trunk/2.6.17-pre/1000_linux-2.6.16.1.patch

diff --git a/arch/i386/kernel/cpu/cpufreq/speedstep-smi.c b/arch/i386/kernel/cpu/cpufreq/speedstep-smi.c
index 28cc5d5..cfc4276 100644
--- a/arch/i386/kernel/cpu/cpufreq/speedstep-smi.c
+++ b/arch/i386/kernel/cpu/cpufreq/speedstep-smi.c
@@ -75,7 +75,9 @@ static int speedstep_smi_ownership (void
        __asm__ __volatile__(
                "out %%al, (%%dx)\n"
                : "=D" (result)
-               : "a" (command), "b" (function), "c" (0), "d" (smi_port), "D" (0), "S" (magic)
+               : "a" (command), "b" (function), "c" (0), "d" (smi_port),
+                       "D" (0), "S" (magic)
+               : "memory"
        );
 
        dprintk("result is %x\n", result);
diff --git a/arch/i386/kernel/dmi_scan.c b/arch/i386/kernel/dmi_scan.c
index 6a93d75..ca2a0cb 100644
--- a/arch/i386/kernel/dmi_scan.c
+++ b/arch/i386/kernel/dmi_scan.c
@@ -106,7 +106,7 @@ static void __init dmi_save_devices(stru
        struct dmi_device *dev;
 
        for (i = 0; i < count; i++) {
-               char *d = ((char *) dm) + (i * 2);
+               char *d = (char *)(dm + 1) + (i * 2);
 
                /* Skip disabled device */
                if ((*d & 0x80) == 0)
diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c
index 07a7f97..29f3d75 100644
--- a/drivers/base/cpu.c
+++ b/drivers/base/cpu.c
@@ -141,7 +141,7 @@ int __devinit register_cpu(struct cpu *c
        return error;
 }
 
-struct sys_device *get_cpu_sysdev(int cpu)
+struct sys_device *get_cpu_sysdev(unsigned cpu)
 {
        if (cpu < NR_CPUS)
                return cpu_sys_devices[cpu];
diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
index e97e911..4723182 100644
--- a/drivers/base/firmware_class.c
+++ b/drivers/base/firmware_class.c
@@ -211,18 +211,20 @@ static int
 fw_realloc_buffer(struct firmware_priv *fw_priv, int min_size)
 {
        u8 *new_data;
+       int new_size = fw_priv->alloc_size;
 
        if (min_size <= fw_priv->alloc_size)
                return 0;
 
-       new_data = vmalloc(fw_priv->alloc_size + PAGE_SIZE);
+       new_size = ALIGN(min_size, PAGE_SIZE);
+       new_data = vmalloc(new_size);
        if (!new_data) {
                printk(KERN_ERR "%s: unable to alloc buffer\n", __FUNCTION__);
                /* Make sure that we don't keep incomplete data */
                fw_load_abort(fw_priv);
                return -ENOMEM;
        }
-       fw_priv->alloc_size += PAGE_SIZE;
+       fw_priv->alloc_size = new_size;
        if (fw_priv->fw->data) {
                memcpy(new_data, fw_priv->fw->data, fw_priv->fw->size);
                vfree(fw_priv->fw->data);
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index 0d65394..c149d57 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -3269,8 +3269,8 @@ clean2:
        unregister_blkdev(hba[i]->major, hba[i]->devname);
 clean1:
        release_io_mem(hba[i]);
-       free_hba(i);
        hba[i]->busy_initializing = 0;
+       free_hba(i);
        return(-1);
 }
 
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 745ca1f..d559569 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -533,30 +533,35 @@ static void __clone_and_map(struct clone
 
        } else {
                /*
-                * Create two copy bios to deal with io that has
-                * been split across a target.
+                * Handle a bvec that must be split between two or more targets.
                 */
                struct bio_vec *bv = bio->bi_io_vec + ci->idx;
+               sector_t remaining = to_sector(bv->bv_len);
+               unsigned int offset = 0;
 
-               clone = split_bvec(bio, ci->sector, ci->idx,
-                                  bv->bv_offset, max);
-               __map_bio(ti, clone, tio);
-
-               ci->sector += max;
-               ci->sector_count -= max;
-               ti = dm_table_find_target(ci->map, ci->sector);
-
-               len = to_sector(bv->bv_len) - max;
-               clone = split_bvec(bio, ci->sector, ci->idx,
-                                  bv->bv_offset + to_bytes(max), len);
-               tio = alloc_tio(ci->md);
-               tio->io = ci->io;
-               tio->ti = ti;
-               memset(&tio->info, 0, sizeof(tio->info));
-               __map_bio(ti, clone, tio);
+               do {
+                       if (offset) {
+                               ti = dm_table_find_target(ci->map, ci->sector);
+                               max = max_io_len(ci->md, ci->sector, ti);
+
+                               tio = alloc_tio(ci->md);
+                               tio->io = ci->io;
+                               tio->ti = ti;
+                               memset(&tio->info, 0, sizeof(tio->info));
+                       }
+
+                       len = min(remaining, max);
+
+                       clone = split_bvec(bio, ci->sector, ci->idx,
+                                          bv->bv_offset + offset, len);
+
+                       __map_bio(ti, clone, tio);
+
+                       ci->sector += len;
+                       ci->sector_count -= len;
+                       offset += to_bytes(len);
+               } while (remaining -= len);
 
