk_allocation);
23455 +                       if (opt->dst0opt && !np->cork.opt->dst0opt)
23456 +                               return -ENOBUFS;
23457 +
23458 +                       np->cork.opt->dst1opt = ip6_opt_dup(opt->dst1opt,
23459 +                                                           sk->sk_allocation);
23460 +                       if (opt->dst1opt && !np->cork.opt->dst1opt)
23461 +                               return -ENOBUFS;
23462 +
23463 +                       np->cork.opt->hopopt = ip6_opt_dup(opt->hopopt,
23464 +                                                          sk->sk_allocation);
23465 +                       if (opt->hopopt && !np->cork.opt->hopopt)
23466 +                               return -ENOBUFS;
23467 +
23468 +                       np->cork.opt->srcrt = ip6_rthdr_dup(opt->srcrt,
23469 +                                                           sk->sk_allocation);
23470 +                       if (opt->srcrt && !np->cork.opt->srcrt)
23471 +                               return -ENOBUFS;
23472 +
23473                         /* need source address above miyazawa*/
23474                 }
23475                 dst_hold(&rt->u.dst);
23476 @@ -1166,8 +1198,7 @@
23477         } else {
23478                 rt = (struct rt6_info *)inet->cork.dst;
23479                 fl = &inet->cork.fl;
23480 -               if (inet->cork.flags & IPCORK_OPT)
23481 -                       opt = np->cork.opt;
23482 +               opt = np->cork.opt;
23483                 transhdrlen = 0;
23484                 exthdrlen = 0;
23485                 mtu = inet->cork.fragsize;
23486 @@ -1406,9 +1437,15 @@
23487
23488  static void ip6_cork_release(struct inet_sock *inet, struct ipv6_pinfo *np)
23489  {
23490 -       inet->cork.flags &= ~IPCORK_OPT;
23491 -       kfree(np->cork.opt);
23492 -       np->cork.opt = NULL;
23493 +       if (np->cork.opt) {
23494 +               kfree(np->cork.opt->dst0opt);
23495 +               kfree(np->cork.opt->dst1opt);
23496 +               kfree(np->cork.opt->hopopt);
23497 +               kfree(np->cork.opt->srcrt);
23498 +               kfree(np->cork.opt);
23499 +               np->cork.opt = NULL;
23500 +       }
23501 +
23502         if (inet->cork.dst) {
23503                 dst_release(inet->cork.dst);
23504                 inet->cork.dst = NULL;
23505 --- kernel-power-2.6.28.orig/net/ipv6/netfilter/ip6_tables.c
23506 +++ kernel-power-2.6.28/net/ipv6/netfilter/ip6_tables.c
23507 @@ -525,7 +525,9 @@
23508                             && unconditional(&e->ipv6)) || visited) {
23509                                 unsigned int oldpos, size;
23510
23511 -                               if (t->verdict < -NF_MAX_VERDICT - 1) {
23512 +                               if ((strcmp(t->target.u.user.name,
23513 +                                           IP6T_STANDARD_TARGET) == 0) &&
23514 +                                   t->verdict < -NF_MAX_VERDICT - 1) {
23515                                         duprintf("mark_source_chains: bad "
23516                                                 "negative verdict (%i)\n",
23517                                                                 t->verdict);
23518 --- kernel-power-2.6.28.orig/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
23519 +++ kernel-power-2.6.28/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
23520 @@ -26,7 +26,7 @@
23521  #include <net/netfilter/ipv6/nf_conntrack_icmpv6.h>
23522  #include <net/netfilter/nf_log.h>
23523
23524 -static unsigned long nf_ct_icmpv6_timeout __read_mostly = 30*HZ;
23525 +static unsigned int nf_ct_icmpv6_timeout __read_mostly = 30*HZ;
23526
23527  static bool icmpv6_pkt_to_tuple(const struct sk_buff *skb,
23528                                 unsigned int dataoff,
23529 @@ -49,8 +49,8 @@
23530  static const u_int8_t invmap[] = {
23531         [ICMPV6_ECHO_REQUEST - 128]     = ICMPV6_ECHO_REPLY + 1,
23532         [ICMPV6_ECHO_REPLY - 128]       = ICMPV6_ECHO_REQUEST + 1,
23533 -       [ICMPV6_NI_QUERY - 128]         = ICMPV6_NI_QUERY + 1,
23534 -       [ICMPV6_NI_REPLY - 128]         = ICMPV6_NI_REPLY +1
23535 +       [ICMPV6_NI_QUERY - 128]         = ICMPV6_NI_REPLY + 1,
23536 +       [ICMPV6_NI_REPLY - 128]         = ICMPV6_NI_QUERY +1
23537  };
23538
23539  static bool icmpv6_invert_tuple(struct nf_conntrack_tuple *tuple,
23540 --- kernel-power-2.6.28.orig/net/mac80211/tx.c
23541 +++ kernel-power-2.6.28/net/mac80211/tx.c
23542 @@ -1302,8 +1302,10 @@
23543                 if (is_multicast_ether_addr(hdr->addr3))
23544                         memcpy(hdr->addr1, hdr->addr3, ETH_ALEN);
23545                 else
23546 -                       if (mesh_nexthop_lookup(skb, osdata))
23547 -                               return  0;
23548 +                       if (mesh_nexthop_lookup(skb, osdata)) {
23549 +                               dev_put(odev);
23550 +                               return 0;
23551 +                       }
23552                 if (memcmp(odev->dev_addr, hdr->addr4, ETH_ALEN) != 0)
23553                         IEEE80211_IFSTA_MESH_CTR_INC(&osdata->u.mesh,
23554                                                             fwded_frames);
23555 @@ -1336,6 +1338,8 @@
23556                                                 list) {
23557                                 if (!netif_running(sdata->dev))
23558                                         continue;
23559 +                               if (sdata->vif.type != NL80211_IFTYPE_AP)
23560 +                                       continue;
23561                                 if (compare_ether_addr(sdata->dev->dev_addr,
23562                                                        hdr->addr2)) {
23563                                         dev_hold(sdata->dev);
23564 --- kernel-power-2.6.28.orig/net/netfilter/nf_conntrack_netlink.c
23565 +++ kernel-power-2.6.28/net/netfilter/nf_conntrack_netlink.c
23566 @@ -825,13 +825,16 @@
23567         if (!parse_nat_setup) {
23568  #ifdef CONFIG_MODULES
23569                 rcu_read_unlock();
23570 +               spin_unlock_bh(&nf_conntrack_lock);
23571                 nfnl_unlock();
23572                 if (request_module("nf-nat-ipv4") < 0) {
23573                         nfnl_lock();
23574 +                       spin_lock_bh(&nf_conntrack_lock);
23575                         rcu_read_lock();
23576                         return -EOPNOTSUPP;
23577                 }
23578                 nfnl_lock();
23579 +               spin_lock_bh(&nf_conntrack_lock);
23580                 rcu_read_lock();
23581                 if (nfnetlink_parse_nat_setup_hook)
23582                         return -EAGAIN;
23583 --- kernel-power-2.6.28.orig/net/netfilter/nf_conntrack_proto_tcp.c
23584 +++ kernel-power-2.6.28/net/netfilter/nf_conntrack_proto_tcp.c
23585 @@ -15,6 +15,7 @@
23586  #include <linux/skbuff.h>
23587  #include <linux/ipv6.h>
23588  #include <net/ip6_checksum.h>
23589 +#include <asm/unaligned.h>
23590
23591  #include <net/tcp.h>
23592
23593 @@ -466,7 +467,7 @@
23594                                 for (i = 0;
23595                                      i < (opsize - TCPOLEN_SACK_BASE);
23596                                      i += TCPOLEN_SACK_PERBLOCK) {
23597 -                                       tmp = ntohl(*((__be32 *)(ptr+i)+1));
23598 +                                       tmp = get_unaligned_be32((__be32 *)(ptr+i)+1);
23599
23600                                         if (after(tmp, *sack))
23601                                                 *sack = tmp;
23602 --- kernel-power-2.6.28.orig/net/netfilter/x_tables.c
23603 +++ kernel-power-2.6.28/net/netfilter/x_tables.c
23604 @@ -273,6 +273,10 @@
23605                                 have_rev = 1;
23606                 }
23607         }
23608 +
23609 +       if (af != NFPROTO_UNSPEC && !have_rev)
23610 +               return match_revfn(NFPROTO_UNSPEC, name, revision, bestp);
23611 +
23612         return have_rev;
23613  }
23614
23615 @@ -289,6 +293,10 @@
23616                                 have_rev = 1;
23617                 }
23618         }
23619 +
23620 +       if (af != NFPROTO_UNSPEC && !have_rev)
23621 +               return target_revfn(NFPROTO_UNSPEC, name, revision, bestp);
23622 +
23623         return have_rev;
23624  }
23625
23626 --- kernel-power-2.6.28.orig/net/netfilter/xt_sctp.c
23627 +++ kernel-power-2.6.28/net/netfilter/xt_sctp.c
23628 @@ -105,7 +105,7 @@
23629
23630         switch (chunk_match_type) {
23631         case SCTP_CHUNK_MATCH_ALL:
23632 -               return SCTP_CHUNKMAP_IS_CLEAR(info->chunkmap);
