## Automatically generated incremental diff
## From:   linux-2.6.19-rc6
## To:     linux-2.6.19
## Robot:  $Id: make-incremental-diff,v 1.12 2004/01/06 07:19:36 hpa Exp $

diff -urN linux-2.6.19-rc6/CREDITS linux-2.6.19/CREDITS
--- linux-2.6.19-rc6/CREDITS	2006-11-29 22:48:07.432565443 +0000
+++ linux-2.6.19/CREDITS	2006-11-29 22:48:12.177080921 +0000
@@ -3511,14 +3511,12 @@
 
 N: David Weinehall
 E: tao@acc.umu.se
+P: 1024D/DC47CA16 7ACE 0FB0 7A74 F994 9B36  E1D1 D14E 8526 DC47 CA16
 W: http://www.acc.umu.se/~tao/
-W: http://www.acc.umu.se/~mcalinux/
+D: v2.0 kernel maintainer
 D: Fixes for the NE/2-driver
 D: Miscellaneous MCA-support
 D: Cleanup of the Config-files
-S: Axtorpsvagen 40:20
-S: S-903 37  UMEA
-S: Sweden
 
 N: Matt Welsh
 E: mdw@metalab.unc.edu
diff -urN linux-2.6.19-rc6/Documentation/filesystems/udf.txt linux-2.6.19/Documentation/filesystems/udf.txt
--- linux-2.6.19-rc6/Documentation/filesystems/udf.txt	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/Documentation/filesystems/udf.txt	2006-11-29 22:48:12.193082659 +0000
@@ -7,8 +7,17 @@
 please report them to linux_udf@hpesjro.fc.hp.com, which is the
 developer's list.
 
-Write support requires a block driver which supports writing. The current
-scsi and ide cdrom drivers do not support writing.
+Write support requires a block driver which supports writing.  Currently
+dvd+rw drives and media support true random sector writes, and so a udf
+filesystem on such devices can be directly mounted read/write.  CD-RW
+media however, does not support this.  Instead the media can be formatted
+for packet mode using the utility cdrwtool, then the pktcdvd driver can
+be bound to the underlying cd device to provide the required buffering
+and read-modify-write cycles to allow the filesystem random sector writes
+while providing the hardware with only full packet writes.  While not
+required for dvd+rw media, use of the pktcdvd driver often enhances
+performance due to very poor read-modify-write support supplied internally
+by drive firmware.
 
 -------------------------------------------------------------------------------
 The following mount options are supported:
diff -urN linux-2.6.19-rc6/Documentation/kprobes.txt linux-2.6.19/Documentation/kprobes.txt
--- linux-2.6.19-rc6/Documentation/kprobes.txt	2006-11-29 22:48:07.460568485 +0000
+++ linux-2.6.19/Documentation/kprobes.txt	2006-11-29 22:48:12.205083963 +0000
@@ -442,9 +442,10 @@
 	kp.fault_handler = handler_fault;
 	kp.symbol_name = "do_fork";
 
-	if ((ret = register_kprobe(&kp) < 0)) {
+	ret = register_kprobe(&kp);
+	if (ret < 0) {
 		printk("register_kprobe failed, returned %d\n", ret);
-		return -1;
+		return ret;
 	}
 	printk("kprobe registered\n");
 	return 0;
diff -urN linux-2.6.19-rc6/Documentation/rtc.txt linux-2.6.19/Documentation/rtc.txt
--- linux-2.6.19-rc6/Documentation/rtc.txt	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/Documentation/rtc.txt	2006-11-29 22:48:12.221085702 +0000
@@ -1,12 +1,49 @@
 
-	Real Time Clock Driver for Linux
-	================================
+	Real Time Clock (RTC) Drivers for Linux
+	=======================================
+
+When Linux developers talk about a "Real Time Clock", they usually mean
+something that tracks wall clock time and is battery backed so that it
+works even with system power off.  Such clocks will normally not track
+the local time zone or daylight savings time -- unless they dual boot
+with MS-Windows -- but will instead be set to Coordinated Universal Time
+(UTC, formerly "Greenwich Mean Time").
+
+The newest non-PC hardware tends to just count seconds, like the time(2)
+system call reports, but RTCs also very commonly represent time using
+the Gregorian calendar and 24 hour time, as reported by gmtime(3).
+
+Linux has two largely-compatible userspace RTC API families you may
+need to know about:
+
+    *	/dev/rtc ... is the RTC provided by PC compatible systems,
+	so it's not very portable to non-x86 systems.
+
+    *	/dev/rtc0, /dev/rtc1 ... are part of a framework that's
+	supported by a wide variety of RTC chips on all systems.
+
+Programmers need to understand that the PC/AT functionality is not
+always available, and some systems can do much more.  That is, the
+RTCs use the same API to make requests in both RTC frameworks (using
+different filenames of course), but the hardware may not offer the
+same functionality.  For example, not every RTC is hooked up to an
+IRQ, so they can't all issue alarms; and where standard PC RTCs can
+only issue an alarm up to 24 hours in the future, other hardware may
+be able to schedule one any time in the upcoming century.
+
+
+	Old PC/AT-Compatible driver:  /dev/rtc
+	--------------------------------------
 
 All PCs (even Alpha machines) have a Real Time Clock built into them.
 Usually they are built into the chipset of the computer, but some may
 actually have a Motorola MC146818 (or clone) on the board. This is the
 clock that keeps the date and time while your computer is turned off.
 
+ACPI has standardized that MC146818 functionality, and extended it in
+a few ways (enabling longer alarm periods, and wake-from-hibernate).
+That functionality is NOT exposed in the old driver.
+
 However it can also be used to generate signals from a slow 2Hz to a
 relatively fast 8192Hz, in increments of powers of two. These signals
 are reported by interrupt number 8. (Oh! So *that* is what IRQ 8 is
@@ -63,223 +100,331 @@
 perhaps more useful to include a small test program that demonstrates
 how to use them, and demonstrates the features of the driver. This is
 probably a lot more useful to people interested in writing applications
-that will be using this driver.
+that will be using this driver.  See the code at the end of this document.
+
+(The original /dev/rtc driver was written by Paul Gortmaker.)
+
+
+	New portable "RTC Class" drivers:  /dev/rtcN
+	--------------------------------------------
+
+Because Linux supports many non-ACPI and non-PC platforms, some of which
+have more than one RTC style clock, it needed a more portable solution
+than expecting a single battery-backed MC146818 clone on every system.
+Accordingly, a new "RTC Class" framework has been defined.  It offers
+three different userspace interfaces:
+
+    *	/dev/rtcN ... much the same as the older /dev/rtc interface
+
+    *	/sys/class/rtc/rtcN ... sysfs attributes support readonly
+	access to some RTC attributes.
+
+    *	/proc/driver/rtc ... the first RTC (rtc0) may expose itself
+	using a procfs interface.  More information is (currently) shown
+	here than through sysfs.
+
+The RTC Class framework supports a wide variety of RTCs, ranging from those
+integrated into embeddable system-on-chip (SOC) processors to discrete chips
+using I2C, SPI, or some other bus to communicate with the host CPU.  There's
+even support for PC-style RTCs ... including the features exposed on newer PCs
+through ACPI.
+
+The new framework also removes the "one RTC per system" restriction.  For
+example, maybe the low-power battery-backed RTC is a discrete I2C chip, but
+a high functionality RTC is integrated into the SOC.  That system might read
+the system clock from the discrete RTC, but use the integrated one for all
+other tasks, because of its greater functionality.
+
+The ioctl() calls supported by /dev/rtc are also supported by the RTC class
+framework.  However, because the chips and systems are not standardized,
+some PC/AT functionality might not be provided.  And in the same way, some
+newer features -- including those enabled by ACPI -- are exposed by the
+RTC class framework, but can't be supported by the older driver.
+
+    *	RTC_RD_TIME, RTC_SET_TIME ... every RTC supports at least reading
+	time, returning the result as a Gregorian calendar date and 24 hour
+	wall clock time.  To be most useful, this time may also be updated.
+
+    *	RTC_AIE_ON, RTC_AIE_OFF, RTC_ALM_SET, RTC_ALM_READ ... when the RTC
+	is connected to an IRQ line, it can often issue an alarm IRQ up to
+	24 hours in the future.
+
+    *	RTC_WKALM_SET, RTC_WKALM_READ ... RTCs that can issue alarms beyond
+	the next 24 hours use a slightly more powerful API, which supports
+	setting the longer alarm time and enabling its IRQ using a single
+	request (using the same model as EFI firmware).
+
+    *	RTC_UIE_ON, RTC_UIE_OFF ... if the RTC offers IRQs, it probably
+	also offers update IRQs whenever the "seconds" counter changes.
+	If needed, the RTC framework can emulate this mechanism.
+
+    *	RTC_PIE_ON, RTC_PIE_OFF, RTC_IRQP_SET, RTC_IRQP_READ ... another
+	feature often accessible with an IRQ line is a periodic IRQ, issued
+	at settable frequencies (usually 2^N Hz).
+
+In many cases, the RTC alarm can be a system wake event, used to force
+Linux out of a low power sleep state (or hibernation) back to a fully
+operational state.  For example, a system could enter a deep power saving
+state until it's time to execute some scheduled tasks.
 
-						Paul Gortmaker
 
 -------------------- 8< ---------------- 8< -----------------------------
 
 /*
- *	Real Time Clock Driver Test/Example Program
+ *      Real Time Clock Driver Test/Example Program
  *
- *	Compile with:
- *		gcc -s -Wall -Wstrict-prototypes rtctest.c -o rtctest
+ *      Compile with:
+ *		     gcc -s -Wall -Wstrict-prototypes rtctest.c -o rtctest
  *
- *	Copyright (C) 1996, Paul Gortmaker.
+ *      Copyright (C) 1996, Paul Gortmaker.
  *
- *	Released under the GNU General Public License, version 2,
- *	included herein by reference.
+ *      Released under the GNU General Public License, version 2,
+ *      included herein by reference.
  *
  */
 
 #include <stdio.h>
-#include <stdlib.h>
 #include <linux/rtc.h>
 #include <sys/ioctl.h>
 #include <sys/time.h>
 #include <sys/types.h>
 #include <fcntl.h>
 #include <unistd.h>
+#include <stdlib.h>
 #include <errno.h>
 
-int main(void) {
 
-int i, fd, retval, irqcount = 0;
-unsigned long tmp, data;
-struct rtc_time rtc_tm;
+/*
+ * This expects the new RTC class driver framework, working with
+ * clocks that will often not be clones of what the PC-AT had.
+ * Use the command line to specify another RTC if you need one.
+ */
+static const char default_rtc[] = "/dev/rtc0";
 
-fd = open ("/dev/rtc", O_RDONLY);
 
-if (fd ==  -1) {
-	perror("/dev/rtc");
-	exit(errno);
-}
+int main(int argc, char **argv)
+{
+	int i, fd, retval, irqcount = 0;
+	unsigned long tmp, data;
+	struct rtc_time rtc_tm;
+	const char *rtc = default_rtc;
+
+	switch (argc) {
+	case 2:
+		rtc = argv[1];
+		/* FALLTHROUGH */
+	case 1:
+		break;
+	default:
+		fprintf(stderr, "usage:  rtctest [rtcdev]\n");
+		return 1;
+	}
 
-fprintf(stderr, "\n\t\t\tRTC Driver Test Example.\n\n");
+	fd = open(rtc, O_RDONLY);
 
-/* Turn on update interrupts (one per second) */
-retval = ioctl(fd, RTC_UIE_ON, 0);
-if (retval == -1) {
-	perror("ioctl");
-	exit(errno);
-}
+	if (fd ==  -1) {
+		perror(rtc);
+		exit(errno);
+	}
 
-fprintf(stderr, "Counting 5 update (1/sec) interrupts from reading /dev/rtc:");
-fflush(stderr);
-for (i=1; i<6; i++) {
-	/* This read will block */
-	retval = read(fd, &data, sizeof(unsigned long));
+	fprintf(stderr, "\n\t\t\tRTC Driver Test Example.\n\n");
+
+	/* Turn on update interrupts (one per second) */
+	retval = ioctl(fd, RTC_UIE_ON, 0);
 	if (retval == -1) {
-		perror("read");
+		if (errno == ENOTTY) {
+			fprintf(stderr,
+				"\n...Update IRQs not supported.\n");
+			goto test_READ;
+		}
+		perror("ioctl");
 		exit(errno);
 	}
-	fprintf(stderr, " %d",i);
+
+	fprintf(stderr, "Counting 5 update (1/sec) interrupts from reading %s:",
+			rtc);
 	fflush(stderr);
-	irqcount++;
-}
+	for (i=1; i<6; i++) {
+		/* This read will block */
+		retval = read(fd, &data, sizeof(unsigned long));
+		if (retval == -1) {
+		        perror("read");
+		        exit(errno);
+		}
+		fprintf(stderr, " %d",i);
+		fflush(stderr);
+		irqcount++;
+	}
+
+	fprintf(stderr, "\nAgain, from using select(2) on /dev/rtc:");
+	fflush(stderr);
+	for (i=1; i<6; i++) {
+		struct timeval tv = {5, 0};     /* 5 second timeout on select */
+		fd_set readfds;
+
+		FD_ZERO(&readfds);
+		FD_SET(fd, &readfds);
+		/* The select will wait until an RTC interrupt happens. */
+		retval = select(fd+1, &readfds, NULL, NULL, &tv);
+		if (retval == -1) {
+		        perror("select");
+		        exit(errno);
+		}
+		/* This read won't block unlike the select-less case above. */
+		retval = read(fd, &data, sizeof(unsigned long));
+		if (retval == -1) {
+		        perror("read");
+		        exit(errno);
+		}
+		fprintf(stderr, " %d",i);
+		fflush(stderr);
+		irqcount++;
+	}
 
-fprintf(stderr, "\nAgain, from using select(2) on /dev/rtc:");
-fflush(stderr);
-for (i=1; i<6; i++) {
-	struct timeval tv = {5, 0};	/* 5 second timeout on select */
-	fd_set readfds;
-
-	FD_ZERO(&readfds);
-	FD_SET(fd, &readfds);
-	/* The select will wait until an RTC interrupt happens. */
-	retval = select(fd+1, &readfds, NULL, NULL, &tv);
+	/* Turn off update interrupts */
+	retval = ioctl(fd, RTC_UIE_OFF, 0);
 	if (retval == -1) {
-		perror("select");
+		perror("ioctl");
 		exit(errno);
 	}
-	/* This read won't block unlike the select-less case above. */
-	retval = read(fd, &data, sizeof(unsigned long));
+
+test_READ:
+	/* Read the RTC time/date */
+	retval = ioctl(fd, RTC_RD_TIME, &rtc_tm);
 	if (retval == -1) {
-		perror("read");
+		perror("ioctl");
 		exit(errno);
 	}
-	fprintf(stderr, " %d",i);
-	fflush(stderr);
-	irqcount++;
-}
-
-/* Turn off update interrupts */
-retval = ioctl(fd, RTC_UIE_OFF, 0);
-if (retval == -1) {
-	perror("ioctl");
-	exit(errno);
-}
-
-/* Read the RTC time/date */
-retval = ioctl(fd, RTC_RD_TIME, &rtc_tm);
-if (retval == -1) {
-	perror("ioctl");
-	exit(errno);
-}
-
-fprintf(stderr, "\n\nCurrent RTC date/time is %d-%d-%d, %02d:%02d:%02d.\n",
-	rtc_tm.tm_mday, rtc_tm.tm_mon + 1, rtc_tm.tm_year + 1900,
-	rtc_tm.tm_hour, rtc_tm.tm_min, rtc_tm.tm_sec);
-
-/* Set the alarm to 5 sec in the future, and check for rollover */
-rtc_tm.tm_sec += 5;
-if (rtc_tm.tm_sec >= 60) {
-	rtc_tm.tm_sec %= 60;
-	rtc_tm.tm_min++;
-}
-if  (rtc_tm.tm_min == 60) {
-	rtc_tm.tm_min = 0;
-	rtc_tm.tm_hour++;
-}
-if  (rtc_tm.tm_hour == 24)
-	rtc_tm.tm_hour = 0;
-
-retval = ioctl(fd, RTC_ALM_SET, &rtc_tm);
-if (retval == -1) {
-	perror("ioctl");
-	exit(errno);
-}
-
-/* Read the current alarm settings */
-retval = ioctl(fd, RTC_ALM_READ, &rtc_tm);
-if (retval == -1) {
-	perror("ioctl");
-	exit(errno);
-}
-
-fprintf(stderr, "Alarm time now set to %02d:%02d:%02d.\n",
-	rtc_tm.tm_hour, rtc_tm.tm_min, rtc_tm.tm_sec);
 
-/* Enable alarm interrupts */
-retval = ioctl(fd, RTC_AIE_ON, 0);
-if (retval == -1) {
-	perror("ioctl");
-	exit(errno);
-}
-
-fprintf(stderr, "Waiting 5 seconds for alarm...");
-fflush(stderr);
-/* This blocks until the alarm ring causes an interrupt */
-retval = read(fd, &data, sizeof(unsigned long));
-if (retval == -1) {
-	perror("read");
-	exit(errno);
-}
-irqcount++;
-fprintf(stderr, " okay. Alarm rang.\n");
-
-/* Disable alarm interrupts */
-retval = ioctl(fd, RTC_AIE_OFF, 0);
-if (retval == -1) {
-	perror("ioctl");
-	exit(errno);
-}
+	fprintf(stderr, "\n\nCurrent RTC date/time is %d-%d-%d, %02d:%02d:%02d.\n",
+		rtc_tm.tm_mday, rtc_tm.tm_mon + 1, rtc_tm.tm_year + 1900,
+		rtc_tm.tm_hour, rtc_tm.tm_min, rtc_tm.tm_sec);
+
+	/* Set the alarm to 5 sec in the future, and check for rollover */
+	rtc_tm.tm_sec += 5;
+	if (rtc_tm.tm_sec >= 60) {
+		rtc_tm.tm_sec %= 60;
+		rtc_tm.tm_min++;
+	}
+	if  (rtc_tm.tm_min == 60) {
+		rtc_tm.tm_min = 0;
+		rtc_tm.tm_hour++;
+	}
+	if  (rtc_tm.tm_hour == 24)
+		rtc_tm.tm_hour = 0;
 
-/* Read periodic IRQ rate */
-retval = ioctl(fd, RTC_IRQP_READ, &tmp);
-if (retval == -1) {
-	perror("ioctl");
-	exit(errno);
-}
-fprintf(stderr, "\nPeriodic IRQ rate was %ldHz.\n", tmp);
+	retval = ioctl(fd, RTC_ALM_SET, &rtc_tm);
+	if (retval == -1) {
+		if (errno == ENOTTY) {
+			fprintf(stderr,
+				"\n...Alarm IRQs not supported.\n");
+			goto test_PIE;
+		}
+		perror("ioctl");
+		exit(errno);
+	}
 
-fprintf(stderr, "Counting 20 interrupts at:");
-fflush(stderr);
+	/* Read the current alarm settings */
+	retval = ioctl(fd, RTC_ALM_READ, &rtc_tm);
+	if (retval == -1) {
+		perror("ioctl");
+		exit(errno);
+	}
 
-/* The frequencies 128Hz, 256Hz, ... 8192Hz are only allowed for root. */
-for (tmp=2; tmp<=64; tmp*=2) {
+	fprintf(stderr, "Alarm time now set to %02d:%02d:%02d.\n",
+		rtc_tm.tm_hour, rtc_tm.tm_min, rtc_tm.tm_sec);
 
-	retval = ioctl(fd, RTC_IRQP_SET, tmp);
+	/* Enable alarm interrupts */
+	retval = ioctl(fd, RTC_AIE_ON, 0);
 	if (retval == -1) {
 		perror("ioctl");
 		exit(errno);
 	}
 
-	fprintf(stderr, "\n%ldHz:\t", tmp);
+	fprintf(stderr, "Waiting 5 seconds for alarm...");
 	fflush(stderr);
+	/* This blocks until the alarm ring causes an interrupt */
+	retval = read(fd, &data, sizeof(unsigned long));
+	if (retval == -1) {
+		perror("read");
+		exit(errno);
+	}
+	irqcount++;
+	fprintf(stderr, " okay. Alarm rang.\n");
 