-               ci->sector += len;
-               ci->sector_count -= len;
                ci->idx++;
        }
 }
diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig
index d82c8a3..ef42a26 100644
--- a/drivers/media/video/Kconfig
+++ b/drivers/media/video/Kconfig
@@ -349,6 +349,7 @@ config VIDEO_AUDIO_DECODER
 config VIDEO_DECODER
        tristate "Add support for additional video chipsets"
        depends on VIDEO_DEV && I2C && EXPERIMENTAL
+       select FW_LOADER
        ---help---
          Say Y here to compile drivers for SAA7115, SAA7127 and CX25840
          video decoders.
diff --git a/drivers/media/video/tuner-types.c b/drivers/media/video/tuner-types.c
index 6fe7817..5f3d46d 100644
--- a/drivers/media/video/tuner-types.c
+++ b/drivers/media/video/tuner-types.c
@@ -1087,8 +1087,8 @@ static struct tuner_params tuner_tnf_533
 /* ------------ TUNER_SAMSUNG_TCPN_2121P30A - Samsung NTSC ------------ */
 
 static struct tuner_range tuner_samsung_tcpn_2121p30a_ntsc_ranges[] = {
-       { 16 * 175.75 /*MHz*/, 0x01, },
-       { 16 * 410.25 /*MHz*/, 0x02, },
+       { 16 * 130.00 /*MHz*/, 0x01, },
+       { 16 * 364.50 /*MHz*/, 0x02, },
        { 16 * 999.99        , 0x08, },
 };
 
diff --git a/drivers/scsi/sata_mv.c b/drivers/scsi/sata_mv.c
index 2770005..b00af08 100644
--- a/drivers/scsi/sata_mv.c
+++ b/drivers/scsi/sata_mv.c
@@ -1102,6 +1102,7 @@ static u8 mv_get_crpb_status(struct ata_
        void __iomem *port_mmio = mv_ap_base(ap);
        struct mv_port_priv *pp = ap->private_data;
        u32 out_ptr;
+       u8 ata_status;
 
        out_ptr = readl(port_mmio + EDMA_RSP_Q_OUT_PTR_OFS);
 
@@ -1109,6 +1110,8 @@ static u8 mv_get_crpb_status(struct ata_
        assert(((out_ptr >> EDMA_RSP_Q_PTR_SHIFT) & MV_MAX_Q_DEPTH_MASK) ==
               pp->rsp_consumer);
 
+       ata_status = pp->crpb[pp->rsp_consumer].flags >> CRPB_FLAG_STATUS_SHIFT;
+
        /* increment our consumer index... */
        pp->rsp_consumer = mv_inc_q_index(&pp->rsp_consumer);
 
@@ -1123,7 +1126,7 @@ static u8 mv_get_crpb_status(struct ata_
        writelfl(out_ptr, port_mmio + EDMA_RSP_Q_OUT_PTR_OFS);
 
        /* Return ATA status register for completed CRPB */
-       return (pp->crpb[pp->rsp_consumer].flags >> CRPB_FLAG_STATUS_SHIFT);
+       return ata_status;
 }
 
 /**
@@ -1192,7 +1195,6 @@ static void mv_host_intr(struct ata_host
        u32 hc_irq_cause;
        int shift, port, port0, hard_port, handled;
        unsigned int err_mask;
-       u8 ata_status = 0;
 
        if (hc == 0) {
                port0 = 0;
@@ -1210,6 +1212,7 @@ static void mv_host_intr(struct ata_host
                hc,relevant,hc_irq_cause);
 
        for (port = port0; port < port0 + MV_PORTS_PER_HC; port++) {
+               u8 ata_status = 0;
                ap = host_set->ports[port];
                hard_port = port & MV_PORT_MASK;        /* range 0-3 */
                handled = 0;    /* ensure ata_status is set if handled++ */
diff --git a/drivers/video/i810/i810_main.c b/drivers/video/i810/i810_main.c
index d8467c0..788297e 100644
--- a/drivers/video/i810/i810_main.c
+++ b/drivers/video/i810/i810_main.c
@@ -1508,7 +1508,7 @@ static int i810fb_cursor(struct fb_info 
                int size = ((cursor->image.width + 7) >> 3) *
                        cursor->image.height;
                int i;
-               u8 *data = kmalloc(64 * 8, GFP_KERNEL);
+               u8 *data = kmalloc(64 * 8, GFP_ATOMIC);
 
