Warning!

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/2.6.19/1000_2.6.19.2.patch	Thu Jan 18 23:26:35 2007 +0100
@@ -0,0 +1,3919 @@
+diff --git a/Makefile b/Makefile
+index aef9625..b0a32c2 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ VERSION = 2
+ PATCHLEVEL = 6
+ SUBLEVEL = 19
+-EXTRAVERSION =
++EXTRAVERSION = .2
+ NAME=Avast! A bilge rat!
+ 
+ # *DOCUMENTATION*
+diff --git a/arch/arm/kernel/calls.S b/arch/arm/kernel/calls.S
+index 3173924..e8f7436 100644
+--- a/arch/arm/kernel/calls.S
++++ b/arch/arm/kernel/calls.S
+@@ -331,6 +331,19 @@
+ 		CALL(sys_mbind)
+ /* 320 */	CALL(sys_get_mempolicy)
+ 		CALL(sys_set_mempolicy)
++		CALL(sys_openat)
++		CALL(sys_mkdirat)
++		CALL(sys_mknodat)
++/* 325 */	CALL(sys_fchownat)
++		CALL(sys_futimesat)
++		CALL(sys_fstatat64)
++		CALL(sys_unlinkat)
++		CALL(sys_renameat)
++/* 330 */	CALL(sys_linkat)
++		CALL(sys_symlinkat)
++		CALL(sys_readlinkat)
++		CALL(sys_fchmodat)
++		CALL(sys_faccessat)
+ #ifndef syscalls_counted
+ .equ syscalls_padding, ((NR_syscalls + 3) & ~3) - NR_syscalls
+ #define syscalls_counted
+diff --git a/arch/i386/kernel/acpi/boot.c b/arch/i386/kernel/acpi/boot.c
+index d12fb97..c8f96cf 100644
+--- a/arch/i386/kernel/acpi/boot.c
++++ b/arch/i386/kernel/acpi/boot.c
+@@ -333,7 +333,7 @@ acpi_parse_ioapic(acpi_table_entry_header * header, const unsigned long end)
+ /*
+  * Parse Interrupt Source Override for the ACPI SCI
+  */
+-static void acpi_sci_ioapic_setup(u32 bus_irq, u32 gsi, u16 polarity, u16 trigger)
++static void acpi_sci_ioapic_setup(u32 gsi, u16 polarity, u16 trigger)
+ {
+ 	if (trigger == 0)	/* compatible SCI trigger is level */
+ 		trigger = 3;
+@@ -353,13 +353,13 @@ static void acpi_sci_ioapic_setup(u32 bus_irq, u32 gsi, u16 polarity, u16 trigge
+ 	 * If GSI is < 16, this will update its flags,
+ 	 * else it will create a new mp_irqs[] entry.
+ 	 */
+-	mp_override_legacy_irq(bus_irq, polarity, trigger, gsi);
++	mp_override_legacy_irq(gsi, polarity, trigger, gsi);
+ 
+ 	/*
+ 	 * stash over-ride to indicate we've been here
+ 	 * and for later update of acpi_fadt
+ 	 */
+-	acpi_sci_override_gsi = bus_irq;
++	acpi_sci_override_gsi = gsi;
+ 	return;
+ }
+ 
+@@ -377,7 +377,7 @@ acpi_parse_int_src_ovr(acpi_table_entry_header * header,
+ 	acpi_table_print_madt_entry(header);
+ 
+ 	if (intsrc->bus_irq == acpi_fadt.sci_int) {
+-		acpi_sci_ioapic_setup(intsrc->bus_irq, intsrc->global_irq,
++		acpi_sci_ioapic_setup(intsrc->global_irq,
+ 				      intsrc->flags.polarity,
+ 				      intsrc->flags.trigger);
+ 		return 0;
+@@ -880,7 +880,7 @@ static int __init acpi_parse_madt_ioapic_entries(void)
+ 	 * pretend we got one so we can set the SCI flags.
+ 	 */
+ 	if (!acpi_sci_override_gsi)
+-		acpi_sci_ioapic_setup(acpi_fadt.sci_int, acpi_fadt.sci_int, 0, 0);
++		acpi_sci_ioapic_setup(acpi_fadt.sci_int, 0, 0);
+ 
+ 	/* Fill in identity legacy mapings where no override */
+ 	mp_config_acpi_legacy_irqs();
+diff --git a/arch/i386/kernel/apm.c b/arch/i386/kernel/apm.c
+index a60358f..44a5535 100644
+--- a/arch/i386/kernel/apm.c
++++ b/arch/i386/kernel/apm.c
+@@ -784,7 +784,11 @@ static int apm_do_idle(void)
+ 	polling = !!(current_thread_info()->status & TS_POLLING);
+ 	if (polling) {
+ 		current_thread_info()->status &= ~TS_POLLING;
+-		smp_mb__after_clear_bit();
++		/*
++		 * TS_POLLING-cleared state must be visible before we
++		 * test NEED_RESCHED:
++		 */
++		smp_mb();
+ 	}
+ 	if (!need_resched()) {
+ 		idled = 1;
+diff --git a/arch/i386/kernel/nmi.c b/arch/i386/kernel/nmi.c
+index eaafe23..d9df609 100644
+--- a/arch/i386/kernel/nmi.c
++++ b/arch/i386/kernel/nmi.c
+@@ -192,6 +192,8 @@ static __cpuinit inline int nmi_known_cpu(void)
+ 	return 0;
+ }
+ 
++static int endflag __initdata = 0;
++
+ #ifdef CONFIG_SMP
+ /* The performance counters used by NMI_LOCAL_APIC don't trigger when
+  * the CPU is idle. To make sure the NMI watchdog really ticks on all
+@@ -199,7 +201,6 @@ static __cpuinit inline int nmi_known_cpu(void)
+  */
+ static __init void nmi_cpu_busy(void *data)
+ {
+-	volatile int *endflag = data;
+ 	local_irq_enable_in_hardirq();
+ 	/* Intentionally don't use cpu_relax here. This is
+ 	   to make sure that the performance counter really ticks,
+@@ -207,14 +208,13 @@ static __init void nmi_cpu_busy(void *data)
+ 	   pause instruction. On a real HT machine this is fine because
+ 	   all other CPUs are busy with "useless" delay loops and don't
+ 	   care if they get somewhat less cycles. */
+-	while (*endflag == 0)
+-		barrier();
++	while (endflag == 0)
++		mb();
+ }
+ #endif
+ 
+ static int __init check_nmi_watchdog(void)
+ {
+-	volatile int endflag = 0;
+ 	unsigned int *prev_nmi_count;
+ 	int cpu;
+ 
+diff --git a/arch/i386/kernel/process.c b/arch/i386/kernel/process.c
+index dd53c58..304b261 100644
+--- a/arch/i386/kernel/process.c
++++ b/arch/i386/kernel/process.c
+@@ -103,7 +103,12 @@ void default_idle(void)
+ 
+ 	if (!hlt_counter && boot_cpu_data.hlt_works_ok) {
+ 		current_thread_info()->status &= ~TS_POLLING;
+-		smp_mb__after_clear_bit();
++		/*
++		 * TS_POLLING-cleared state must be visible before we
++		 * test NEED_RESCHED:
++		 */
++		smp_mb();
++
+ 		while (!need_resched()) {
+ 			local_irq_disable();
+ 			if (!need_resched())
+diff --git a/arch/i386/kernel/smpboot.c b/arch/i386/kernel/smpboot.c
+index 4bb8b77..b5f562e 100644
+--- a/arch/i386/kernel/smpboot.c
++++ b/arch/i386/kernel/smpboot.c
+@@ -1095,7 +1095,7 @@ static int __cpuinit __smp_prepare_cpu(int cpu)
+ 
+ 	/* init low mem mapping */
+ 	clone_pgd_range(swapper_pg_dir, swapper_pg_dir + USER_PGD_PTRS,
+-			KERNEL_PGD_PTRS);
++			min_t(unsigned long, KERNEL_PGD_PTRS, USER_PGD_PTRS));
+ 	flush_tlb_all();
+ 	schedule_work(&task);
+ 	wait_for_completion(&done);
+diff --git a/arch/ia64/kernel/process.c b/arch/ia64/kernel/process.c
+index 51922b9..17685ab 100644
+--- a/arch/ia64/kernel/process.c
++++ b/arch/ia64/kernel/process.c
+@@ -268,10 +268,16 @@ cpu_idle (void)
+ 
+ 	/* endless idle loop with no priority at all */
+ 	while (1) {
+-		if (can_do_pal_halt)
++		if (can_do_pal_halt) {
+ 			current_thread_info()->status &= ~TS_POLLING;
+-		else
++			/*
++			 * TS_POLLING-cleared state must be visible before we
++			 * test NEED_RESCHED:
++			 */
++			smp_mb();
++		} else {
+ 			current_thread_info()->status |= TS_POLLING;
++		}
+ 
+ 		if (!need_resched()) {
+ 			void (*idle)(void);
+diff --git a/arch/m32r/kernel/entry.S b/arch/m32r/kernel/entry.S
+index ac6d840..5b01fd2 100644
+--- a/arch/m32r/kernel/entry.S
++++ b/arch/m32r/kernel/entry.S
+@@ -23,35 +23,35 @@