-	/* Enable periodic interrupts */
-	retval = ioctl(fd, RTC_PIE_ON, 0);
+	/* Disable alarm interrupts */
+	retval = ioctl(fd, RTC_AIE_OFF, 0);
 	if (retval == -1) {
 		perror("ioctl");
 		exit(errno);
 	}
 
-	for (i=1; i<21; i++) {
-		/* This blocks */
-		retval = read(fd, &data, sizeof(unsigned long));
+test_PIE:
+	/* Read periodic IRQ rate */
+	retval = ioctl(fd, RTC_IRQP_READ, &tmp);
+	if (retval == -1) {
+		/* not all RTCs support periodic IRQs */
+		if (errno == ENOTTY) {
+			fprintf(stderr, "\nNo periodic IRQ support\n");
+			return 0;
+		}
+		perror("ioctl");
+		exit(errno);
+	}
+	fprintf(stderr, "\nPeriodic IRQ rate is %ldHz.\n", tmp);
+
+	fprintf(stderr, "Counting 20 interrupts at:");
+	fflush(stderr);
+
+	/* The frequencies 128Hz, 256Hz, ... 8192Hz are only allowed for root. */
+	for (tmp=2; tmp<=64; tmp*=2) {
+
+		retval = ioctl(fd, RTC_IRQP_SET, tmp);
 		if (retval == -1) {
-			perror("read");
-			exit(errno);
+			/* not all RTCs can change their periodic IRQ rate */
+			if (errno == ENOTTY) {
+				fprintf(stderr,
+					"\n...Periodic IRQ rate is fixed\n");
+				goto done;
+			}
+		        perror("ioctl");
+		        exit(errno);
 		}
-		fprintf(stderr, " %d",i);
+
+		fprintf(stderr, "\n%ldHz:\t", tmp);
 		fflush(stderr);
-		irqcount++;
-	}
 
-	/* Disable periodic interrupts */
-	retval = ioctl(fd, RTC_PIE_OFF, 0);
-	if (retval == -1) {
-		perror("ioctl");
-		exit(errno);
+		/* Enable periodic interrupts */
+		retval = ioctl(fd, RTC_PIE_ON, 0);
+		if (retval == -1) {
+		        perror("ioctl");
+		        exit(errno);
+		}
+
+		for (i=1; i<21; i++) {
+		        /* This blocks */
+		        retval = read(fd, &data, sizeof(unsigned long));
+		        if (retval == -1) {
+				       perror("read");
+				       exit(errno);
+		        }
+		        fprintf(stderr, " %d",i);
+		        fflush(stderr);
+		        irqcount++;
+		}
+
+		/* Disable periodic interrupts */
+		retval = ioctl(fd, RTC_PIE_OFF, 0);
+		if (retval == -1) {
+		        perror("ioctl");
+		        exit(errno);
+		}
 	}
-}
 
-fprintf(stderr, "\n\n\t\t\t *** Test complete ***\n");
-fprintf(stderr, "\nTyping \"cat /proc/interrupts\" will show %d more events on IRQ 8.\n\n",
-								 irqcount);
+done:
+	fprintf(stderr, "\n\n\t\t\t *** Test complete ***\n");
 
-close(fd);
-return 0;
+	close(fd);
 
-} /* end main */
+	return 0;
+}
diff -urN linux-2.6.19-rc6/MAINTAINERS linux-2.6.19/MAINTAINERS
--- linux-2.6.19-rc6/MAINTAINERS	2006-11-29 22:48:07.500572832 +0000
+++ linux-2.6.19/MAINTAINERS	2006-11-29 22:48:12.245088310 +0000
@@ -353,6 +353,12 @@
 M:	rpurdie@rpsys.net
 S:	Maintained
 
+ARM/HP JORNADA 7XX MACHINE SUPPORT
+P:      Kristoffer Ericson
+M:      kristoffer_e1@hotmail.com
+W:      www.jlime.com
+S:      Maintained
+
 ARM/TOSA MACHINE SUPPORT
 P:	Dirk Opfer
 M:	dirk@opfer-online.de
diff -urN linux-2.6.19-rc6/Makefile linux-2.6.19/Makefile
--- linux-2.6.19-rc6/Makefile	2006-11-29 22:48:07.500572832 +0000
+++ linux-2.6.19/Makefile	2006-11-29 22:48:12.245088310 +0000
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 19
-EXTRAVERSION =-rc6
+EXTRAVERSION =
 NAME=Avast! A bilge rat!
 
 # *DOCUMENTATION*
diff -urN linux-2.6.19-rc6/arch/arm/Kconfig linux-2.6.19/arch/arm/Kconfig
--- linux-2.6.19-rc6/arch/arm/Kconfig	2006-11-29 22:48:07.516574570 +0000
+++ linux-2.6.19/arch/arm/Kconfig	2006-11-29 22:48:12.261090048 +0000
@@ -879,6 +879,8 @@
 
 source "drivers/scsi/Kconfig"
 
+source "drivers/ata/Kconfig"
+
 source "drivers/md/Kconfig"
 
 source "drivers/message/fusion/Kconfig"
diff -urN linux-2.6.19-rc6/arch/arm/configs/assabet_defconfig linux-2.6.19/arch/arm/configs/assabet_defconfig
--- linux-2.6.19-rc6/arch/arm/configs/assabet_defconfig	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/arch/arm/configs/assabet_defconfig	2006-11-29 22:48:12.261090048 +0000
@@ -184,6 +184,7 @@
 # Power management options
 #
 CONFIG_PM=y
+# CONFIG_PM_LEGACY is not set
 # CONFIG_APM is not set
 
 #
diff -urN linux-2.6.19-rc6/arch/arm/configs/ateb9200_defconfig linux-2.6.19/arch/arm/configs/ateb9200_defconfig
--- linux-2.6.19-rc6/arch/arm/configs/ateb9200_defconfig	2006-11-29 22:48:07.520575005 +0000
+++ linux-2.6.19/arch/arm/configs/ateb9200_defconfig	2006-11-29 22:48:12.265090483 +0000
@@ -217,7 +217,7 @@
 # Power management options
 #
 CONFIG_PM=y
-CONFIG_PM_LEGACY=y
+# CONFIG_PM_LEGACY is not set
 # CONFIG_PM_DEBUG is not set
 # CONFIG_APM is not set
 
diff -urN linux-2.6.19-rc6/arch/arm/configs/cerfcube_defconfig linux-2.6.19/arch/arm/configs/cerfcube_defconfig
--- linux-2.6.19-rc6/arch/arm/configs/cerfcube_defconfig	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/arch/arm/configs/cerfcube_defconfig	2006-11-29 22:48:12.265090483 +0000
@@ -194,6 +194,7 @@
 # Power management options
 #
 CONFIG_PM=y
+# CONFIG_PM_LEGACY is not set
 # CONFIG_APM is not set
 
 #
diff -urN linux-2.6.19-rc6/arch/arm/configs/collie_defconfig linux-2.6.19/arch/arm/configs/collie_defconfig
--- linux-2.6.19-rc6/arch/arm/configs/collie_defconfig	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/arch/arm/configs/collie_defconfig	2006-11-29 22:48:12.265090483 +0000
@@ -219,7 +219,7 @@
 # Power management options
 #
 CONFIG_PM=y
-CONFIG_PM_LEGACY=y
+# CONFIG_PM_LEGACY is not set
 # CONFIG_PM_DEBUG is not set
 CONFIG_APM=y
 
diff -urN linux-2.6.19-rc6/arch/arm/configs/corgi_defconfig linux-2.6.19/arch/arm/configs/corgi_defconfig
--- linux-2.6.19-rc6/arch/arm/configs/corgi_defconfig	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/arch/arm/configs/corgi_defconfig	2006-11-29 22:48:12.265090483 +0000
@@ -208,6 +208,7 @@
 # Power management options
 #
 CONFIG_PM=y
+# CONFIG_PM_LEGACY is not set
 CONFIG_APM=y
 
 #
diff -urN linux-2.6.19-rc6/arch/arm/configs/h3600_defconfig linux-2.6.19/arch/arm/configs/h3600_defconfig
--- linux-2.6.19-rc6/arch/arm/configs/h3600_defconfig	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/arch/arm/configs/h3600_defconfig	2006-11-29 22:48:12.269090917 +0000
@@ -194,6 +194,7 @@
 # Power management options
 #
 CONFIG_PM=y
+# CONFIG_PM_LEGACY is not set
 # CONFIG_APM is not set
 
 #
diff -urN linux-2.6.19-rc6/arch/arm/configs/integrator_defconfig linux-2.6.19/arch/arm/configs/integrator_defconfig
--- linux-2.6.19-rc6/arch/arm/configs/integrator_defconfig	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/arch/arm/configs/integrator_defconfig	2006-11-29 22:48:12.269090917 +0000
@@ -190,6 +190,7 @@
 # Power management options
 #
 CONFIG_PM=y
+# CONFIG_PM_LEGACY is not set
 # CONFIG_APM is not set
 
 #
diff -urN linux-2.6.19-rc6/arch/arm/configs/ixp4xx_defconfig linux-2.6.19/arch/arm/configs/ixp4xx_defconfig
--- linux-2.6.19-rc6/arch/arm/configs/ixp4xx_defconfig	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/arch/arm/configs/ixp4xx_defconfig	2006-11-29 22:48:12.277091787 +0000
@@ -206,10 +206,8 @@
 #
 # Power management options
 #
-CONFIG_PM=y
-CONFIG_PM_LEGACY=y
-# CONFIG_PM_DEBUG is not set
-CONFIG_APM=y
+# CONFIG_PM is not set
+# CONFIG_APM is not set
 
 #
 # Networking
diff -urN linux-2.6.19-rc6/arch/arm/configs/jornada720_defconfig linux-2.6.19/arch/arm/configs/jornada720_defconfig
--- linux-2.6.19-rc6/arch/arm/configs/jornada720_defconfig	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/arch/arm/configs/jornada720_defconfig	2006-11-29 22:48:12.277091787 +0000
@@ -182,6 +182,7 @@
 # Power management options
 #
 CONFIG_PM=y
+# CONFIG_PM_LEGACY is not set
 # CONFIG_APM is not set
 
 #
diff -urN linux-2.6.19-rc6/arch/arm/configs/lart_defconfig linux-2.6.19/arch/arm/configs/lart_defconfig
--- linux-2.6.19-rc6/arch/arm/configs/lart_defconfig	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/arch/arm/configs/lart_defconfig	2006-11-29 22:48:12.277091787 +0000
@@ -180,6 +180,7 @@
 # Power management options
 #
 CONFIG_PM=y
+# CONFIG_PM_LEGACY is not set
 CONFIG_APM=m
 
 #
diff -urN linux-2.6.19-rc6/arch/arm/configs/neponset_defconfig linux-2.6.19/arch/arm/configs/neponset_defconfig
--- linux-2.6.19-rc6/arch/arm/configs/neponset_defconfig	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/arch/arm/configs/neponset_defconfig	2006-11-29 22:48:12.277091787 +0000
@@ -190,6 +190,7 @@
 # Power management options
 #
 CONFIG_PM=y
+# CONFIG_PM_LEGACY is not set
 CONFIG_APM=y
 
 #
diff -urN linux-2.6.19-rc6/arch/arm/configs/omap_h2_1610_defconfig linux-2.6.19/arch/arm/configs/omap_h2_1610_defconfig
--- linux-2.6.19-rc6/arch/arm/configs/omap_h2_1610_defconfig	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/arch/arm/configs/omap_h2_1610_defconfig	2006-11-29 22:48:12.277091787 +0000
@@ -257,7 +257,7 @@
 # Power management options
 #
 CONFIG_PM=y
-CONFIG_PM_LEGACY=y
+# CONFIG_PM_LEGACY is not set
 # CONFIG_PM_DEBUG is not set
 # CONFIG_APM is not set
 
diff -urN linux-2.6.19-rc6/arch/arm/configs/s3c2410_defconfig linux-2.6.19/arch/arm/configs/s3c2410_defconfig
--- linux-2.6.19-rc6/arch/arm/configs/s3c2410_defconfig	2006-11-29 22:48:07.532576309 +0000
+++ linux-2.6.19/arch/arm/configs/s3c2410_defconfig	2006-11-29 22:48:12.277091787 +0000
@@ -258,7 +258,7 @@
 # Power management options
 #
 CONFIG_PM=y
-CONFIG_PM_LEGACY=y
+# CONFIG_PM_LEGACY is not set
 # CONFIG_PM_DEBUG is not set
 # CONFIG_PM_SYSFS_DEPRECATED is not set
 CONFIG_APM=y
diff -urN linux-2.6.19-rc6/arch/arm/configs/simpad_defconfig linux-2.6.19/arch/arm/configs/simpad_defconfig
--- linux-2.6.19-rc6/arch/arm/configs/simpad_defconfig	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/arch/arm/configs/simpad_defconfig	2006-11-29 22:48:12.277091787 +0000
@@ -180,6 +180,7 @@
 # Power management options
 #
 CONFIG_PM=y
+# CONFIG_PM_LEGACY is not set
 CONFIG_APM=y
 
 #
diff -urN linux-2.6.19-rc6/arch/arm/configs/spitz_defconfig linux-2.6.19/arch/arm/configs/spitz_defconfig
--- linux-2.6.19-rc6/arch/arm/configs/spitz_defconfig	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/arch/arm/configs/spitz_defconfig	2006-11-29 22:48:12.281092221 +0000
@@ -207,6 +207,7 @@
 # Power management options
 #
 CONFIG_PM=y
+# CONFIG_PM_LEGACY is not set
 CONFIG_APM=y
 
 #
diff -urN linux-2.6.19-rc6/arch/arm/configs/versatile_defconfig linux-2.6.19/arch/arm/configs/versatile_defconfig
--- linux-2.6.19-rc6/arch/arm/configs/versatile_defconfig	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/arch/arm/configs/versatile_defconfig	2006-11-29 22:48:12.281092221 +0000
@@ -200,7 +200,7 @@
 # Power management options
 #
 CONFIG_PM=y
-CONFIG_PM_LEGACY=y
+# CONFIG_PM_LEGACY is not set
 # CONFIG_PM_DEBUG is not set
 # CONFIG_APM is not set
 
diff -urN linux-2.6.19-rc6/arch/arm/kernel/smp.c linux-2.6.19/arch/arm/kernel/smp.c
--- linux-2.6.19-rc6/arch/arm/kernel/smp.c	2006-11-29 22:48:07.536576743 +0000
+++ linux-2.6.19/arch/arm/kernel/smp.c	2006-11-29 22:48:12.285092656 +0000
@@ -451,6 +451,7 @@
 	return smp_call_function_on_cpu(func, info, retry, wait,
 					cpu_online_map);
 }
+EXPORT_SYMBOL_GPL(smp_call_function);
 
 void show_ipi_list(struct seq_file *p)
 {
diff -urN linux-2.6.19-rc6/arch/arm/mach-ebsa110/io.c linux-2.6.19/arch/arm/mach-ebsa110/io.c
--- linux-2.6.19-rc6/arch/arm/mach-ebsa110/io.c	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/arch/arm/mach-ebsa110/io.c	2006-11-29 22:48:12.289093091 +0000
@@ -28,7 +28,7 @@
 #include <asm/io.h>
 #include <asm/page.h>
 
-static void __iomem *__isamem_convert_addr(void __iomem *addr)
+static void __iomem *__isamem_convert_addr(const volatile void __iomem *addr)
 {
 	u32 ret, a = (u32 __force) addr;
 
@@ -63,7 +63,7 @@
 /*
  * read[bwl] and write[bwl]
  */
-u8 __readb(void __iomem *addr)
+u8 __readb(const volatile void __iomem *addr)
 {
 	void __iomem *a = __isamem_convert_addr(addr);
 	u32 ret;
@@ -75,7 +75,7 @@
 	return ret;
 }
 
-u16 __readw(void __iomem *addr)
+u16 __readw(const volatile void __iomem *addr)
 {
 	void __iomem *a = __isamem_convert_addr(addr);
 
@@ -85,7 +85,7 @@
 	return __raw_readw(a);
 }
 
-u32 __readl(void __iomem *addr)
+u32 __readl(const volatile void __iomem *addr)
 {
 	void __iomem *a = __isamem_convert_addr(addr);
 	u32 ret;
diff -urN linux-2.6.19-rc6/arch/arm/mach-pnx4008/core.c linux-2.6.19/arch/arm/mach-pnx4008/core.c
--- linux-2.6.19-rc6/arch/arm/mach-pnx4008/core.c	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/arch/arm/mach-pnx4008/core.c	2006-11-29 22:48:12.317096133 +0000
@@ -133,10 +133,79 @@
 	},
 };
 
+static struct platform_device nand_flash_device = {
+	.name = "pnx4008-flash",
+	.id = -1,
+	.dev = {
+		.coherent_dma_mask = 0xFFFFFFFF,
+	},
+};
+
+/* The dmamask must be set for OHCI to work */
+static u64 ohci_dmamask = ~(u32) 0;
+
+static struct resource ohci_resources[] = {
+	{
+		.start = IO_ADDRESS(PNX4008_USB_CONFIG_BASE),
+		.end = IO_ADDRESS(PNX4008_USB_CONFIG_BASE + 0x100),
+		.flags = IORESOURCE_MEM,
+	}, {
+		.start = USB_HOST_INT,
+		.flags = IORESOURCE_IRQ,
+	},
+};
+
+static struct platform_device ohci_device = {
+	.name = "pnx4008-usb-ohci",
+	.id = -1,
+	.dev = {
+		.dma_mask = &ohci_dmamask,
+		.coherent_dma_mask = 0xffffffff,
+		},
+	.num_resources = ARRAY_SIZE(ohci_resources),
+	.resource = ohci_resources,
+};
+
+static struct platform_device sdum_device = {
+	.name = "pnx4008-sdum",
+	.id = 0,
+	.dev = {
+		.coherent_dma_mask = 0xffffffff,
+	},
+};
+
+static struct platform_device rgbfb_device = {
+	.name = "pnx4008-rgbfb",
+	.id = 0,
+	.dev = {
+		.coherent_dma_mask = 0xffffffff,
+	}
+};
+
+struct resource watchdog_resources[] = {
+	{
+		.start = PNX4008_WDOG_BASE,
+		.end = PNX4008_WDOG_BASE + SZ_4K - 1,
+		.flags = IORESOURCE_MEM,
+	},
+};
+
+static struct platform_device watchdog_device = {
+	.name = "pnx4008-watchdog",
+	.id = -1,
+	.num_resources = ARRAY_SIZE(watchdog_resources),
+	.resource = watchdog_resources,
+};
+
 static struct platform_device *devices[] __initdata = {
 	&spipnx_1,
 	&spipnx_2,
 	&serial_device,
+	&ohci_device,
+	&nand_flash_device,
+	&sdum_device,
+	&rgbfb_device,
+	&watchdog_device,
 };
 
 
diff -urN linux-2.6.19-rc6/arch/arm/mm/consistent.c linux-2.6.19/arch/arm/mm/consistent.c
--- linux-2.6.19-rc6/arch/arm/mm/consistent.c	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/arch/arm/mm/consistent.c	2006-11-29 22:48:12.333097872 +0000
@@ -476,6 +476,9 @@
 
 /*
  * Make an area consistent for devices.
+ * Note: Drivers should NOT use this function directly, as it will break
+ * platforms with CONFIG_DMABOUNCE.
+ * Use the driver DMA support - see dma-mapping.h (dma_sync_*)
  */
 void consistent_sync(void *vaddr, size_t size, int direction)
 {
diff -urN linux-2.6.19-rc6/arch/arm/oprofile/op_counter.h linux-2.6.19/arch/arm/oprofile/op_counter.h
--- linux-2.6.19-rc6/arch/arm/oprofile/op_counter.h	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/arch/arm/oprofile/op_counter.h	2006-11-29 22:48:12.337098306 +0000
@@ -10,8 +10,6 @@
 #ifndef OP_COUNTER_H
 #define OP_COUNTER_H
 