                if (data == NULL)
                        return -ENOMEM;
diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index 3ad8455..651a9e1 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -614,6 +614,7 @@ static struct dentry *v9fs_vfs_lookup(st
 
        sb = dir->i_sb;
        v9ses = v9fs_inode2v9ses(dir);
+       dentry->d_op = &v9fs_dentry_operations;
        dirfid = v9fs_fid_lookup(dentry->d_parent);
 
        if (!dirfid) {
@@ -681,8 +682,6 @@ static struct dentry *v9fs_vfs_lookup(st
                goto FreeFcall;
 
        fid->qid = fcall->params.rstat.stat.qid;
-
-       dentry->d_op = &v9fs_dentry_operations;
        v9fs_stat2inode(&fcall->params.rstat.stat, inode, inode->i_sb);
 
        d_add(dentry, inode);
diff --git a/fs/proc/proc_misc.c b/fs/proc/proc_misc.c
index 1d24fea..826c131 100644
--- a/fs/proc/proc_misc.c
+++ b/fs/proc/proc_misc.c
@@ -312,7 +312,7 @@ static void *devinfo_next(struct seq_fil
                case BLK_HDR:
                        info->state = BLK_LIST;
                        (*pos)++;
-                       break;
+                       /*fallthrough*/
                case BLK_LIST:
                        if (get_blkdev_info(info->blkdev,&idummy,&ndummy)) {
                                /*
diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
index 49bd219..cfd290d 100644
--- a/fs/sysfs/dir.c
+++ b/fs/sysfs/dir.c
@@ -302,6 +302,7 @@ void sysfs_remove_dir(struct kobject * k
         * Drop reference from dget() on entrance.
         */
        dput(dentry);
+       kobj->dentry = NULL;
 }
 
 int sysfs_rename_dir(struct kobject * kobj, const char *new_name)
diff --git a/fs/sysfs/inode.c b/fs/sysfs/inode.c
index 689f7bc..6beee6f 100644
--- a/fs/sysfs/inode.c
+++ b/fs/sysfs/inode.c
@@ -227,12 +227,16 @@ void sysfs_drop_dentry(struct sysfs_dire
 void sysfs_hash_and_remove(struct dentry * dir, const char * name)
 {
        struct sysfs_dirent * sd;
-       struct sysfs_dirent * parent_sd = dir->d_fsdata;
+       struct sysfs_dirent * parent_sd;
+
+       if (!dir)
+               return;
 
        if (dir->d_inode == NULL)
                /* no inode means this hasn't been made visible yet */
                return;
 
+       parent_sd = dir->d_fsdata;
        mutex_lock(&dir->d_inode->i_mutex);
        list_for_each_entry(sd, &parent_sd->s_children, s_sibling) {
                if (!sd->s_element)
diff --git a/fs/sysfs/symlink.c b/fs/sysfs/symlink.c
index e38d633..e5ce6e7 100644
--- a/fs/sysfs/symlink.c
+++ b/fs/sysfs/symlink.c
@@ -66,6 +66,7 @@ static int sysfs_add_link(struct dentry 
        if (!error)
                return 0;
 
+       kobject_put(target);
        kfree(sl->link_name);
 exit2:
        kfree(sl);
diff --git a/fs/xfs/linux-2.6/xfs_aops.c b/fs/xfs/linux-2.6/xfs_aops.c
index 74d8be8..a980736 100644
--- a/fs/xfs/linux-2.6/xfs_aops.c
+++ b/fs/xfs/linux-2.6/xfs_aops.c
@@ -616,7 +616,7 @@ xfs_is_delayed_page(
                                acceptable = (type == IOMAP_UNWRITTEN);
                        else if (buffer_delay(bh))
                                acceptable = (type == IOMAP_DELAY);
-                       else if (buffer_mapped(bh))
+                       else if (buffer_dirty(bh) && buffer_mapped(bh))
                                acceptable = (type == 0);
                        else
                                break;
diff --git a/include/linux/cpu.h b/include/linux/cpu.h
index 0ed1d48..d612b89 100644
--- a/include/linux/cpu.h
+++ b/include/linux/cpu.h
@@ -32,7 +32,7 @@ struct cpu {
 };
 
 extern int register_cpu(struct cpu *, int, struct node *);
-extern struct sys_device *get_cpu_sysdev(int cpu);
+extern struct sys_device *get_cpu_sysdev(unsigned cpu);
 #ifdef CONFIG_HOTPLUG_CPU
 extern void unregister_cpu(struct cpu *, struct node *);
 #endif
diff --git a/include/linux/raid/raid1.h b/include/linux/raid/raid1.h
index 9d5494a..3009c81 100644
--- a/include/linux/raid/raid1.h
+++ b/include/linux/raid/raid1.h
@@ -130,6 +130,6 @@ struct r1bio_s {
  * with failure when last write completes (and all failed).
  * Record that bi_end_io was called with this flag...
  */
-#define        R1BIO_Returned 4
+#define        R1BIO_Returned 6
 