+  *	updated in fork.c:copy_thread, signal.c:do_signal,
+  *	ptrace.c and ptrace.h
+  *
+- * M32Rx/M32R2				M32R
+- *       @(sp)      - r4		ditto
+- *       @(0x04,sp) - r5		ditto
+- *       @(0x08,sp) - r6		ditto
+- *       @(0x0c,sp) - *pt_regs		ditto
+- *       @(0x10,sp) - r0		ditto
+- *       @(0x14,sp) - r1		ditto
+- *       @(0x18,sp) - r2		ditto
+- *       @(0x1c,sp) - r3		ditto
+- *       @(0x20,sp) - r7		ditto
+- *       @(0x24,sp) - r8		ditto
+- *       @(0x28,sp) - r9		ditto
+- *       @(0x2c,sp) - r10		ditto
+- *       @(0x30,sp) - r11		ditto
+- *       @(0x34,sp) - r12		ditto
+- *       @(0x38,sp) - syscall_nr	ditto
+- *       @(0x3c,sp) - acc0h		@(0x3c,sp) - acch
+- *       @(0x40,sp) - acc0l		@(0x40,sp) - accl
+- *       @(0x44,sp) - acc1h		@(0x44,sp) - dummy_acc1h
+- *       @(0x48,sp) - acc1l		@(0x48,sp) - dummy_acc1l
+- *       @(0x4c,sp) - psw		ditto
+- *       @(0x50,sp) - bpc		ditto
+- *       @(0x54,sp) - bbpsw		ditto
+- *       @(0x58,sp) - bbpc		ditto
+- *       @(0x5c,sp) - spu (cr3)		ditto
+- *       @(0x60,sp) - fp (r13)		ditto
+- *       @(0x64,sp) - lr (r14)		ditto
+- *       @(0x68,sp) - spi (cr2)		ditto
+- *       @(0x6c,sp) - orig_r0		ditto
++ * M32R/M32Rx/M32R2
++ *       @(sp)      - r4
++ *       @(0x04,sp) - r5
++ *       @(0x08,sp) - r6
++ *       @(0x0c,sp) - *pt_regs
++ *       @(0x10,sp) - r0
++ *       @(0x14,sp) - r1
++ *       @(0x18,sp) - r2
++ *       @(0x1c,sp) - r3
++ *       @(0x20,sp) - r7
++ *       @(0x24,sp) - r8
++ *       @(0x28,sp) - r9
++ *       @(0x2c,sp) - r10
++ *       @(0x30,sp) - r11
++ *       @(0x34,sp) - r12
++ *       @(0x38,sp) - syscall_nr
++ *       @(0x3c,sp) - acc0h
++ *       @(0x40,sp) - acc0l
++ *       @(0x44,sp) - acc1h		; ISA_DSP_LEVEL2 only
++ *       @(0x48,sp) - acc1l		; ISA_DSP_LEVEL2 only
++ *       @(0x4c,sp) - psw
++ *       @(0x50,sp) - bpc
++ *       @(0x54,sp) - bbpsw
++ *       @(0x58,sp) - bbpc
++ *       @(0x5c,sp) - spu (cr3)
++ *       @(0x60,sp) - fp (r13)
++ *       @(0x64,sp) - lr (r14)
++ *       @(0x68,sp) - spi (cr2)
++ *       @(0x6c,sp) - orig_r0
+  */
+ 
+ #include <linux/linkage.h>
+@@ -95,17 +95,10 @@
+ #define R11(reg)		@(0x30,reg)
+ #define R12(reg)		@(0x34,reg)
+ #define SYSCALL_NR(reg)		@(0x38,reg)
+-#if defined(CONFIG_ISA_M32R2) && defined(CONFIG_ISA_DSP_LEVEL2)
+ #define ACC0H(reg)		@(0x3C,reg)
+ #define ACC0L(reg)		@(0x40,reg)
+ #define ACC1H(reg)		@(0x44,reg)
+ #define ACC1L(reg)		@(0x48,reg)
+-#elif defined(CONFIG_ISA_M32R2) || defined(CONFIG_ISA_M32R)
+-#define ACCH(reg)		@(0x3C,reg)
+-#define ACCL(reg)		@(0x40,reg)
+-#else
+-#error unknown isa configuration
+-#endif
+ #define PSW(reg)		@(0x4C,reg)
+ #define BPC(reg)		@(0x50,reg)
+ #define BBPSW(reg)		@(0x54,reg)
+diff --git a/arch/sparc/kernel/ioport.c b/arch/sparc/kernel/ioport.c
+index 54d51b4..7efb262 100644
+--- a/arch/sparc/kernel/ioport.c
++++ b/arch/sparc/kernel/ioport.c
+@@ -728,7 +728,8 @@ int pci_map_sg(struct pci_dev *hwdev, struct scatterlist *sg, int nents,
+ 	/* IIep is write-through, not flushing. */
+ 	for (n = 0; n < nents; n++) {
+ 		BUG_ON(page_address(sg->page) == NULL);
+-		sg->dvma_address = virt_to_phys(page_address(sg->page));
++		sg->dvma_address =
++			virt_to_phys(page_address(sg->page)) + sg->offset;
+ 		sg->dvma_length = sg->length;
+ 		sg++;
+ 	}
+diff --git a/arch/sparc64/kernel/isa.c b/arch/sparc64/kernel/isa.c
+index f028e68..fc7ca6d 100644
+--- a/arch/sparc64/kernel/isa.c
++++ b/arch/sparc64/kernel/isa.c
+@@ -22,14 +22,15 @@ static void __init report_dev(struct sparc_isa_device *isa_dev, int child)
+ 		printk(" [%s", isa_dev->prom_node->name);
+ }
+ 
+-static struct linux_prom_registers * __init
+-isa_dev_get_resource(struct sparc_isa_device *isa_dev)
++static void __init isa_dev_get_resource(struct sparc_isa_device *isa_dev)
+ {
+ 	struct linux_prom_registers *pregs;
+ 	unsigned long base, len;
+ 	int prop_len;
+ 
+ 	pregs = of_get_property(isa_dev->prom_node, "reg", &prop_len);
++	if (!pregs)
++		return;
+ 
+ 	/* Only the first one is interesting. */
+ 	len = pregs[0].reg_size;
+@@ -44,12 +45,9 @@ isa_dev_get_resource(struct sparc_isa_device *isa_dev)
+ 
+ 	request_resource(&isa_dev->bus->parent->io_space,
+ 			 &isa_dev->resource);
+-
+-	return pregs;
+ }
+ 
+-static void __init isa_dev_get_irq(struct sparc_isa_device *isa_dev,
+-				   struct linux_prom_registers *pregs)
++static void __init isa_dev_get_irq(struct sparc_isa_device *isa_dev)
+ {
+ 	struct of_device *op = of_find_device_by_node(isa_dev->prom_node);
+ 
+@@ -69,7 +67,6 @@ static void __init isa_fill_children(struct sparc_isa_device *parent_isa_dev)
+ 
+ 	printk(" ->");
+ 	while (dp) {
+-		struct linux_prom_registers *regs;
+ 		struct sparc_isa_device *isa_dev;
+ 
+ 		isa_dev = kmalloc(sizeof(*isa_dev), GFP_KERNEL);
+@@ -87,8 +84,8 @@ static void __init isa_fill_children(struct sparc_isa_device *parent_isa_dev)
+ 		isa_dev->bus = parent_isa_dev->bus;
+ 		isa_dev->prom_node = dp;
+ 
+-		regs = isa_dev_get_resource(isa_dev);
+-		isa_dev_get_irq(isa_dev, regs);
++		isa_dev_get_resource(isa_dev);
++		isa_dev_get_irq(isa_dev);
+ 
+ 		report_dev(isa_dev, 1);
+ 
+@@ -101,7 +98,6 @@ static void __init isa_fill_devices(struct sparc_isa_bridge *isa_br)
+ 	struct device_node *dp = isa_br->prom_node->child;
+ 
+ 	while (dp) {
+-		struct linux_prom_registers *regs;
+ 		struct sparc_isa_device *isa_dev;
+ 
+ 		isa_dev = kmalloc(sizeof(*isa_dev), GFP_KERNEL);
+@@ -141,8 +137,8 @@ static void __init isa_fill_devices(struct sparc_isa_bridge *isa_br)
+ 		isa_dev->bus = isa_br;
+ 		isa_dev->prom_node = dp;
+ 
+-		regs = isa_dev_get_resource(isa_dev);
+-		isa_dev_get_irq(isa_dev, regs);
++		isa_dev_get_resource(isa_dev);
++		isa_dev_get_irq(isa_dev);
+ 
+ 		report_dev(isa_dev, 0);
+ 
+diff --git a/arch/sparc64/mm/init.c b/arch/sparc64/mm/init.c
+index 09cb7fc..ab6d0ca 100644
+--- a/arch/sparc64/mm/init.c
++++ b/arch/sparc64/mm/init.c
+@@ -872,6 +872,115 @@ static unsigned long __init choose_bootmap_pfn(unsigned long start_pfn,
+ 	prom_halt();
+ }
+ 
++static void __init trim_pavail(unsigned long *cur_size_p,
++			       unsigned long *end_of_phys_p)
++{
++	unsigned long to_trim = *cur_size_p - cmdline_memory_size;
++	unsigned long avoid_start, avoid_end;
++	int i;
++
++	to_trim = PAGE_ALIGN(to_trim);
++
++	avoid_start = avoid_end = 0;
++#ifdef CONFIG_BLK_DEV_INITRD
++	avoid_start = initrd_start;
++	avoid_end = PAGE_ALIGN(initrd_end);
++#endif
++
++	/* Trim some pavail[] entries in order to satisfy the
++	 * requested "mem=xxx" kernel command line specification.