-#define OP_MAX_COUNTER 5
-
 /* Per performance monitor configuration as set via
  * oprofilefs.
  */
diff -urN linux-2.6.19-rc6/arch/i386/kernel/process.c linux-2.6.19/arch/i386/kernel/process.c
--- linux-2.6.19-rc6/arch/i386/kernel/process.c	2006-11-29 22:48:07.640588044 +0000
+++ linux-2.6.19/arch/i386/kernel/process.c	2006-11-29 22:48:12.385103522 +0000
@@ -205,7 +205,7 @@
 void cpu_idle_wait(void)
 {
 	unsigned int cpu, this_cpu = get_cpu();
-	cpumask_t map;
+	cpumask_t map, tmp = current->cpus_allowed;
 
 	set_cpus_allowed(current, cpumask_of_cpu(this_cpu));
 	put_cpu();
@@ -227,6 +227,8 @@
 		}
 		cpus_and(map, map, cpu_online_map);
 	} while (!cpus_empty(map));
+
+	set_cpus_allowed(current, tmp);
 }
 EXPORT_SYMBOL_GPL(cpu_idle_wait);
 
diff -urN linux-2.6.19-rc6/arch/i386/kernel/traps.c linux-2.6.19/arch/i386/kernel/traps.c
--- linux-2.6.19-rc6/arch/i386/kernel/traps.c	2006-11-29 22:48:07.644588479 +0000
+++ linux-2.6.19/arch/i386/kernel/traps.c	2006-11-29 22:48:12.389103957 +0000
@@ -129,15 +129,19 @@
 
 #ifdef	CONFIG_FRAME_POINTER
 	while (valid_stack_ptr(tinfo, (void *)ebp)) {
+		unsigned long new_ebp;
 		addr = *(unsigned long *)(ebp + 4);
 		ops->address(data, addr);
 		/*
 		 * break out of recursive entries (such as
-		 * end_of_stack_stop_unwind_function):
+		 * end_of_stack_stop_unwind_function). Also,
+		 * we can never allow a frame pointer to
+		 * move downwards!
 	 	 */
-		if (ebp == *(unsigned long *)ebp)
+	 	new_ebp = *(unsigned long *)ebp;
+		if (new_ebp <= ebp)
 			break;
-		ebp = *(unsigned long *)ebp;
+		ebp = new_ebp;
 	}
 #else
 	while (valid_stack_ptr(tinfo, stack)) {
diff -urN linux-2.6.19-rc6/arch/ia64/hp/sim/Kconfig linux-2.6.19/arch/ia64/hp/sim/Kconfig
--- linux-2.6.19-rc6/arch/ia64/hp/sim/Kconfig	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/arch/ia64/hp/sim/Kconfig	2006-11-29 22:48:12.401105260 +0000
@@ -13,8 +13,8 @@
 	depends on HP_SIMSERIAL
 
 config HP_SIMSCSI
-	tristate "Simulated SCSI disk"
-	depends on SCSI
+	bool "Simulated SCSI disk"
+	depends on SCSI=y
 
 endmenu
 
diff -urN linux-2.6.19-rc6/arch/ia64/hp/sim/hpsim_irq.c linux-2.6.19/arch/ia64/hp/sim/hpsim_irq.c
--- linux-2.6.19-rc6/arch/ia64/hp/sim/hpsim_irq.c	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/arch/ia64/hp/sim/hpsim_irq.c	2006-11-29 22:48:12.401105260 +0000
@@ -27,7 +27,7 @@
 }
 
 static struct hw_interrupt_type irq_type_hp_sim = {
-	.typename =	"hpsim",
+	.name =		"hpsim",
 	.startup =	hpsim_irq_startup,
 	.shutdown =	hpsim_irq_noop,
 	.enable =	hpsim_irq_noop,
diff -urN linux-2.6.19-rc6/arch/ia64/kernel/iosapic.c linux-2.6.19/arch/ia64/kernel/iosapic.c
--- linux-2.6.19-rc6/arch/ia64/kernel/iosapic.c	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/arch/ia64/kernel/iosapic.c	2006-11-29 22:48:12.405105695 +0000
@@ -426,7 +426,7 @@
 #define iosapic_ack_level_irq		nop
 
 struct hw_interrupt_type irq_type_iosapic_level = {
-	.typename =	"IO-SAPIC-level",
+	.name =		"IO-SAPIC-level",
 	.startup =	iosapic_startup_level_irq,
 	.shutdown =	iosapic_shutdown_level_irq,
 	.enable =	iosapic_enable_level_irq,
@@ -473,7 +473,7 @@
 #define iosapic_end_edge_irq		nop
 
 struct hw_interrupt_type irq_type_iosapic_edge = {
-	.typename =	"IO-SAPIC-edge",
+	.name =		"IO-SAPIC-edge",
 	.startup =	iosapic_startup_edge_irq,
 	.shutdown =	iosapic_disable_edge_irq,
 	.enable =	iosapic_enable_edge_irq,
@@ -664,7 +664,7 @@
 			printk(KERN_WARNING
 			       "%s: changing vector %d from %s to %s\n",
 			       __FUNCTION__, vector,
-			       idesc->chip->typename, irq_type->typename);
+			       idesc->chip->name, irq_type->name);
 		idesc->chip = irq_type;
 	}
 	return 0;
diff -urN linux-2.6.19-rc6/arch/ia64/kernel/irq.c linux-2.6.19/arch/ia64/kernel/irq.c
--- linux-2.6.19-rc6/arch/ia64/kernel/irq.c	2006-11-29 22:48:07.656589782 +0000
+++ linux-2.6.19/arch/ia64/kernel/irq.c	2006-11-29 22:48:12.405105695 +0000
@@ -76,7 +76,7 @@
 			seq_printf(p, "%10u ", kstat_cpu(j).irqs[i]);
 		}
 #endif
-		seq_printf(p, " %14s", irq_desc[i].chip->typename);
+		seq_printf(p, " %14s", irq_desc[i].chip->name);
 		seq_printf(p, "  %s", action->name);
 
 		for (action=action->next; action; action = action->next)
@@ -197,7 +197,7 @@
 			struct pt_regs *old_regs = set_irq_regs(NULL);
 
 			vectors_in_migration[irq]=0;
-			__do_IRQ(irq);
+			generic_handle_irq(irq);
 			set_irq_regs(old_regs);
 		}
 	}
diff -urN linux-2.6.19-rc6/arch/ia64/kernel/irq_ia64.c linux-2.6.19/arch/ia64/kernel/irq_ia64.c
--- linux-2.6.19-rc6/arch/ia64/kernel/irq_ia64.c	2006-11-29 22:48:07.660590217 +0000
+++ linux-2.6.19/arch/ia64/kernel/irq_ia64.c	2006-11-29 22:48:12.405105695 +0000
@@ -186,7 +186,7 @@
 			ia64_setreg(_IA64_REG_CR_TPR, vector);
 			ia64_srlz_d();
 
-			__do_IRQ(local_vector_to_irq(vector));
+			generic_handle_irq(local_vector_to_irq(vector));
 
 			/*
 			 * Disable interrupts and send EOI:
@@ -242,7 +242,7 @@
 			 * Probably could shared code.
 			 */
 			vectors_in_migration[local_vector_to_irq(vector)]=0;
-			__do_IRQ(local_vector_to_irq(vector));
+			generic_handle_irq(local_vector_to_irq(vector));
 			set_irq_regs(old_regs);
 
 			/*
diff -urN linux-2.6.19-rc6/arch/ia64/kernel/irq_lsapic.c linux-2.6.19/arch/ia64/kernel/irq_lsapic.c
--- linux-2.6.19-rc6/arch/ia64/kernel/irq_lsapic.c	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/arch/ia64/kernel/irq_lsapic.c	2006-11-29 22:48:12.405105695 +0000
@@ -34,7 +34,7 @@
 }
 
 struct hw_interrupt_type irq_type_ia64_lsapic = {
-	.typename =	"LSAPIC",
+	.name =		"LSAPIC",
 	.startup =	lsapic_noop_startup,
 	.shutdown =	lsapic_noop,
 	.enable =	lsapic_noop,
diff -urN linux-2.6.19-rc6/arch/ia64/sn/kernel/bte.c linux-2.6.19/arch/ia64/sn/kernel/bte.c
--- linux-2.6.19-rc6/arch/ia64/sn/kernel/bte.c	2006-11-29 22:48:07.668591086 +0000
+++ linux-2.6.19/arch/ia64/sn/kernel/bte.c	2006-11-29 22:48:12.413106564 +0000
@@ -381,14 +381,13 @@
 		 * bcopy to the destination.
 		 */
 
-		/* Add the leader from source */
-		headBteLen = len + (src & L1_CACHE_MASK);
-		/* Add the trailing bytes from footer. */
-		headBteLen += L1_CACHE_BYTES - (headBteLen & L1_CACHE_MASK);
-		headBteSource = src & ~L1_CACHE_MASK;
 		headBcopySrcOffset = src & L1_CACHE_MASK;
 		headBcopyDest = dest;
 		headBcopyLen = len;
+
+		headBteSource = src - headBcopySrcOffset;
+		/* Add the leading and trailing bytes from source */
+		headBteLen = L1_CACHE_ALIGN(len + headBcopySrcOffset);
 	}
 
 	if (headBcopyLen > 0) {
diff -urN linux-2.6.19-rc6/arch/ia64/sn/kernel/irq.c linux-2.6.19/arch/ia64/sn/kernel/irq.c
--- linux-2.6.19-rc6/arch/ia64/sn/kernel/irq.c	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/arch/ia64/sn/kernel/irq.c	2006-11-29 22:48:12.413106564 +0000
@@ -201,7 +201,7 @@
 }
 
 struct hw_interrupt_type irq_type_sn = {
-	.typename	= "SN hub",
+	.name		= "SN hub",
 	.startup	= sn_startup_irq,
 	.shutdown	= sn_shutdown_irq,
 	.enable		= sn_enable_irq,
diff -urN linux-2.6.19-rc6/arch/m68knommu/kernel/setup.c linux-2.6.19/arch/m68knommu/kernel/setup.c
--- linux-2.6.19-rc6/arch/m68knommu/kernel/setup.c	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/arch/m68knommu/kernel/setup.c	2006-11-29 22:48:12.429108303 +0000
@@ -62,7 +62,7 @@
 void (*mach_kbd_leds) (unsigned int);
 /* machine dependent irq functions */
 void (*mach_init_IRQ) (void);
-irqreturn_t (*(*mach_default_handler)[]) (int, void *, struct pt_regs *);
+irq_handler_t mach_default_handler;
 int (*mach_get_irq_list) (struct seq_file *, void *);
 void (*mach_process_int) (int irq, struct pt_regs *fp);
 void (*mach_trap_init) (void);
diff -urN linux-2.6.19-rc6/arch/m68knommu/kernel/time.c linux-2.6.19/arch/m68knommu/kernel/time.c
--- linux-2.6.19-rc6/arch/m68knommu/kernel/time.c	2006-11-29 22:48:07.684592825 +0000
+++ linux-2.6.19/arch/m68knommu/kernel/time.c	2006-11-29 22:48:12.433108738 +0000
@@ -54,7 +54,7 @@
 	update_process_times(user_mode(regs));
 #endif
 	if (current->pid)
-		profile_tick(CPU_PROFILING, regs);
+		profile_tick(CPU_PROFILING);
 
 	/*
 	 * If we have an externally synchronized Linux clock, then update
diff -urN linux-2.6.19-rc6/arch/m68knommu/platform/5307/ints.c linux-2.6.19/arch/m68knommu/platform/5307/ints.c
--- linux-2.6.19-rc6/arch/m68knommu/platform/5307/ints.c	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/arch/m68knommu/platform/5307/ints.c	2006-11-29 22:48:12.433108738 +0000
@@ -33,7 +33,7 @@
 /*
  *	This table stores the address info for each vector handler.
  */
-irq_handler_t irq_list[SYS_IRQS];
+struct irq_entry irq_list[SYS_IRQS];
 
 #define NUM_IRQ_NODES 16
 static irq_node_t nodes[NUM_IRQ_NODES];
@@ -44,7 +44,7 @@
 unsigned int local_bh_count[NR_CPUS];
 unsigned int local_irq_count[NR_CPUS];
 
-static irqreturn_t default_irq_handler(int irq, void *ptr, struct pt_regs *regs)
+static irqreturn_t default_irq_handler(int irq, void *ptr)
 {
 #if 1
 	printk(KERN_INFO "%s(%d): default irq handler vec=%d [0x%x]\n",
@@ -70,7 +70,7 @@
 
 	for (i = 0; i < SYS_IRQS; i++) {
 		if (mach_default_handler)
-			irq_list[i].handler = (*mach_default_handler)[i];
+			irq_list[i].handler = mach_default_handler;
 		else
 			irq_list[i].handler = default_irq_handler;
 		irq_list[i].flags   = IRQ_FLG_STD;
@@ -100,7 +100,7 @@
 
 int request_irq(
 	unsigned int irq,
-	irqreturn_t (*handler)(int, void *, struct pt_regs *),
+	irq_handler_t handler,
 	unsigned long flags,
 	const char *devname,
 	void *dev_id)
@@ -157,7 +157,7 @@
 	}
 
 	if (mach_default_handler)
-		irq_list[irq].handler = (*mach_default_handler)[irq];
+		irq_list[irq].handler = mach_default_handler;
 	else
 		irq_list[irq].handler = default_irq_handler;
 	irq_list[irq].flags   = IRQ_FLG_STD;
@@ -168,8 +168,7 @@
 EXPORT_SYMBOL(free_irq);
 
 
-int sys_request_irq(unsigned int irq, 
-                    irqreturn_t (*handler)(int, void *, struct pt_regs *), 
+int sys_request_irq(unsigned int irq, irq_handler_t handler, 
                     unsigned long flags, const char *devname, void *dev_id)
 {
 	if (irq > IRQ7) {
@@ -211,7 +210,7 @@
 		printk(KERN_WARNING "%s: Removing probably wrong IRQ %d from %s\n",
 		       __FUNCTION__, irq, irq_list[irq].devname);
 
-	irq_list[irq].handler = (*mach_default_handler)[irq];
+	irq_list[irq].handler = mach_default_handler;
 	irq_list[irq].flags   = 0;
 	irq_list[irq].dev_id  = NULL;
 	irq_list[irq].devname = NULL;
@@ -241,7 +240,7 @@
 	if (vec >= VEC_INT1 && vec <= VEC_INT7) {
 		vec -= VEC_SPUR;
 		kstat_cpu(0).irqs[vec]++;
-		irq_list[vec].handler(vec, irq_list[vec].dev_id, fp);
+		irq_list[vec].handler(vec, irq_list[vec].dev_id);
 	} else {
 		if (mach_process_int)
 			mach_process_int(vec, fp);
diff -urN linux-2.6.19-rc6/arch/mips/kernel/Makefile linux-2.6.19/arch/mips/kernel/Makefile
--- linux-2.6.19-rc6/arch/mips/kernel/Makefile	2006-11-29 22:48:07.740598910 +0000
+++ linux-2.6.19/arch/mips/kernel/Makefile	2006-11-29 22:48:12.485114388 +0000
@@ -6,7 +6,7 @@
 
 obj-y		+= cpu-probe.o branch.o entry.o genex.o irq.o process.o \
 		   ptrace.o reset.o semaphore.o setup.o signal.o syscall.o \
-		   time.o traps.o unaligned.o
+		   time.o topology.o traps.o unaligned.o
 
 binfmt_irix-objs	:= irixelf.o irixinv.o irixioctl.o irixsig.o	\
 			   irix5sys.o sysirix.o
diff -urN linux-2.6.19-rc6/arch/mips/kernel/smp.c linux-2.6.19/arch/mips/kernel/smp.c
--- linux-2.6.19-rc6/arch/mips/kernel/smp.c	2006-11-29 22:48:07.744599344 +0000
+++ linux-2.6.19/arch/mips/kernel/smp.c	2006-11-29 22:48:12.489114822 +0000
@@ -463,28 +463,5 @@
 	smp_on_each_tlb(flush_tlb_one_ipi, (void *) vaddr);
 }
 
-static DEFINE_PER_CPU(struct cpu, cpu_devices);
-
-static int __init topology_init(void)
-{
-	int i, ret;
-
-#ifdef CONFIG_NUMA
-	for_each_online_node(i)
-		register_one_node(i);
-#endif /* CONFIG_NUMA */
-
-	for_each_present_cpu(i) {
-		ret = register_cpu(&per_cpu(cpu_devices, i), i);
-		if (ret)
-			printk(KERN_WARNING "topology_init: register_cpu %d "
-			       "failed (%d)\n", i, ret);
-	}
-
-	return 0;
-}
-
-subsys_initcall(topology_init);
-
 EXPORT_SYMBOL(flush_tlb_page);
 EXPORT_SYMBOL(flush_tlb_one);
diff -urN linux-2.6.19-rc6/arch/mips/kernel/topology.c linux-2.6.19/arch/mips/kernel/topology.c
--- linux-2.6.19-rc6/arch/mips/kernel/topology.c	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.19/arch/mips/kernel/topology.c	2006-11-29 22:48:12.493115257 +0000
@@ -0,0 +1,29 @@
+#include <linux/cpu.h>
+#include <linux/cpumask.h>
+#include <linux/init.h>
+#include <linux/node.h>
+#include <linux/nodemask.h>
+#include <linux/percpu.h>
+
+static DEFINE_PER_CPU(struct cpu, cpu_devices);
+
+static int __init topology_init(void)
+{
+	int i, ret;
+
+#ifdef CONFIG_NUMA
+	for_each_online_node(i)
+		register_one_node(i);
+#endif /* CONFIG_NUMA */
+
+	for_each_present_cpu(i) {
+		ret = register_cpu(&per_cpu(cpu_devices, i), i);
+		if (ret)
+			printk(KERN_WARNING "topology_init: register_cpu %d "
+			       "failed (%d)\n", i, ret);
+	}
+
+	return 0;
+}
+
+subsys_initcall(topology_init);
diff -urN linux-2.6.19-rc6/arch/mips/mips-boards/malta/malta_setup.c linux-2.6.19/arch/mips/mips-boards/malta/malta_setup.c
--- linux-2.6.19-rc6/arch/mips/mips-boards/malta/malta_setup.c	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/arch/mips/mips-boards/malta/malta_setup.c	2006-11-29 22:48:12.497115692 +0000
@@ -159,7 +159,7 @@
 				BONITO_PCIMEMBASECFG |=
 					(BONITO_PCIMEMBASECFG_MEMBASE0_CACHED |
 					 BONITO_PCIMEMBASECFG_MEMBASE1_CACHED);
-				printk("Disabled Bonito IOBC coherency\n");
+				printk("Enabled Bonito IOBC coherency\n");
 			}
 		}
 		else
diff -urN linux-2.6.19-rc6/arch/mips/mm/c-sb1.c linux-2.6.19/arch/mips/mm/c-sb1.c
--- linux-2.6.19-rc6/arch/mips/mm/c-sb1.c	2006-11-29 22:48:07.752600214 +0000
+++ linux-2.6.19/arch/mips/mm/c-sb1.c	2006-11-29 22:48:12.497115692 +0000
@@ -19,6 +19,7 @@
  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  */
 #include <linux/init.h>
+#include <linux/hardirq.h>
 
 #include <asm/asm.h>
 #include <asm/bootinfo.h>
@@ -242,6 +243,25 @@
 	__attribute__((alias("local_sb1_flush_cache_page")));
 #endif
 
+#ifdef CONFIG_SMP
+static void sb1_flush_cache_data_page_ipi(void *info)
+{
+	unsigned long start = (unsigned long)info;
+
+	__sb1_writeback_inv_dcache_range(start, start + PAGE_SIZE);
+}
+
+static void sb1_flush_cache_data_page(unsigned long addr)
+{
+	if (in_atomic())
+		__sb1_writeback_inv_dcache_range(addr, addr + PAGE_SIZE);
+	else
+		on_each_cpu(sb1_flush_cache_data_page_ipi, (void *) addr, 1, 1);
+}
+#else
+void sb1_flush_cache_data_page(unsigned long)
+	__attribute__((alias("local_sb1_flush_cache_data_page")));
+#endif
 