 #endif
diff --git a/include/linux/rtc.h b/include/linux/rtc.h
index 0b2ba67..b739ac1 100644
--- a/include/linux/rtc.h
+++ b/include/linux/rtc.h
@@ -11,8 +11,6 @@
 #ifndef _LINUX_RTC_H_
 #define _LINUX_RTC_H_
 
-#include <linux/interrupt.h>
-
 /*
  * The struct used to pass data via the following ioctl. Similar to the
  * struct tm in <time.h>, but it needs to be here so that the kernel 
@@ -95,6 +93,8 @@ struct rtc_pll_info {
 
 #ifdef __KERNEL__
 
+#include <linux/interrupt.h>
+
 typedef struct rtc_task {
        void (*func)(void *private_data);
        void *private_data;
diff --git a/kernel/sched.c b/kernel/sched.c
index 4d46e90..4e7efac 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -237,6 +237,7 @@ struct runqueue {
 
        task_t *migration_thread;
        struct list_head migration_queue;
+       int cpu;
 #endif
 
 #ifdef CONFIG_SCHEDSTATS
@@ -1660,6 +1661,9 @@ unsigned long nr_iowait(void)
 /*
  * double_rq_lock - safely lock two runqueues
  *
+ * We must take them in cpu order to match code in
+ * dependent_sleeper and wake_dependent_sleeper.
+ *
  * Note this does not disable interrupts like task_rq_lock,
  * you need to do so manually before calling.
  */
@@ -1671,7 +1675,7 @@ static void double_rq_lock(runqueue_t *r
                spin_lock(&rq1->lock);
                __acquire(rq2->lock);   /* Fake it out ;) */
        } else {
-               if (rq1 < rq2) {
+               if (rq1->cpu < rq2->cpu) {
                        spin_lock(&rq1->lock);
                        spin_lock(&rq2->lock);
                } else {
@@ -1707,7 +1711,7 @@ static void double_lock_balance(runqueue
        __acquires(this_rq->lock)
 {
        if (unlikely(!spin_trylock(&busiest->lock))) {
-               if (busiest < this_rq) {
+               if (busiest->cpu < this_rq->cpu) {
                        spin_unlock(&this_rq->lock);
                        spin_lock(&busiest->lock);
                        spin_lock(&this_rq->lock);
@@ -6035,6 +6039,7 @@ void __init sched_init(void)
                rq->push_cpu = 0;
                rq->migration_thread = NULL;
                INIT_LIST_HEAD(&rq->migration_queue);
+               rq->cpu = i;
 #endif
                atomic_set(&rq->nr_iowait, 0);
 