++	 *
++	 * We must not trim off the kernel image area nor the
++	 * initial ramdisk range (if any).  Also, we must not trim
++	 * any pavail[] entry down to zero in order to preserve
++	 * the invariant that all pavail[] entries have a non-zero
++	 * size which is assumed by all of the code in here.
++	 */
++	for (i = 0; i < pavail_ents; i++) {
++		unsigned long start, end, kern_end;
++		unsigned long trim_low, trim_high, n;
++
++		kern_end = PAGE_ALIGN(kern_base + kern_size);
++
++		trim_low = start = pavail[i].phys_addr;
++		trim_high = end = start + pavail[i].reg_size;
++
++		if (kern_base >= start &&
++		    kern_base < end) {
++			trim_low = kern_base;
++			if (kern_end >= end)
++				continue;
++		}
++		if (kern_end >= start &&
++		    kern_end < end) {
++			trim_high = kern_end;
++		}
++		if (avoid_start &&
++		    avoid_start >= start &&
++		    avoid_start < end) {
++			if (trim_low > avoid_start)
++				trim_low = avoid_start;
++			if (avoid_end >= end)
++				continue;
++		}
++		if (avoid_end &&
++		    avoid_end >= start &&
++		    avoid_end < end) {
++			if (trim_high < avoid_end)
++				trim_high = avoid_end;
++		}
++
++		if (trim_high <= trim_low)
++			continue;
++
++		if (trim_low == start && trim_high == end) {
++			/* Whole chunk is available for trimming.
++			 * Trim all except one page, in order to keep
++			 * entry non-empty.
++			 */
++			n = (end - start) - PAGE_SIZE;
++			if (n > to_trim)
++				n = to_trim;
++
++			if (n) {
++				pavail[i].phys_addr += n;
++				pavail[i].reg_size -= n;
++				to_trim -= n;
++			}
++		} else {
++			n = (trim_low - start);
++			if (n > to_trim)
++				n = to_trim;
++
++			if (n) {
++				pavail[i].phys_addr += n;
++				pavail[i].reg_size -= n;
++				to_trim -= n;
++			}
++			if (to_trim) {
++				n = end - trim_high;
++				if (n > to_trim)
++					n = to_trim;
++				if (n) {
++					pavail[i].reg_size -= n;
++					to_trim -= n;
++				}
++			}
++		}
++
++		if (!to_trim)
++			break;
++	}
++
++	/* Recalculate.  */
++	*cur_size_p = 0UL;
++	for (i = 0; i < pavail_ents; i++) {
++		*end_of_phys_p = pavail[i].phys_addr +
++			pavail[i].reg_size;
++		*cur_size_p += pavail[i].reg_size;
++	}
++}
++
+ static unsigned long __init bootmem_init(unsigned long *pages_avail,
+ 					 unsigned long phys_base)
+ {
+@@ -889,31 +998,13 @@ static unsigned long __init bootmem_init(unsigned long *pages_avail,
+ 		end_of_phys_memory = pavail[i].phys_addr +
+ 			pavail[i].reg_size;
+ 		bytes_avail += pavail[i].reg_size;
+-		if (cmdline_memory_size) {
+-			if (bytes_avail > cmdline_memory_size) {
+-				unsigned long slack = bytes_avail - cmdline_memory_size;
+-
+-				bytes_avail -= slack;
+-				end_of_phys_memory -= slack;
+-
+-				pavail[i].reg_size -= slack;
+-				if ((long)pavail[i].reg_size <= 0L) {
+-					pavail[i].phys_addr = 0xdeadbeefUL;
+-					pavail[i].reg_size = 0UL;
+-					pavail_ents = i;
+-				} else {
+-					pavail[i+1].reg_size = 0Ul;
+-					pavail[i+1].phys_addr = 0xdeadbeefUL;
+-					pavail_ents = i + 1;
+-				}
+-				break;
+-			}
+-		}
+ 	}
+ 
+-	*pages_avail = bytes_avail >> PAGE_SHIFT;
+-
+-	end_pfn = end_of_phys_memory >> PAGE_SHIFT;
++	/* Determine the location of the initial ramdisk before trying
++	 * to honor the "mem=xxx" command line argument.  We must know
++	 * where the kernel image and the ramdisk image are so that we
++	 * do not trim those two areas from the physical memory map.
++	 */
+ 
+ #ifdef CONFIG_BLK_DEV_INITRD
+ 	/* Now have to check initial ramdisk, so that bootmap does not overwrite it */
+@@ -932,6 +1023,16 @@ static unsigned long __init bootmem_init(unsigned long *pages_avail,
+ 		}
+ 	}
+ #endif	
++
++	if (cmdline_memory_size &&
++	    bytes_avail > cmdline_memory_size)
++		trim_pavail(&bytes_avail,
++			    &end_of_phys_memory);
++
++	*pages_avail = bytes_avail >> PAGE_SHIFT;
++
++	end_pfn = end_of_phys_memory >> PAGE_SHIFT;
++
+ 	/* Initialize the boot-time allocator. */
+ 	max_pfn = max_low_pfn = end_pfn;
+ 	min_low_pfn = (phys_base >> PAGE_SHIFT);
+diff --git a/arch/x86_64/kernel/nmi.c b/arch/x86_64/kernel/nmi.c
+index 7af9cb3..b10b9ef 100644
+--- a/arch/x86_64/kernel/nmi.c
++++ b/arch/x86_64/kernel/nmi.c
+@@ -190,6 +190,8 @@ void nmi_watchdog_default(void)
+ 		nmi_watchdog = NMI_IO_APIC;
+ }
+ 
++static int endflag __initdata = 0;
++
+ #ifdef CONFIG_SMP
+ /* The performance counters used by NMI_LOCAL_APIC don't trigger when
+  * the CPU is idle. To make sure the NMI watchdog really ticks on all
+@@ -197,7 +199,6 @@ void nmi_watchdog_default(void)
+  */
+ static __init void nmi_cpu_busy(void *data)
+ {
+-	volatile int *endflag = data;
+ 	local_irq_enable_in_hardirq();
+ 	/* Intentionally don't use cpu_relax here. This is
+ 	   to make sure that the performance counter really ticks,
+@@ -205,14 +206,13 @@ static __init void nmi_cpu_busy(void *data)
+ 	   pause instruction. On a real HT machine this is fine because
+ 	   all other CPUs are busy with "useless" delay loops and don't
+ 	   care if they get somewhat less cycles. */
+-	while (*endflag == 0)
+-		barrier();
++	while (endflag == 0)
++		mb();
+ }
+ #endif
+ 
+ int __init check_nmi_watchdog (void)
+ {
+-	volatile int endflag = 0;
+ 	int *counts;
+ 	int cpu;
+ 
+@@ -253,6 +253,7 @@ int __init check_nmi_watchdog (void)
+ 	if (!atomic_read(&nmi_active)) {
+ 		kfree(counts);
+ 		atomic_set(&nmi_active, -1);
++		endflag = 1;
+ 		return -1;
+ 	}
+ 	endflag = 1;
+diff --git a/arch/x86_64/kernel/process.c b/arch/x86_64/kernel/process.c
+index 7451a4c..bbab3f2 100644
+--- a/arch/x86_64/kernel/process.c
++++ b/arch/x86_64/kernel/process.c
+@@ -111,7 +111,11 @@ static void default_idle(void)
+ 	local_irq_enable();
+ 
+ 	current_thread_info()->status &= ~TS_POLLING;
+-	smp_mb__after_clear_bit();
++	/*
++	 * TS_POLLING-cleared state must be visible before we
++	 * test NEED_RESCHED:
++	 */
++	smp_mb();
+ 	while (!need_resched()) {
+ 		local_irq_disable();
+ 		if (!need_resched())
+diff --git a/arch/x86_64/kernel/setup.c b/arch/x86_64/kernel/setup.c
+index fc944b5..013539f 100644
+--- a/arch/x86_64/kernel/setup.c
++++ b/arch/x86_64/kernel/setup.c
+@@ -854,7 +854,10 @@ static void __cpuinit init_intel(struct cpuinfo_x86 *c)
+ 		set_bit(X86_FEATURE_CONSTANT_TSC, &c->x86_capability);
+ 	if (c->x86 == 6)
+ 		set_bit(X86_FEATURE_REP_GOOD, &c->x86_capability);
+-	set_bit(X86_FEATURE_SYNC_RDTSC, &c->x86_capability);
++	if (c->x86 == 15)
++		set_bit(X86_FEATURE_SYNC_RDTSC, &c->x86_capability);
++	else
++		clear_bit(X86_FEATURE_SYNC_RDTSC, &c->x86_capability);
+  	c->x86_max_cores = intel_num_cpu_cores(c);
+ 
+ 	srat_detect_node();
+diff --git a/crypto/sha512.c b/crypto/sha512.c
+index 2dfe7f1..15eab9d 100644
+--- a/crypto/sha512.c
++++ b/crypto/sha512.c
+@@ -24,7 +24,7 @@
+ 
+ #define SHA384_DIGEST_SIZE 48
+ #define SHA512_DIGEST_SIZE 64
+-#define SHA384_HMAC_BLOCK_SIZE  96
++#define SHA384_HMAC_BLOCK_SIZE 128
+ #define SHA512_HMAC_BLOCK_SIZE 128
+ 
+ struct sha512_ctx {
+diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
+index 65b3f05..6dac605 100644
+--- a/drivers/acpi/processor_idle.c
++++ b/drivers/acpi/processor_idle.c
+@@ -211,7 +211,11 @@ acpi_processor_power_activate(struct acpi_processor *pr,
+ static void acpi_safe_halt(void)
+ {
+ 	current_thread_info()->status &= ~TS_POLLING;
+-	smp_mb__after_clear_bit();
++	/*
++	 * TS_POLLING-cleared state must be visible before we
++	 * test NEED_RESCHED:
++	 */
++	smp_mb();
+ 	if (!need_resched())
+ 		safe_halt();
+ 	current_thread_info()->status |= TS_POLLING;
+@@ -345,7 +349,11 @@ static void acpi_processor_idle(void)
+ 	 */
+ 	if (cx->type == ACPI_STATE_C2 || cx->type == ACPI_STATE_C3) {
+ 		current_thread_info()->status &= ~TS_POLLING;
+-		smp_mb__after_clear_bit();
++		/*
++		 * TS_POLLING-cleared state must be visible before we
++		 * test NEED_RESCHED:
++		 */
++		smp_mb();
+ 		if (need_resched()) {
+ 			current_thread_info()->status |= TS_POLLING;
+ 			local_irq_enable();
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 915a55a..ff8a690 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -2325,11 +2325,14 @@ static inline void ata_tf_to_host(struct ata_port *ap,
+  *	Sleep until ATA Status register bit BSY clears,
+  *	or a timeout occurs.