23633 +               return SCTP_CHUNKMAP_IS_CLEAR(chunkmapcopy);
23634         case SCTP_CHUNK_MATCH_ANY:
23635                 return false;
23636         case SCTP_CHUNK_MATCH_ONLY:
23637 --- kernel-power-2.6.28.orig/net/netrom/af_netrom.c
23638 +++ kernel-power-2.6.28/net/netrom/af_netrom.c
23639 @@ -1082,7 +1082,13 @@
23640
23641         SOCK_DEBUG(sk, "NET/ROM: sendto: Addresses built.\n");
23642
23643 -       /* Build a packet */
23644 +       /* Build a packet - the conventional user limit is 236 bytes. We can
23645 +          do ludicrously large NetROM frames but must not overflow */
23646 +       if (len > 65536) {
23647 +               err = -EMSGSIZE;
23648 +               goto out;
23649 +       }
23650 +
23651         SOCK_DEBUG(sk, "NET/ROM: sendto: building packet.\n");
23652         size = len + NR_NETWORK_LEN + NR_TRANSPORT_LEN;
23653
23654 --- kernel-power-2.6.28.orig/net/packet/af_packet.c
23655 +++ kernel-power-2.6.28/net/packet/af_packet.c
23656 @@ -77,6 +77,7 @@
23657  #include <linux/poll.h>
23658  #include <linux/module.h>
23659  #include <linux/init.h>
23660 +#include <linux/mutex.h>
23661
23662  #ifdef CONFIG_INET
23663  #include <net/inet_common.h>
23664 @@ -175,6 +176,7 @@
23665  #endif
23666         struct packet_type      prot_hook;
23667         spinlock_t              bind_lock;
23668 +       struct mutex            pg_vec_lock;
23669         unsigned int            running:1,      /* prot_hook is attached*/
23670                                 auxdata:1,
23671                                 origdev:1;
23672 @@ -220,13 +222,13 @@
23673         h.raw = po->pg_vec[pg_vec_pos] + (frame_offset * po->frame_size);
23674         switch (po->tp_version) {
23675         case TPACKET_V1:
23676 -               if (status != h.h1->tp_status ? TP_STATUS_USER :
23677 -                                               TP_STATUS_KERNEL)
23678 +               if (status != (h.h1->tp_status ? TP_STATUS_USER :
23679 +                                               TP_STATUS_KERNEL))
23680                         return NULL;
23681                 break;
23682         case TPACKET_V2:
23683 -               if (status != h.h2->tp_status ? TP_STATUS_USER :
23684 -                                               TP_STATUS_KERNEL)
23685 +               if (status != (h.h2->tp_status ? TP_STATUS_USER :
23686 +                                               TP_STATUS_KERNEL))
23687                         return NULL;
23688                 break;
23689         }
23690 @@ -1068,6 +1070,7 @@
23691          */
23692
23693         spin_lock_init(&po->bind_lock);
23694 +       mutex_init(&po->pg_vec_lock);
23695         po->prot_hook.func = packet_rcv;
23696
23697         if (sock->type == SOCK_PACKET)
23698 @@ -1863,6 +1866,7 @@
23699         synchronize_net();
23700
23701         err = -EBUSY;
23702 +       mutex_lock(&po->pg_vec_lock);
23703         if (closing || atomic_read(&po->mapped) == 0) {
23704                 err = 0;
23705  #define XC(a, b) ({ __typeof__ ((a)) __t; __t = (a); (a) = (b); __t; })
23706 @@ -1884,6 +1888,7 @@
23707                 if (atomic_read(&po->mapped))
23708                         printk(KERN_DEBUG "packet_mmap: vma is busy: %d\n", atomic_read(&po->mapped));
23709         }
23710 +       mutex_unlock(&po->pg_vec_lock);
23711
23712         spin_lock(&po->bind_lock);
23713         if (was_running && !po->running) {
23714 @@ -1916,7 +1921,7 @@
23715
23716         size = vma->vm_end - vma->vm_start;
23717
23718 -       lock_sock(sk);
23719 +       mutex_lock(&po->pg_vec_lock);
23720         if (po->pg_vec == NULL)
23721                 goto out;
23722         if (size != po->pg_vec_len*po->pg_vec_pages*PAGE_SIZE)
23723 @@ -1939,7 +1944,7 @@
23724         err = 0;
23725
23726  out:
23727 -       release_sock(sk);
23728 +       mutex_unlock(&po->pg_vec_lock);
23729         return err;
23730  }
23731  #endif
23732 --- kernel-power-2.6.28.orig/net/rose/af_rose.c
23733 +++ kernel-power-2.6.28/net/rose/af_rose.c
23734 @@ -1124,6 +1124,10 @@
23735
23736         /* Build a packet */
23737         SOCK_DEBUG(sk, "ROSE: sendto: building packet.\n");
23738 +       /* Sanity check the packet size */
23739 +       if (len > 65535)
23740 +               return -EMSGSIZE;
23741 +
23742         size = len + AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + ROSE_MIN_LEN;
23743
23744         if ((skb = sock_alloc_send_skb(sk, size, msg->msg_flags & MSG_DONTWAIT, &err)) == NULL)
23745 --- kernel-power-2.6.28.orig/net/sched/cls_u32.c
23746 +++ kernel-power-2.6.28/net/sched/cls_u32.c
23747 @@ -637,8 +637,9 @@
23748                                 break;
23749
23750                 n->next = *ins;
23751 -               wmb();
23752 +               tcf_tree_lock(tp);
23753                 *ins = n;
23754 +               tcf_tree_unlock(tp);
23755
23756                 *arg = (unsigned long)n;
23757                 return 0;
23758 --- kernel-power-2.6.28.orig/net/sched/sch_htb.c
23759 +++ kernel-power-2.6.28/net/sched/sch_htb.c
23760 @@ -924,6 +924,7 @@
23761                 }
23762         }
23763         sch->qstats.overlimits++;
23764 +       qdisc_watchdog_cancel(&q->watchdog);
23765         qdisc_watchdog_schedule(&q->watchdog, next_event);
23766  fin:
23767         return skb;
23768 --- kernel-power-2.6.28.orig/net/sctp/endpointola.c
23769 +++ kernel-power-2.6.28/net/sctp/endpointola.c
23770 @@ -111,7 +111,8 @@
23771                 if (sctp_addip_enable) {
23772                         auth_chunks->chunks[0] = SCTP_CID_ASCONF;
23773                         auth_chunks->chunks[1] = SCTP_CID_ASCONF_ACK;
23774 -                       auth_chunks->param_hdr.length += htons(2);
23775 +                       auth_chunks->param_hdr.length =
23776 +                                       htons(sizeof(sctp_paramhdr_t) + 2);
23777                 }
23778         }
23779
23780 --- kernel-power-2.6.28.orig/net/sctp/input.c
23781 +++ kernel-power-2.6.28/net/sctp/input.c
23782 @@ -249,6 +249,19 @@
23783          */
23784         sctp_bh_lock_sock(sk);
23785
23786 +       if (sk != rcvr->sk) {
23787 +               /* Our cached sk is different from the rcvr->sk.  This is
23788 +                * because migrate()/accept() may have moved the association
23789 +                * to a new socket and released all the sockets.  So now we
23790 +                * are holding a lock on the old socket while the user may
23791 +                * be doing something with the new socket.  Switch our veiw
23792 +                * of the current sk.
23793 +                */
23794 +               sctp_bh_unlock_sock(sk);
23795 +               sk = rcvr->sk;
23796 +               sctp_bh_lock_sock(sk);
23797 +       }
23798 +
23799         if (sock_owned_by_user(sk)) {
23800                 SCTP_INC_STATS_BH(SCTP_MIB_IN_PKT_BACKLOG);
23801                 sctp_add_backlog(sk, skb);
23802 --- kernel-power-2.6.28.orig/net/sctp/output.c
23803 +++ kernel-power-2.6.28/net/sctp/output.c
23804 @@ -324,14 +324,16 @@
23805         switch (chunk->chunk_hdr->type) {
23806             case SCTP_CID_DATA:
23807                 retval = sctp_packet_append_data(packet, chunk);
23808 +               if (SCTP_XMIT_OK != retval)
23809 +                       goto finish;
23810                 /* Disallow SACK bundling after DATA. */
23811                 packet->has_sack = 1;
23812                 /* Disallow AUTH bundling after DATA */
23813                 packet->has_auth = 1;
23814                 /* Let it be knows that packet has DATA in it */
23815                 packet->has_data = 1;
23816 -               if (SCTP_XMIT_OK != retval)
23817 -                       goto finish;
23818 +               /* timestamp the chunk for rtx purposes */
23819 +               chunk->sent_at = jiffies;
23820                 break;
23821             case SCTP_CID_COOKIE_ECHO:
23822                 packet->has_cookie_echo = 1;
23823 @@ -470,7 +472,6 @@
23824                         } else
23825                                 chunk->resent = 1;
23826
23827 -                       chunk->sent_at = jiffies;
23828                         has_data = 1;
23829                 }
23830
23831 --- kernel-power-2.6.28.orig/net/sctp/outqueue.c
23832 +++ kernel-power-2.6.28/net/sctp/outqueue.c
23833 @@ -929,7 +929,6 @@
23834                 }
23835
23836                 /* Finally, transmit new packets.  */
23837 -               start_timer = 0;
23838                 while ((chunk = sctp_outq_dequeue_data(q)) != NULL) {
23839                         /* RFC 2960 6.5 Every DATA chunk MUST carry a valid
23840                          * stream identifier.