 /*
  * Invalidate all caches on this CPU
@@ -481,7 +501,7 @@
 
 	flush_cache_sigtramp = sb1_flush_cache_sigtramp;
 	local_flush_data_cache_page = (void *) sb1_nop;
-	flush_data_cache_page = (void *) sb1_nop;
+	flush_data_cache_page = sb1_flush_cache_data_page;
 
 	/* Full flush */
 	__flush_cache_all = sb1___flush_cache_all;
diff -urN linux-2.6.19-rc6/arch/powerpc/kernel/time.c linux-2.6.19/arch/powerpc/kernel/time.c
--- linux-2.6.19-rc6/arch/powerpc/kernel/time.c	2006-11-29 22:48:07.808606299 +0000
+++ linux-2.6.19/arch/powerpc/kernel/time.c	2006-11-29 22:48:12.553121777 +0000
@@ -1014,48 +1014,6 @@
 	set_dec(tb_ticks_per_jiffy);
 }
 
-#ifdef CONFIG_RTC_CLASS
-static int set_rtc_class_time(struct rtc_time *tm)
-{
-	int err;
-	struct class_device *class_dev =
-		rtc_class_open(CONFIG_RTC_HCTOSYS_DEVICE);
-
-	if (class_dev == NULL)
-		return -ENODEV;
-
-	err = rtc_set_time(class_dev, tm);
-
-	rtc_class_close(class_dev);
-
-	return 0;
-}
-
-static void get_rtc_class_time(struct rtc_time *tm)
-{
-	int err;
-	struct class_device *class_dev =
-		rtc_class_open(CONFIG_RTC_HCTOSYS_DEVICE);
-
-	if (class_dev == NULL)
-		return;
-
-	err = rtc_read_time(class_dev, tm);
-
-	rtc_class_close(class_dev);
-
-	return;
-}
-
-int __init rtc_class_hookup(void)
-{
-	ppc_md.get_rtc_time = get_rtc_class_time;
-	ppc_md.set_rtc_time = set_rtc_class_time;
-
-	return 0;
-}
-#endif /* CONFIG_RTC_CLASS */
-
 
 #define FEBRUARY	2
 #define	STARTOFTIME	1970
diff -urN linux-2.6.19-rc6/arch/powerpc/platforms/83xx/mpc832x_mds.c linux-2.6.19/arch/powerpc/platforms/83xx/mpc832x_mds.c
--- linux-2.6.19-rc6/arch/powerpc/platforms/83xx/mpc832x_mds.c	2006-11-29 22:48:07.816607168 +0000
+++ linux-2.6.19/arch/powerpc/platforms/83xx/mpc832x_mds.c	2006-11-29 22:48:12.561122646 +0000
@@ -24,6 +24,7 @@
 #include <linux/root_dev.h>
 #include <linux/initrd.h>
 
+#include <asm/of_device.h>
 #include <asm/system.h>
 #include <asm/atomic.h>
 #include <asm/time.h>
@@ -136,6 +137,24 @@
 #endif
 }
 
+static int __init mpc832x_declare_of_platform_devices(void)
+{
+	struct device_node *np;
+
+	for (np = NULL; (np = of_find_compatible_node(np, "network",
+					"ucc_geth")) != NULL;) {
+		int ucc_num;
+		char bus_id[BUS_ID_SIZE];
+
+		ucc_num = *((uint *) get_property(np, "device-id", NULL)) - 1;
+		snprintf(bus_id, BUS_ID_SIZE, "ucc_geth.%u", ucc_num);
+		of_platform_device_create(np, bus_id, NULL);
+	}
+
+	return 0;
+}
+device_initcall(mpc832x_declare_of_platform_devices);
+
 void __init mpc832x_sys_init_IRQ(void)
 {
 
diff -urN linux-2.6.19-rc6/arch/powerpc/platforms/83xx/mpc834x_itx.c linux-2.6.19/arch/powerpc/platforms/83xx/mpc834x_itx.c
--- linux-2.6.19-rc6/arch/powerpc/platforms/83xx/mpc834x_itx.c	2006-11-29 22:48:07.816607168 +0000
+++ linux-2.6.19/arch/powerpc/platforms/83xx/mpc834x_itx.c	2006-11-29 22:48:12.561122646 +0000
@@ -108,10 +108,6 @@
 	return 1;
 }
 
-#ifdef CONFIG_RTC_CLASS
-late_initcall(rtc_class_hookup);
-#endif
-
 define_machine(mpc834x_itx) {
 	.name			= "MPC834x ITX",
 	.probe			= mpc834x_itx_probe,
diff -urN linux-2.6.19-rc6/arch/um/include/os.h linux-2.6.19/arch/um/include/os.h
--- linux-2.6.19-rc6/arch/um/include/os.h	2006-11-29 22:48:07.996626726 +0000
+++ linux-2.6.19/arch/um/include/os.h	2006-11-29 22:48:12.789147420 +0000
@@ -233,6 +233,8 @@
 				    void (*op)(void *to, const void *from,
 					       int n), int *faulted_out);
 
+/* execvp.c */
+extern int execvp_noalloc(char *buf, const char *file, char *const argv[]);
 /* helper.c */
 extern int run_helper(void (*pre_exec)(void *), void *pre_data, char **argv,
 		      unsigned long *stack_out);
diff -urN linux-2.6.19-rc6/arch/um/os-Linux/Makefile linux-2.6.19/arch/um/os-Linux/Makefile
--- linux-2.6.19-rc6/arch/um/os-Linux/Makefile	2006-11-29 22:48:08.004627596 +0000
+++ linux-2.6.19/arch/um/os-Linux/Makefile	2006-11-29 22:48:12.797148289 +0000
@@ -3,8 +3,8 @@
 # Licensed under the GPL
 #
 
-obj-y = aio.o elf_aux.o file.o helper.o irq.o main.o mem.o process.o sigio.o \
-	signal.o start_up.o time.o trap.o tty.o uaccess.o umid.o tls.o \
+obj-y = aio.o elf_aux.o execvp.o file.o helper.o irq.o main.o mem.o process.o \
+	sigio.o signal.o start_up.o time.o trap.o tty.o uaccess.o umid.o tls.o \
 	user_syms.o util.o drivers/ sys-$(SUBARCH)/
 
 obj-$(CONFIG_MODE_SKAS) += skas/
@@ -15,9 +15,9 @@
 obj-$(CONFIG_TTY_LOG) += tty_log.o
 user-objs-$(CONFIG_TTY_LOG) += tty_log.o
 
-USER_OBJS := $(user-objs-y) aio.o elf_aux.o file.o helper.o irq.o main.o mem.o \
-	process.o sigio.o signal.o start_up.o time.o trap.o tty.o tls.o \
-	uaccess.o umid.o util.o
+USER_OBJS := $(user-objs-y) aio.o elf_aux.o execvp.o file.o helper.o irq.o \
+	main.o mem.o process.o sigio.o signal.o start_up.o time.o trap.o tty.o \
+	tls.o uaccess.o umid.o util.o
 
 CFLAGS_user_syms.o += -DSUBARCH_$(SUBARCH)
 
diff -urN linux-2.6.19-rc6/arch/um/os-Linux/execvp.c linux-2.6.19/arch/um/os-Linux/execvp.c
--- linux-2.6.19-rc6/arch/um/os-Linux/execvp.c	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.19/arch/um/os-Linux/execvp.c	2006-11-29 22:48:12.801148724 +0000
@@ -0,0 +1,149 @@
+/* Copyright (C) 2006 by Paolo Giarrusso - modified from glibc' execvp.c.
+   Original copyright notice follows:
+
+   Copyright (C) 1991,92,1995-99,2002,2004 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, write to the Free
+   Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
+   02111-1307 USA.  */
+#include <unistd.h>
+
+#include <stdbool.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <limits.h>
+
+#ifndef TEST
+#include "um_malloc.h"
+#else
+#include <stdio.h>
+#define um_kmalloc malloc
+#endif
+#include "os.h"
+
+/* Execute FILE, searching in the `PATH' environment variable if it contains
+   no slashes, with arguments ARGV and environment from `environ'.  */
+int execvp_noalloc(char *buf, const char *file, char *const argv[])
+{
+	if (*file == '\0') {
+		return -ENOENT;
+	}
+
+	if (strchr (file, '/') != NULL) {
+		/* Don't search when it contains a slash.  */
+		execv(file, argv);
+	} else {
+		int got_eacces;
+		size_t len, pathlen;
+		char *name, *p;
+		char *path = getenv("PATH");
+		if (path == NULL)
+			path = ":/bin:/usr/bin";
+
+		len = strlen(file) + 1;
+		pathlen = strlen(path);
+		/* Copy the file name at the top.  */
+		name = memcpy(buf + pathlen + 1, file, len);
+		/* And add the slash.  */
+		*--name = '/';
+
+		got_eacces = 0;
+		p = path;
+		do {
+			char *startp;
+
+			path = p;
+			//Let's avoid this GNU extension.
+			//p = strchrnul (path, ':');
+			p = strchr(path, ':');
+			if (!p)
+				p = strchr(path, '\0');
+
+			if (p == path)
+				/* Two adjacent colons, or a colon at the beginning or the end
+				   of `PATH' means to search the current directory.  */
+				startp = name + 1;
+			else
+				startp = memcpy(name - (p - path), path, p - path);
+
+			/* Try to execute this name.  If it works, execv will not return.  */
+			execv(startp, argv);
+
+			/*
+			if (errno == ENOEXEC) {
+			}
+			*/
+
+			switch (errno) {
+				case EACCES:
+					/* Record the we got a `Permission denied' error.  If we end
+					   up finding no executable we can use, we want to diagnose
+					   that we did find one but were denied access.  */
+					got_eacces = 1;
+				case ENOENT:
+				case ESTALE:
+				case ENOTDIR:
+					/* Those errors indicate the file is missing or not executable
+					   by us, in which case we want to just try the next path
+					   directory.  */
+				case ENODEV:
+				case ETIMEDOUT:
+					/* Some strange filesystems like AFS return even
+					   stranger error numbers.  They cannot reasonably mean
+					   anything else so ignore those, too.  */
+				case ENOEXEC:
+					/* We won't go searching for the shell
+					 * if it is not executable - the Linux
+					 * kernel already handles this enough,
+					 * for us. */
+					break;
+
+				default:
+					/* Some other error means we found an executable file, but
+					   something went wrong executing it; return the error to our
+					   caller.  */
+					return -errno;
+			}
+		} while (*p++ != '\0');
+
+		/* We tried every element and none of them worked.  */
+		if (got_eacces)
+			/* At least one failure was due to permissions, so report that
+			   error.  */
+			return -EACCES;
+	}
+
+	/* Return the error from the last attempt (probably ENOENT).  */
+	return -errno;
+}
+#ifdef TEST
+int main(int argc, char**argv)
+{
+	char buf[PATH_MAX];
+	int ret;
+	argc--;
+	if (!argc) {
+		fprintf(stderr, "Not enough arguments\n");
+		return 1;
+	}
+	argv++;
+	if (ret = execvp_noalloc(buf, argv[0], argv)) {
+		errno = -ret;
+		perror("execvp_noalloc");
+	}
+	return 0;
+}
+#endif
diff -urN linux-2.6.19-rc6/arch/um/os-Linux/helper.c linux-2.6.19/arch/um/os-Linux/helper.c
--- linux-2.6.19-rc6/arch/um/os-Linux/helper.c	2006-11-29 22:48:08.008628030 +0000
+++ linux-2.6.19/arch/um/os-Linux/helper.c	2006-11-29 22:48:12.801148724 +0000
@@ -8,18 +8,21 @@
 #include <unistd.h>
 #include <errno.h>
 #include <sched.h>
+#include <limits.h>
 #include <sys/signal.h>
 #include <sys/wait.h>
 #include "user.h"
 #include "kern_util.h"
 #include "user_util.h"
 #include "os.h"
+#include "um_malloc.h"
 
 struct helper_data {
 	void (*pre_exec)(void*);
 	void *pre_data;
 	char **argv;
 	int fd;
+	char *buf;
 };
 
 /* Debugging aid, changed only from gdb */
@@ -41,9 +44,8 @@
 	}
 	if (data->pre_exec != NULL)
 		(*data->pre_exec)(data->pre_data);
-	execvp(argv[0], argv);
-	errval = -errno;
-	printk("helper_child - execve of '%s' failed - errno = %d\n", argv[0], errno);
+	errval = execvp_noalloc(data->buf, argv[0], argv);
+	printk("helper_child - execvp of '%s' failed - errno = %d\n", argv[0], -errval);
 	os_write_file(data->fd, &errval, sizeof(errval));
 	kill(os_getpid(), SIGKILL);
 	return 0;
@@ -84,11 +86,13 @@
 	data.pre_data = pre_data;
 	data.argv = argv;
 	data.fd = fds[1];
+	data.buf = __cant_sleep() ? um_kmalloc_atomic(PATH_MAX) :
+					um_kmalloc(PATH_MAX);
 	pid = clone(helper_child, (void *) sp, CLONE_VM | SIGCHLD, &data);
 	if (pid < 0) {
 		ret = -errno;
 		printk("run_helper : clone failed, errno = %d\n", errno);
-		goto out_close;
+		goto out_free2;
 	}
 
 	close(fds[1]);
@@ -109,6 +113,8 @@
 		CATCH_EINTR(waitpid(pid, NULL, 0));
 	}
 
+out_free2:
+	kfree(data.buf);
 out_close:
 	if (fds[1] != -1)
 		close(fds[1]);
diff -urN linux-2.6.19-rc6/arch/x86_64/Makefile linux-2.6.19/arch/x86_64/Makefile
--- linux-2.6.19-rc6/arch/x86_64/Makefile	2006-11-29 22:48:08.012628465 +0000
+++ linux-2.6.19/arch/x86_64/Makefile	2006-11-29 22:48:12.805149159 +0000
@@ -66,8 +66,8 @@
 cflags-y += $(call as-instr,.cfi_startproc\n.cfi_signal_frame\n.cfi_endproc,-DCONFIG_AS_CFI_SIGNAL_FRAME=1,)
 AFLAGS += $(call as-instr,.cfi_startproc\n.cfi_signal_frame\n.cfi_endproc,-DCONFIG_AS_CFI_SIGNAL_FRAME=1,)
 
-cflags-$(CONFIG_CC_STACKPROTECTOR) += $(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-x86_64-has-stack-protector.sh $(CC) -fstack-protector )
-cflags-$(CONFIG_CC_STACKPROTECTOR_ALL) += $(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-x86_64-has-stack-protector.sh $(CC) -fstack-protector-all )
+cflags-$(CONFIG_CC_STACKPROTECTOR) += $(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-x86_64-has-stack-protector.sh "$(CC)" -fstack-protector )
+cflags-$(CONFIG_CC_STACKPROTECTOR_ALL) += $(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-x86_64-has-stack-protector.sh "$(CC)" -fstack-protector-all )
 
 CFLAGS += $(cflags-y)
 CFLAGS_KERNEL += $(cflags-kernel-y)
diff -urN linux-2.6.19-rc6/arch/x86_64/kernel/early_printk.c linux-2.6.19/arch/x86_64/kernel/early_printk.c
--- linux-2.6.19-rc6/arch/x86_64/kernel/early_printk.c	2006-11-29 22:48:08.020629334 +0000
+++ linux-2.6.19/arch/x86_64/kernel/early_printk.c	2006-11-29 22:48:12.813150028 +0000
@@ -224,7 +224,7 @@
 		return 0;
 	early_console_initialized = 1;
 
-	if (!strcmp(buf,"keep"))
+	if (strstr(buf, "keep"))
 		keep_early = 1;
 
 	if (!strncmp(buf, "serial", 6)) {
diff -urN linux-2.6.19-rc6/arch/x86_64/kernel/io_apic.c linux-2.6.19/arch/x86_64/kernel/io_apic.c
--- linux-2.6.19-rc6/arch/x86_64/kernel/io_apic.c	2006-11-29 22:48:08.024629769 +0000
+++ linux-2.6.19/arch/x86_64/kernel/io_apic.c	2006-11-29 22:48:12.817150463 +0000
@@ -754,10 +754,8 @@
 {
 	/* Initialize vector_irq on a new cpu */
 	/* This function must be called with vector_lock held */
-	unsigned long flags;
 	int irq, vector;
 
-
 	/* Mark the inuse vectors */
 	for (irq = 0; irq < NR_IRQ_VECTORS; ++irq) {
 		if (!cpu_isset(cpu, irq_domain[irq]))
diff -urN linux-2.6.19-rc6/arch/x86_64/kernel/process.c linux-2.6.19/arch/x86_64/kernel/process.c
--- linux-2.6.19-rc6/arch/x86_64/kernel/process.c	2006-11-29 22:48:08.028630204 +0000
+++ linux-2.6.19/arch/x86_64/kernel/process.c	2006-11-29 22:48:12.821150897 +0000
@@ -144,7 +144,7 @@
 void cpu_idle_wait(void)
 {
 	unsigned int cpu, this_cpu = get_cpu();
-	cpumask_t map;
+	cpumask_t map, tmp = current->cpus_allowed;
 
 	set_cpus_allowed(current, cpumask_of_cpu(this_cpu));
 	put_cpu();
@@ -167,6 +167,8 @@
 		}
 		cpus_and(map, map, cpu_online_map);
 	} while (!cpus_empty(map));
+
+	set_cpus_allowed(current, tmp);
 }
 EXPORT_SYMBOL_GPL(cpu_idle_wait);
 
diff -urN linux-2.6.19-rc6/arch/x86_64/kernel/traps.c linux-2.6.19/arch/x86_64/kernel/traps.c
--- linux-2.6.19-rc6/arch/x86_64/kernel/traps.c	2006-11-29 22:48:08.032630638 +0000
+++ linux-2.6.19/arch/x86_64/kernel/traps.c	2006-11-29 22:48:12.825151332 +0000
@@ -242,12 +242,19 @@
  * severe exception (double fault, nmi, stack fault, debug, mce) hardware stack
  */
 
+static inline int valid_stack_ptr(struct thread_info *tinfo, void *p)
+{
+	void *t = (void *)tinfo;
+        return p > t && p < t + THREAD_SIZE - 3;
+}
+
 void dump_trace(struct task_struct *tsk, struct pt_regs *regs, unsigned long * stack,
 		struct stacktrace_ops *ops, void *data)
 {
 	const unsigned cpu = smp_processor_id();
 	unsigned long *irqstack_end = (unsigned long *)cpu_pda(cpu)->irqstackptr;
 	unsigned used = 0;
+	struct thread_info *tinfo;
 
 	if (!tsk)
 		tsk = current;
@@ -290,6 +297,12 @@
 		if (tsk && tsk != current)
 			stack = (unsigned long *)tsk->thread.rsp;
 	}
+	/*
+	 * Align the stack pointer on word boundary, later loops
+	 * rely on that (and corruption / debug info bugs can cause
+	 * unaligned values here):
+	 */
+	stack = (unsigned long *)((unsigned long)stack & ~(sizeof(long)-1));
 
 	/*
 	 * Print function call entries within a stack. 'cond' is the
@@ -364,7 +377,8 @@
 	/*
 	 * This handles the process stack:
 	 */
-	HANDLE_STACK (((long) stack & (THREAD_SIZE-1)) != 0);
+	tinfo = current_thread_info();
+	HANDLE_STACK (valid_stack_ptr(tinfo, stack));
 #undef HANDLE_STACK
 }
 EXPORT_SYMBOL(dump_trace);
diff -urN linux-2.6.19-rc6/arch/x86_64/kernel/vmlinux.lds.S linux-2.6.19/arch/x86_64/kernel/vmlinux.lds.S
--- linux-2.6.19-rc6/arch/x86_64/kernel/vmlinux.lds.S	2006-11-29 22:48:08.032630638 +0000
+++ linux-2.6.19/arch/x86_64/kernel/vmlinux.lds.S	2006-11-29 22:48:12.825151332 +0000
@@ -60,6 +60,7 @@
   }
 #endif
 