diff --git a/net/core/sock.c b/net/core/sock.c
index 6e00811..5621198 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -404,8 +404,9 @@ set_rcvbuf:
                        if (!valbool) {
                                sk->sk_bound_dev_if = 0;
                        } else {
-                               if (optlen > IFNAMSIZ) 
-                                       optlen = IFNAMSIZ; 
+                               if (optlen > IFNAMSIZ - 1)
+                                       optlen = IFNAMSIZ - 1;
+                               memset(devname, 0, sizeof(devname));
                                if (copy_from_user(devname, optval, optlen)) {
                                        ret = -EFAULT;
                                        break;
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 8ee4d01..f75ff1d 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -1249,11 +1249,7 @@ int ip_push_pending_frames(struct sock *
        iph->tos = inet->tos;
        iph->tot_len = htons(skb->len);
        iph->frag_off = df;
-       if (!df) {
-               __ip_select_ident(iph, &rt->u.dst, 0);
-       } else {
-               iph->id = htons(inet->id++);
-       }
+       ip_select_ident(iph, &rt->u.dst, sk);
        iph->ttl = ttl;
        iph->protocol = sk->sk_protocol;
        iph->saddr = rt->rt_src;
1	diff --git a/arch/i386/kernel/cpu/cpufreq/speedstep-smi.c b/arch/i386/kernel/cpu/cpufreq/speedstep-smi.c
2	index 28cc5d5..cfc4276 100644
3	--- a/arch/i386/kernel/cpu/cpufreq/speedstep-smi.c
4	+++ b/arch/i386/kernel/cpu/cpufreq/speedstep-smi.c
5	@@ -75,7 +75,9 @@ static int speedstep_smi_ownership (void
6	__asm__ __volatile__(
7	"out %%al, (%%dx)\n"
8	: "=D" (result)
9	- : "a" (command), "b" (function), "c" (0), "d" (smi_port), "D" (0), "S" (magic)
10	+ : "a" (command), "b" (function), "c" (0), "d" (smi_port),
11	+ "D" (0), "S" (magic)
12	+ : "memory"
13	);
14
15	dprintk("result is %x\n", result);
16	diff --git a/arch/i386/kernel/dmi_scan.c b/arch/i386/kernel/dmi_scan.c
17	index 6a93d75..ca2a0cb 100644
18	--- a/arch/i386/kernel/dmi_scan.c
19	+++ b/arch/i386/kernel/dmi_scan.c
20	@@ -106,7 +106,7 @@ static void __init dmi_save_devices(stru
21	struct dmi_device *dev;
22
23	for (i = 0; i < count; i++) {
24	- char d = ((char ) dm) + (i * 2);
25	+ char d = (char )(dm + 1) + (i * 2);
26
27	/* Skip disabled device */
28	if ((*d & 0x80) == 0)
29	diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c
30	index 07a7f97..29f3d75 100644
31	--- a/drivers/base/cpu.c
32	+++ b/drivers/base/cpu.c
33	@@ -141,7 +141,7 @@ int __devinit register_cpu(struct cpu *c
34	return error;
35	}
36
37	-struct sys_device *get_cpu_sysdev(int cpu)
38	+struct sys_device *get_cpu_sysdev(unsigned cpu)
39	{
40	if (cpu < NR_CPUS)
41	return cpu_sys_devices[cpu];
42	diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
43	index e97e911..4723182 100644
44	--- a/drivers/base/firmware_class.c
45	+++ b/drivers/base/firmware_class.c
46	@@ -211,18 +211,20 @@ static int
47	fw_realloc_buffer(struct firmware_priv *fw_priv, int min_size)
48	{
49	u8 *new_data;
50	+ int new_size = fw_priv->alloc_size;
51
52	if (min_size <= fw_priv->alloc_size)
53	return 0;
54
55	- new_data = vmalloc(fw_priv->alloc_size + PAGE_SIZE);
56	+ new_size = ALIGN(min_size, PAGE_SIZE);
57	+ new_data = vmalloc(new_size);
58	if (!new_data) {
59	printk(KERN_ERR "%s: unable to alloc buffer\n", __FUNCTION__);
60	/* Make sure that we don't keep incomplete data */
61	fw_load_abort(fw_priv);
62	return -ENOMEM;
63	}
64	- fw_priv->alloc_size += PAGE_SIZE;
65	+ fw_priv->alloc_size = new_size;
66	if (fw_priv->fw->data) {
67	memcpy(new_data, fw_priv->fw->data, fw_priv->fw->size);
68	vfree(fw_priv->fw->data);
69	diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
70	index 0d65394..c149d57 100644
71	--- a/drivers/block/cciss.c
72	+++ b/drivers/block/cciss.c
73	@@ -3269,8 +3269,8 @@ clean2:
74	unregister_blkdev(hba[i]->major, hba[i]->devname);
75	clean1:
76	release_io_mem(hba[i]);
77	- free_hba(i);