23841 @@ -1028,7 +1027,7 @@
23842                         list_add_tail(&chunk->transmitted_list,
23843                                       &transport->transmitted);
23844
23845 -                       sctp_transport_reset_timers(transport, start_timer-1);
23846 +                       sctp_transport_reset_timers(transport, 0);
23847
23848                         q->empty = 0;
23849
23850 --- kernel-power-2.6.28.orig/net/sctp/sm_statefuns.c
23851 +++ kernel-power-2.6.28/net/sctp/sm_statefuns.c
23852 @@ -3691,6 +3691,7 @@
23853  {
23854         struct sctp_chunk *chunk = arg;
23855         struct sctp_fwdtsn_hdr *fwdtsn_hdr;
23856 +       struct sctp_fwdtsn_skip *skip;
23857         __u16 len;
23858         __u32 tsn;
23859
23860 @@ -3720,6 +3721,12 @@
23861         if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
23862                 goto discard_noforce;
23863
23864 +       /* Silently discard the chunk if stream-id is not valid */
23865 +       sctp_walk_fwdtsn(skip, chunk) {
23866 +               if (ntohs(skip->stream) >= asoc->c.sinit_max_instreams)
23867 +                       goto discard_noforce;
23868 +       }
23869 +
23870         sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_FWDTSN, SCTP_U32(tsn));
23871         if (len > sizeof(struct sctp_fwdtsn_hdr))
23872                 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_FWDTSN,
23873 @@ -3751,6 +3758,7 @@
23874  {
23875         struct sctp_chunk *chunk = arg;
23876         struct sctp_fwdtsn_hdr *fwdtsn_hdr;
23877 +       struct sctp_fwdtsn_skip *skip;
23878         __u16 len;
23879         __u32 tsn;
23880
23881 @@ -3780,6 +3788,12 @@
23882         if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
23883                 goto gen_shutdown;
23884
23885 +       /* Silently discard the chunk if stream-id is not valid */
23886 +       sctp_walk_fwdtsn(skip, chunk) {
23887 +               if (ntohs(skip->stream) >= asoc->c.sinit_max_instreams)
23888 +                       goto gen_shutdown;
23889 +       }
23890 +
23891         sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_FWDTSN, SCTP_U32(tsn));
23892         if (len > sizeof(struct sctp_fwdtsn_hdr))
23893                 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_FWDTSN,
23894 --- kernel-power-2.6.28.orig/net/socket.c
23895 +++ kernel-power-2.6.28/net/socket.c
23896 @@ -1215,7 +1215,7 @@
23897         return __sock_create(&init_net, family, type, protocol, res, 1);
23898  }
23899
23900 -asmlinkage long sys_socket(int family, int type, int protocol)
23901 +SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
23902  {
23903         int retval;
23904         struct socket *sock;
23905 @@ -1256,8 +1256,8 @@
23906   *     Create a pair of connected sockets.
23907   */
23908
23909 -asmlinkage long sys_socketpair(int family, int type, int protocol,
23910 -                              int __user *usockvec)
23911 +SYSCALL_DEFINE4(socketpair, int, family, int, type, int, protocol,
23912 +               int __user *, usockvec)
23913  {
23914         struct socket *sock1, *sock2;
23915         int fd1, fd2, err;
23916 @@ -1364,7 +1364,7 @@
23917   *     the protocol layer (having also checked the address is ok).
23918   */
23919
23920 -asmlinkage long sys_bind(int fd, struct sockaddr __user *umyaddr, int addrlen)
23921 +SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
23922  {
23923         struct socket *sock;
23924         struct sockaddr_storage address;
23925 @@ -1393,7 +1393,7 @@
23926   *     ready for listening.
23927   */
23928
23929 -asmlinkage long sys_listen(int fd, int backlog)
23930 +SYSCALL_DEFINE2(listen, int, fd, int, backlog)
23931  {
23932         struct socket *sock;
23933         int err, fput_needed;
23934 @@ -1426,8 +1426,8 @@
23935   *     clean when we restucture accept also.
23936   */
23937
23938 -asmlinkage long sys_accept4(int fd, struct sockaddr __user *upeer_sockaddr,
23939 -                           int __user *upeer_addrlen, int flags)
23940 +SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
23941 +               int __user *, upeer_addrlen, int, flags)
23942  {
23943         struct socket *sock, *newsock;
23944         struct file *newfile;
23945 @@ -1510,8 +1510,8 @@
23946         goto out_put;
23947  }
23948
23949 -asmlinkage long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr,
23950 -                          int __user *upeer_addrlen)
23951 +SYSCALL_DEFINE3(accept, int, fd, struct sockaddr __user *, upeer_sockaddr,
23952 +               int __user *, upeer_addrlen)
23953  {
23954         return sys_accept4(fd, upeer_sockaddr, upeer_addrlen, 0);
23955  }
23956 @@ -1528,8 +1528,8 @@
23957   *     include the -EINPROGRESS status for such sockets.
23958   */
23959
23960 -asmlinkage long sys_connect(int fd, struct sockaddr __user *uservaddr,
23961 -                           int addrlen)
23962 +SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
23963 +               int, addrlen)
23964  {
23965         struct socket *sock;
23966         struct sockaddr_storage address;
23967 @@ -1560,8 +1560,8 @@
23968   *     name to user space.
23969   */
23970
23971 -asmlinkage long sys_getsockname(int fd, struct sockaddr __user *usockaddr,
23972 -                               int __user *usockaddr_len)
23973 +SYSCALL_DEFINE3(getsockname, int, fd, struct sockaddr __user *, usockaddr,
23974 +               int __user *, usockaddr_len)
23975  {
23976         struct socket *sock;
23977         struct sockaddr_storage address;
23978 @@ -1591,8 +1591,8 @@
23979   *     name to user space.
23980   */
23981
23982 -asmlinkage long sys_getpeername(int fd, struct sockaddr __user *usockaddr,
23983 -                               int __user *usockaddr_len)
23984 +SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
23985 +               int __user *, usockaddr_len)
23986  {
23987         struct socket *sock;
23988         struct sockaddr_storage address;
23989 @@ -1623,9 +1623,9 @@
23990   *     the protocol.
23991   */
23992
23993 -asmlinkage long sys_sendto(int fd, void __user *buff, size_t len,
23994 -                          unsigned flags, struct sockaddr __user *addr,
23995 -                          int addr_len)
23996 +SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
23997 +               unsigned, flags, struct sockaddr __user *, addr,
23998 +               int, addr_len)
23999  {
24000         struct socket *sock;
24001         struct sockaddr_storage address;
24002 @@ -1668,7 +1668,8 @@
24003   *     Send a datagram down a socket.
24004   */
24005
24006 -asmlinkage long sys_send(int fd, void __user *buff, size_t len, unsigned flags)
24007 +SYSCALL_DEFINE4(send, int, fd, void __user *, buff, size_t, len,
24008 +               unsigned, flags)
24009  {
24010         return sys_sendto(fd, buff, len, flags, NULL, 0);
24011  }
24012 @@ -1679,9 +1680,9 @@
24013   *     sender address from kernel to user space.
24014   */
24015
24016 -asmlinkage long sys_recvfrom(int fd, void __user *ubuf, size_t size,
24017 -                            unsigned flags, struct sockaddr __user *addr,
24018 -                            int __user *addr_len)
24019 +SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
24020 +               unsigned, flags, struct sockaddr __user *, addr,
24021 +               int __user *, addr_len)
24022  {
24023         struct socket *sock;
24024         struct iovec iov;
24025 @@ -1733,8 +1734,8 @@
24026   *     to pass the user mode parameter for the protocols to sort out.
24027   */
24028
24029 -asmlinkage long sys_setsockopt(int fd, int level, int optname,
24030 -                              char __user *optval, int optlen)
24031 +SYSCALL_DEFINE5(setsockopt, int, fd, int, level, int, optname,
24032 +               char __user *, optval, int, optlen)
24033  {
24034         int err, fput_needed;
24035         struct socket *sock;
24036 @@ -1767,8 +1768,8 @@
24037   *     to pass a user mode parameter for the protocols to sort out.
24038   */
24039
24040 -asmlinkage long sys_getsockopt(int fd, int level, int optname,
24041 -                              char __user *optval, int __user *optlen)
24042 +SYSCALL_DEFINE5(getsockopt, int, fd, int, level, int, optname,
24043 +               char __user *, optval, int __user *, optlen)
24044  {
24045         int err, fput_needed;
24046         struct socket *sock;
24047 @@ -1797,7 +1798,7 @@
24048   *     Shutdown a socket.
24049   */
24050
24051 -asmlinkage long sys_shutdown(int fd, int how)
24052 +SYSCALL_DEFINE2(shutdown, int, fd, int, how)
24053  {
24054         int err, fput_needed;
24055         struct socket *sock;
24056 @@ -1823,7 +1824,7 @@
24057   *     BSD sendmsg interface
24058   */
24059
24060 -asmlinkage long sys_sendmsg(int fd, struct msghdr __user *msg, unsigned flags)
24061 +SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned, flags)
24062  {
24063         struct compat_msghdr __user *msg_compat =
24064             (struct compat_msghdr __user *)msg;
24065 @@ -1929,8 +1930,8 @@
24066   *     BSD recvmsg interface
24067   */
24068
24069 -asmlinkage long sys_recvmsg(int fd, struct msghdr __user *msg,
24070 -                           unsigned int flags)
24071 +SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
24072 +               unsigned int, flags)
24073  {
24074         struct compat_msghdr __user *msg_compat =
24075             (struct compat_msghdr __user *)msg;
24076 @@ -2053,7 +2054,7 @@
24077   *  it is set by the callees.