+  . = ALIGN(PAGE_SIZE);        /* Align data segment to page size boundary */
 				/* Data */
   .data : AT(ADDR(.data) - LOAD_OFFSET) {
 	*(.data)
diff -urN linux-2.6.19-rc6/arch/x86_64/kernel/vsyscall.c linux-2.6.19/arch/x86_64/kernel/vsyscall.c
--- linux-2.6.19-rc6/arch/x86_64/kernel/vsyscall.c	2006-11-29 22:48:08.032630638 +0000
+++ linux-2.6.19/arch/x86_64/kernel/vsyscall.c	2006-11-29 22:48:12.825151332 +0000
@@ -274,6 +274,7 @@
 	vsyscall_set_cpu(raw_smp_processor_id());
 }
 
+#ifdef CONFIG_HOTPLUG_CPU
 static int __cpuinit
 cpu_vsyscall_notifier(struct notifier_block *n, unsigned long action, void *arg)
 {
@@ -282,6 +283,7 @@
 		smp_call_function_single(cpu, cpu_vsyscall_init, NULL, 0, 1);
 	return NOTIFY_DONE;
 }
+#endif
 
 static void __init map_vsyscall(void)
 {
diff -urN linux-2.6.19-rc6/arch/x86_64/mm/init.c linux-2.6.19/arch/x86_64/mm/init.c
--- linux-2.6.19-rc6/arch/x86_64/mm/init.c	2006-11-29 22:48:08.036631073 +0000
+++ linux-2.6.19/arch/x86_64/mm/init.c	2006-11-29 22:48:12.829151766 +0000
@@ -496,7 +496,7 @@
 }
 EXPORT_SYMBOL_GPL(remove_memory);
 
-#ifndef CONFIG_ACPI_NUMA
+#if !defined(CONFIG_ACPI_NUMA) && defined(CONFIG_NUMA)
 int memory_add_physaddr_to_nid(u64 start)
 {
 	return 0;
@@ -504,13 +504,6 @@
 EXPORT_SYMBOL_GPL(memory_add_physaddr_to_nid);
 #endif
 
-#ifndef CONFIG_ACPI_NUMA
-int memory_add_physaddr_to_nid(u64 start)
-{
-	return 0;
-}
-#endif
-
 #endif /* CONFIG_MEMORY_HOTPLUG */
 
 #ifdef CONFIG_MEMORY_HOTPLUG_RESERVE
diff -urN linux-2.6.19-rc6/block/scsi_ioctl.c linux-2.6.19/block/scsi_ioctl.c
--- linux-2.6.19-rc6/block/scsi_ioctl.c	2006-11-29 22:48:08.048632377 +0000
+++ linux-2.6.19/block/scsi_ioctl.c	2006-11-29 22:48:12.841153070 +0000
@@ -286,9 +286,8 @@
 	 * fill in request structure
 	 */
 	rq->cmd_len = hdr->cmd_len;
+	memset(rq->cmd, 0, BLK_MAX_CDB); /* ATAPI hates garbage after CDB */
 	memcpy(rq->cmd, cmd, hdr->cmd_len);
-	if (sizeof(rq->cmd) != hdr->cmd_len)
-		memset(rq->cmd + hdr->cmd_len, 0, sizeof(rq->cmd) - hdr->cmd_len);
 
 	memset(sense, 0, sizeof(sense));
 	rq->sense = sense;
diff -urN linux-2.6.19-rc6/drivers/acpi/osl.c linux-2.6.19/drivers/acpi/osl.c
--- linux-2.6.19-rc6/drivers/acpi/osl.c	2006-11-29 22:48:08.064634115 +0000
+++ linux-2.6.19/drivers/acpi/osl.c	2006-11-29 22:48:12.857154809 +0000
@@ -73,7 +73,6 @@
 static acpi_osd_handler acpi_irq_handler;
 static void *acpi_irq_context;
 static struct workqueue_struct *kacpid_wq;
-static struct workqueue_struct *kacpi_notify_wq;
 
 acpi_status acpi_os_initialize(void)
 {
@@ -92,9 +91,8 @@
 		return AE_NULL_ENTRY;
 	}
 	kacpid_wq = create_singlethread_workqueue("kacpid");
-	kacpi_notify_wq = create_singlethread_workqueue("kacpi_notify");
 	BUG_ON(!kacpid_wq);
-	BUG_ON(!kacpi_notify_wq);
+
 	return AE_OK;
 }
 
@@ -106,7 +104,6 @@
 	}
 
 	destroy_workqueue(kacpid_wq);
-	destroy_workqueue(kacpi_notify_wq);
 
 	return AE_OK;
 }
@@ -569,7 +566,10 @@
 
 static void acpi_os_execute_deferred(void *context)
 {
-	struct acpi_os_dpc *dpc = (struct acpi_os_dpc *)context;
+	struct acpi_os_dpc *dpc = NULL;
+
+
+	dpc = (struct acpi_os_dpc *)context;
 	if (!dpc) {
 		printk(KERN_ERR PREFIX "Invalid (NULL) context\n");
 		return;
@@ -604,12 +604,14 @@
 	struct acpi_os_dpc *dpc;
 	struct work_struct *task;
 
+	ACPI_FUNCTION_TRACE("os_queue_for_execution");
+
 	ACPI_DEBUG_PRINT((ACPI_DB_EXEC,
 			  "Scheduling function [%p(%p)] for deferred execution.\n",
 			  function, context));
 
 	if (!function)
-		return AE_BAD_PARAMETER;
+		return_ACPI_STATUS(AE_BAD_PARAMETER);
 
 	/*
 	 * Allocate/initialize DPC structure.  Note that this memory will be
@@ -622,20 +624,26 @@
 	 * from the same memory.
 	 */
 
-	dpc = kmalloc(sizeof(struct acpi_os_dpc) +
-			sizeof(struct work_struct), GFP_ATOMIC);
+	dpc =
+	    kmalloc(sizeof(struct acpi_os_dpc) + sizeof(struct work_struct),
+		    GFP_ATOMIC);
 	if (!dpc)
-		return AE_NO_MEMORY;
+		return_ACPI_STATUS(AE_NO_MEMORY);
+
 	dpc->function = function;
 	dpc->context = context;
+
 	task = (void *)(dpc + 1);
 	INIT_WORK(task, acpi_os_execute_deferred, (void *)dpc);
-	if (!queue_work((type == OSL_NOTIFY_HANDLER)?
-			kacpi_notify_wq : kacpid_wq, task)) {
-		status = AE_ERROR;
+
+	if (!queue_work(kacpid_wq, task)) {
+		ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+				  "Call to queue_work() failed.\n"));
 		kfree(dpc);
+		status = AE_ERROR;
 	}
-	return status;
+
+	return_ACPI_STATUS(status);
 }
 
 EXPORT_SYMBOL(acpi_os_execute);
diff -urN linux-2.6.19-rc6/drivers/acpi/processor_perflib.c linux-2.6.19/drivers/acpi/processor_perflib.c
--- linux-2.6.19-rc6/drivers/acpi/processor_perflib.c	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/drivers/acpi/processor_perflib.c	2006-11-29 22:48:12.857154809 +0000
@@ -83,10 +83,8 @@
 		goto out;
 
 	ppc = (unsigned int)pr->performance_platform_limit;
-	if (!ppc)
-		goto out;
 
-	if (ppc > pr->performance->state_count)
+	if (ppc >= pr->performance->state_count)
 		goto out;
 
 	cpufreq_verify_within_limits(policy, 0,
diff -urN linux-2.6.19-rc6/drivers/ata/ahci.c linux-2.6.19/drivers/ata/ahci.c
--- linux-2.6.19-rc6/drivers/ata/ahci.c	2006-11-29 22:48:08.068634550 +0000
+++ linux-2.6.19/drivers/ata/ahci.c	2006-11-29 22:48:12.861155244 +0000
@@ -314,6 +314,17 @@
 	{ PCI_VDEVICE(INTEL, 0x2824), board_ahci }, /* ICH8 */
 	{ PCI_VDEVICE(INTEL, 0x2829), board_ahci }, /* ICH8M */
 	{ PCI_VDEVICE(INTEL, 0x282a), board_ahci }, /* ICH8M */
+	{ PCI_VDEVICE(INTEL, 0x2922), board_ahci }, /* ICH9 */
+	{ PCI_VDEVICE(INTEL, 0x2923), board_ahci }, /* ICH9 */
+	{ PCI_VDEVICE(INTEL, 0x2924), board_ahci }, /* ICH9 */
+	{ PCI_VDEVICE(INTEL, 0x2925), board_ahci }, /* ICH9 */
+	{ PCI_VDEVICE(INTEL, 0x2927), board_ahci }, /* ICH9 */
+	{ PCI_VDEVICE(INTEL, 0x2929), board_ahci }, /* ICH9M */
+	{ PCI_VDEVICE(INTEL, 0x292a), board_ahci }, /* ICH9M */
+	{ PCI_VDEVICE(INTEL, 0x292b), board_ahci }, /* ICH9M */
+	{ PCI_VDEVICE(INTEL, 0x292f), board_ahci }, /* ICH9M */
+	{ PCI_VDEVICE(INTEL, 0x294d), board_ahci }, /* ICH9 */
+	{ PCI_VDEVICE(INTEL, 0x294e), board_ahci }, /* ICH9M */
 
 	/* JMicron */
 	{ PCI_VDEVICE(JMICRON, 0x2360), board_ahci }, /* JMicron JMB360 */
diff -urN linux-2.6.19-rc6/drivers/ata/libata-scsi.c linux-2.6.19/drivers/ata/libata-scsi.c
--- linux-2.6.19-rc6/drivers/ata/libata-scsi.c	2006-11-29 22:48:08.076635419 +0000
+++ linux-2.6.19/drivers/ata/libata-scsi.c	2006-11-29 22:48:12.869156113 +0000
@@ -1451,6 +1451,7 @@
 
 static void ata_scsi_qc_complete(struct ata_queued_cmd *qc)
 {
+	struct ata_port *ap = qc->ap;
 	struct scsi_cmnd *cmd = qc->scsicmd;
 	u8 *cdb = cmd->cmnd;
  	int need_sense = (qc->err_mask != 0);
@@ -1459,11 +1460,12 @@
 	 * schedule EH_REVALIDATE operation to update the IDENTIFY DEVICE
 	 * cache
 	 */
-	if (!need_sense && (qc->tf.command == ATA_CMD_SET_FEATURES) &&
+	if (ap->ops->error_handler &&
+	    !need_sense && (qc->tf.command == ATA_CMD_SET_FEATURES) &&
 	    ((qc->tf.feature == SETFEATURES_WC_ON) ||
 	     (qc->tf.feature == SETFEATURES_WC_OFF))) {
-		qc->ap->eh_info.action |= ATA_EH_REVALIDATE;
-		ata_port_schedule_eh(qc->ap);
+		ap->eh_info.action |= ATA_EH_REVALIDATE;
+		ata_port_schedule_eh(ap);
 	}
 
 	/* For ATA pass thru (SAT) commands, generate a sense block if
@@ -1490,8 +1492,8 @@
 		}
 	}
 
-	if (need_sense && !qc->ap->ops->error_handler)
-		ata_dump_status(qc->ap->id, &qc->result_tf);
+	if (need_sense && !ap->ops->error_handler)
+		ata_dump_status(ap->id, &qc->result_tf);
 
 	qc->scsidone(cmd);
 
@@ -3345,20 +3347,23 @@
  *	@ap:	ATA port to which the command is being sent
  *
  *	RETURNS:
- *	Zero.
+ *	Return value from __ata_scsi_queuecmd() if @cmd can be queued,
+ *	0 otherwise.
  */
 
 int ata_sas_queuecmd(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *),
 		     struct ata_port *ap)
 {
+	int rc = 0;
+
 	ata_scsi_dump_cdb(ap, cmd);
 
 	if (likely(ata_scsi_dev_enabled(ap->device)))
-		__ata_scsi_queuecmd(cmd, done, ap->device);
+		rc = __ata_scsi_queuecmd(cmd, done, ap->device);
 	else {
 		cmd->result = (DID_BAD_TARGET << 16);
 		done(cmd);
 	}
-	return 0;
+	return rc;
 }
 EXPORT_SYMBOL_GPL(ata_sas_queuecmd);
diff -urN linux-2.6.19-rc6/drivers/base/core.c linux-2.6.19/drivers/base/core.c
--- linux-2.6.19-rc6/drivers/base/core.c	2006-11-29 22:48:08.112639331 +0000
+++ linux-2.6.19/drivers/base/core.c	2006-11-29 22:48:12.905160025 +0000
@@ -591,8 +591,10 @@
 
 	if (parent)
 		klist_del(&dev->knode_parent);
-	if (dev->devt_attr)
+	if (dev->devt_attr) {
 		device_remove_file(dev, dev->devt_attr);
+		kfree(dev->devt_attr);
+	}
 	if (dev->class) {
 		sysfs_remove_link(&dev->kobj, "subsystem");
 		sysfs_remove_link(&dev->class->subsys.kset.kobj, dev->bus_id);
diff -urN linux-2.6.19-rc6/drivers/block/aoe/aoeblk.c linux-2.6.19/drivers/block/aoe/aoeblk.c
--- linux-2.6.19-rc6/drivers/block/aoe/aoeblk.c	2006-11-29 22:48:08.120640200 +0000
+++ linux-2.6.19/drivers/block/aoe/aoeblk.c	2006-11-29 22:48:12.913160894 +0000
@@ -68,6 +68,7 @@
 	&disk_attr_mac.attr,
 	&disk_attr_netif.attr,
 	&disk_attr_fwver.attr,
+	NULL
 };
 
 static const struct attribute_group attr_group = {
diff -urN linux-2.6.19-rc6/drivers/char/agp/generic.c linux-2.6.19/drivers/char/agp/generic.c
--- linux-2.6.19-rc6/drivers/char/agp/generic.c	2006-11-29 22:48:08.144642808 +0000
+++ linux-2.6.19/drivers/char/agp/generic.c	2006-11-29 22:48:12.933163067 +0000
@@ -1054,7 +1054,7 @@
 {
 	struct page * page;
 
-	page = alloc_page(GFP_KERNEL);
+	page = alloc_page(GFP_KERNEL | GFP_DMA32);
 	if (page == NULL)
 		return NULL;
 
diff -urN linux-2.6.19-rc6/drivers/char/agp/intel-agp.c linux-2.6.19/drivers/char/agp/intel-agp.c
--- linux-2.6.19-rc6/drivers/char/agp/intel-agp.c	2006-11-29 22:48:08.144642808 +0000
+++ linux-2.6.19/drivers/char/agp/intel-agp.c	2006-11-29 22:48:12.937163502 +0000
@@ -169,7 +169,7 @@
 {
 	struct page * page;
 
-	page = alloc_pages(GFP_KERNEL, 2);
+	page = alloc_pages(GFP_KERNEL | GFP_DMA32, 2);
 	if (page == NULL)
 		return NULL;
 
@@ -387,11 +387,7 @@
 	/* We obtain the size of the GTT, which is also stored (for some
 	 * reason) at the top of stolen memory. Then we add 4KB to that
 	 * for the video BIOS popup, which is also stored in there. */
-
-	if (IS_I965)
-		size = 512 + 4;
-	else
-		size = agp_bridge->driver->fetch_size() + 4;
+	size = agp_bridge->driver->fetch_size() + 4;
 
 	if (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82830_HB ||
 	    agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82845G_HB) {
@@ -805,6 +801,26 @@
 
 	return 0;
 }
+
+/*
+ * The i965 supports 36-bit physical addresses, but to keep
+ * the format of the GTT the same, the bits that don't fit
+ * in a 32-bit word are shifted down to bits 4..7.
+ *
+ * Gcc is smart enough to notice that "(addr >> 28) & 0xf0"
+ * is always zero on 32-bit architectures, so no need to make
+ * this conditional.
+ */
+static unsigned long intel_i965_mask_memory(struct agp_bridge_data *bridge,
+	unsigned long addr, int type)
+{
+	/* Shift high bits down */
+	addr |= (addr >> 28) & 0xf0;
+
+	/* Type checking must be done elsewhere */
+	return addr | bridge->driver->masks[type].mask;
+}
+
 static int intel_i965_fetch_size(void)
 {
        struct aper_size_info_fixed *values;
@@ -832,7 +848,8 @@
 
        agp_bridge->previous_size = agp_bridge->current_size = (void *)(values + offset);
 
-       return values[offset].size;
+	/* The i965 GTT is always sized as if it had a 512kB aperture size */
+	return 512;
 }
 
 /* The intel i965 automatically initializes the agp aperture during POST.
@@ -1584,7 +1601,7 @@
        .fetch_size             = intel_i965_fetch_size,
        .cleanup                = intel_i915_cleanup,
        .tlb_flush              = intel_i810_tlbflush,
-       .mask_memory            = intel_i810_mask_memory,
+       .mask_memory            = intel_i965_mask_memory,
        .masks                  = intel_i810_masks,
        .agp_enable             = intel_i810_agp_enable,
        .cache_flush            = global_cache_flush,
diff -urN linux-2.6.19-rc6/drivers/char/ftape/zftape/zftape-buffers.c linux-2.6.19/drivers/char/ftape/zftape/zftape-buffers.c
--- linux-2.6.19-rc6/drivers/char/ftape/zftape/zftape-buffers.c	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/drivers/char/ftape/zftape/zftape-buffers.c	2006-11-29 22:48:12.957165675 +0000
@@ -85,7 +85,7 @@
 		peak_memory = used_memory;
 	}
 	TRACE_ABORT(0, ft_t_noise,
-		    "allocated buffer @ %p, %d bytes", *(void **)new, size);
+		    "allocated buffer @ %p, %zd bytes", *(void **)new, size);
 }
 int zft_vmalloc_always(void *new, size_t size)
 {
@@ -101,7 +101,7 @@
 	if (*(void **)old) {
 		vfree(*(void **)old);
 		used_memory -= size;
-		TRACE(ft_t_noise, "released buffer @ %p, %d bytes",
+		TRACE(ft_t_noise, "released buffer @ %p, %zd bytes",
 		      *(void **)old, size);
 		*(void **)old = NULL;
 	}
diff -urN linux-2.6.19-rc6/drivers/char/ipmi/ipmi_msghandler.c linux-2.6.19/drivers/char/ipmi/ipmi_msghandler.c
--- linux-2.6.19-rc6/drivers/char/ipmi/ipmi_msghandler.c	2006-11-29 22:48:08.172645850 +0000
+++ linux-2.6.19/drivers/char/ipmi/ipmi_msghandler.c	2006-11-29 22:48:12.965166544 +0000
@@ -2118,7 +2118,7 @@
 		dev_set_drvdata(&bmc->dev->dev, bmc);
 		kref_init(&bmc->refcount);
 
-		rv = platform_device_register(bmc->dev);
+		rv = platform_device_add(bmc->dev);
 		mutex_unlock(&ipmidriver_mutex);
 		if (rv) {
 			printk(KERN_ERR
diff -urN linux-2.6.19-rc6/drivers/char/ipmi/ipmi_si_intf.c linux-2.6.19/drivers/char/ipmi/ipmi_si_intf.c
--- linux-2.6.19-rc6/drivers/char/ipmi/ipmi_si_intf.c	2006-11-29 22:48:08.172645850 +0000
+++ linux-2.6.19/drivers/char/ipmi/ipmi_si_intf.c	2006-11-29 22:48:12.965166544 +0000
@@ -2346,7 +2346,7 @@
 		new_smi->dev = &new_smi->pdev->dev;
 		new_smi->dev->driver = &ipmi_driver;
 