+  *
+- *	LOCKING: None.
++ *	LOCKING:
++ *	Kernel thread context (may sleep).
++ *
++ *	RETURNS:
++ *	0 on success, -errno otherwise.
+  */
+-
+-unsigned int ata_busy_sleep (struct ata_port *ap,
+-			     unsigned long tmout_pat, unsigned long tmout)
++int ata_busy_sleep(struct ata_port *ap,
++		   unsigned long tmout_pat, unsigned long tmout)
+ {
+ 	unsigned long timer_start, timeout;
+ 	u8 status;
+@@ -2337,27 +2340,32 @@ unsigned int ata_busy_sleep (struct ata_port *ap,
+ 	status = ata_busy_wait(ap, ATA_BUSY, 300);
+ 	timer_start = jiffies;
+ 	timeout = timer_start + tmout_pat;
+-	while ((status & ATA_BUSY) && (time_before(jiffies, timeout))) {
++	while (status != 0xff && (status & ATA_BUSY) &&
++	       time_before(jiffies, timeout)) {
+ 		msleep(50);
+ 		status = ata_busy_wait(ap, ATA_BUSY, 3);
+ 	}
+ 
+-	if (status & ATA_BUSY)
++	if (status != 0xff && (status & ATA_BUSY))
+ 		ata_port_printk(ap, KERN_WARNING,
+ 				"port is slow to respond, please be patient "
+ 				"(Status 0x%x)\n", status);
+ 
+ 	timeout = timer_start + tmout;
+-	while ((status & ATA_BUSY) && (time_before(jiffies, timeout))) {
++	while (status != 0xff && (status & ATA_BUSY) &&
++	       time_before(jiffies, timeout)) {
+ 		msleep(50);
+ 		status = ata_chk_status(ap);
+ 	}
+ 
++	if (status == 0xff)
++		return -ENODEV;
++
+ 	if (status & ATA_BUSY) {
+ 		ata_port_printk(ap, KERN_ERR, "port failed to respond "
+ 				"(%lu secs, Status 0x%x)\n",
+ 				tmout / HZ, status);
+-		return 1;
++		return -EBUSY;
+ 	}
+ 
+ 	return 0;
+@@ -2448,10 +2456,8 @@ static unsigned int ata_bus_softreset(struct ata_port *ap,
+ 	 * the bus shows 0xFF because the odd clown forgets the D7
+ 	 * pulldown resistor.
+ 	 */
+-	if (ata_check_status(ap) == 0xFF) {
+-		ata_port_printk(ap, KERN_ERR, "SRST failed (status 0xFF)\n");
+-		return AC_ERR_OTHER;
+-	}
++	if (ata_check_status(ap) == 0xFF)
++		return 0;
+ 
+ 	ata_bus_post_reset(ap, devmask);
+ 
+diff --git a/drivers/block/Kconfig b/drivers/block/Kconfig
+index 17dc222..e00568e 100644
+--- a/drivers/block/Kconfig
++++ b/drivers/block/Kconfig
+@@ -305,6 +305,7 @@ config BLK_DEV_LOOP
+ config BLK_DEV_CRYPTOLOOP
+ 	tristate "Cryptoloop Support"
+ 	select CRYPTO
++	select CRYPTO_CBC
+ 	depends on BLK_DEV_LOOP
+ 	---help---
+ 	  Say Y here if you want to be able to use the ciphers that are 
+diff --git a/drivers/block/aoe/aoecmd.c b/drivers/block/aoe/aoecmd.c
+index 8a13b1a..85a4cb3 100644
+--- a/drivers/block/aoe/aoecmd.c
++++ b/drivers/block/aoe/aoecmd.c
+@@ -30,8 +30,6 @@ new_skb(ulong len)
+ 		skb->nh.raw = skb->mac.raw = skb->data;
+ 		skb->protocol = __constant_htons(ETH_P_AOE);
+ 		skb->priority = 0;
+-		skb_put(skb, len);
+-		memset(skb->head, 0, len);
+ 		skb->next = skb->prev = NULL;
+ 
+ 		/* tell the network layer not to perform IP checksums
+@@ -122,8 +120,8 @@ aoecmd_ata_rw(struct aoedev *d, struct frame *f)
+ 	skb = f->skb;
+ 	h = (struct aoe_hdr *) skb->mac.raw;
+ 	ah = (struct aoe_atahdr *) (h+1);
+-	skb->len = sizeof *h + sizeof *ah;
+-	memset(h, 0, ETH_ZLEN);
++	skb_put(skb, sizeof *h + sizeof *ah);
++	memset(h, 0, skb->len);
+ 	f->tag = aoehdr_atainit(d, h);
+ 	f->waited = 0;
+ 	f->buf = buf;
+@@ -149,7 +147,6 @@ aoecmd_ata_rw(struct aoedev *d, struct frame *f)
+ 		skb->len += bcnt;
+ 		skb->data_len = bcnt;
+ 	} else {
+-		skb->len = ETH_ZLEN;
+ 		writebit = 0;
+ 	}
+ 
+@@ -206,6 +203,7 @@ aoecmd_cfg_pkts(ushort aoemajor, unsigned char aoeminor, struct sk_buff **tail)
+ 			printk(KERN_INFO "aoe: skb alloc failure\n");
+ 			continue;
+ 		}
++		skb_put(skb, sizeof *h + sizeof *ch);
+ 		skb->dev = ifp;
+ 		if (sl_tail == NULL)
+ 			sl_tail = skb;
+@@ -243,6 +241,7 @@ freeframe(struct aoedev *d)
+ 			continue;
+ 		if (atomic_read(&skb_shinfo(f->skb)->dataref) == 1) {
+ 			skb_shinfo(f->skb)->nr_frags = f->skb->data_len = 0;
++			skb_trim(f->skb, 0);
+ 			return f;
+ 		}
+ 		n++;
+@@ -698,8 +697,8 @@ aoecmd_ata_id(struct aoedev *d)
+ 	skb = f->skb;
+ 	h = (struct aoe_hdr *) skb->mac.raw;
+ 	ah = (struct aoe_atahdr *) (h+1);
+-	skb->len = ETH_ZLEN;
+-	memset(h, 0, ETH_ZLEN);
++	skb_put(skb, sizeof *h + sizeof *ah);
++	memset(h, 0, skb->len);
+ 	f->tag = aoehdr_atainit(d, h);
+ 	f->waited = 0;
+ 
+diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
+index 4105c3b..95df5bf 100644
+--- a/drivers/block/cciss.c
++++ b/drivers/block/cciss.c
+@@ -2530,7 +2530,7 @@ static void do_cciss_request(request_queue_t *q)
+ 	c->Request.Type.Type = TYPE_CMD;	// It is a command.