24078   */
24079
24080 -asmlinkage long sys_socketcall(int call, unsigned long __user *args)
24081 +SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
24082  {
24083         unsigned long a[6];
24084         unsigned long a0, a1;
24085 --- kernel-power-2.6.28.orig/net/x25/af_x25.c
24086 +++ kernel-power-2.6.28/net/x25/af_x25.c
24087 @@ -1037,6 +1037,12 @@
24088                 sx25.sx25_addr   = x25->dest_addr;
24089         }
24090
24091 +       /* Sanity check the packet size */
24092 +       if (len > 65535) {
24093 +               rc = -EMSGSIZE;
24094 +               goto out;
24095 +       }
24096 +
24097         SOCK_DEBUG(sk, "x25_sendmsg: sendto: Addresses built.\n");
24098
24099         /* Build a packet */
24100 --- kernel-power-2.6.28.orig/net/xfrm/xfrm_state.c
24101 +++ kernel-power-2.6.28/net/xfrm/xfrm_state.c
24102 @@ -1601,7 +1601,7 @@
24103
24104         spin_lock_bh(&xfrm_state_lock);
24105         list_del(&walk->all);
24106 -       spin_lock_bh(&xfrm_state_lock);
24107 +       spin_unlock_bh(&xfrm_state_lock);
24108  }
24109  EXPORT_SYMBOL(xfrm_state_walk_done);
24110
24111 --- kernel-power-2.6.28.orig/scripts/kernel-doc
24112 +++ kernel-power-2.6.28/scripts/kernel-doc
24113 @@ -1762,6 +1762,40 @@
24114      $state = 0;
24115  }
24116
24117 +sub syscall_munge() {
24118 +       my $void = 0;
24119 +
24120 +       $prototype =~ s@[\r\n\t]+@ @gos; # strip newlines/CR's/tabs
24121 +##     if ($prototype =~ m/SYSCALL_DEFINE0\s*\(\s*(a-zA-Z0-9_)*\s*\)/) {
24122 +       if ($prototype =~ m/SYSCALL_DEFINE0/) {
24123 +               $void = 1;
24124 +##             $prototype = "long sys_$1(void)";
24125 +       }
24126 +
24127 +       $prototype =~ s/SYSCALL_DEFINE.*\(/long sys_/; # fix return type & func name
24128 +       if ($prototype =~ m/long (sys_.*?),/) {
24129 +               $prototype =~ s/,/\(/;
24130 +       } elsif ($void) {
24131 +               $prototype =~ s/\)/\(void\)/;
24132 +       }
24133 +
24134 +       # now delete all of the odd-number commas in $prototype
24135 +       # so that arg types & arg names don't have a comma between them
24136 +       my $count = 0;
24137 +       my $len = length($prototype);
24138 +       if ($void) {
24139 +               $len = 0;       # skip the for-loop
24140 +       }
24141 +       for (my $ix = 0; $ix < $len; $ix++) {
24142 +               if (substr($prototype, $ix, 1) eq ',') {
24143 +                       $count++;
24144 +                       if ($count % 2 == 1) {
24145 +                               substr($prototype, $ix, 1) = ' ';
24146 +                       }
24147 +               }
24148 +       }
24149 +}
24150 +
24151  sub process_state3_function($$) {
24152      my $x = shift;
24153      my $file = shift;
24154 @@ -1774,11 +1808,15 @@
24155      elsif ($x =~ /([^\{]*)/) {
24156         $prototype .= $1;
24157      }
24158 +
24159      if (($x =~ /\{/) || ($x =~ /\#\s*define/) || ($x =~ /;/)) {
24160         $prototype =~ s@/\*.*?\*/@@gos; # strip comments.
24161         $prototype =~ s@[\r\n]+@ @gos; # strip newlines/cr's.
24162         $prototype =~ s@^\s+@@gos; # strip leading spaces
24163 -       dump_function($prototype,$file);
24164 +       if ($prototype =~ /SYSCALL_DEFINE/) {
24165 +               syscall_munge();
24166 +       }
24167 +       dump_function($prototype, $file);
24168         reset_state();
24169      }
24170  }
24171 --- kernel-power-2.6.28.orig/scripts/mod/file2alias.c
24172 +++ kernel-power-2.6.28/scripts/mod/file2alias.c
24173 @@ -210,6 +210,7 @@
24174  static int do_hid_entry(const char *filename,
24175                              struct hid_device_id *id, char *alias)
24176  {
24177 +       id->bus = TO_NATIVE(id->bus);
24178         id->vendor = TO_NATIVE(id->vendor);
24179         id->product = TO_NATIVE(id->product);
24180
24181 --- kernel-power-2.6.28.orig/security/keys/keyctl.c
24182 +++ kernel-power-2.6.28/security/keys/keyctl.c
24183 @@ -54,11 +54,11 @@
24184   * - returns the new key's serial number
24185   * - implements add_key()
24186   */
24187 -asmlinkage long sys_add_key(const char __user *_type,
24188 -                           const char __user *_description,
24189 -                           const void __user *_payload,
24190 -                           size_t plen,
24191 -                           key_serial_t ringid)
24192 +SYSCALL_DEFINE5(add_key, const char __user *, _type,
24193 +               const char __user *, _description,
24194 +               const void __user *, _payload,
24195 +               size_t, plen,
24196 +               key_serial_t, ringid)
24197  {
24198         key_ref_t keyring_ref, key_ref;
24199         char type[32], *description;
24200 @@ -146,10 +146,10 @@
24201   *   - if the _callout_info string is empty, it will be rendered as "-"
24202   * - implements request_key()
24203   */
24204 -asmlinkage long sys_request_key(const char __user *_type,
24205 -                               const char __user *_description,
24206 -                               const char __user *_callout_info,
24207 -                               key_serial_t destringid)
24208 +SYSCALL_DEFINE4(request_key, const char __user *, _type,
24209 +               const char __user *, _description,
24210 +               const char __user *, _callout_info,
24211 +               key_serial_t, destringid)
24212  {
24213         struct key_type *ktype;
24214         struct key *key;
24215 @@ -270,6 +270,7 @@
24216
24217         /* join the session */
24218         ret = join_session_keyring(name);
24219 +       kfree(name);
24220
24221   error:
24222         return ret;
24223 @@ -1152,8 +1153,8 @@
24224  /*
24225   * the key control system call
24226   */
24227 -asmlinkage long sys_keyctl(int option, unsigned long arg2, unsigned long arg3,
24228 -                          unsigned long arg4, unsigned long arg5)
24229 +SYSCALL_DEFINE5(keyctl, int, option, unsigned long, arg2, unsigned long, arg3,
24230 +               unsigned long, arg4, unsigned long, arg5)
24231  {
24232         switch (option) {
24233         case KEYCTL_GET_KEYRING_ID:
24234 --- kernel-power-2.6.28.orig/security/selinux/hooks.c
24235 +++ kernel-power-2.6.28/security/selinux/hooks.c
24236 @@ -4550,6 +4550,7 @@
24237         if (err)
24238                 return err;
24239         err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
24240 +       if (err)
24241                 return err;
24242
24243         err = sel_netnode_sid(addrp, family, &node_sid);
24244 --- kernel-power-2.6.28.orig/security/selinux/netlabel.c
24245 +++ kernel-power-2.6.28/security/selinux/netlabel.c
24246 @@ -386,11 +386,12 @@
24247         if (!S_ISSOCK(inode->i_mode) ||
24248             ((mask & (MAY_WRITE | MAY_APPEND)) == 0))
24249                 return 0;
24250 -
24251         sock = SOCKET_I(inode);
24252         sk = sock->sk;
24253 +       if (sk == NULL)
24254 +               return 0;
24255         sksec = sk->sk_security;
24256 -       if (sksec->nlbl_state != NLBL_REQUIRE)
24257 +       if (sksec == NULL || sksec->nlbl_state != NLBL_REQUIRE)
24258                 return 0;
24259
24260         local_bh_disable();
24261 @@ -490,8 +491,10 @@
24262                 lock_sock(sk);
24263                 rc = netlbl_sock_getattr(sk, &secattr);
24264                 release_sock(sk);
24265 -               if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE)
24266 +               if (rc == 0)
24267                         rc = -EACCES;
24268 +               else if (rc == -ENOMSG)
24269 +                       rc = 0;
24270                 netlbl_secattr_destroy(&secattr);
24271         }
24272
24273 --- kernel-power-2.6.28.orig/security/smack/smack_lsm.c
24274 +++ kernel-power-2.6.28/security/smack/smack_lsm.c
24275 @@ -604,6 +604,8 @@
24276             strcmp(name, XATTR_NAME_SMACKIPOUT) == 0) {
24277                 if (!capable(CAP_MAC_ADMIN))
24278                         rc = -EPERM;
24279 +               if (size == 0)
24280 +                       rc = -EINVAL;
24281         } else
24282                 rc = cap_inode_setxattr(dentry, name, value, size, flags);
24283
24284 @@ -1360,7 +1362,7 @@
24285         struct socket *sock;
24286         int rc = 0;
24287
24288 -       if (value == NULL || size > SMK_LABELLEN)
24289 +       if (value == NULL || size > SMK_LABELLEN || size == 0)
24290                 return -EACCES;
24291
24292         sp = smk_import(value, size);