-		rv = platform_device_register(new_smi->pdev);
+		rv = platform_device_add(new_smi->pdev);
 		if (rv) {
 			printk(KERN_ERR
 			       "ipmi_si_intf:"
diff -urN linux-2.6.19-rc6/drivers/char/tlclk.c linux-2.6.19/drivers/char/tlclk.c
--- linux-2.6.19-rc6/drivers/char/tlclk.c	2006-11-29 22:48:08.204649328 +0000
+++ linux-2.6.19/drivers/char/tlclk.c	2006-11-29 22:48:12.993169587 +0000
@@ -792,15 +792,14 @@
 	ret = misc_register(&tlclk_miscdev);
 	if (ret < 0) {
 		printk(KERN_ERR "tlclk: misc_register returns %d.\n", ret);
-		ret = -EBUSY;
 		goto out3;
 	}
 
 	tlclk_device = platform_device_register_simple("telco_clock",
 				-1, NULL, 0);
-	if (!tlclk_device) {
+	if (IS_ERR(tlclk_device)) {
 		printk(KERN_ERR "tlclk: platform_device_register failed.\n");
-		ret = -EBUSY;
+		ret = PTR_ERR(tlclk_device);
 		goto out4;
 	}
 
diff -urN linux-2.6.19-rc6/drivers/cpufreq/Kconfig linux-2.6.19/drivers/cpufreq/Kconfig
--- linux-2.6.19-rc6/drivers/cpufreq/Kconfig	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/drivers/cpufreq/Kconfig	2006-11-29 22:48:13.013171760 +0000
@@ -107,6 +107,7 @@
 
 config CPU_FREQ_GOV_ONDEMAND
 	tristate "'ondemand' cpufreq policy governor"
+	select CPU_FREQ_TABLE
 	help
 	  'ondemand' - This driver adds a dynamic cpufreq policy governor.
 	  The governor does a periodic polling and 
diff -urN linux-2.6.19-rc6/drivers/cpufreq/cpufreq.c linux-2.6.19/drivers/cpufreq/cpufreq.c
--- linux-2.6.19-rc6/drivers/cpufreq/cpufreq.c	2006-11-29 22:48:08.224651501 +0000
+++ linux-2.6.19/drivers/cpufreq/cpufreq.c	2006-11-29 22:48:13.013171760 +0000
@@ -59,7 +59,7 @@
 	srcu_init_notifier_head(&cpufreq_transition_notifier_list);
 	return 0;
 }
-core_initcall(init_cpufreq_transition_notifier_list);
+pure_initcall(init_cpufreq_transition_notifier_list);
 
 static LIST_HEAD(cpufreq_governor_list);
 static DEFINE_MUTEX (cpufreq_governor_mutex);
diff -urN linux-2.6.19-rc6/drivers/firmware/dell_rbu.c linux-2.6.19/drivers/firmware/dell_rbu.c
--- linux-2.6.19-rc6/drivers/firmware/dell_rbu.c	2006-11-29 22:48:08.228651935 +0000
+++ linux-2.6.19/drivers/firmware/dell_rbu.c	2006-11-29 22:48:13.017172194 +0000
@@ -705,17 +705,16 @@
 
 static int __init dcdrbu_init(void)
 {
-	int rc = 0;
+	int rc;
 	spin_lock_init(&rbu_data.lock);
 
 	init_packet_head();
-	rbu_device =
-		platform_device_register_simple("dell_rbu", -1, NULL, 0);
-	if (!rbu_device) {
+	rbu_device = platform_device_register_simple("dell_rbu", -1, NULL, 0);
+	if (IS_ERR(rbu_device)) {
 		printk(KERN_ERR
 			"dell_rbu:%s:platform_device_register_simple "
 			"failed\n", __FUNCTION__);
-		return -EIO;
+		return PTR_ERR(rbu_device);
 	}
 
 	rc = sysfs_create_bin_file(&rbu_device->dev.kobj, &rbu_data_attr);
diff -urN linux-2.6.19-rc6/drivers/i2c/busses/i2c-ixp4xx.c linux-2.6.19/drivers/i2c/busses/i2c-ixp4xx.c
--- linux-2.6.19-rc6/drivers/i2c/busses/i2c-ixp4xx.c	2006-11-29 22:48:08.252654543 +0000
+++ linux-2.6.19/drivers/i2c/busses/i2c-ixp4xx.c	2006-11-29 22:48:13.045175237 +0000
@@ -137,7 +137,8 @@
 	gpio_line_set(gpio->scl_pin, 0);
 	gpio_line_set(gpio->sda_pin, 0);
 
-	if ((err = i2c_bit_add_bus(&drv_data->adapter) != 0)) {
+	err = i2c_bit_add_bus(&drv_data->adapter);
+	if (err) {
 		printk(KERN_ERR "ERROR: Could not install %s\n", plat_dev->dev.bus_id);
 
 		kfree(drv_data);
diff -urN linux-2.6.19-rc6/drivers/i2c/busses/scx200_acb.c linux-2.6.19/drivers/i2c/busses/scx200_acb.c
--- linux-2.6.19-rc6/drivers/i2c/busses/scx200_acb.c	2006-11-29 22:48:08.256654978 +0000
+++ linux-2.6.19/drivers/i2c/busses/scx200_acb.c	2006-11-29 22:48:13.049175671 +0000
@@ -494,11 +494,12 @@
 	iface->pdev = pdev;
 	iface->bar = bar;
 
-	pci_enable_device_bars(iface->pdev, 1 << iface->bar);
+	rc = pci_enable_device_bars(iface->pdev, 1 << iface->bar);
+	if (rc)
+		goto errout_free;
 
 	rc = pci_request_region(iface->pdev, iface->bar, iface->adapter.name);
-
-	if (rc != 0) {
+	if (rc) {
 		printk(KERN_ERR NAME ": can't allocate PCI BAR %d\n",
 				iface->bar);
 		goto errout_free;
diff -urN linux-2.6.19-rc6/drivers/ide/pci/sgiioc4.c linux-2.6.19/drivers/ide/pci/sgiioc4.c
--- linux-2.6.19-rc6/drivers/ide/pci/sgiioc4.c	2006-11-29 22:48:08.272656716 +0000
+++ linux-2.6.19/drivers/ide/pci/sgiioc4.c	2006-11-29 22:48:13.065177410 +0000
@@ -768,14 +768,7 @@
 	return ioc4_register_submodule(&ioc4_ide_submodule);
 }
 
-static void __devexit
-ioc4_ide_exit(void)
-{
-	ioc4_unregister_submodule(&ioc4_ide_submodule);
-}
-
 late_initcall(ioc4_ide_init); /* Call only after IDE init is done */
-module_exit(ioc4_ide_exit);
 
 MODULE_AUTHOR("Aniket Malatpure/Jeremy Higdon");
 MODULE_DESCRIPTION("IDE PCI driver module for SGI IOC4 Base-IO Card");
diff -urN linux-2.6.19-rc6/drivers/infiniband/hw/ipath/Kconfig linux-2.6.19/drivers/infiniband/hw/ipath/Kconfig
--- linux-2.6.19-rc6/drivers/infiniband/hw/ipath/Kconfig	2006-11-29 22:48:08.316661497 +0000
+++ linux-2.6.19/drivers/infiniband/hw/ipath/Kconfig	2006-11-29 22:48:13.109182191 +0000
@@ -1,6 +1,6 @@
 config INFINIBAND_IPATH
 	tristate "QLogic InfiniPath Driver"
-	depends on PCI_MSI && 64BIT && INFINIBAND
+	depends on (PCI_MSI || HT_IRQ) && 64BIT && INFINIBAND && NET
 	---help---
 	This is a driver for QLogic InfiniPath host channel adapters,
 	including InfiniBand verbs support.  This driver allows these
diff -urN linux-2.6.19-rc6/drivers/infiniband/hw/ipath/Makefile linux-2.6.19/drivers/infiniband/hw/ipath/Makefile
--- linux-2.6.19-rc6/drivers/infiniband/hw/ipath/Makefile	2006-11-29 22:48:08.316661497 +0000
+++ linux-2.6.19/drivers/infiniband/hw/ipath/Makefile	2006-11-29 22:48:13.109182191 +0000
@@ -10,8 +10,6 @@
 	ipath_eeprom.o \
 	ipath_file_ops.o \
 	ipath_fs.o \
-	ipath_iba6110.o \
-	ipath_iba6120.o \
 	ipath_init_chip.o \
 	ipath_intr.o \
 	ipath_keys.o \
@@ -31,5 +29,8 @@
 	ipath_verbs_mcast.o \
 	ipath_verbs.o
 
+ib_ipath-$(CONFIG_HT_IRQ) += ipath_iba6110.o
+ib_ipath-$(CONFIG_PCI_MSI) += ipath_iba6120.o
+
 ib_ipath-$(CONFIG_X86_64) += ipath_wc_x86_64.o
 ib_ipath-$(CONFIG_PPC64) += ipath_wc_ppc64.o
diff -urN linux-2.6.19-rc6/drivers/infiniband/hw/ipath/ipath_driver.c linux-2.6.19/drivers/infiniband/hw/ipath/ipath_driver.c
--- linux-2.6.19-rc6/drivers/infiniband/hw/ipath/ipath_driver.c	2006-11-29 22:48:08.320661932 +0000
+++ linux-2.6.19/drivers/infiniband/hw/ipath/ipath_driver.c	2006-11-29 22:48:13.109182191 +0000
@@ -390,12 +390,16 @@
 
 	/* setup the chip-specific functions, as early as possible. */
 	switch (ent->device) {
+#ifdef CONFIG_HT_IRQ
 	case PCI_DEVICE_ID_INFINIPATH_HT:
 		ipath_init_iba6110_funcs(dd);
 		break;
+#endif
+#ifdef CONFIG_PCI_MSI
 	case PCI_DEVICE_ID_INFINIPATH_PE800:
 		ipath_init_iba6120_funcs(dd);
 		break;
+#endif
 	default:
 		ipath_dev_err(dd, "Found unknown QLogic deviceid 0x%x, "
 			      "failing\n", ent->device);
diff -urN linux-2.6.19-rc6/drivers/infiniband/ulp/ipoib/ipoib_main.c linux-2.6.19/drivers/infiniband/ulp/ipoib/ipoib_main.c
--- linux-2.6.19-rc6/drivers/infiniband/ulp/ipoib/ipoib_main.c	2006-11-29 22:48:08.344664540 +0000
+++ linux-2.6.19/drivers/infiniband/ulp/ipoib/ipoib_main.c	2006-11-29 22:48:13.137185233 +0000
@@ -49,6 +49,8 @@
 
 #include <net/dst.h>
 
+#define IPOIB_QPN(ha) (be32_to_cpup((__be32 *) ha) & 0xffffff)
+
 MODULE_AUTHOR("Roland Dreier");
 MODULE_DESCRIPTION("IP-over-InfiniBand net driver");
 MODULE_LICENSE("Dual BSD/GPL");
@@ -520,8 +522,7 @@
 		memcpy(&neigh->dgid.raw, &path->pathrec.dgid.raw,
 		       sizeof(union ib_gid));
 
-		ipoib_send(dev, skb, path->ah,
-			   be32_to_cpup((__be32 *) skb->dst->neighbour->ha));
+		ipoib_send(dev, skb, path->ah, IPOIB_QPN(skb->dst->neighbour->ha));
 	} else {
 		neigh->ah  = NULL;
 		__skb_queue_tail(&neigh->queue, skb);
@@ -599,8 +600,7 @@
 		ipoib_dbg(priv, "Send unicast ARP to %04x\n",
 			  be16_to_cpu(path->pathrec.dlid));
 
-		ipoib_send(dev, skb, path->ah,
-			   be32_to_cpup((__be32 *) phdr->hwaddr));
+		ipoib_send(dev, skb, path->ah, IPOIB_QPN(phdr->hwaddr));
 	} else if ((path->query || !path_rec_start(dev, path)) &&
 		   skb_queue_len(&path->queue) < IPOIB_MAX_PATH_REC_QUEUE) {
 		/* put pseudoheader back on for next time */
@@ -661,8 +661,7 @@
 				goto out;
 			}
 
-			ipoib_send(dev, skb, neigh->ah,
-				   be32_to_cpup((__be32 *) skb->dst->neighbour->ha));
+			ipoib_send(dev, skb, neigh->ah, IPOIB_QPN(skb->dst->neighbour->ha));
 			goto out;
 		}
 
@@ -694,7 +693,7 @@
 					   IPOIB_GID_FMT "\n",
 					   skb->dst ? "neigh" : "dst",
 					   be16_to_cpup((__be16 *) skb->data),
-					   be32_to_cpup((__be32 *) phdr->hwaddr),
+					   IPOIB_QPN(phdr->hwaddr),
 					   IPOIB_GID_RAW_ARG(phdr->hwaddr + 4));
 				dev_kfree_skb_any(skb);
 				++priv->stats.tx_dropped;
@@ -777,7 +776,7 @@
 
 	ipoib_dbg(priv,
 		  "neigh_destructor for %06x " IPOIB_GID_FMT "\n",
-		  be32_to_cpup((__be32 *) n->ha),
+		  IPOIB_QPN(n->ha),
 		  IPOIB_GID_RAW_ARG(n->ha + 4));
 
 	spin_lock_irqsave(&priv->lock, flags);
diff -urN linux-2.6.19-rc6/drivers/input/keyboard/lkkbd.c linux-2.6.19/drivers/input/keyboard/lkkbd.c
--- linux-2.6.19-rc6/drivers/input/keyboard/lkkbd.c	2006-11-29 22:48:08.356665844 +0000
+++ linux-2.6.19/drivers/input/keyboard/lkkbd.c	2006-11-29 22:48:13.145186103 +0000
@@ -59,11 +59,6 @@
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
- *
- * Should you need to contact me, the author, you can do so either by
- * email or by paper mail:
- * Jan-Benedict Glaw, Lilienstraße 16, 33790 Hörste (near Halle/Westf.),
- * Germany.
  */
 
 #include <linux/delay.h>
diff -urN linux-2.6.19-rc6/drivers/isdn/hisax/Kconfig linux-2.6.19/drivers/isdn/hisax/Kconfig
--- linux-2.6.19-rc6/drivers/isdn/hisax/Kconfig	2006-11-29 22:48:08.372667582 +0000
+++ linux-2.6.19/drivers/isdn/hisax/Kconfig	2006-11-29 22:48:13.165188276 +0000
@@ -344,7 +344,7 @@
 
 config HISAX_ENTERNOW_PCI
 	bool "Formula-n enter:now PCI card"
-	depends on PCI && (BROKEN || !(SPARC || PPC || PARISC || M68K || FRV))
+	depends on HISAX_NETJET && PCI && (BROKEN || !(SPARC || PPC || PARISC || M68K || FRV))
 	help
 	  This enables HiSax support for the Formula-n enter:now PCI
 	  ISDN card.
diff -urN linux-2.6.19-rc6/drivers/media/dvb/dvb-core/dvb_frontend.c linux-2.6.19/drivers/media/dvb/dvb-core/dvb_frontend.c
--- linux-2.6.19-rc6/drivers/media/dvb/dvb-core/dvb_frontend.c	2006-11-29 22:48:08.416672363 +0000
+++ linux-2.6.19/drivers/media/dvb/dvb-core/dvb_frontend.c	2006-11-29 22:48:13.209193057 +0000
@@ -348,7 +348,7 @@
 
 static void dvb_frontend_swzigzag(struct dvb_frontend *fe)
 {
-	fe_status_t s;
+	fe_status_t s = 0;
 	struct dvb_frontend_private *fepriv = fe->frontend_priv;
 
 	/* if we've got no parameters, just keep idling */
diff -urN linux-2.6.19-rc6/drivers/media/dvb/frontends/tda10086.c linux-2.6.19/drivers/media/dvb/frontends/tda10086.c
--- linux-2.6.19-rc6/drivers/media/dvb/frontends/tda10086.c	2006-11-29 22:48:08.436674536 +0000
+++ linux-2.6.19/drivers/media/dvb/frontends/tda10086.c	2006-11-29 22:48:13.229195230 +0000
@@ -441,6 +441,10 @@
 
 	dprintk ("%s\n", __FUNCTION__);
 
+	// check for invalid symbol rate
+	if (fe_params->u.qpsk.symbol_rate < 500000)
+		return -EINVAL;
+
 	// calculate the updated frequency (note: we convert from Hz->kHz)
 	tmp64 = tda10086_read_byte(state, 0x52);
 	tmp64 |= (tda10086_read_byte(state, 0x51) << 8);
diff -urN linux-2.6.19-rc6/drivers/media/dvb/ttpci/budget.c linux-2.6.19/drivers/media/dvb/ttpci/budget.c
--- linux-2.6.19-rc6/drivers/media/dvb/ttpci/budget.c	2006-11-29 22:48:08.444675406 +0000
+++ linux-2.6.19/drivers/media/dvb/ttpci/budget.c	2006-11-29 22:48:13.237196099 +0000
@@ -46,6 +46,10 @@
 #include "lnbp21.h"
 #include "bsru6.h"
 
+static int diseqc_method;
+module_param(diseqc_method, int, 0444);
+MODULE_PARM_DESC(diseqc_method, "Select DiSEqC method for subsystem id 13c2:1003, 0: default, 1: more reliable (for newer revisions only)");
+
 static void Set22K (struct budget *budget, int state)
 {
 	struct saa7146_dev *dev=budget->dev;
@@ -382,6 +386,11 @@
 		if (budget->dvb_frontend) {
 			budget->dvb_frontend->ops.tuner_ops.set_params = alps_bsru6_tuner_set_params;
 			budget->dvb_frontend->tuner_priv = &budget->i2c_adap;
+			if (budget->dev->pci->subsystem_device == 0x1003 && diseqc_method == 0) {
+				budget->dvb_frontend->ops.diseqc_send_master_cmd = budget_diseqc_send_master_cmd;
+				budget->dvb_frontend->ops.diseqc_send_burst = budget_diseqc_send_burst;
+				budget->dvb_frontend->ops.set_tone = budget_set_tone;
+			}
 			break;
 		}
 		break;
diff -urN linux-2.6.19-rc6/drivers/media/video/et61x251/et61x251_core.c linux-2.6.19/drivers/media/video/et61x251/et61x251_core.c
--- linux-2.6.19-rc6/drivers/media/video/et61x251/et61x251_core.c	2006-11-29 22:48:08.464677579 +0000
+++ linux-2.6.19/drivers/media/video/et61x251/et61x251_core.c	2006-11-29 22:48:13.253197838 +0000
@@ -1182,8 +1182,6 @@
 	video_set_drvdata(cam->v4ldev, NULL);
 	video_unregister_device(cam->v4ldev);
 
-	usb_put_dev(cam->usbdev);
-
 	mutex_unlock(&et61x251_sysfs_lock);
 
 	kfree(cam->control_buffer);
@@ -1275,6 +1273,7 @@
 
 	if (cam->state & DEV_DISCONNECTED) {
 		et61x251_release_resources(cam);
+		usb_put_dev(cam->usbdev);
 		mutex_unlock(&cam->dev_mutex);
 		kfree(cam);
 		return 0;
diff -urN linux-2.6.19-rc6/drivers/media/video/saa6588.c linux-2.6.19/drivers/media/video/saa6588.c
--- linux-2.6.19-rc6/drivers/media/video/saa6588.c	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/drivers/media/video/saa6588.c	2006-11-29 22:48:13.265199142 +0000
@@ -212,8 +212,10 @@
 	if (rd_blocks > s->block_count)
 		rd_blocks = s->block_count;
 
-	if (!rd_blocks)
+	if (!rd_blocks) {
+		spin_unlock_irqrestore(&s->lock, flags);
 		return;
+	}
 
 	for (i = 0; i < rd_blocks; i++) {
 		if (block_to_user_buf(s, buf_ptr)) {
diff -urN linux-2.6.19-rc6/drivers/media/video/saa7115.c linux-2.6.19/drivers/media/video/saa7115.c
--- linux-2.6.19-rc6/drivers/media/video/saa7115.c	2006-11-29 22:48:08.476678883 +0000
+++ linux-2.6.19/drivers/media/video/saa7115.c	2006-11-29 22:48:13.265199142 +0000
@@ -1464,8 +1464,6 @@
 	client->driver = &i2c_driver_saa711x;
 	snprintf(client->name, sizeof(client->name) - 1, "saa7115");
 