+ 	c->Request.Type.Attribute = ATTR_SIMPLE;
+ 	c->Request.Type.Direction =
+-	    (rq_data_dir(creq) == READ) ? h->cciss_read : h->cciss_write;
++	    (rq_data_dir(creq) == READ) ? XFER_READ : XFER_WRITE;
+ 	c->Request.Timeout = 0;	// Don't time out
+ 	c->Request.CDB[0] =
+ 	    (rq_data_dir(creq) == READ) ? h->cciss_read : h->cciss_write;
+diff --git a/drivers/char/drm/drm_sman.c b/drivers/char/drm/drm_sman.c
+index 425c823..19c81d2 100644
+--- a/drivers/char/drm/drm_sman.c
++++ b/drivers/char/drm/drm_sman.c
+@@ -162,6 +162,7 @@ drm_sman_set_manager(drm_sman_t * sman, unsigned int manager,
+ 
+ 	return 0;
+ }
++EXPORT_SYMBOL(drm_sman_set_manager);
+ 
+ static drm_owner_item_t *drm_sman_get_owner_item(drm_sman_t * sman,
+ 						 unsigned long owner)
+diff --git a/drivers/char/mem.c b/drivers/char/mem.c
+index 5547337..149a1ff 100644
+--- a/drivers/char/mem.c
++++ b/drivers/char/mem.c
+@@ -646,7 +646,8 @@ static inline size_t read_zero_pagealigned(char __user * buf, size_t size)
+ 			count = size;
+ 
+ 		zap_page_range(vma, addr, count, NULL);
+-        	zeromap_page_range(vma, addr, count, PAGE_COPY);
++        	if (zeromap_page_range(vma, addr, count, PAGE_COPY))
++			break;
+ 
+ 		size -= count;
+ 		buf += count;
+@@ -713,11 +714,14 @@ out:
+ 
+ static int mmap_zero(struct file * file, struct vm_area_struct * vma)
+ {
++	int err;
++
+ 	if (vma->vm_flags & VM_SHARED)
+ 		return shmem_zero_setup(vma);
+-	if (zeromap_page_range(vma, vma->vm_start, vma->vm_end - vma->vm_start, vma->vm_page_prot))
+-		return -EAGAIN;
+-	return 0;
++	err = zeromap_page_range(vma, vma->vm_start,
++			vma->vm_end - vma->vm_start, vma->vm_page_prot);
++	BUG_ON(err == -EEXIST);
++	return err;
+ }
+ #else /* CONFIG_MMU */
+ static ssize_t read_zero(struct file * file, char * buf, 
+diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c
+index 3ece692..5c9f67f 100644
+--- a/drivers/connector/cn_proc.c
++++ b/drivers/connector/cn_proc.c
+@@ -28,6 +28,7 @@
+ #include <linux/init.h>
+ #include <linux/connector.h>
+ #include <asm/atomic.h>
++#include <asm/unaligned.h>
+ 
+ #include <linux/cn_proc.h>
+ 
+@@ -60,7 +61,7 @@ void proc_fork_connector(struct task_struct *task)
+ 	ev = (struct proc_event*)msg->data;
+ 	get_seq(&msg->seq, &ev->cpu);
+ 	ktime_get_ts(&ts); /* get high res monotonic timestamp */
+-	ev->timestamp_ns = timespec_to_ns(&ts);
++	put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
+ 	ev->what = PROC_EVENT_FORK;
+ 	ev->event_data.fork.parent_pid = task->real_parent->pid;
+ 	ev->event_data.fork.parent_tgid = task->real_parent->tgid;
+@@ -88,7 +89,7 @@ void proc_exec_connector(struct task_struct *task)
+ 	ev = (struct proc_event*)msg->data;
+ 	get_seq(&msg->seq, &ev->cpu);
+ 	ktime_get_ts(&ts); /* get high res monotonic timestamp */
+-	ev->timestamp_ns = timespec_to_ns(&ts);
++	put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
+ 	ev->what = PROC_EVENT_EXEC;
+ 	ev->event_data.exec.process_pid = task->pid;
+ 	ev->event_data.exec.process_tgid = task->tgid;
+@@ -124,7 +125,7 @@ void proc_id_connector(struct task_struct *task, int which_id)
+ 	     	return;
+ 	get_seq(&msg->seq, &ev->cpu);
+ 	ktime_get_ts(&ts); /* get high res monotonic timestamp */
+-	ev->timestamp_ns = timespec_to_ns(&ts);
++	put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
+ 
+ 	memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
+ 	msg->ack = 0; /* not used */
+@@ -146,7 +147,7 @@ void proc_exit_connector(struct task_struct *task)
+ 	ev = (struct proc_event*)msg->data;
+ 	get_seq(&msg->seq, &ev->cpu);
+ 	ktime_get_ts(&ts); /* get high res monotonic timestamp */
+-	ev->timestamp_ns = timespec_to_ns(&ts);
++	put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
+ 	ev->what = PROC_EVENT_EXIT;
+ 	ev->event_data.exit.process_pid = task->pid;
+ 	ev->event_data.exit.process_tgid = task->tgid;
+@@ -181,7 +182,7 @@ static void cn_proc_ack(int err, int rcvd_seq, int rcvd_ack)
+ 	ev = (struct proc_event*)msg->data;
+ 	msg->seq = rcvd_seq;
+ 	ktime_get_ts(&ts); /* get high res monotonic timestamp */
+-	ev->timestamp_ns = timespec_to_ns(&ts);
++	put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
+ 	ev->cpu = -1;
+ 	ev->what = PROC_EVENT_NONE;
+ 	ev->event_data.ack.err = err;
+diff --git a/drivers/i2c/chips/ds1337.c b/drivers/i2c/chips/ds1337.c
+index 93d483b..ec17d6b 100644
+--- a/drivers/i2c/chips/ds1337.c
++++ b/drivers/i2c/chips/ds1337.c
+@@ -347,13 +347,19 @@ static void ds1337_init_client(struct i2c_client *client)
+ 
+ 	if ((status & 0x80) || (control & 0x80)) {
+ 		/* RTC not running */
+-		u8 buf[16];
++		u8 buf[1+16];	/* First byte is interpreted as address */
+ 		struct i2c_msg msg[1];
+ 
+ 		dev_dbg(&client->dev, "%s: RTC not running!\n", __FUNCTION__);
+ 
+ 		/* Initialize all, including STATUS and CONTROL to zero */
+ 		memset(buf, 0, sizeof(buf));
++
++		/* Write valid values in the date/time registers */
++		buf[1+DS1337_REG_DAY] = 1;
++		buf[1+DS1337_REG_DATE] = 1;
++		buf[1+DS1337_REG_MONTH] = 1;
++
+ 		msg[0].addr = client->addr;
+ 		msg[0].flags = 0;
+ 		msg[0].len = sizeof(buf);
+diff --git a/drivers/ieee1394/ohci1394.c b/drivers/ieee1394/ohci1394.c
+index 6e8ea91..268f282 100644
+--- a/drivers/ieee1394/ohci1394.c
++++ b/drivers/ieee1394/ohci1394.c
+@@ -3217,6 +3217,19 @@ static int __devinit ohci1394_pci_probe(struct pci_dev *dev,
+ 	struct ti_ohci *ohci;	/* shortcut to currently handled device */
+ 	resource_size_t ohci_base;
+ 
++#ifdef CONFIG_PPC_PMAC
++	/* Necessary on some machines if ohci1394 was loaded/ unloaded before */
++	if (machine_is(powermac)) {
++		struct device_node *of_node = pci_device_to_OF_node(dev);
++
++		if (of_node) {
++			pmac_call_feature(PMAC_FTR_1394_CABLE_POWER, of_node,
++					  0, 1);
++			pmac_call_feature(PMAC_FTR_1394_ENABLE, of_node, 0, 1);
++		}
++	}
++#endif /* CONFIG_PPC_PMAC */
++
+         if (pci_enable_device(dev))
+ 		FAIL(-ENXIO, "Failed to enable OHCI hardware");
+         pci_set_master(dev);
+@@ -3505,11 +3518,9 @@ static void ohci1394_pci_remove(struct pci_dev *pdev)
+ #endif
+ 
+ #ifdef CONFIG_PPC_PMAC
+-	/* On UniNorth, power down the cable and turn off the chip
+-	 * clock when the module is removed to save power on
+-	 * laptops. Turning it back ON is done by the arch code when
+-	 * pci_enable_device() is called */
+-	{
++	/* On UniNorth, power down the cable and turn off the chip clock
++	 * to save power on laptops */
++	if (machine_is(powermac)) {
+ 		struct device_node* of_node;
+ 
+ 		of_node = pci_device_to_OF_node(ohci->dev);
+diff --git a/drivers/infiniband/core/ucm.c b/drivers/infiniband/core/ucm.c
+index ad4f4d5..0128288 100644
+--- a/drivers/infiniband/core/ucm.c
++++ b/drivers/infiniband/core/ucm.c
+@@ -161,12 +161,14 @@ static void ib_ucm_cleanup_events(struct ib_ucm_context *ctx)
+ 				    struct ib_ucm_event, ctx_list);
+ 		list_del(&uevent->file_list);