24293 --- kernel-power-2.6.28.orig/sound/core/oss/pcm_oss.c
24294 +++ kernel-power-2.6.28/sound/core/oss/pcm_oss.c
24295 @@ -2872,7 +2872,7 @@
24296                         setup = kmalloc(sizeof(*setup), GFP_KERNEL);
24297                         if (! setup) {
24298                                 buffer->error = -ENOMEM;
24299 -                               mutex_lock(&pstr->oss.setup_mutex);
24300 +                               mutex_unlock(&pstr->oss.setup_mutex);
24301                                 return;
24302                         }
24303                         if (pstr->oss.setup_list == NULL)
24304 @@ -2886,7 +2886,7 @@
24305                         if (! template.task_name) {
24306                                 kfree(setup);
24307                                 buffer->error = -ENOMEM;
24308 -                               mutex_lock(&pstr->oss.setup_mutex);
24309 +                               mutex_unlock(&pstr->oss.setup_mutex);
24310                                 return;
24311                         }
24312                 }
24313 --- kernel-power-2.6.28.orig/sound/core/oss/rate.c
24314 +++ kernel-power-2.6.28/sound/core/oss/rate.c
24315 @@ -157,7 +157,7 @@
24316                 while (dst_frames1 > 0) {
24317                         S1 = S2;
24318                         if (src_frames1-- > 0) {
24319 -                               S1 = *src;
24320 +                               S2 = *src;
24321                                 src += src_step;
24322                         }
24323                         if (pos & ~R_MASK) {
24324 --- kernel-power-2.6.28.orig/sound/core/sgbuf.c
24325 +++ kernel-power-2.6.28/sound/core/sgbuf.c
24326 @@ -38,6 +38,10 @@
24327         if (! sgbuf)
24328                 return -EINVAL;
24329
24330 +       if (dmab->area)
24331 +               vunmap(dmab->area);
24332 +       dmab->area = NULL;
24333 +
24334         tmpb.dev.type = SNDRV_DMA_TYPE_DEV;
24335         tmpb.dev.dev = sgbuf->dev;
24336         for (i = 0; i < sgbuf->pages; i++) {
24337 @@ -48,9 +52,6 @@
24338                 tmpb.bytes = (sgbuf->table[i].addr & ~PAGE_MASK) << PAGE_SHIFT;
24339                 snd_dma_free_pages(&tmpb);
24340         }
24341 -       if (dmab->area)
24342 -               vunmap(dmab->area);
24343 -       dmab->area = NULL;
24344
24345         kfree(sgbuf->table);
24346         kfree(sgbuf->page_table);
24347 --- kernel-power-2.6.28.orig/sound/drivers/mtpav.c
24348 +++ kernel-power-2.6.28/sound/drivers/mtpav.c
24349 @@ -706,7 +706,6 @@
24350         mtp_card->card = card;
24351         mtp_card->irq = -1;
24352         mtp_card->share_irq = 0;
24353 -       mtp_card->inmidiport = 0xffffffff;
24354         mtp_card->inmidistate = 0;
24355         mtp_card->outmidihwport = 0xffffffff;
24356         init_timer(&mtp_card->timer);
24357 @@ -719,6 +718,8 @@
24358         if (err < 0)
24359                 goto __error;
24360
24361 +       mtp_card->inmidiport = mtp_card->num_ports + MTPAV_PIDX_BROADCAST;
24362 +
24363         err = snd_mtpav_get_ISA(mtp_card);
24364         if (err < 0)
24365                 goto __error;
24366 --- kernel-power-2.6.28.orig/sound/isa/opl3sa2.c
24367 +++ kernel-power-2.6.28/sound/isa/opl3sa2.c
24368 @@ -550,21 +550,27 @@
24369  #ifdef CONFIG_PM
24370  static int snd_opl3sa2_suspend(struct snd_card *card, pm_message_t state)
24371  {
24372 -       struct snd_opl3sa2 *chip = card->private_data;
24373 +       if (card) {
24374 +               struct snd_opl3sa2 *chip = card->private_data;
24375
24376 -       snd_power_change_state(card, SNDRV_CTL_POWER_D3hot);
24377 -       chip->wss->suspend(chip->wss);
24378 -       /* power down */
24379 -       snd_opl3sa2_write(chip, OPL3SA2_PM_CTRL, OPL3SA2_PM_D3);
24380 +               snd_power_change_state(card, SNDRV_CTL_POWER_D3hot);
24381 +               chip->wss->suspend(chip->wss);
24382 +               /* power down */
24383 +               snd_opl3sa2_write(chip, OPL3SA2_PM_CTRL, OPL3SA2_PM_D3);
24384 +       }
24385
24386         return 0;
24387  }
24388
24389  static int snd_opl3sa2_resume(struct snd_card *card)
24390  {
24391 -       struct snd_opl3sa2 *chip = card->private_data;
24392 +       struct snd_opl3sa2 *chip;
24393         int i;
24394
24395 +       if (!card)
24396 +               return 0;
24397 +
24398 +       chip = card->private_data;
24399         /* power up */
24400         snd_opl3sa2_write(chip, OPL3SA2_PM_CTRL, OPL3SA2_PM_D0);
24401
24402 --- kernel-power-2.6.28.orig/sound/pci/aw2/aw2-alsa.c
24403 +++ kernel-power-2.6.28/sound/pci/aw2/aw2-alsa.c
24404 @@ -165,7 +165,7 @@
24405  MODULE_PARM_DESC(enable, "Enable Audiowerk2 soundcard.");
24406
24407  static struct pci_device_id snd_aw2_ids[] = {
24408 -       {PCI_VENDOR_ID_SAA7146, PCI_DEVICE_ID_SAA7146, PCI_ANY_ID, PCI_ANY_ID,
24409 +       {PCI_VENDOR_ID_SAA7146, PCI_DEVICE_ID_SAA7146, 0, 0,
24410          0, 0, 0},
24411         {0}
24412  };
24413 --- kernel-power-2.6.28.orig/sound/pci/hda/hda_intel.c
24414 +++ kernel-power-2.6.28/sound/pci/hda/hda_intel.c
24415 @@ -2063,26 +2063,31 @@
24416  {
24417         const struct snd_pci_quirk *q;
24418
24419 -       /* Check VIA HD Audio Controller exist */
24420 -       if (chip->pci->vendor == PCI_VENDOR_ID_VIA &&
24421 -           chip->pci->device == VIA_HDAC_DEVICE_ID) {
24422 +       switch (fix) {
24423 +       case POS_FIX_LPIB:
24424 +       case POS_FIX_POSBUF:
24425 +               return fix;
24426 +       }
24427 +
24428 +       /* Check VIA/ATI HD Audio Controller exist */
24429 +       switch (chip->driver_type) {
24430 +       case AZX_DRIVER_VIA:
24431 +       case AZX_DRIVER_ATI:
24432                 chip->via_dmapos_patch = 1;
24433                 /* Use link position directly, avoid any transfer problem. */
24434                 return POS_FIX_LPIB;
24435         }
24436         chip->via_dmapos_patch = 0;
24437
24438 -       if (fix == POS_FIX_AUTO) {
24439 -               q = snd_pci_quirk_lookup(chip->pci, position_fix_list);
24440 -               if (q) {
24441 -                       printk(KERN_INFO
24442 -                                   "hda_intel: position_fix set to %d "
24443 -                                   "for device %04x:%04x\n",
24444 -                                   q->value, q->subvendor, q->subdevice);
24445 -                       return q->value;
24446 -               }
24447 +       q = snd_pci_quirk_lookup(chip->pci, position_fix_list);
24448 +       if (q) {
24449 +               printk(KERN_INFO
24450 +                      "hda_intel: position_fix set to %d "
24451 +                      "for device %04x:%04x\n",
24452 +                      q->value, q->subvendor, q->subdevice);
24453 +               return q->value;
24454         }
24455 -       return fix;
24456 +       return POS_FIX_AUTO;
24457  }
24458
24459  /*
24460 @@ -2208,9 +2213,17 @@
24461         gcap = azx_readw(chip, GCAP);
24462         snd_printdd("chipset global capabilities = 0x%x\n", gcap);
24463
24464 +       /* ATI chips seems buggy about 64bit DMA addresses */
24465 +       if (chip->driver_type == AZX_DRIVER_ATI)
24466 +               gcap &= ~0x01;
24467 +
24468         /* allow 64bit DMA address if supported by H/W */
24469         if ((gcap & 0x01) && !pci_set_dma_mask(pci, DMA_64BIT_MASK))
24470                 pci_set_consistent_dma_mask(pci, DMA_64BIT_MASK);
24471 +       else {
24472 +               pci_set_dma_mask(pci, DMA_32BIT_MASK);
24473 +               pci_set_consistent_dma_mask(pci, DMA_32BIT_MASK);
24474 +       }
24475
24476         /* read number of streams from GCAP register instead of using
24477          * hardcoded value
24478 --- kernel-power-2.6.28.orig/sound/pci/hda/patch_analog.c
24479 +++ kernel-power-2.6.28/sound/pci/hda/patch_analog.c
24480 @@ -629,6 +629,36 @@
24481         HDA_BIND_SW("Master Playback Switch", &ad1986a_laptop_master_sw),
24482         HDA_CODEC_VOLUME("PCM Playback Volume", 0x03, 0x0, HDA_OUTPUT),
24483         HDA_CODEC_MUTE("PCM Playback Switch", 0x03, 0x0, HDA_OUTPUT),
24484 +       HDA_CODEC_VOLUME("Internal Mic Playback Volume", 0x17, 0, HDA_OUTPUT),
24485 +       HDA_CODEC_MUTE("Internal Mic Playback Switch", 0x17, 0, HDA_OUTPUT),
24486 +       HDA_CODEC_VOLUME("Mic Playback Volume", 0x13, 0x0, HDA_OUTPUT),
24487 +       HDA_CODEC_MUTE("Mic Playback Switch", 0x13, 0x0, HDA_OUTPUT),
24488 +       HDA_CODEC_VOLUME("Mic Boost", 0x0f, 0x0, HDA_OUTPUT),
24489 +       HDA_CODEC_VOLUME("Capture Volume", 0x12, 0x0, HDA_OUTPUT),