-	v4l_dbg(1, debug, client, "detecting saa7115 client on address 0x%x\n", address << 1);
-
 	for (i=0;i<0x0f;i++) {
 		saa711x_write(client, 0, i);
 		name[i] = (saa711x_read(client, 0) &0x0f) +'0';
@@ -1477,6 +1475,13 @@
 	saa711x_write(client, 0, 5);
 	chip_id = saa711x_read(client, 0) & 0x0f;
 
+	/* Check whether this chip is part of the saa711x series */
+	if (memcmp(name, "1f711", 5)) {
+		v4l_dbg(1, debug, client, "chip found @ 0x%x (ID %s) does not match a known saa711x chip.\n",
+			address << 1, name);
+		return 0;
+	}
+
 	snprintf(client->name, sizeof(client->name) - 1, "saa711%d",chip_id);
 	v4l_info(client, "saa711%d found (%s) @ 0x%x (%s)\n", chip_id, name, address << 1, adapter->name);
 
diff -urN linux-2.6.19-rc6/drivers/media/video/sn9c102/sn9c102_core.c linux-2.6.19/drivers/media/video/sn9c102/sn9c102_core.c
--- linux-2.6.19-rc6/drivers/media/video/sn9c102/sn9c102_core.c	2006-11-29 22:48:08.480679317 +0000
+++ linux-2.6.19/drivers/media/video/sn9c102/sn9c102_core.c	2006-11-29 22:48:13.273200011 +0000
@@ -1462,8 +1462,6 @@
 	video_set_drvdata(cam->v4ldev, NULL);
 	video_unregister_device(cam->v4ldev);
 
-	usb_put_dev(cam->usbdev);
-
 	mutex_unlock(&sn9c102_sysfs_lock);
 
 	kfree(cam->control_buffer);
@@ -1555,6 +1553,7 @@
 
 	if (cam->state & DEV_DISCONNECTED) {
 		sn9c102_release_resources(cam);
+		usb_put_dev(cam->usbdev);
 		mutex_unlock(&cam->dev_mutex);
 		kfree(cam);
 		return 0;
diff -urN linux-2.6.19-rc6/drivers/mtd/chips/cfi_cmdset_0001.c linux-2.6.19/drivers/mtd/chips/cfi_cmdset_0001.c
--- linux-2.6.19-rc6/drivers/mtd/chips/cfi_cmdset_0001.c	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/drivers/mtd/chips/cfi_cmdset_0001.c	2006-11-29 22:48:13.301203053 +0000
@@ -1087,7 +1087,7 @@
 		}
 		spin_lock(chip->mutex);
 
-		if (chip->state != chip_state) {
+		while (chip->state != chip_state) {
 			/* Someone's suspended the operation: sleep */
 			DECLARE_WAITQUEUE(wait, current);
 			set_current_state(TASK_UNINTERRUPTIBLE);
diff -urN linux-2.6.19-rc6/drivers/net/hamradio/6pack.c linux-2.6.19/drivers/net/hamradio/6pack.c
--- linux-2.6.19-rc6/drivers/net/hamradio/6pack.c	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/drivers/net/hamradio/6pack.c	2006-11-29 22:48:13.425216527 +0000
@@ -914,7 +914,7 @@
 					printk(KERN_DEBUG "6pack: protocol violation\n");
 				else
 					sp->status = 0;
-				cmd &= !SIXP_RX_DCD_MASK;
+				cmd &= ~SIXP_RX_DCD_MASK;
 		}
 		sp->status = cmd & SIXP_PRIO_DATA_MASK;
 	} else { /* output watchdog char if idle */
diff -urN linux-2.6.19-rc6/drivers/net/r8169.c linux-2.6.19/drivers/net/r8169.c
--- linux-2.6.19-rc6/drivers/net/r8169.c	2006-11-29 22:48:08.700703222 +0000
+++ linux-2.6.19/drivers/net/r8169.c	2006-11-29 22:48:13.489223481 +0000
@@ -1473,8 +1473,8 @@
 	struct rtl8169_private *tp;
 	struct net_device *dev;
 	void __iomem *ioaddr;
-	unsigned int i, pm_cap;
-	int rc;
+	unsigned int pm_cap;
+	int i, rc;
 
 	if (netif_msg_drv(&debug)) {
 		printk(KERN_INFO "%s Gigabit Ethernet driver %s loaded\n",
diff -urN linux-2.6.19-rc6/drivers/net/tg3.c linux-2.6.19/drivers/net/tg3.c
--- linux-2.6.19-rc6/drivers/net/tg3.c	2006-11-29 22:48:08.740707569 +0000
+++ linux-2.6.19/drivers/net/tg3.c	2006-11-29 22:48:13.529227828 +0000
@@ -68,8 +68,8 @@
 
 #define DRV_MODULE_NAME		"tg3"
 #define PFX DRV_MODULE_NAME	": "
-#define DRV_MODULE_VERSION	"3.68"
-#define DRV_MODULE_RELDATE	"November 02, 2006"
+#define DRV_MODULE_VERSION	"3.69"
+#define DRV_MODULE_RELDATE	"November 15, 2006"
 
 #define TG3_DEF_MAC_MODE	0
 #define TG3_DEF_RX_MODE		0
@@ -4728,10 +4728,11 @@
 	u32 val;
 
 	if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906) {
-		for (i = 0; i < 400; i++) {
+		/* Wait up to 20ms for init done. */
+		for (i = 0; i < 200; i++) {
 			if (tr32(VCPU_STATUS) & VCPU_STATUS_INIT_DONE)
 				return 0;
-			udelay(10);
+			udelay(100);
 		}
 		return -ENODEV;
 	}
@@ -6978,8 +6979,10 @@
 	tg3_full_lock(tp, 0);
 
 	err = tg3_set_power_state(tp, PCI_D0);
-	if (err)
+	if (err) {
+		tg3_full_unlock(tp);
 		return err;
+	}
 
 	tg3_disable_ints(tp);
 	tp->tg3_flags &= ~TG3_FLAG_INIT_COMPLETE;
@@ -10365,7 +10368,7 @@
 	u32 pci_state_reg, grc_misc_cfg;
 	u32 val;
 	u16 pci_cmd;
-	int err;
+	int err, pcie_cap;
 
 	/* Force memory write invalidate off.  If we leave it on,
 	 * then on 5700_BX chips we have to enable a workaround.
@@ -10540,8 +10543,19 @@
 	    GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5906)
 		tp->tg3_flags2 |= TG3_FLG2_JUMBO_CAPABLE;
 
-	if (pci_find_capability(tp->pdev, PCI_CAP_ID_EXP) != 0)
+	pcie_cap = pci_find_capability(tp->pdev, PCI_CAP_ID_EXP);
+	if (pcie_cap != 0) {
 		tp->tg3_flags2 |= TG3_FLG2_PCI_EXPRESS;
+		if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906) {
+			u16 lnkctl;
+
+			pci_read_config_word(tp->pdev,
+					     pcie_cap + PCI_EXP_LNKCTL,
+					     &lnkctl);
+			if (lnkctl & PCI_EXP_LNKCTL_CLKREQ_EN)
+				tp->tg3_flags2 &= ~TG3_FLG2_HW_TSO_2;
+		}
+	}
 
 	/* If we have an AMD 762 or VIA K8T800 chipset, write
 	 * reordering to the mailbox registers done by the host
@@ -11808,6 +11822,7 @@
 	else if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5700 ||
 	    GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5701 ||
 	    tp->pci_chip_rev_id == CHIPREV_ID_5705_A0 ||
+	    GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906 ||
 	    (tp->tg3_flags & TG3_FLAG_ENABLE_ASF) != 0) {
 		tp->tg3_flags2 &= ~TG3_FLG2_TSO_CAPABLE;
 	} else {
diff -urN linux-2.6.19-rc6/drivers/parport/parport_ip32.c linux-2.6.19/drivers/parport/parport_ip32.c
--- linux-2.6.19-rc6/drivers/parport/parport_ip32.c	2006-11-29 22:48:08.832717565 +0000
+++ linux-2.6.19/drivers/parport/parport_ip32.c	2006-11-29 22:48:13.625238259 +0000
@@ -780,7 +780,7 @@
 	enum parport_ip32_irq_mode irq_mode = priv->irq_mode;
 	switch (irq_mode) {
 	case PARPORT_IP32_IRQ_FWD:
-		parport_generic_irq(irq, p, regs);
+		parport_generic_irq(irq, p);
 		break;
 	case PARPORT_IP32_IRQ_HERE:
 		parport_ip32_wakeup(p);
diff -urN linux-2.6.19-rc6/drivers/pcmcia/ds.c linux-2.6.19/drivers/pcmcia/ds.c
--- linux-2.6.19-rc6/drivers/pcmcia/ds.c	2006-11-29 22:48:08.856720173 +0000
+++ linux-2.6.19/drivers/pcmcia/ds.c	2006-11-29 22:48:13.645240432 +0000
@@ -1271,6 +1271,11 @@
 	socket->pcmcia_state.dead = 1;
 	pccard_register_pcmcia(socket, NULL);
 
+	/* unregister any unbound devices */
+	mutex_lock(&socket->skt_mutex);
+	pcmcia_card_remove(socket, NULL);
+	mutex_unlock(&socket->skt_mutex);
+
 	pcmcia_put_socket(socket);
 
 	return;
diff -urN linux-2.6.19-rc6/drivers/rtc/interface.c linux-2.6.19/drivers/rtc/interface.c
--- linux-2.6.19-rc6/drivers/rtc/interface.c	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/drivers/rtc/interface.c	2006-11-29 22:48:13.653241301 +0000
@@ -145,6 +145,13 @@
 }
 EXPORT_SYMBOL_GPL(rtc_set_alarm);
 
+/**
+ * rtc_update_irq - report RTC periodic, alarm, and/or update irqs
+ * @class_dev: the rtc's class device
+ * @num: how many irqs are being reported (usually one)
+ * @events: mask of RTC_IRQF with one or more of RTC_PF, RTC_AF, RTC_UF
+ * Context: in_interrupt(), irqs blocked
+ */
 void rtc_update_irq(struct class_device *class_dev,
 		unsigned long num, unsigned long events)
 {
@@ -201,12 +208,12 @@
 	if (task == NULL || task->func == NULL)
 		return -EINVAL;
 
-	spin_lock(&rtc->irq_task_lock);
+	spin_lock_irq(&rtc->irq_task_lock);
 	if (rtc->irq_task == NULL) {
 		rtc->irq_task = task;
 		retval = 0;
 	}
-	spin_unlock(&rtc->irq_task_lock);
+	spin_unlock_irq(&rtc->irq_task_lock);
 
 	return retval;
 }
@@ -216,10 +223,10 @@
 {
 	struct rtc_device *rtc = to_rtc_device(class_dev);
 
-	spin_lock(&rtc->irq_task_lock);
+	spin_lock_irq(&rtc->irq_task_lock);
 	if (rtc->irq_task == task)
 		rtc->irq_task = NULL;
-	spin_unlock(&rtc->irq_task_lock);
+	spin_unlock_irq(&rtc->irq_task_lock);
 }
 EXPORT_SYMBOL_GPL(rtc_irq_unregister);
 
@@ -265,3 +272,4 @@
 	}
 	return err;
 }
+EXPORT_SYMBOL_GPL(rtc_irq_set_freq);
diff -urN linux-2.6.19-rc6/drivers/rtc/rtc-at91.c linux-2.6.19/drivers/rtc/rtc-at91.c
--- linux-2.6.19-rc6/drivers/rtc/rtc-at91.c	2006-11-29 22:48:08.864721042 +0000
+++ linux-2.6.19/drivers/rtc/rtc-at91.c	2006-11-29 22:48:13.653241301 +0000
@@ -292,7 +292,8 @@
 					AT91_RTC_CALEV);
 
 	ret = request_irq(AT91_ID_SYS, at91_rtc_interrupt,
-				IRQF_SHARED, "at91_rtc", pdev);
+				IRQF_DISABLED | IRQF_SHARED,
+				"at91_rtc", pdev);
 	if (ret) {
 		printk(KERN_ERR "at91_rtc: IRQ %d already in use.\n",
 				AT91_ID_SYS);
diff -urN linux-2.6.19-rc6/drivers/rtc/rtc-dev.c linux-2.6.19/drivers/rtc/rtc-dev.c
--- linux-2.6.19-rc6/drivers/rtc/rtc-dev.c	2006-11-29 22:48:08.864721042 +0000
+++ linux-2.6.19/drivers/rtc/rtc-dev.c	2006-11-29 22:48:13.653241301 +0000
@@ -61,7 +61,9 @@
 	int err;
 
 	err = rtc_read_time(&rtc->class_dev, &tm);
-	spin_lock_irq(&rtc->irq_lock);
+
+	local_irq_disable();
+	spin_lock(&rtc->irq_lock);
 	if (rtc->stop_uie_polling || err) {
 		rtc->uie_task_active = 0;
 	} else if (rtc->oldsecs != tm.tm_sec) {
@@ -74,11 +76,11 @@
 	} else if (schedule_work(&rtc->uie_task) == 0) {
 		rtc->uie_task_active = 0;
 	}
-	spin_unlock_irq(&rtc->irq_lock);
+	spin_unlock(&rtc->irq_lock);
 	if (num)
 		rtc_update_irq(&rtc->class_dev, num, RTC_UF | RTC_IRQF);
+	local_irq_enable();
 }
-
 static void rtc_uie_timer(unsigned long data)
 {
 	struct rtc_device *rtc = (struct rtc_device *)data;
@@ -214,7 +216,7 @@
 	struct rtc_wkalrm alarm;
 	void __user *uarg = (void __user *) arg;
 
-	/* check that the calles has appropriate permissions
+	/* check that the calling task has appropriate permissions
 	 * for certain ioctls. doing this check here is useful
 	 * to avoid duplicate code in each driver.
 	 */
@@ -238,10 +240,10 @@
 
 	/* avoid conflicting IRQ users */
 	if (cmd == RTC_PIE_ON || cmd == RTC_PIE_OFF || cmd == RTC_IRQP_SET) {
-		spin_lock(&rtc->irq_task_lock);
+		spin_lock_irq(&rtc->irq_task_lock);
 		if (rtc->irq_task)
 			err = -EBUSY;
-		spin_unlock(&rtc->irq_task_lock);
+		spin_unlock_irq(&rtc->irq_task_lock);
 
 		if (err < 0)
 			return err;
@@ -299,6 +301,17 @@
 
 		err = rtc_set_time(class_dev, &tm);
 		break;
+
+	case RTC_IRQP_READ:
+		if (ops->irq_set_freq)
+			err = put_user(rtc->irq_freq, (unsigned long *) arg);
+		break;
+
+	case RTC_IRQP_SET:
+		if (ops->irq_set_freq)
+			err = rtc_irq_set_freq(class_dev, rtc->irq_task, arg);
+		break;
+
 #if 0
 	case RTC_EPOCH_SET:
 #ifndef rtc_epoch
diff -urN linux-2.6.19-rc6/drivers/rtc/rtc-ds1553.c linux-2.6.19/drivers/rtc/rtc-ds1553.c
--- linux-2.6.19-rc6/drivers/rtc/rtc-ds1553.c	2006-11-29 22:48:08.864721042 +0000
+++ linux-2.6.19/drivers/rtc/rtc-ds1553.c	2006-11-29 22:48:13.653241301 +0000
@@ -340,7 +340,8 @@
 
 	if (pdata->irq >= 0) {
 		writeb(0, ioaddr + RTC_INTERRUPTS);
-		if (request_irq(pdata->irq, ds1553_rtc_interrupt, IRQF_SHARED,
+		if (request_irq(pdata->irq, ds1553_rtc_interrupt,
+				IRQF_DISABLED | IRQF_SHARED,
 				pdev->name, pdev) < 0) {
 			dev_warn(&pdev->dev, "interrupt not available.\n");
 			pdata->irq = -1;
diff -urN linux-2.6.19-rc6/drivers/rtc/rtc-rs5c372.c linux-2.6.19/drivers/rtc/rtc-rs5c372.c
--- linux-2.6.19-rc6/drivers/rtc/rtc-rs5c372.c	2006-11-29 22:48:08.864721042 +0000
+++ linux-2.6.19/drivers/rtc/rtc-rs5c372.c	2006-11-29 22:48:13.657241736 +0000
@@ -126,13 +126,13 @@
 		return -EIO;
 	}
 
-	dev_dbg(&client->dev, "%s: raw trim=%x\n", __FUNCTION__, *trim);
-
 	if (osc)
 		*osc = (buf & RS5C372_TRIM_XSL) ? 32000 : 32768;
 
-	if (trim)
+	if (trim) {
 		*trim = buf & RS5C372_TRIM_MASK;
+		dev_dbg(&client->dev, "%s: raw trim=%x\n", __FUNCTION__, *trim);
+	}
 
 	return 0;
 }
diff -urN linux-2.6.19-rc6/drivers/rtc/rtc-test.c linux-2.6.19/drivers/rtc/rtc-test.c
--- linux-2.6.19-rc6/drivers/rtc/rtc-test.c	2006-11-29 22:48:08.864721042 +0000
+++ linux-2.6.19/drivers/rtc/rtc-test.c	2006-11-29 22:48:13.657241736 +0000
@@ -99,6 +99,7 @@
 	struct rtc_device *rtc = platform_get_drvdata(plat_dev);
 
 	retval = count;
+	local_irq_disable();
 	if (strncmp(buf, "tick", 4) == 0)
 		rtc_update_irq(&rtc->class_dev, 1, RTC_PF | RTC_IRQF);
 	else if (strncmp(buf, "alarm", 5) == 0)
@@ -107,6 +108,7 @@
 		rtc_update_irq(&rtc->class_dev, 1, RTC_UF | RTC_IRQF);
 	else
 		retval = -EINVAL;
+	local_irq_enable();
 
 	return retval;
 }
diff -urN linux-2.6.19-rc6/drivers/scsi/3w-9xxx.c linux-2.6.19/drivers/scsi/3w-9xxx.c
--- linux-2.6.19-rc6/drivers/scsi/3w-9xxx.c	2006-11-29 22:48:08.904725389 +0000
+++ linux-2.6.19/drivers/scsi/3w-9xxx.c	2006-11-29 22:48:13.697246082 +0000
@@ -66,6 +66,9 @@
    2.26.02.006 - Fix 9550SX pchip reset timeout.
                  Add big endian support.
    2.26.02.007 - Disable local interrupts during kmap/unmap_atomic().
+   2.26.02.008 - Free irq handler in __twa_shutdown().
+                 Serialize reset code.
+                 Add support for 9650SE controllers.
 */
 
 #include <linux/module.h>
@@ -89,7 +92,7 @@
 #include "3w-9xxx.h"
 
 /* Globals */
-#define TW_DRIVER_VERSION "2.26.02.007"
+#define TW_DRIVER_VERSION "2.26.02.008"
 static TW_Device_Extension *twa_device_extension_list[TW_MAX_SLOT];
 static unsigned int twa_device_extension_count;
 static int twa_major = -1;
@@ -566,9 +569,9 @@
 		goto out;
 	}
 
-	tw_dev->working_srl = fw_on_ctlr_srl;
-	tw_dev->working_branch = fw_on_ctlr_branch;
-	tw_dev->working_build = fw_on_ctlr_build;
+	tw_dev->tw_compat_info.working_srl = fw_on_ctlr_srl;
+	tw_dev->tw_compat_info.working_branch = fw_on_ctlr_branch;
+	tw_dev->tw_compat_info.working_build = fw_on_ctlr_build;
 