+ 		list_del(&uevent->ctx_list);
++		mutex_unlock(&ctx->file->file_mutex);
+ 
+ 		/* clear incoming connections. */
+ 		if (ib_ucm_new_cm_id(uevent->resp.event))
+ 			ib_destroy_cm_id(uevent->cm_id);
+ 
+ 		kfree(uevent);
++		mutex_lock(&ctx->file->file_mutex);
+ 	}
+ 	mutex_unlock(&ctx->file->file_mutex);
+ }
+diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
+index 4b09147..ca44cc6 100644
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -1879,7 +1879,7 @@ static void srp_add_one(struct ib_device *device)
+ 	 */
+ 	srp_dev->fmr_page_shift = max(9, ffs(dev_attr->page_size_cap) - 1);
+ 	srp_dev->fmr_page_size  = 1 << srp_dev->fmr_page_shift;
+-	srp_dev->fmr_page_mask  = ~((unsigned long) srp_dev->fmr_page_size - 1);
++	srp_dev->fmr_page_mask  = ~((u64) srp_dev->fmr_page_size - 1);
+ 
+ 	INIT_LIST_HEAD(&srp_dev->dev_list);
+ 
+diff --git a/drivers/infiniband/ulp/srp/ib_srp.h b/drivers/infiniband/ulp/srp/ib_srp.h
+index d4e35ef..1e140bb 100644
+--- a/drivers/infiniband/ulp/srp/ib_srp.h
++++ b/drivers/infiniband/ulp/srp/ib_srp.h
+@@ -87,7 +87,7 @@ struct srp_device {
+ 	struct ib_fmr_pool     *fmr_pool;
+ 	int			fmr_page_shift;
+ 	int			fmr_page_size;
+-	unsigned long		fmr_page_mask;
++	u64			fmr_page_mask;
+ };
+ 
+ struct srp_host {
+diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig
+index c92c152..4540ade 100644
+--- a/drivers/md/Kconfig
++++ b/drivers/md/Kconfig
+@@ -215,6 +215,7 @@ config DM_CRYPT
+ 	tristate "Crypt target support"
+ 	depends on BLK_DEV_DM && EXPERIMENTAL
+ 	select CRYPTO
++	select CRYPTO_CBC
+ 	---help---
+ 	  This device-mapper target allows you to create a device that
+ 	  transparently encrypts the data on it. You'll need to activate
+diff --git a/drivers/media/dvb/dvb-core/dvb_net.c b/drivers/media/dvb/dvb-core/dvb_net.c
+index 8859ab7..ee23125 100644
+--- a/drivers/media/dvb/dvb-core/dvb_net.c
++++ b/drivers/media/dvb/dvb-core/dvb_net.c
+@@ -604,7 +604,7 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
+ 				{ &utype, sizeof utype },
+ 				{ priv->ule_skb->data, priv->ule_skb->len - 4 }
+ 			};
+-			unsigned long ule_crc = ~0L, expected_crc;
++			u32 ule_crc = ~0L, expected_crc;
+ 			if (priv->ule_dbit) {
+ 				/* Set D-bit for CRC32 verification,
+ 				 * if it was set originally. */
+@@ -617,7 +617,7 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
+ 				       *((u8 *)priv->ule_skb->tail - 2) << 8 |
+ 				       *((u8 *)priv->ule_skb->tail - 1);
+ 			if (ule_crc != expected_crc) {
+-				printk(KERN_WARNING "%lu: CRC32 check FAILED: %#lx / %#lx, SNDU len %d type %#x, ts_remain %d, next 2: %x.\n",
++				printk(KERN_WARNING "%lu: CRC32 check FAILED: %08x / %08x, SNDU len %d type %#x, ts_remain %d, next 2: %x.\n",
+ 				       priv->ts_count, ule_crc, expected_crc, priv->ule_sndu_len, priv->ule_sndu_type, ts_remain, ts_remain > 2 ? *(unsigned short *)from_where : 0);
+ 
+ #ifdef ULE_DEBUG
+diff --git a/drivers/media/dvb/frontends/lgdt330x.c b/drivers/media/dvb/frontends/lgdt330x.c
+index 9a35470..467f199 100644
+--- a/drivers/media/dvb/frontends/lgdt330x.c
++++ b/drivers/media/dvb/frontends/lgdt330x.c
+@@ -435,9 +435,6 @@ static int lgdt3302_read_status(struct dvb_frontend* fe, fe_status_t* status)
+ 		/* Test signal does not exist flag */
+ 		/* as well as the AGC lock flag.   */
+ 		*status |= FE_HAS_SIGNAL;
+-	} else {
+-		/* Without a signal all other status bits are meaningless */
+-		return 0;
+ 	}
+ 
+ 	/*
+@@ -500,9 +497,6 @@ static int lgdt3303_read_status(struct dvb_frontend* fe, fe_status_t* status)
+ 		/* Test input signal does not exist flag */
+ 		/* as well as the AGC lock flag.   */
+ 		*status |= FE_HAS_SIGNAL;
+-	} else {
+-		/* Without a signal all other status bits are meaningless */
+-		return 0;
+ 	}
+ 
+ 	/* Carrier Recovery Lock Status Register */
+diff --git a/drivers/media/video/cx88/cx88-cards.c b/drivers/media/video/cx88/cx88-cards.c
+index f764a57..dec146f 100644
+--- a/drivers/media/video/cx88/cx88-cards.c
++++ b/drivers/media/video/cx88/cx88-cards.c
+@@ -1610,7 +1610,7 @@ const unsigned int cx88_idcount = ARRAY_SIZE(cx88_subids);
+ /* ----------------------------------------------------------------------- */
+ /* some leadtek specific stuff                                             */
+ 
+-static void __devinit leadtek_eeprom(struct cx88_core *core, u8 *eeprom_data)
++static void leadtek_eeprom(struct cx88_core *core, u8 *eeprom_data)
+ {
+ 	/* This is just for the "Winfast 2000XP Expert" board ATM; I don't have data on
+ 	 * any others.
+diff --git a/drivers/media/video/tuner-simple.c b/drivers/media/video/tuner-simple.c
+index 63db4e9..fcf8693 100644
+--- a/drivers/media/video/tuner-simple.c
++++ b/drivers/media/video/tuner-simple.c
+@@ -108,6 +108,7 @@ static int tuner_stereo(struct i2c_client *c)
+ 		case TUNER_PHILIPS_FM1216ME_MK3:
+ 		case TUNER_PHILIPS_FM1236_MK3:
+ 		case TUNER_PHILIPS_FM1256_IH3:
++		case TUNER_LG_NTSC_TAPE:
+ 			stereo = ((status & TUNER_SIGNAL) == TUNER_STEREO_MK3);
+ 			break;
+ 		default:
+@@ -421,6 +422,7 @@ static void default_set_radio_freq(struct i2c_client *c, unsigned int freq)
+ 	case TUNER_PHILIPS_FM1216ME_MK3:
+ 	case TUNER_PHILIPS_FM1236_MK3:
+ 	case TUNER_PHILIPS_FMD1216ME_MK3:
++	case TUNER_LG_NTSC_TAPE:
+ 		buffer[3] = 0x19;
+ 		break;
+ 	case TUNER_TNF_5335MF:
+diff --git a/drivers/media/video/tuner-types.c b/drivers/media/video/tuner-types.c
+index 7816823..1256c64 100644
+--- a/drivers/media/video/tuner-types.c
++++ b/drivers/media/video/tuner-types.c
+@@ -672,16 +672,6 @@ static struct tuner_params tuner_panasonic_vp27_params[] = {
+ 	},
+ };
+ 
+-/* ------------ TUNER_LG_NTSC_TAPE - LGINNOTEK NTSC ------------ */
+-
+-static struct tuner_params tuner_lg_ntsc_tape_params[] = {
+-	{
+-		.type   = TUNER_PARAM_TYPE_NTSC,
+-		.ranges = tuner_fm1236_mk3_ntsc_ranges,
+-		.count  = ARRAY_SIZE(tuner_fm1236_mk3_ntsc_ranges),
+-	},
+-};
+-
+ /* ------------ TUNER_TNF_8831BGFF - Philips PAL ------------ */
+ 
+ static struct tuner_range tuner_tnf_8831bgff_pal_ranges[] = {
+@@ -1331,8 +1321,8 @@ struct tunertype tuners[] = {
+ 	},
+ 	[TUNER_LG_NTSC_TAPE] = { /* LGINNOTEK NTSC */
+ 		.name   = "LG NTSC (TAPE series)",
+-		.params = tuner_lg_ntsc_tape_params,
+-		.count  = ARRAY_SIZE(tuner_lg_ntsc_tape_params),
++		.params = tuner_fm1236_mk3_params,
++		.count  = ARRAY_SIZE(tuner_fm1236_mk3_params),
+ 	},
+ 	[TUNER_TNF_8831BGFF] = { /* Philips PAL */
+ 		.name   = "Tenna TNF 8831 BGFF)",
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 17a4611..946303b 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -3675,7 +3675,7 @@ static int bond_do_ioctl(struct net_device *bond_dev, struct ifreq *ifr, int cmd
+ 			mii->val_out = 0;
+ 			read_lock_bh(&bond->lock);
+ 			read_lock(&bond->curr_slave_lock);
+-			if (bond->curr_active_slave) {
++			if (netif_carrier_ok(bond->dev)) {
+ 				mii->val_out = BMSR_LSTATUS;
+ 			}