24490 +       HDA_CODEC_MUTE("Capture Switch", 0x12, 0x0, HDA_OUTPUT),
24491 +       {
24492 +               .iface = SNDRV_CTL_ELEM_IFACE_MIXER,
24493 +               .name = "Capture Source",
24494 +               .info = ad198x_mux_enum_info,
24495 +               .get = ad198x_mux_enum_get,
24496 +               .put = ad198x_mux_enum_put,
24497 +       },
24498 +       {
24499 +               .iface = SNDRV_CTL_ELEM_IFACE_MIXER,
24500 +               .name = "External Amplifier",
24501 +               .info = ad198x_eapd_info,
24502 +               .get = ad198x_eapd_get,
24503 +               .put = ad198x_eapd_put,
24504 +               .private_value = 0x1b | (1 << 8), /* port-D, inversed */
24505 +       },
24506 +       { } /* end */
24507 +};
24508 +
24509 +static struct snd_kcontrol_new ad1986a_samsung_mixers[] = {
24510 +       HDA_BIND_VOL("Master Playback Volume", &ad1986a_laptop_master_vol),
24511 +       HDA_BIND_SW("Master Playback Switch", &ad1986a_laptop_master_sw),
24512 +       HDA_CODEC_VOLUME("PCM Playback Volume", 0x03, 0x0, HDA_OUTPUT),
24513 +       HDA_CODEC_MUTE("PCM Playback Switch", 0x03, 0x0, HDA_OUTPUT),
24514         HDA_CODEC_VOLUME("Mic Playback Volume", 0x13, 0x0, HDA_OUTPUT),
24515         HDA_CODEC_MUTE("Mic Playback Switch", 0x13, 0x0, HDA_OUTPUT),
24516         HDA_CODEC_VOLUME("Mic Boost", 0x0f, 0x0, HDA_OUTPUT),
24517 @@ -917,6 +947,7 @@
24518         AD1986A_LAPTOP_EAPD,
24519         AD1986A_LAPTOP_AUTOMUTE,
24520         AD1986A_ULTRA,
24521 +       AD1986A_SAMSUNG,
24522         AD1986A_MODELS
24523  };
24524
24525 @@ -927,6 +958,7 @@
24526         [AD1986A_LAPTOP_EAPD]   = "laptop-eapd",
24527         [AD1986A_LAPTOP_AUTOMUTE] = "laptop-automute",
24528         [AD1986A_ULTRA]         = "ultra",
24529 +       [AD1986A_SAMSUNG]       = "samsung",
24530  };
24531
24532  static struct snd_pci_quirk ad1986a_cfg_tbl[] = {
24533 @@ -949,9 +981,9 @@
24534         SND_PCI_QUIRK(0x1179, 0xff40, "Toshiba", AD1986A_LAPTOP_EAPD),
24535         SND_PCI_QUIRK(0x144d, 0xb03c, "Samsung R55", AD1986A_3STACK),
24536         SND_PCI_QUIRK(0x144d, 0xc01e, "FSC V2060", AD1986A_LAPTOP),
24537 -       SND_PCI_QUIRK(0x144d, 0xc023, "Samsung X60", AD1986A_LAPTOP_EAPD),
24538 -       SND_PCI_QUIRK(0x144d, 0xc024, "Samsung R65", AD1986A_LAPTOP_EAPD),
24539 -       SND_PCI_QUIRK(0x144d, 0xc026, "Samsung X11", AD1986A_LAPTOP_EAPD),
24540 +       SND_PCI_QUIRK(0x144d, 0xc023, "Samsung X60", AD1986A_SAMSUNG),
24541 +       SND_PCI_QUIRK(0x144d, 0xc024, "Samsung R65", AD1986A_SAMSUNG),
24542 +       SND_PCI_QUIRK(0x144d, 0xc026, "Samsung X11", AD1986A_SAMSUNG),
24543         SND_PCI_QUIRK(0x144d, 0xc027, "Samsung Q1", AD1986A_ULTRA),
24544         SND_PCI_QUIRK(0x144d, 0xc504, "Samsung Q35", AD1986A_3STACK),
24545         SND_PCI_QUIRK(0x17aa, 0x1011, "Lenovo M55", AD1986A_LAPTOP),
24546 @@ -1033,6 +1065,17 @@
24547                 break;
24548         case AD1986A_LAPTOP_EAPD:
24549                 spec->mixers[0] = ad1986a_laptop_eapd_mixers;
24550 +               spec->num_init_verbs = 2;
24551 +               spec->init_verbs[1] = ad1986a_eapd_init_verbs;
24552 +               spec->multiout.max_channels = 2;
24553 +               spec->multiout.num_dacs = 1;
24554 +               spec->multiout.dac_nids = ad1986a_laptop_dac_nids;
24555 +               if (!is_jack_available(codec, 0x25))
24556 +                       spec->multiout.dig_out_nid = 0;
24557 +               spec->input_mux = &ad1986a_laptop_eapd_capture_source;
24558 +               break;
24559 +       case AD1986A_SAMSUNG:
24560 +               spec->mixers[0] = ad1986a_samsung_mixers;
24561                 spec->num_init_verbs = 3;
24562                 spec->init_verbs[1] = ad1986a_eapd_init_verbs;
24563                 spec->init_verbs[2] = ad1986a_automic_verbs;
24564 @@ -1830,8 +1873,8 @@
24565  #define AD1988_SPDIF_OUT_HDMI  0x0b
24566  #define AD1988_SPDIF_IN                0x07
24567
24568 -static hda_nid_t ad1989b_slave_dig_outs[2] = {
24569 -       AD1988_SPDIF_OUT, AD1988_SPDIF_OUT_HDMI
24570 +static hda_nid_t ad1989b_slave_dig_outs[] = {
24571 +       AD1988_SPDIF_OUT, AD1988_SPDIF_OUT_HDMI, 0
24572  };
24573
24574  static struct hda_input_mux ad1988_6stack_capture_source = {
24575 @@ -3190,7 +3233,7 @@
24576         "Mic Playback Volume",
24577         "CD Playback Volume",
24578         "Internal Mic Playback Volume",
24579 -       "Docking Mic Playback Volume"
24580 +       "Docking Mic Playback Volume",
24581         "Beep Playback Volume",
24582         "IEC958 Playback Volume",
24583         NULL
24584 @@ -3861,6 +3904,7 @@
24585  static struct snd_pci_quirk ad1884a_cfg_tbl[] = {
24586         SND_PCI_QUIRK(0x103c, 0x3030, "HP", AD1884A_MOBILE),
24587         SND_PCI_QUIRK(0x103c, 0x3056, "HP", AD1884A_MOBILE),
24588 +       SND_PCI_QUIRK(0x103c, 0x30e6, "HP 6730b", AD1884A_LAPTOP),
24589         SND_PCI_QUIRK(0x103c, 0x30e7, "HP EliteBook 8530p", AD1884A_LAPTOP),
24590         SND_PCI_QUIRK(0x103c, 0x3614, "HP 6730s", AD1884A_LAPTOP),
24591         SND_PCI_QUIRK(0x17aa, 0x20ac, "Thinkpad X300", AD1884A_THINKPAD),
24592 @@ -4221,13 +4265,13 @@
24593         spec->num_adc_nids = ARRAY_SIZE(ad1882_adc_nids);
24594         spec->adc_nids = ad1882_adc_nids;
24595         spec->capsrc_nids = ad1882_capsrc_nids;
24596 -       if (codec->vendor_id == 0x11d1882)
24597 +       if (codec->vendor_id == 0x11d41882)
24598                 spec->input_mux = &ad1882_capture_source;
24599         else
24600                 spec->input_mux = &ad1882a_capture_source;
24601         spec->num_mixers = 2;
24602         spec->mixers[0] = ad1882_base_mixers;
24603 -       if (codec->vendor_id == 0x11d1882)
24604 +       if (codec->vendor_id == 0x11d41882)
24605                 spec->mixers[1] = ad1882_loopback_mixers;
24606         else
24607                 spec->mixers[1] = ad1882a_loopback_mixers;
24608 --- kernel-power-2.6.28.orig/sound/pci/hda/patch_conexant.c
24609 +++ kernel-power-2.6.28/sound/pci/hda/patch_conexant.c
24610 @@ -1470,6 +1470,7 @@
24611         SND_PCI_QUIRK(0x103c, 0x30a5, "HP DV5200T/DV8000T", CXT5047_LAPTOP_HP),
24612         SND_PCI_QUIRK(0x103c, 0x30b2, "HP DV2000T/DV3000T", CXT5047_LAPTOP),
24613         SND_PCI_QUIRK(0x103c, 0x30b5, "HP DV2000Z", CXT5047_LAPTOP),
24614 +       SND_PCI_QUIRK(0x103c, 0x30cf, "HP DV6700", CXT5047_LAPTOP),
24615         SND_PCI_QUIRK(0x1179, 0xff31, "Toshiba P100", CXT5047_LAPTOP_EAPD),
24616         {}
24617  };
24618 --- kernel-power-2.6.28.orig/sound/pci/hda/patch_realtek.c
24619 +++ kernel-power-2.6.28/sound/pci/hda/patch_realtek.c
24620 @@ -967,6 +967,7 @@
24621                 case 0x10ec0267:
24622                 case 0x10ec0268:
24623                 case 0x10ec0269:
24624 +               case 0x10ec0272:
24625                 case 0x10ec0660:
24626                 case 0x10ec0662:
24627                 case 0x10ec0663:
24628 @@ -995,6 +996,7 @@
24629                 case 0x10ec0882:
24630                 case 0x10ec0883:
24631                 case 0x10ec0885:
24632 +               case 0x10ec0887:
24633                 case 0x10ec0889:
24634                         snd_hda_codec_write(codec, 0x20, 0,
24635                                             AC_VERB_SET_COEF_INDEX, 7);
24636 @@ -6776,10 +6778,12 @@
24637                 case 0x106b2800: /* AppleTV */
24638                         board_config = ALC885_IMAC24;
24639                         break;
24640 +               case 0x106b00a0: /* MacBookPro3,1 - Another revision */
24641                 case 0x106b00a1: /* Macbook (might be wrong - PCI SSID?) */
24642                 case 0x106b00a4: /* MacbookPro4,1 */
24643                 case 0x106b2c00: /* Macbook Pro rev3 */
24644                 case 0x106b3600: /* Macbook 3.1 */
24645 +               case 0x106b3800: /* MacbookPro4,1 - latter revision */
24646                         board_config = ALC885_MBP3;
24647                         break;
24648                 default:
24649 @@ -8462,6 +8466,8 @@
24650         SND_PCI_QUIRK(0x1558, 0, "Clevo laptop", ALC883_LAPTOP_EAPD),
24651         SND_PCI_QUIRK(0x15d9, 0x8780, "Supermicro PDSBA", ALC883_3ST_6ch),
24652         SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_MEDION),
24653 +       SND_PCI_QUIRK(0x1734, 0x1107, "FSC AMILO Xi2550",
24654 +                     ALC883_FUJITSU_PI2515),
24655         SND_PCI_QUIRK(0x1734, 0x1108, "Fujitsu AMILO Pi2515", ALC883_FUJITSU_PI2515),