78	hba[i]->busy_initializing = 0;
79	+ free_hba(i);
80	return(-1);
81	}
82
83	diff --git a/drivers/md/dm.c b/drivers/md/dm.c
84	index 745ca1f..d559569 100644
85	--- a/drivers/md/dm.c
86	+++ b/drivers/md/dm.c
87	@@ -533,30 +533,35 @@ static void __clone_and_map(struct clone
88
89	} else {
90	/*
91	- * Create two copy bios to deal with io that has
92	- * been split across a target.
93	+ * Handle a bvec that must be split between two or more targets.
94	*/
95	struct bio_vec *bv = bio->bi_io_vec + ci->idx;
96	+ sector_t remaining = to_sector(bv->bv_len);
97	+ unsigned int offset = 0;
98
99	- clone = split_bvec(bio, ci->sector, ci->idx,
100	- bv->bv_offset, max);
101	- __map_bio(ti, clone, tio);
102	-
103	- ci->sector += max;
104	- ci->sector_count -= max;
105	- ti = dm_table_find_target(ci->map, ci->sector);
106	-
107	- len = to_sector(bv->bv_len) - max;
108	- clone = split_bvec(bio, ci->sector, ci->idx,
109	- bv->bv_offset + to_bytes(max), len);
110	- tio = alloc_tio(ci->md);
111	- tio->io = ci->io;
112	- tio->ti = ti;
113	- memset(&tio->info, 0, sizeof(tio->info));
114	- __map_bio(ti, clone, tio);
115	+ do {
116	+ if (offset) {
117	+ ti = dm_table_find_target(ci->map, ci->sector);
118	+ max = max_io_len(ci->md, ci->sector, ti);
119	+
120	+ tio = alloc_tio(ci->md);
121	+ tio->io = ci->io;
122	+ tio->ti = ti;
123	+ memset(&tio->info, 0, sizeof(tio->info));
124	+ }
125	+
126	+ len = min(remaining, max);
127	+
128	+ clone = split_bvec(bio, ci->sector, ci->idx,
129	+ bv->bv_offset + offset, len);
130	+
131	+ __map_bio(ti, clone, tio);
132	+
133	+ ci->sector += len;
134	+ ci->sector_count -= len;
135	+ offset += to_bytes(len);
136	+ } while (remaining -= len);
137
138	- ci->sector += len;
139	- ci->sector_count -= len;
140	ci->idx++;
141	}
142	}
143	diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig
144	index d82c8a3..ef42a26 100644
145	--- a/drivers/media/video/Kconfig
146	+++ b/drivers/media/video/Kconfig
147	@@ -349,6 +349,7 @@ config VIDEO_AUDIO_DECODER
148	config VIDEO_DECODER
149	tristate "Add support for additional video chipsets"
150	depends on VIDEO_DEV && I2C && EXPERIMENTAL
151	+ select FW_LOADER
152	---help---
153	Say Y here to compile drivers for SAA7115, SAA7127 and CX25840
154	video decoders.
155	diff --git a/drivers/media/video/tuner-types.c b/drivers/media/video/tuner-types.c
156	index 6fe7817..5f3d46d 100644
157	--- a/drivers/media/video/tuner-types.c
158	+++ b/drivers/media/video/tuner-types.c
159	@@ -1087,8 +1087,8 @@ static struct tuner_params tuner_tnf_533
160	/* ------------ TUNER_SAMSUNG_TCPN_2121P30A - Samsung NTSC ------------ */
161
162	static struct tuner_range tuner_samsung_tcpn_2121p30a_ntsc_ranges[] = {
163	- { 16 * 175.75 /MHz/, 0x01, },
164	- { 16 * 410.25 /MHz/, 0x02, },
165	+ { 16 * 130.00 /MHz/, 0x01, },
166	+ { 16 * 364.50 /MHz/, 0x02, },
167	{ 16 * 999.99 , 0x08, },
168	};
169
170	diff --git a/drivers/scsi/sata_mv.c b/drivers/scsi/sata_mv.c
171	index 2770005..b00af08 100644
172	--- a/drivers/scsi/sata_mv.c
173	+++ b/drivers/scsi/sata_mv.c
174	@@ -1102,6 +1102,7 @@ static u8 mv_get_crpb_status(struct ata_
175	void __iomem *port_mmio = mv_ap_base(ap);
176	struct mv_port_priv *pp = ap->private_data;
177	u32 out_ptr;
178	+ u8 ata_status;
179
180	out_ptr = readl(port_mmio + EDMA_RSP_Q_OUT_PTR_OFS);
181
182	@@ -1109,6 +1110,8 @@ static u8 mv_get_crpb_status(struct ata_
183	assert(((out_ptr >> EDMA_RSP_Q_PTR_SHIFT) & MV_MAX_Q_DEPTH_MASK) ==
184	pp->rsp_consumer);
185
186	+ ata_status = pp->crpb[pp->rsp_consumer].flags >> CRPB_FLAG_STATUS_SHIFT;
187	+
188	/* increment our consumer index... */
189	pp->rsp_consumer = mv_inc_q_index(&pp->rsp_consumer);
190
191	@@ -1123,7 +1126,7 @@ static u8 mv_get_crpb_status(struct ata_
192	writelfl(out_ptr, port_mmio + EDMA_RSP_Q_OUT_PTR_OFS);
193
194	/* Return ATA status register for completed CRPB */
195	- return (pp->crpb[pp->rsp_consumer].flags >> CRPB_FLAG_STATUS_SHIFT);
196	+ return ata_status;
197	}
198
199	/**
200	@@ -1192,7 +1195,6 @@ static void mv_host_intr(struct ata_host