+ 			read_unlock(&bond->curr_slave_lock);
+diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
+index c5ed635..72325fa 100644
+--- a/drivers/net/forcedeth.c
++++ b/drivers/net/forcedeth.c
+@@ -2815,11 +2815,13 @@ static int nv_request_irq(struct net_device *dev, int intr_test)
+ 	}
+ 	if (ret != 0 && np->msi_flags & NV_MSI_CAPABLE) {
+ 		if ((ret = pci_enable_msi(np->pci_dev)) == 0) {
++			pci_intx(np->pci_dev, 0);
+ 			np->msi_flags |= NV_MSI_ENABLED;
+ 			if ((!intr_test && request_irq(np->pci_dev->irq, &nv_nic_irq, IRQF_SHARED, dev->name, dev) != 0) ||
+ 			    (intr_test && request_irq(np->pci_dev->irq, &nv_nic_irq_test, IRQF_SHARED, dev->name, dev) != 0)) {
+ 				printk(KERN_INFO "forcedeth: request_irq failed %d\n", ret);
+ 				pci_disable_msi(np->pci_dev);
++				pci_intx(np->pci_dev, 1);
+ 				np->msi_flags &= ~NV_MSI_ENABLED;
+ 				goto out_err;
+ 			}
+@@ -2862,6 +2864,7 @@ static void nv_free_irq(struct net_device *dev)
+ 		free_irq(np->pci_dev->irq, dev);
+ 		if (np->msi_flags & NV_MSI_ENABLED) {
+ 			pci_disable_msi(np->pci_dev);
++			pci_intx(np->pci_dev, 1);
+ 			np->msi_flags &= ~NV_MSI_ENABLED;
+ 		}
+ 	}
+diff --git a/drivers/net/smc911x.c b/drivers/net/smc911x.c
+index 2c43433..797ab91 100644
+--- a/drivers/net/smc911x.c
++++ b/drivers/net/smc911x.c
+@@ -1331,7 +1331,7 @@ smc911x_rx_dma_irq(int dma, void *data)
+ static void smc911x_poll_controller(struct net_device *dev)
+ {
+ 	disable_irq(dev->irq);
+-	smc911x_interrupt(dev->irq, dev, NULL);
++	smc911x_interrupt(dev->irq, dev);
+ 	enable_irq(dev->irq);
+ }
+ #endif
+diff --git a/drivers/net/sunhme.c b/drivers/net/sunhme.c
+index 9d7cd13..9f1c9bc 100644
+--- a/drivers/net/sunhme.c
++++ b/drivers/net/sunhme.c
+@@ -3012,6 +3012,11 @@ static int __devinit happy_meal_pci_probe(struct pci_dev *pdev,
+ #endif
+ 
+ 	err = -ENODEV;
++
++	if (pci_enable_device(pdev))
++		goto err_out;
++	pci_set_master(pdev);
++
+ 	if (!strcmp(prom_name, "SUNW,qfe") || !strcmp(prom_name, "qfe")) {
+ 		qp = quattro_pci_find(pdev);
+ 		if (qp == NULL)
+diff --git a/drivers/net/tokenring/ibmtr.c b/drivers/net/tokenring/ibmtr.c
+index bfe5986..0d97e10 100644
+--- a/drivers/net/tokenring/ibmtr.c
++++ b/drivers/net/tokenring/ibmtr.c
+@@ -1826,7 +1826,7 @@ static void tr_rx(struct net_device *dev)
+ 	skb->protocol = tr_type_trans(skb, dev);
+ 	if (IPv4_p) {
+ 		skb->csum = chksum;
+-		skb->ip_summed = 1;
++		skb->ip_summed = CHECKSUM_COMPLETE;
+ 	}
+ 	netif_rx(skb);
+ 	dev->last_rx = jiffies;
+diff --git a/drivers/net/wireless/zd1211rw/zd_ieee80211.h b/drivers/net/wireless/zd1211rw/zd_ieee80211.h
+index f63245b..3632989 100644
+--- a/drivers/net/wireless/zd1211rw/zd_ieee80211.h
++++ b/drivers/net/wireless/zd1211rw/zd_ieee80211.h
+@@ -64,7 +64,7 @@ struct cck_plcp_header {
+ 	u8 service;
+ 	__le16 length;
+ 	__le16 crc16;
+-};
++} __attribute__((packed));
+ 
+ static inline u8 zd_cck_plcp_header_rate(const struct cck_plcp_header *header)
+ {
+diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
+index a7d29bd..9ab3077 100644
+--- a/drivers/net/wireless/zd1211rw/zd_mac.c
++++ b/drivers/net/wireless/zd1211rw/zd_mac.c
+@@ -37,6 +37,8 @@ static void housekeeping_init(struct zd_mac *mac);
+ static void housekeeping_enable(struct zd_mac *mac);
+ static void housekeeping_disable(struct zd_mac *mac);
+ 
++static void do_rx(unsigned long mac_ptr);
++
+ int zd_mac_init(struct zd_mac *mac,
+ 	        struct net_device *netdev,
+ 	        struct usb_interface *intf)
+@@ -47,6 +49,10 @@ int zd_mac_init(struct zd_mac *mac,
+ 	spin_lock_init(&mac->lock);
+ 	mac->netdev = netdev;
+ 
++	skb_queue_head_init(&mac->rx_queue);
++	tasklet_init(&mac->rx_tasklet, do_rx, (unsigned long)mac);
++	tasklet_disable(&mac->rx_tasklet);
++
+ 	ieee_init(ieee);
+ 	softmac_init(ieee80211_priv(netdev));
+ 	zd_chip_init(&mac->chip, netdev, intf);
+@@ -132,6 +138,8 @@ out:
+ 
+ void zd_mac_clear(struct zd_mac *mac)
+ {
++	skb_queue_purge(&mac->rx_queue);
++	tasklet_kill(&mac->rx_tasklet);
+ 	zd_chip_clear(&mac->chip);
+ 	ZD_ASSERT(!spin_is_locked(&mac->lock));
+ 	ZD_MEMCLEAR(mac, sizeof(struct zd_mac));
+@@ -160,6 +168,8 @@ int zd_mac_open(struct net_device *netdev)
+ 	struct zd_chip *chip = &mac->chip;
+ 	int r;
+ 
++	tasklet_enable(&mac->rx_tasklet);
++
+ 	r = zd_chip_enable_int(chip);
+ 	if (r < 0)
+ 		goto out;
+@@ -210,6 +220,8 @@ int zd_mac_stop(struct net_device *netdev)
+ 	 */
+ 
+ 	zd_chip_disable_rx(chip);
++	skb_queue_purge(&mac->rx_queue);
++	tasklet_disable(&mac->rx_tasklet);
+ 	housekeeping_disable(mac);
+ 	ieee80211softmac_stop(netdev);
+ 
+@@ -721,7 +733,7 @@ struct zd_rt_hdr {
+ 	u8  rt_rate;
+ 	u16 rt_channel;
+ 	u16 rt_chbitmask;
+-};
++} __attribute__((packed));
+ 
+ static void fill_rt_header(void *buffer, struct zd_mac *mac,
+ 	                   const struct ieee80211_rx_stats *stats,
+@@ -873,45 +885,78 @@ static int fill_rx_stats(struct ieee80211_rx_stats *stats,
+ 	return 0;
+ }
+ 
+-int zd_mac_rx(struct zd_mac *mac, const u8 *buffer, unsigned int length)
++static void zd_mac_rx(struct zd_mac *mac, struct sk_buff *skb)
+ {
+ 	int r;
+ 	struct ieee80211_device *ieee = zd_mac_to_ieee80211(mac);
+ 	struct ieee80211_rx_stats stats;
+ 	const struct rx_status *status;
+-	struct sk_buff *skb;
+ 
+-	if (length < ZD_PLCP_HEADER_SIZE + IEEE80211_1ADDR_LEN +
+-	             IEEE80211_FCS_LEN + sizeof(struct rx_status))
+-		return -EINVAL;
++	if (skb->len < ZD_PLCP_HEADER_SIZE + IEEE80211_1ADDR_LEN +
++	               IEEE80211_FCS_LEN + sizeof(struct rx_status))
++	{
++		dev_dbg_f(zd_mac_dev(mac), "Packet with length %u to small.\n",
++			 skb->len);
++		goto free_skb;
++	}
+ 
+-	r = fill_rx_stats(&stats, &status, mac, buffer, length);
+-	if (r)
+-		return r;
++	r = fill_rx_stats(&stats, &status, mac, skb->data, skb->len);
++	if (r) {
++		/* Only packets with rx errors are included here. */
++		goto free_skb;
++	}
+ 
+-	length -= ZD_PLCP_HEADER_SIZE+IEEE80211_FCS_LEN+
+-		  sizeof(struct rx_status);
+-	buffer += ZD_PLCP_HEADER_SIZE;
++	__skb_pull(skb, ZD_PLCP_HEADER_SIZE);
++	__skb_trim(skb, skb->len -
++		        (IEEE80211_FCS_LEN + sizeof(struct rx_status)));
+ 
+-	update_qual_rssi(mac, buffer, length, stats.signal, stats.rssi);
++	update_qual_rssi(mac, skb->data, skb->len, stats.signal,
++		         status->signal_strength);
+ 
+-	r = filter_rx(ieee, buffer, length, &stats);
+-	if (r <= 0)
+-		return r;
+ 
+-	skb = dev_alloc_skb(sizeof(struct zd_rt_hdr) + length);
+-	if (!skb)
+-		return -ENOMEM;
++	r = filter_rx(ieee, skb->data, skb->len, &stats);
++	if (r <= 0) {
++		if (r < 0)
++			dev_dbg_f(zd_mac_dev(mac), "Error in packet.\n");
++		goto free_skb;
++	}
++
+ 	if (ieee->iw_mode == IW_MODE_MONITOR)
+-		fill_rt_header(skb_put(skb, sizeof(struct zd_rt_hdr)), mac,
++		fill_rt_header(skb_push(skb, sizeof(struct zd_rt_hdr)), mac,
+ 			       &stats, status);
+-	memcpy(skb_put(skb, length), buffer, length);