24656         SND_PCI_QUIRK(0x17aa, 0x101e, "Lenovo 101e", ALC883_LENOVO_101E_2ch),
24657         SND_PCI_QUIRK(0x17aa, 0x2085, "Lenovo NB0763", ALC883_LENOVO_NB0763),
24658 @@ -10473,6 +10479,7 @@
24659         SND_PCI_QUIRK(0x10cf, 0x142d, "Fujitsu Lifebook E8410", ALC262_FUJITSU),
24660         SND_PCI_QUIRK(0x144d, 0xc032, "Samsung Q1 Ultra", ALC262_ULTRA),
24661         SND_PCI_QUIRK(0x144d, 0xc039, "Samsung Q1U EL", ALC262_ULTRA),
24662 +       SND_PCI_QUIRK(0x144d, 0xc510, "Samsung Q45", ALC262_HIPPO),
24663         SND_PCI_QUIRK(0x17aa, 0x384e, "Lenovo 3000 y410", ALC262_LENOVO_3000),
24664         SND_PCI_QUIRK(0x17ff, 0x0560, "Benq ED8", ALC262_BENQ_ED8),
24665         SND_PCI_QUIRK(0x17ff, 0x058d, "Benq T31-16", ALC262_BENQ_T31),
24666 --- kernel-power-2.6.28.orig/sound/pci/hda/patch_sigmatel.c
24667 +++ kernel-power-2.6.28/sound/pci/hda/patch_sigmatel.c
24668 @@ -89,6 +89,7 @@
24669         STAC_DELL_M4_2,
24670         STAC_DELL_M4_3,
24671         STAC_HP_M4,
24672 +       STAC_HP_DV5,
24673         STAC_92HD71BXX_MODELS
24674  };
24675
24676 @@ -1702,6 +1703,7 @@
24677         [STAC_DELL_M4_2]        = dell_m4_2_pin_configs,
24678         [STAC_DELL_M4_3]        = dell_m4_3_pin_configs,
24679         [STAC_HP_M4]            = NULL,
24680 +       [STAC_HP_DV5]           = NULL,
24681  };
24682
24683  static const char *stac92hd71bxx_models[STAC_92HD71BXX_MODELS] = {
24684 @@ -1710,6 +1712,7 @@
24685         [STAC_DELL_M4_2] = "dell-m4-2",
24686         [STAC_DELL_M4_3] = "dell-m4-3",
24687         [STAC_HP_M4] = "hp-m4",
24688 +       [STAC_HP_DV5] = "hp-dv5",
24689  };
24690
24691  static struct snd_pci_quirk stac92hd71bxx_cfg_tbl[] = {
24692 @@ -1720,6 +1723,10 @@
24693                       "HP dv5", STAC_HP_M4),
24694         SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x30f4,
24695                       "HP dv7", STAC_HP_M4),
24696 +       SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x30fc,
24697 +                     "HP dv7", STAC_HP_M4),
24698 +       SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x3603,
24699 +                     "HP dv5", STAC_HP_DV5),
24700         SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x361a,
24701                                 "unknown HP", STAC_HP_M4),
24702         SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0233,
24703 @@ -2421,6 +2428,8 @@
24704
24705         info->name = "STAC92xx Analog";
24706         info->stream[SNDRV_PCM_STREAM_PLAYBACK] = stac92xx_pcm_analog_playback;
24707 +       info->stream[SNDRV_PCM_STREAM_PLAYBACK].nid =
24708 +               spec->multiout.dac_nids[0];
24709         info->stream[SNDRV_PCM_STREAM_CAPTURE] = stac92xx_pcm_analog_capture;
24710         info->stream[SNDRV_PCM_STREAM_CAPTURE].nid = spec->adc_nids[0];
24711         info->stream[SNDRV_PCM_STREAM_CAPTURE].substreams = spec->num_adcs;
24712 @@ -3978,8 +3987,19 @@
24713                         continue;
24714                 if (presence)
24715                         stac92xx_set_pinctl(codec, cfg->hp_pins[i], val);
24716 +#if 0 /* FIXME */
24717 +/* Resetting the pinctl like below may lead to (a sort of) regressions
24718 + * on some devices since they use the HP pin actually for line/speaker
24719 + * outs although the default pin config shows a different pin (that is
24720 + * wrong and useless).
24721 + *
24722 + * So, it's basically a problem of default pin configs, likely a BIOS issue.
24723 + * But, disabling the code below just works around it, and I'm too tired of
24724 + * bug reports with such devices...
24725 + */
24726                 else
24727                         stac92xx_reset_pinctl(codec, cfg->hp_pins[i], val);
24728 +#endif /* FIXME */
24729         }
24730  }
24731
24732 @@ -4648,7 +4668,7 @@
24733         case STAC_DELL_M4_3:
24734                 spec->num_dmics = 1;
24735                 spec->num_smuxes = 0;
24736 -               spec->num_dmuxes = 0;
24737 +               spec->num_dmuxes = 1;
24738                 break;
24739         default:
24740                 spec->num_dmics = STAC92HD71BXX_NUM_DMICS;
24741 --- kernel-power-2.6.28.orig/sound/pci/mixart/mixart.c
24742 +++ kernel-power-2.6.28/sound/pci/mixart/mixart.c
24743 @@ -607,6 +607,7 @@
24744         /* set the format to the board */
24745         err = mixart_set_format(stream, format);
24746         if(err < 0) {
24747 +               mutex_unlock(&mgr->setup_mutex);
24748                 return err;
24749         }
24750
24751 --- kernel-power-2.6.28.orig/sound/pci/oxygen/virtuoso.c
24752 +++ kernel-power-2.6.28/sound/pci/oxygen/virtuoso.c
24753 @@ -899,6 +899,7 @@
24754         .dac_channels = 8,
24755         .dac_volume_min = 0x0f,
24756         .dac_volume_max = 0xff,
24757 +       .misc_flags = OXYGEN_MISC_MIDI,
24758         .function_flags = OXYGEN_FUNCTION_2WIRE,
24759         .dac_i2s_format = OXYGEN_I2S_FORMAT_LJUST,
24760         .adc_i2s_format = OXYGEN_I2S_FORMAT_LJUST,
24761 --- kernel-power-2.6.28.orig/sound/usb/caiaq/caiaq-device.h
24762 +++ kernel-power-2.6.28/sound/usb/caiaq/caiaq-device.h
24763 @@ -75,6 +75,7 @@
24764         wait_queue_head_t ep1_wait_queue;
24765         wait_queue_head_t prepare_wait_queue;
24766         int spec_received, audio_parm_answer;
24767 +       int midi_out_active;
24768
24769         char vendor_name[CAIAQ_USB_STR_LEN];
24770         char product_name[CAIAQ_USB_STR_LEN];
24771 --- kernel-power-2.6.28.orig/sound/usb/caiaq/caiaq-midi.c
24772 +++ kernel-power-2.6.28/sound/usb/caiaq/caiaq-midi.c
24773 @@ -59,6 +59,11 @@
24774
24775  static int snd_usb_caiaq_midi_output_close(struct snd_rawmidi_substream *substream)
24776  {
24777 +       struct snd_usb_caiaqdev *dev = substream->rmidi->private_data;
24778 +       if (dev->midi_out_active) {
24779 +               usb_kill_urb(&dev->midi_out_urb);
24780 +               dev->midi_out_active = 0;
24781 +       }
24782         return 0;
24783  }
24784
24785 @@ -69,7 +74,8 @@
24786
24787         dev->midi_out_buf[0] = EP1_CMD_MIDI_WRITE;
24788         dev->midi_out_buf[1] = 0; /* port */
24789 -       len = snd_rawmidi_transmit_peek(substream, dev->midi_out_buf+3, EP1_BUFSIZE-3);
24790 +       len = snd_rawmidi_transmit(substream, dev->midi_out_buf + 3,
24791 +                                  EP1_BUFSIZE - 3);
24792
24793         if (len <= 0)
24794                 return;
24795 @@ -79,24 +85,24 @@
24796
24797         ret = usb_submit_urb(&dev->midi_out_urb, GFP_ATOMIC);
24798         if (ret < 0)
24799 -               log("snd_usb_caiaq_midi_send(%p): usb_submit_urb() failed, %d\n",
24800 -                               substream, ret);
24801 +               log("snd_usb_caiaq_midi_send(%p): usb_submit_urb() failed,"
24802 +                   "ret=%d, len=%d\n",
24803 +                   substream, ret, len);
24804 +       else
24805 +               dev->midi_out_active = 1;
24806  }
24807
24808  static void snd_usb_caiaq_midi_output_trigger(struct snd_rawmidi_substream *substream, int up)
24809  {
24810         struct snd_usb_caiaqdev *dev = substream->rmidi->private_data;
24811
24812 -       if (dev->midi_out_substream != NULL)
24813 -               return;
24814 -
24815 -       if (!up) {
24816 +       if (up) {
24817 +               dev->midi_out_substream = substream;
24818 +               if (!dev->midi_out_active)
24819 +                       snd_usb_caiaq_midi_send(dev, substream);
24820 +       } else {
24821                 dev->midi_out_substream = NULL;
24822 -               return;
24823         }
24824 -
24825 -       dev->midi_out_substream = substream;
24826 -       snd_usb_caiaq_midi_send(dev, substream);
24827  }
24828
24829
24830 @@ -161,16 +167,14 @@
24831  void snd_usb_caiaq_midi_output_done(struct urb* urb)
24832  {
24833         struct snd_usb_caiaqdev *dev = urb->context;
24834 -       char *buf = urb->transfer_buffer;
24835
24836 +       dev->midi_out_active = 0;
24837         if (urb->status != 0)
24838                 return;
24839
24840         if (!dev->midi_out_substream)
24841                 return;
24842
24843 -       snd_rawmidi_transmit_ack(dev->midi_out_substream, buf[2]);
24844 -       dev->midi_out_substream = NULL;
24845         snd_usb_caiaq_midi_send(dev, dev->midi_out_substream);
24846  }
24847
24848 --- kernel-power-2.6.28.orig/sound/usb/usbaudio.c
24849 +++ kernel-power-2.6.28/sound/usb/usbaudio.c
24850 @@ -2524,7 +2524,6 @@