201	u32 hc_irq_cause;
202	int shift, port, port0, hard_port, handled;
203	unsigned int err_mask;
204	- u8 ata_status = 0;
205
206	if (hc == 0) {
207	port0 = 0;
208	@@ -1210,6 +1212,7 @@ static void mv_host_intr(struct ata_host
209	hc,relevant,hc_irq_cause);
210
211	for (port = port0; port < port0 + MV_PORTS_PER_HC; port++) {
212	+ u8 ata_status = 0;
213	ap = host_set->ports[port];
214	hard_port = port & MV_PORT_MASK; /* range 0-3 */
215	handled = 0; /* ensure ata_status is set if handled++ */
216	diff --git a/drivers/video/i810/i810_main.c b/drivers/video/i810/i810_main.c
217	index d8467c0..788297e 100644
218	--- a/drivers/video/i810/i810_main.c
219	+++ b/drivers/video/i810/i810_main.c
220	@@ -1508,7 +1508,7 @@ static int i810fb_cursor(struct fb_info
221	int size = ((cursor->image.width + 7) >> 3) *
222	cursor->image.height;
223	int i;
224	- u8 data = kmalloc(64 8, GFP_KERNEL);
225	+ u8 data = kmalloc(64 8, GFP_ATOMIC);
226
227	if (data == NULL)
228	return -ENOMEM;
229	diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
230	index 3ad8455..651a9e1 100644
231	--- a/fs/9p/vfs_inode.c
232	+++ b/fs/9p/vfs_inode.c
233	@@ -614,6 +614,7 @@ static struct dentry *v9fs_vfs_lookup(st
234
235	sb = dir->i_sb;
236	v9ses = v9fs_inode2v9ses(dir);
237	+ dentry->d_op = &v9fs_dentry_operations;
238	dirfid = v9fs_fid_lookup(dentry->d_parent);
239
240	if (!dirfid) {
241	@@ -681,8 +682,6 @@ static struct dentry *v9fs_vfs_lookup(st
242	goto FreeFcall;
243
244	fid->qid = fcall->params.rstat.stat.qid;
245	-
246	- dentry->d_op = &v9fs_dentry_operations;
247	v9fs_stat2inode(&fcall->params.rstat.stat, inode, inode->i_sb);
248
249	d_add(dentry, inode);
250	diff --git a/fs/proc/proc_misc.c b/fs/proc/proc_misc.c
251	index 1d24fea..826c131 100644
252	--- a/fs/proc/proc_misc.c
253	+++ b/fs/proc/proc_misc.c
254	@@ -312,7 +312,7 @@ static void *devinfo_next(struct seq_fil
255	case BLK_HDR:
256	info->state = BLK_LIST;
257	(*pos)++;
258	- break;
259	+ /fallthrough/
260	case BLK_LIST:
261	if (get_blkdev_info(info->blkdev,&idummy,&ndummy)) {
262	/*
263	diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
264	index 49bd219..cfd290d 100644
265	--- a/fs/sysfs/dir.c
266	+++ b/fs/sysfs/dir.c
267	@@ -302,6 +302,7 @@ void sysfs_remove_dir(struct kobject * k
268	* Drop reference from dget() on entrance.
269	*/
270	dput(dentry);
271	+ kobj->dentry = NULL;
272	}
273
274	int sysfs_rename_dir(struct kobject * kobj, const char *new_name)
275	diff --git a/fs/sysfs/inode.c b/fs/sysfs/inode.c
276	index 689f7bc..6beee6f 100644
277	--- a/fs/sysfs/inode.c
278	+++ b/fs/sysfs/inode.c
279	@@ -227,12 +227,16 @@ void sysfs_drop_dentry(struct sysfs_dire
280	void sysfs_hash_and_remove(struct dentry * dir, const char * name)
281	{
282	struct sysfs_dirent * sd;
283	- struct sysfs_dirent * parent_sd = dir->d_fsdata;
284	+ struct sysfs_dirent * parent_sd;
285	+
286	+ if (!dir)
287	+ return;
288
289	if (dir->d_inode == NULL)
290	/* no inode means this hasn't been made visible yet */
291	return;
292
293	+ parent_sd = dir->d_fsdata;
294	mutex_lock(&dir->d_inode->i_mutex);
295	list_for_each_entry(sd, &parent_sd->s_children, s_sibling) {
296	if (!sd->s_element)
297	diff --git a/fs/sysfs/symlink.c b/fs/sysfs/symlink.c
298	index e38d633..e5ce6e7 100644
299	--- a/fs/sysfs/symlink.c
300	+++ b/fs/sysfs/symlink.c
301	@@ -66,6 +66,7 @@ static int sysfs_add_link(struct dentry
302	if (!error)
303	return 0;
304
305	+ kobject_put(target);
306	kfree(sl->link_name);
307	exit2:
308	kfree(sl);
309	diff --git a/fs/xfs/linux-2.6/xfs_aops.c b/fs/xfs/linux-2.6/xfs_aops.c
310	index 74d8be8..a980736 100644
311	--- a/fs/xfs/linux-2.6/xfs_aops.c
312	+++ b/fs/xfs/linux-2.6/xfs_aops.c
313	@@ -616,7 +616,7 @@ xfs_is_delayed_page(
314	acceptable = (type == IOMAP_UNWRITTEN);
315	else if (buffer_delay(bh))
316	acceptable = (type == IOMAP_DELAY);
317	- else if (buffer_mapped(bh))
318	+ else if (buffer_dirty(bh) && buffer_mapped(bh))
319	acceptable = (type == 0);
320	else
321	break;
322	diff --git a/include/linux/cpu.h b/include/linux/cpu.h