+ 
+ 	r = ieee80211_rx(ieee, skb, &stats);
+-	if (!r) {
+-		ZD_ASSERT(in_irq());
+-		dev_kfree_skb_irq(skb);
++	if (r)
++		return;
++
++free_skb:
++	/* We are always in a soft irq. */
++	dev_kfree_skb(skb);
++}
++
++static void do_rx(unsigned long mac_ptr)
++{
++	struct zd_mac *mac = (struct zd_mac *)mac_ptr;
++	struct sk_buff *skb;
++
++	while ((skb = skb_dequeue(&mac->rx_queue)) != NULL)
++		zd_mac_rx(mac, skb);
++}
++
++int zd_mac_rx_irq(struct zd_mac *mac, const u8 *buffer, unsigned int length)
++{
++	struct sk_buff *skb;
++
++	skb = dev_alloc_skb(sizeof(struct zd_rt_hdr) + length);
++	if (!skb) {
++		dev_warn(zd_mac_dev(mac), "Could not allocate skb.\n");
++		return -ENOMEM;
+ 	}
++	skb_reserve(skb, sizeof(struct zd_rt_hdr));
++	memcpy(__skb_put(skb, length), buffer, length);
++	skb_queue_tail(&mac->rx_queue, skb);
++	tasklet_schedule(&mac->rx_tasklet);
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/net/wireless/zd1211rw/zd_mac.h b/drivers/net/wireless/zd1211rw/zd_mac.h
+index b8ea3de..f3213ab 100644
+--- a/drivers/net/wireless/zd1211rw/zd_mac.h
++++ b/drivers/net/wireless/zd1211rw/zd_mac.h
+@@ -82,7 +82,7 @@ struct zd_ctrlset {
+ struct rx_length_info {
+ 	__le16 length[3];
+ 	__le16 tag;
+-};
++} __attribute__((packed));
+ 
+ #define RX_LENGTH_INFO_TAG		0x697e
+ 
+@@ -93,7 +93,7 @@ struct rx_status {
+ 	u8 signal_quality_ofdm;
+ 	u8 decryption_type;
+ 	u8 frame_status;
+-};
++} __attribute__((packed));
+ 
+ /* rx_status field decryption_type */
+ #define ZD_RX_NO_WEP	0
+@@ -133,6 +133,10 @@ struct zd_mac {
+ 	/* Unlocked reading possible */
+ 	struct iw_statistics iw_stats;
+ 	struct housekeeping housekeeping;
++
++	struct tasklet_struct rx_tasklet;
++	struct sk_buff_head rx_queue;
++
+ 	unsigned int stats_count;
+ 	u8 qual_buffer[ZD_MAC_STATS_BUFFER_SIZE];
+ 	u8 rssi_buffer[ZD_MAC_STATS_BUFFER_SIZE];
+@@ -174,7 +178,7 @@ int zd_mac_open(struct net_device *netdev);
+ int zd_mac_stop(struct net_device *netdev);
+ int zd_mac_set_mac_address(struct net_device *dev, void *p);
+ 
+-int zd_mac_rx(struct zd_mac *mac, const u8 *buffer, unsigned int length);
++int zd_mac_rx_irq(struct zd_mac *mac, const u8 *buffer, unsigned int length);
+ 
+ int zd_mac_set_regdomain(struct zd_mac *zd_mac, u8 regdomain);
+ u8 zd_mac_get_regdomain(struct zd_mac *zd_mac);
+diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c
+index 3faaeb2..4a5f5d5 100644
+--- a/drivers/net/wireless/zd1211rw/zd_usb.c
++++ b/drivers/net/wireless/zd1211rw/zd_usb.c
+@@ -599,13 +599,13 @@ static void handle_rx_packet(struct zd_usb *usb, const u8 *buffer,
+ 			n = l+k;
+ 			if (n > length)
+ 				return;
+-			zd_mac_rx(mac, buffer+l, k);
++			zd_mac_rx_irq(mac, buffer+l, k);
+ 			if (i >= 2)
+ 				return;
+ 			l = (n+3) & ~3;
+ 		}
+ 	} else {
+-		zd_mac_rx(mac, buffer, length);
++		zd_mac_rx_irq(mac, buffer, length);
+ 	}
+ }
+ 
+diff --git a/drivers/net/wireless/zd1211rw/zd_usb.h b/drivers/net/wireless/zd1211rw/zd_usb.h
+index e81a2d3..317d37c 100644
+--- a/drivers/net/wireless/zd1211rw/zd_usb.h
++++ b/drivers/net/wireless/zd1211rw/zd_usb.h
+@@ -74,17 +74,17 @@ enum control_requests {
+ struct usb_req_read_regs {
+ 	__le16 id;
+ 	__le16 addr[0];
+-};
++} __attribute__((packed));
+ 
+ struct reg_data {
+ 	__le16 addr;
+ 	__le16 value;
+-};
++} __attribute__((packed));
+ 
+ struct usb_req_write_regs {
+ 	__le16 id;
+ 	struct reg_data reg_writes[0];
+-};
++} __attribute__((packed));
+ 
+ enum {
+ 	RF_IF_LE = 0x02,
+@@ -101,7 +101,7 @@ struct usb_req_rfwrite {
+ 	/* RF2595: 24 */
+ 	__le16 bit_values[0];
+ 	/* (CR203 & ~(RF_IF_LE | RF_CLK | RF_DATA)) | (bit ? RF_DATA : 0) */
+-};
++} __attribute__((packed));
+ 
+ /* USB interrupt */
+ 
+@@ -118,12 +118,12 @@ enum usb_int_flags {
+ struct usb_int_header {
+ 	u8 type;	/* must always be 1 */
+ 	u8 id;
+-};
++} __attribute__((packed));
+ 
+ struct usb_int_regs {
+ 	struct usb_int_header hdr;
+ 	struct reg_data regs[0];
+-};
++} __attribute__((packed));
+ 
+ struct usb_int_retry_fail {
+ 	struct usb_int_header hdr;
+@@ -131,7 +131,7 @@ struct usb_int_retry_fail {
+ 	u8 _dummy;
+ 	u8 addr[ETH_ALEN];
+ 	u8 ibss_wakeup_dest;
+-};
++} __attribute__((packed));
+ 
+ struct read_regs_int {
+ 	struct completion completion;
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index 3ac4890..f018e49 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -191,6 +191,7 @@ int scsi_execute(struct scsi_device *sdev, const unsigned char *cmd,
+ 		goto out;
+ 
+ 	req->cmd_len = COMMAND_SIZE(cmd[0]);
++	memset(req->cmd, 0, BLK_MAX_CDB); /* ATAPI hates garbage after CDB */
+ 	memcpy(req->cmd, cmd, req->cmd_len);
+ 	req->sense = sense;
+ 	req->sense_len = 0;
+diff --git a/drivers/usb/misc/phidgetservo.c b/drivers/usb/misc/phidgetservo.c
+index 7163f05..0d9de2f 100644
+--- a/drivers/usb/misc/phidgetservo.c
++++ b/drivers/usb/misc/phidgetservo.c
+@@ -282,6 +282,7 @@ servo_probe(struct usb_interface *interface, const struct usb_device_id *id)
+ 		dev->dev = NULL;
+ 		goto out;
+ 	}
++	dev_set_drvdata(dev->dev, dev);
+ 
+ 	servo_count = dev->type & SERVO_COUNT_QUAD ? 4 : 1;
+ 
+diff --git a/drivers/usb/net/asix.c b/drivers/usb/net/asix.c
+index 881841e..1a22d00 100644
+--- a/drivers/usb/net/asix.c
++++ b/drivers/usb/net/asix.c
+@@ -920,7 +920,7 @@ static int ax88772_bind(struct usbnet *dev, struct usb_interface *intf)
+ 		goto out2;
+ 
+ 	if ((ret = asix_write_cmd(dev, AX_CMD_SW_PHY_SELECT,
+-				0x0000, 0, 0, buf)) < 0) {
++				1, 0, 0, buf)) < 0) {
+ 		dbg("Select PHY #1 failed: %d", ret);
+ 		goto out2;
+ 	}
+diff --git a/fs/autofs/inode.c b/fs/autofs/inode.c
+index 38ede5c..f968d13 100644
+--- a/fs/autofs/inode.c
++++ b/fs/autofs/inode.c
+@@ -28,10 +28,11 @@ void autofs_kill_sb(struct super_block *sb)
+ 	/*
+ 	 * In the event of a failure in get_sb_nodev the superblock
+ 	 * info is not present so nothing else has been setup, so
+-	 * just exit when we are called from deactivate_super.
++	 * just call kill_anon_super when we are called from
++	 * deactivate_super.
+ 	 */
+ 	if (!sbi)
+-		return;
++		goto out_kill_sb;
+ 
+ 	if ( !sbi->catatonic )
+ 		autofs_catatonic_mode(sbi); /* Free wait queues, close pipe */
+@@ -44,6 +45,7 @@ void autofs_kill_sb(struct super_block *sb)
+ 
+ 	kfree(sb->s_fs_info);
+ 
++out_kill_sb:
+ 	DPRINTK(("autofs: shutting down\n"));
+ 	kill_anon_super(sb);
+ }
+@@ -209,7 +211,6 @@ fail_iput:
+ fail_free:
+ 	kfree(sbi);
+ 	s->s_fs_info = NULL;
+-	kill_anon_super(s);
+ fail_unlock:
+ 	return -EINVAL;
+ }
+diff --git a/fs/autofs4/inode.c b/fs/autofs4/inode.c
+index ce7c0f1..9c48250 100644
+--- a/fs/autofs4/inode.c
++++ b/fs/autofs4/inode.c
+@@ -152,10 +152,11 @@ void autofs4_kill_sb(struct super_block *sb)
+ 	/*
+ 	 * In the event of a failure in get_sb_nodev the superblock
+ 	 * info is not present so nothing else has been setup, so
+-	 * just exit when we are called from deactivate_super.
++	 * just ca