24851                  * build the rate table and bitmap flags
24852                  */
24853                 int r, idx;
24854 -               unsigned int nonzero_rates = 0;
24855
24856                 fp->rate_table = kmalloc(sizeof(int) * nr_rates, GFP_KERNEL);
24857                 if (fp->rate_table == NULL) {
24858 @@ -2532,24 +2531,27 @@
24859                         return -1;
24860                 }
24861
24862 -               fp->nr_rates = nr_rates;
24863 -               fp->rate_min = fp->rate_max = combine_triple(&fmt[8]);
24864 +               fp->nr_rates = 0;
24865 +               fp->rate_min = fp->rate_max = 0;
24866                 for (r = 0, idx = offset + 1; r < nr_rates; r++, idx += 3) {
24867                         unsigned int rate = combine_triple(&fmt[idx]);
24868 +                       if (!rate)
24869 +                               continue;
24870                         /* C-Media CM6501 mislabels its 96 kHz altsetting */
24871                         if (rate == 48000 && nr_rates == 1 &&
24872 -                           chip->usb_id == USB_ID(0x0d8c, 0x0201) &&
24873 +                           (chip->usb_id == USB_ID(0x0d8c, 0x0201) ||
24874 +                            chip->usb_id == USB_ID(0x0d8c, 0x0102)) &&
24875                             fp->altsetting == 5 && fp->maxpacksize == 392)
24876                                 rate = 96000;
24877 -                       fp->rate_table[r] = rate;
24878 -                       nonzero_rates |= rate;
24879 -                       if (rate < fp->rate_min)
24880 +                       fp->rate_table[fp->nr_rates] = rate;
24881 +                       if (!fp->rate_min || rate < fp->rate_min)
24882                                 fp->rate_min = rate;
24883 -                       else if (rate > fp->rate_max)
24884 +                       if (!fp->rate_max || rate > fp->rate_max)
24885                                 fp->rate_max = rate;
24886                         fp->rates |= snd_pcm_rate_to_rate_bit(rate);
24887 +                       fp->nr_rates++;
24888                 }
24889 -               if (!nonzero_rates) {
24890 +               if (!fp->nr_rates) {
24891                         hwc_debug("All rates were zero. Skipping format!\n");
24892                         return -1;
24893                 }
24894 @@ -2966,6 +2968,7 @@
24895                 return -EINVAL;
24896         }
24897         alts = &iface->altsetting[fp->altset_idx];
24898 +       fp->maxpacksize = le16_to_cpu(get_endpoint(alts, 0)->wMaxPacketSize);
24899         usb_set_interface(chip->dev, fp->iface, 0);
24900         init_usb_pitch(chip->dev, fp->iface, alts, fp);
24901         init_usb_sample_rate(chip->dev, fp->iface, alts, fp, fp->rate_max);
24902 --- kernel-power-2.6.28.orig/sound/usb/usbmidi.c
24903 +++ kernel-power-2.6.28/sound/usb/usbmidi.c
24904 @@ -1628,6 +1628,7 @@
24905         }
24906
24907         ep_info.out_ep = get_endpoint(hostif, 2)->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK;
24908 +       ep_info.out_interval = 0;
24909         ep_info.out_cables = endpoint->out_cables & 0x5555;
24910         err = snd_usbmidi_out_endpoint_create(umidi, &ep_info, &umidi->endpoints[0]);
24911         if (err < 0)
24912 --- kernel-power-2.6.28.orig/virt/kvm/kvm_main.c
24913 +++ kernel-power-2.6.28/virt/kvm/kvm_main.c
24914 @@ -553,11 +553,19 @@
24915         return young;
24916  }
24917
24918 +static void kvm_mmu_notifier_release(struct mmu_notifier *mn,
24919 +                                    struct mm_struct *mm)
24920 +{
24921 +       struct kvm *kvm = mmu_notifier_to_kvm(mn);
24922 +       kvm_arch_flush_shadow(kvm);
24923 +}
24924 +
24925  static const struct mmu_notifier_ops kvm_mmu_notifier_ops = {
24926         .invalidate_page        = kvm_mmu_notifier_invalidate_page,
24927         .invalidate_range_start = kvm_mmu_notifier_invalidate_range_start,
24928         .invalidate_range_end   = kvm_mmu_notifier_invalidate_range_end,
24929         .clear_flush_young      = kvm_mmu_notifier_clear_flush_young,
24930 +       .release                = kvm_mmu_notifier_release,
24931  };
24932  #endif /* CONFIG_MMU_NOTIFIER && KVM_ARCH_WANT_MMU_NOTIFIER */
24933
24934 @@ -821,7 +829,10 @@
24935                 goto out_free;
24936         }
24937
24938 -       kvm_free_physmem_slot(&old, &new);
24939 +       kvm_free_physmem_slot(&old, npages ? &new : NULL);
24940 +       /* Slot deletion case: we have to update the current slot */
24941 +       if (!npages)
24942 +               *memslot = old;
24943  #ifdef CONFIG_DMAR
24944         /* map the pages in iommu page table */
24945         r = kvm_iommu_map_pages(kvm, base_gfn, npages);
24946 @@ -918,7 +929,7 @@
24947  }
24948  EXPORT_SYMBOL_GPL(kvm_is_error_hva);
24949
24950 -static struct kvm_memory_slot *__gfn_to_memslot(struct kvm *kvm, gfn_t gfn)
24951 +struct kvm_memory_slot *gfn_to_memslot_unaliased(struct kvm *kvm, gfn_t gfn)
24952  {
24953         int i;
24954
24955 @@ -931,11 +942,12 @@
24956         }
24957         return NULL;
24958  }
24959 +EXPORT_SYMBOL_GPL(gfn_to_memslot_unaliased);
24960
24961  struct kvm_memory_slot *gfn_to_memslot(struct kvm *kvm, gfn_t gfn)
24962  {
24963         gfn = unalias_gfn(kvm, gfn);
24964 -       return __gfn_to_memslot(kvm, gfn);
24965 +       return gfn_to_memslot_unaliased(kvm, gfn);
24966  }
24967
24968  int kvm_is_visible_gfn(struct kvm *kvm, gfn_t gfn)
24969 @@ -959,7 +971,7 @@
24970         struct kvm_memory_slot *slot;
24971
24972         gfn = unalias_gfn(kvm, gfn);
24973 -       slot = __gfn_to_memslot(kvm, gfn);
24974 +       slot = gfn_to_memslot_unaliased(kvm, gfn);
24975         if (!slot)
24976                 return bad_hva();
24977         return (slot->userspace_addr + (gfn - slot->base_gfn) * PAGE_SIZE);
24978 @@ -1210,7 +1222,7 @@
24979         struct kvm_memory_slot *memslot;
24980
24981         gfn = unalias_gfn(kvm, gfn);
24982 -       memslot = __gfn_to_memslot(kvm, gfn);
24983 +       memslot = gfn_to_memslot_unaliased(kvm, gfn);
24984         if (memslot && memslot->dirty_bitmap) {
24985                 unsigned long rel_gfn = gfn - memslot->base_gfn;
24986
24987 @@ -1295,7 +1307,7 @@
24988         return 0;
24989  }
24990
24991 -static const struct file_operations kvm_vcpu_fops = {
24992 +static struct file_operations kvm_vcpu_fops = {
24993         .release        = kvm_vcpu_release,
24994         .unlocked_ioctl = kvm_vcpu_ioctl,
24995         .compat_ioctl   = kvm_vcpu_ioctl,
24996 @@ -1689,7 +1701,7 @@
24997         return 0;
24998  }
24999
25000 -static const struct file_operations kvm_vm_fops = {
25001 +static struct file_operations kvm_vm_fops = {
25002         .release        = kvm_vm_release,
25003         .unlocked_ioctl = kvm_vm_ioctl,
25004         .compat_ioctl   = kvm_vm_ioctl,
25005 @@ -1711,6 +1723,17 @@
25006         return fd;
25007  }
25008
25009 +static long kvm_dev_ioctl_check_extension_generic(long arg)
25010 +{
25011 +       switch (arg) {
25012 +       case KVM_CAP_DESTROY_MEMORY_REGION_WORKS:
25013 +               return 1;
25014 +       default:
25015 +               break;
25016 +       }
25017 +       return kvm_dev_ioctl_check_extension(arg);
25018 +}
25019 +
25020  static long kvm_dev_ioctl(struct file *filp,
25021                           unsigned int ioctl, unsigned long arg)
25022  {
25023 @@ -1730,7 +1753,7 @@
25024                 r = kvm_dev_ioctl_create_vm();
25025                 break;
25026         case KVM_CHECK_EXTENSION:
25027 -               r = kvm_dev_ioctl_check_extension(arg);
25028 +               r = kvm_dev_ioctl_check_extension_generic(arg);
25029                 break;
25030         case KVM_GET_VCPU_MMAP_SIZE:
25031                 r = -EINVAL;
25032 @@ -2053,6 +2076,8 @@
25033         }
25034
25035         kvm_chardev_ops.owner = module;
25036 +       kvm_vm_fops.owner = module;
25037 +       kvm_vcpu_fops.owner = module;
25038
25039         r = misc_register(&kvm_dev);
25040         if (r) {
25041 --- kernel-power-2.6.28.orig/virt/kvm/kvm_trace.c
25042 +++ kernel-power-2.6.28/virt/kvm/kvm_trace.c
25043 @@ -252,6 +252,7 @@
25044                         struct kvm_trace_probe *p = &kvm_trace_probes[i];
25045                         marker_probe_unregister(p->name, p->probe_func, p);
25046                 }
25047 +               marker_synchronize_unregister();
25048
25049                 relay_close(kt->rchan);
25050                 debugfs_remove(kt->lost_file);