323	index 0ed1d48..d612b89 100644
324	--- a/include/linux/cpu.h
325	+++ b/include/linux/cpu.h
326	@@ -32,7 +32,7 @@ struct cpu {
327	};
328
329	extern int register_cpu(struct cpu , int, struct node );
330	-extern struct sys_device *get_cpu_sysdev(int cpu);
331	+extern struct sys_device *get_cpu_sysdev(unsigned cpu);
332	#ifdef CONFIG_HOTPLUG_CPU
333	extern void unregister_cpu(struct cpu , struct node );
334	#endif
335	diff --git a/include/linux/raid/raid1.h b/include/linux/raid/raid1.h
336	index 9d5494a..3009c81 100644
337	--- a/include/linux/raid/raid1.h
338	+++ b/include/linux/raid/raid1.h
339	@@ -130,6 +130,6 @@ struct r1bio_s {
340	* with failure when last write completes (and all failed).
341	* Record that bi_end_io was called with this flag...
342	*/
343	-#define R1BIO_Returned 4
344	+#define R1BIO_Returned 6
345
346	#endif
347	diff --git a/include/linux/rtc.h b/include/linux/rtc.h
348	index 0b2ba67..b739ac1 100644
349	--- a/include/linux/rtc.h
350	+++ b/include/linux/rtc.h
351	@@ -11,8 +11,6 @@
352	#ifndef _LINUX_RTC_H_
353	#define _LINUX_RTC_H_
354
355	-#include <linux/interrupt.h>
356	-
357	/*
358	* The struct used to pass data via the following ioctl. Similar to the
359	* struct tm in <time.h>, but it needs to be here so that the kernel
360	@@ -95,6 +93,8 @@ struct rtc_pll_info {
361
362	#ifdef __KERNEL__
363
364	+#include <linux/interrupt.h>
365	+
366	typedef struct rtc_task {
367	void (func)(void private_data);
368	void *private_data;
369	diff --git a/kernel/sched.c b/kernel/sched.c
370	index 4d46e90..4e7efac 100644
371	--- a/kernel/sched.c
372	+++ b/kernel/sched.c
373	@@ -237,6 +237,7 @@ struct runqueue {
374
375	task_t *migration_thread;
376	struct list_head migration_queue;
377	+ int cpu;
378	#endif
379
380	#ifdef CONFIG_SCHEDSTATS
381	@@ -1660,6 +1661,9 @@ unsigned long nr_iowait(void)
382	/*
383	* double_rq_lock - safely lock two runqueues
384	*
385	+ * We must take them in cpu order to match code in
386	+ * dependent_sleeper and wake_dependent_sleeper.
387	+ *
388	* Note this does not disable interrupts like task_rq_lock,
389	* you need to do so manually before calling.
390	*/
391	@@ -1671,7 +1675,7 @@ static void double_rq_lock(runqueue_t *r
392	spin_lock(&rq1->lock);
393	__acquire(rq2->lock); /* Fake it out ;) */
394	} else {
395	- if (rq1 < rq2) {
396	+ if (rq1->cpu < rq2->cpu) {
397	spin_lock(&rq1->lock);
398	spin_lock(&rq2->lock);
399	} else {
400	@@ -1707,7 +1711,7 @@ static void double_lock_balance(runqueue
401	__acquires(this_rq->lock)
402	{
403	if (unlikely(!spin_trylock(&busiest->lock))) {
404	- if (busiest < this_rq) {
405	+ if (busiest->cpu < this_rq->cpu) {
406	spin_unlock(&this_rq->lock);
407	spin_lock(&busiest->lock);
408	spin_lock(&this_rq->lock);
409	@@ -6035,6 +6039,7 @@ void __init sched_init(void)
410	rq->push_cpu = 0;
411	rq->migration_thread = NULL;
412	INIT_LIST_HEAD(&rq->migration_queue);
413	+ rq->cpu = i;
414	#endif
415	atomic_set(&rq->nr_iowait, 0);
416
417	diff --git a/net/core/sock.c b/net/core/sock.c
418	index 6e00811..5621198 100644
419	--- a/net/core/sock.c
420	+++ b/net/core/sock.c
421	@@ -404,8 +404,9 @@ set_rcvbuf:
422	if (!valbool) {
423	sk->sk_bound_dev_if = 0;
424	} else {
425	- if (optlen > IFNAMSIZ)
426	- optlen = IFNAMSIZ;
427	+ if (optlen > IFNAMSIZ - 1)
428	+ optlen = IFNAMSIZ - 1;
429	+ memset(devname, 0, sizeof(devname));
430	if (copy_from_user(devname, optval, optlen)) {
431	ret = -EFAULT;
432	break;
433	diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
434	index 8ee4d01..f75ff1d 100644
435	--- a/net/ipv4/ip_output.c
436	+++ b/net/ipv4/ip_output.c
437	@@ -1249,11 +1249,7 @@ int ip_push_pending_frames(struct sock *
438	iph->tos = inet->tos;
439	iph->tot_len = htons(skb->len);
440	iph->frag_off = df;
441	- if (!df) {
442	- __ip_select_ident(iph, &rt->u.dst, 0);
443	- } else {
444	- iph->id = htons(inet->id++);
445	- }
446	+ ip_select_ident(iph, &rt->u.dst, sk);
447	iph->ttl = ttl;
448	iph->protocol = sk->sk_protocol;
449	iph->saddr = rt->rt_src;