 	/* Try base mode compatibility */
 	if (!(init_connect_result & TW_CTLR_FW_COMPATIBLE)) {
@@ -590,10 +593,23 @@
 			}
 			goto out;
 		}
-		tw_dev->working_srl = TW_BASE_FW_SRL;
-		tw_dev->working_branch = TW_BASE_FW_BRANCH;
-		tw_dev->working_build = TW_BASE_FW_BUILD;
-	}
+		tw_dev->tw_compat_info.working_srl = TW_BASE_FW_SRL;
+		tw_dev->tw_compat_info.working_branch = TW_BASE_FW_BRANCH;
+		tw_dev->tw_compat_info.working_build = TW_BASE_FW_BUILD;
+	}
+
+	/* Load rest of compatibility struct */
+	strncpy(tw_dev->tw_compat_info.driver_version, TW_DRIVER_VERSION, strlen(TW_DRIVER_VERSION));
+	tw_dev->tw_compat_info.driver_srl_high = TW_CURRENT_DRIVER_SRL;
+	tw_dev->tw_compat_info.driver_branch_high = TW_CURRENT_DRIVER_BRANCH;
+	tw_dev->tw_compat_info.driver_build_high = TW_CURRENT_DRIVER_BUILD;
+	tw_dev->tw_compat_info.driver_srl_low = TW_BASE_FW_SRL;
+	tw_dev->tw_compat_info.driver_branch_low = TW_BASE_FW_BRANCH;
+	tw_dev->tw_compat_info.driver_build_low = TW_BASE_FW_BUILD;
+	tw_dev->tw_compat_info.fw_on_ctlr_srl = fw_on_ctlr_srl;
+	tw_dev->tw_compat_info.fw_on_ctlr_branch = fw_on_ctlr_branch;
+	tw_dev->tw_compat_info.fw_on_ctlr_build = fw_on_ctlr_build;
+
 	retval = 0;
 out:
 	return retval;
@@ -631,7 +647,7 @@
 		goto out2;
 
 	/* Check data buffer size */
-	if (driver_command.buffer_length > TW_MAX_SECTORS * 512) {
+	if (driver_command.buffer_length > TW_MAX_SECTORS * 2048) {
 		retval = TW_IOCTL_ERROR_OS_EINVAL;
 		goto out2;
 	}
@@ -680,13 +696,6 @@
 		/* Now wait for command to complete */
 		timeout = wait_event_timeout(tw_dev->ioctl_wqueue, tw_dev->chrdev_request_id == TW_IOCTL_CHRDEV_FREE, timeout);
 
-		/* See if we reset while waiting for the ioctl to complete */
-		if (test_bit(TW_IN_RESET, &tw_dev->flags)) {
-			clear_bit(TW_IN_RESET, &tw_dev->flags);
-			retval = TW_IOCTL_ERROR_OS_ERESTARTSYS;
-			goto out3;
-		}
-
 		/* We timed out, and didn't get an interrupt */
 		if (tw_dev->chrdev_request_id != TW_IOCTL_CHRDEV_FREE) {
 			/* Now we need to reset the board */
@@ -694,11 +703,6 @@
 			       tw_dev->host->host_no, TW_DRIVER, 0xc,
 			       cmd);
 			retval = TW_IOCTL_ERROR_OS_EIO;
-			spin_lock_irqsave(tw_dev->host->host_lock, flags);
-			tw_dev->state[request_id] = TW_S_COMPLETED;
-			twa_free_request_id(tw_dev, request_id);
-			tw_dev->posted_request_count--;
-			spin_unlock_irqrestore(tw_dev->host->host_lock, flags);
 			twa_reset_device_extension(tw_dev, 1);
 			goto out3;
 		}
@@ -717,16 +721,7 @@
 		tw_ioctl->driver_command.status = 0;
 		/* Copy compatiblity struct into ioctl data buffer */
 		tw_compat_info = (TW_Compatibility_Info *)tw_ioctl->data_buffer;
-		strncpy(tw_compat_info->driver_version, TW_DRIVER_VERSION, strlen(TW_DRIVER_VERSION));
-		tw_compat_info->working_srl = tw_dev->working_srl;
-		tw_compat_info->working_branch = tw_dev->working_branch;
-		tw_compat_info->working_build = tw_dev->working_build;
-		tw_compat_info->driver_srl_high = TW_CURRENT_DRIVER_SRL;
-		tw_compat_info->driver_branch_high = TW_CURRENT_DRIVER_BRANCH;
-		tw_compat_info->driver_build_high = TW_CURRENT_DRIVER_BUILD;
-		tw_compat_info->driver_srl_low = TW_BASE_FW_SRL;
-		tw_compat_info->driver_branch_low = TW_BASE_FW_BRANCH;
-		tw_compat_info->driver_build_low = TW_BASE_FW_BUILD;
+		memcpy(tw_compat_info, &tw_dev->tw_compat_info, sizeof(TW_Compatibility_Info));
 		break;
 	case TW_IOCTL_GET_LAST_EVENT:
 		if (tw_dev->event_queue_wrapped) {
@@ -895,7 +890,8 @@
 	}
 
 	if (status_reg_value & TW_STATUS_QUEUE_ERROR) {
-		TW_PRINTK(tw_dev->host, TW_DRIVER, 0xe, "Controller Queue Error: clearing");
+		if ((tw_dev->tw_pci_dev->device != PCI_DEVICE_ID_3WARE_9650SE) || (!test_bit(TW_IN_RESET, &tw_dev->flags)))
+			TW_PRINTK(tw_dev->host, TW_DRIVER, 0xe, "Controller Queue Error: clearing");
 		writel(TW_CONTROL_CLEAR_QUEUE_ERROR, TW_CONTROL_REG_ADDR(tw_dev));
 	}
 
@@ -939,10 +935,12 @@
 	unsigned long before;
 	int retval = 1;
 
-	if (tw_dev->tw_pci_dev->device == PCI_DEVICE_ID_3WARE_9550SX) {
+	if ((tw_dev->tw_pci_dev->device == PCI_DEVICE_ID_3WARE_9550SX) ||
+	    (tw_dev->tw_pci_dev->device == PCI_DEVICE_ID_3WARE_9650SE)) {
 		before = jiffies;
 		while ((response_que_value & TW_9550SX_DRAIN_COMPLETED) != TW_9550SX_DRAIN_COMPLETED) {
 			response_que_value = readl(TW_RESPONSE_QUEUE_REG_ADDR_LARGE(tw_dev));
+			msleep(1);
 			if (time_after(jiffies, before + HZ * 30))
 				goto out;
 		}
@@ -1214,6 +1212,10 @@
 
 	handled = 1;
 
+	/* If we are resetting, bail */
+	if (test_bit(TW_IN_RESET, &tw_dev->flags))
+		goto twa_interrupt_bail;
+
 	/* Check controller for errors */
 	if (twa_check_bits(status_reg_value)) {
 		if (twa_decode_bits(tw_dev, status_reg_value)) {
@@ -1355,8 +1357,8 @@
 
 	if (TW_OP_OUT(full_command_packet->command.newcommand.opcode__reserved) == TW_OP_EXECUTE_SCSI) {
 		newcommand = &full_command_packet->command.newcommand;
-		newcommand->request_id__lunl = 
-			TW_REQ_LUN_IN(TW_LUN_OUT(newcommand->request_id__lunl), request_id);
+		newcommand->request_id__lunl =
+			cpu_to_le16(TW_REQ_LUN_IN(TW_LUN_OUT(newcommand->request_id__lunl), request_id));
 		newcommand->sg_list[0].address = TW_CPU_TO_SGL(dma_handle + sizeof(TW_Ioctl_Buf_Apache) - 1);
 		newcommand->sg_list[0].length = cpu_to_le32(length);
 		newcommand->sgl_entries__lunh =
@@ -1531,6 +1533,13 @@
 	int retval = 1;
 
 	command_que_value = tw_dev->command_packet_phys[request_id];
+
+	/* For 9650SE write low 4 bytes first */
+	if (tw_dev->tw_pci_dev->device == PCI_DEVICE_ID_3WARE_9650SE) {
+		command_que_value += TW_COMMAND_OFFSET;
+		writel((u32)command_que_value, TW_COMMAND_QUEUE_REG_ADDR_LARGE(tw_dev));
+	}
+
 	status_reg_value = readl(TW_STATUS_REG_ADDR(tw_dev));
 
 	if (twa_check_bits(status_reg_value))
@@ -1557,13 +1566,17 @@
 		TW_UNMASK_COMMAND_INTERRUPT(tw_dev);
 		goto out;
 	} else {
-		/* We successfully posted the command packet */
-		if (sizeof(dma_addr_t) > 4) {
-			command_que_value += TW_COMMAND_OFFSET;
-			writel((u32)command_que_value, TW_COMMAND_QUEUE_REG_ADDR(tw_dev));
-			writel((u32)((u64)command_que_value >> 32), TW_COMMAND_QUEUE_REG_ADDR(tw_dev) + 0x4);
+		if (tw_dev->tw_pci_dev->device == PCI_DEVICE_ID_3WARE_9650SE) {
+			/* Now write upper 4 bytes */
+			writel((u32)((u64)command_que_value >> 32), TW_COMMAND_QUEUE_REG_ADDR_LARGE(tw_dev) + 0x4);
 		} else {
-			writel(TW_COMMAND_OFFSET + command_que_value, TW_COMMAND_QUEUE_REG_ADDR(tw_dev));
+			if (sizeof(dma_addr_t) > 4) {
+				command_que_value += TW_COMMAND_OFFSET;
+				writel((u32)command_que_value, TW_COMMAND_QUEUE_REG_ADDR(tw_dev));
+				writel((u32)((u64)command_que_value >> 32), TW_COMMAND_QUEUE_REG_ADDR(tw_dev) + 0x4);
+			} else {
+				writel(TW_COMMAND_OFFSET + command_que_value, TW_COMMAND_QUEUE_REG_ADDR(tw_dev));
+			}
 		}
 		tw_dev->state[request_id] = TW_S_POSTED;
 		tw_dev->posted_request_count++;
@@ -1620,14 +1633,9 @@
 		goto out;
 
 	TW_ENABLE_AND_CLEAR_INTERRUPTS(tw_dev);
+	clear_bit(TW_IN_RESET, &tw_dev->flags);
+	tw_dev->chrdev_request_id = TW_IOCTL_CHRDEV_FREE;
 
-	/* Wake up any ioctl that was pending before the reset */
-	if ((tw_dev->chrdev_request_id == TW_IOCTL_CHRDEV_FREE) || (ioctl_reset)) {
-		clear_bit(TW_IN_RESET, &tw_dev->flags);
-	} else {
-		tw_dev->chrdev_request_id = TW_IOCTL_CHRDEV_FREE;
-		wake_up(&tw_dev->ioctl_wqueue);
-	}
 	retval = 0;
 out:
 	return retval;
@@ -1736,6 +1744,9 @@
 		"WARNING: (0x%02X:0x%04X): Command (0x%x) timed out, resetting card.\n",
 		TW_DRIVER, 0x2c, SCpnt->cmnd[0]);
 
+	/* Make sure we are not issuing an ioctl or resetting from ioctl */
+	mutex_lock(&tw_dev->ioctl_lock);
+
 	/* Now reset the card and some of the device extension data */
 	if (twa_reset_device_extension(tw_dev, 0)) {
 		TW_PRINTK(tw_dev->host, TW_DRIVER, 0x2b, "Controller reset failed during scsi host reset");
@@ -1744,6 +1755,7 @@
 
 	retval = SUCCESS;
 out:
+	mutex_unlock(&tw_dev->ioctl_lock);
 	return retval;
 } /* End twa_scsi_eh_reset() */
 
@@ -1753,8 +1765,14 @@
 	int request_id, retval;
 	TW_Device_Extension *tw_dev = (TW_Device_Extension *)SCpnt->device->host->hostdata;
 
+	/* If we are resetting due to timed out ioctl, report as busy */
+	if (test_bit(TW_IN_RESET, &tw_dev->flags)) {
+		retval = SCSI_MLQUEUE_HOST_BUSY;
+		goto out;
+	}
+
 	/* Check if this FW supports luns */
-	if ((SCpnt->device->lun != 0) && (tw_dev->working_srl < TW_FW_SRL_LUNS_SUPPORTED)) {
+	if ((SCpnt->device->lun != 0) && (tw_dev->tw_compat_info.working_srl < TW_FW_SRL_LUNS_SUPPORTED)) {
 		SCpnt->result = (DID_BAD_TARGET << 16);
 		done(SCpnt);
 		retval = 0;
@@ -1960,6 +1978,9 @@
 	/* Disable interrupts */
 	TW_DISABLE_INTERRUPTS(tw_dev);
 
+	/* Free up the IRQ */
+	free_irq(tw_dev->tw_pci_dev->irq, tw_dev);
+
 	printk(KERN_WARNING "3w-9xxx: Shutting down host %d.\n", tw_dev->host->host_no);
 
 	/* Tell the card we are shutting down */
@@ -2091,21 +2112,25 @@
 
 	/* Initialize the card */
 	if (twa_reset_sequence(tw_dev, 0))
-		goto out_release_mem_region;
+		goto out_iounmap;
 
 	/* Set host specific parameters */
-	host->max_id = TW_MAX_UNITS;
+	if (pdev->device == PCI_DEVICE_ID_3WARE_9650SE)
+		host->max_id = TW_MAX_UNITS_9650SE;
+	else
+		host->max_id = TW_MAX_UNITS;
+
 	host->max_cmd_len = TW_MAX_CDB_LEN;
 
 	/* Channels aren't supported by adapter */
-	host->max_lun = TW_MAX_LUNS(tw_dev->working_srl);
+	host->max_lun = TW_MAX_LUNS(tw_dev->tw_compat_info.working_srl);
 	host->max_channel = 0;
 
 	/* Register the card with the kernel SCSI layer */
 	retval = scsi_add_host(host, &pdev->dev);
 	if (retval) {
 		TW_PRINTK(tw_dev->host, TW_DRIVER, 0x27, "scsi add host failed");
-		goto out_release_mem_region;
+		goto out_iounmap;
 	}
 
 	pci_set_drvdata(pdev, host);
@@ -2145,6 +2170,8 @@
 
 out_remove_host:
 	scsi_remove_host(host);
+out_iounmap:
+	iounmap(tw_dev->base_addr);
 out_release_mem_region:
 	pci_release_regions(pdev);
 out_free_device_extension:
@@ -2170,12 +2197,12 @@
 		twa_major = -1;
 	}
 
-	/* Free up the IRQ */
-	free_irq(tw_dev->tw_pci_dev->irq, tw_dev);
-
 	/* Shutdown the card */
 	__twa_shutdown(tw_dev);
 
+	/* Free IO remapping */
+	iounmap(tw_dev->base_addr);
+
 	/* Free up the mem region */
 	pci_release_regions(pdev);
 
@@ -2193,6 +2220,8 @@
 	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
 	{ PCI_VENDOR_ID_3WARE, PCI_DEVICE_ID_3WARE_9550SX,
 	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
+	{ PCI_VENDOR_ID_3WARE, PCI_DEVICE_ID_3WARE_9650SE,
+	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
 	{ }
 };
 MODULE_DEVICE_TABLE(pci, twa_pci_tbl);
diff -urN linux-2.6.19-rc6/drivers/scsi/3w-9xxx.h linux-2.6.19/drivers/scsi/3w-9xxx.h
--- linux-2.6.19-rc6/drivers/scsi/3w-9xxx.h	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/drivers/scsi/3w-9xxx.h	2006-11-29 22:48:13.697246082 +0000
@@ -289,7 +289,6 @@
 #define TW_STATUS_VALID_INTERRUPT              0x00DF0000
 
 /* PCI related defines */
-#define TW_NUMDEVICES 1
 #define TW_PCI_CLEAR_PARITY_ERRORS 0xc100
 #define TW_PCI_CLEAR_PCI_ABORT     0x2000
 
@@ -335,6 +334,7 @@
 #define TW_ALIGNMENT_9000                     4  /* 4 bytes */
 #define TW_ALIGNMENT_9000_SGL                 0x3
 #define TW_MAX_UNITS			      16
+#define TW_MAX_UNITS_9650SE		      32
 #define TW_INIT_MESSAGE_CREDITS		      0x100
 #define TW_INIT_COMMAND_PACKET_SIZE	      0x3
 #define TW_INIT_COMMAND_PACKET_SIZE_EXTENDED  0x6
@@ -354,7 +354,6 @@
 #define TW_MAX_RESPONSE_DRAIN		      256
 #define TW_MAX_AEN_DRAIN		      40
 #define TW_IN_RESET                           2
-#define TW_IN_CHRDEV_IOCTL                    3
 #define TW_IN_ATTENTION_LOOP		      4
 #define TW_MAX_SECTORS                        256
 #define TW_AEN_WAIT_TIME                      1000
@@ -417,6 +416,9 @@
 #ifndef PCI_DEVICE_ID_3WARE_9550SX
 #define PCI_DEVICE_ID_3WARE_9550SX 0x1003
 #endif
+#ifndef PCI_DEVICE_ID_3WARE_9650SE
+#define PCI_DEVICE_ID_3WARE_9650SE 0x1004
+#endif
 
 /* Bitmask macros to eliminate bitfields */
 
@@ -442,6 +444,7 @@
 #define TW_CONTROL_REG_ADDR(x) (x->base_addr)
 #define TW_STATUS_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + 0x4)
 #define TW_COMMAND_QUEUE_REG_ADDR(x) (sizeof(dma_addr_t) > 4 ? ((unsigned char __iomem *)x->base_addr + 0x20) : ((unsigned char __iomem *)x->base_addr + 0x8))
+#define TW_COMMAND_QUEUE_REG_ADDR_LARGE(x) ((unsigned char __iomem *)x->base_addr + 0x20)
 #define TW_RESPONSE_QUEUE_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + 0xC)
 #define TW_RESPONSE_QUEUE_REG_ADDR_LARGE(x) ((unsigned char __iomem *)x->base_addr + 0x30)
 #define TW_CLEAR_ALL_INTERRUPTS(x) (writel(TW_STATUS_VALID_INTERRUPT, TW_CONTROL_REG_ADDR(x)))
@@ -626,6 +629,9 @@
 	unsigned short driver_srl_low;
 	unsigned short driver_branch_low;
 	unsigned short driver_build_low;
+	unsigned short fw_on_ctlr_srl;
+	unsigned short fw_on_ctlr_branch;
+	unsigned short fw_on_ctlr_build;
 } TW_Compatibility_Info;
 
 #pragma pack()
@@ -668,9 +674,7 @@
 	wait_queue_head_t	ioctl_wqueue;
 	struct mutex		ioctl_lock;
 	char			aen_clobber;
-	unsigned short		working_srl;
-	unsigned short		working_branch;
-	unsigned short		working_build;
+	TW_Compatibility_Info	tw_compat_info;
 } TW_Device_Extension;
 
 #endif /* _3W_9XXX_H */
diff -urN linux-2.6.19-rc6/drivers/scsi/aic94xx/aic94xx_hwi.c linux-2.6.19/drivers/scsi/aic94xx/aic94xx_hwi.c
--- linux-2.6.19-rc6/drivers/scsi/aic94xx/aic94xx_hwi.c	2006-11-29 22:48:08.948730170 +0000
+++ linux-2.6.19/drivers/scsi/aic94xx/aic94xx_hwi.c	2006-11-29 22:48:13.741250863 +0000
@@ -112,6 +112,21 @@
 	return 0;
 }
 
+static void asd_init_ports(struct asd_ha_struct *asd_ha)
+{
+	int i;
+
+	spin_lock_init(&asd_ha->asd_ports_lock);
+	for (i = 0; i < ASD_MAX_PHYS; i++) {
+		struct asd_port *asd_port = &asd_ha->asd_ports[i];
+
+		memset(asd_port->sas_addr, 0, SAS_ADDR_SIZE);
+		memset(asd_port->attached_sas_addr, 0, SAS_ADDR_SIZE);
+		asd_port->phy_mask = 0;
+		asd_port->num_phys = 0;
+	}
+}
+
 static int asd_init_phys(struct asd_ha_struct *asd_ha)
 {
 	u8 i;
@@ -121,6 +136,7 @@
 		struct asd_phy *phy = &asd_ha->phys[i];
 
 		phy->phy_desc = &asd_ha->hw_prof.phy_desc[i];
+		phy->asd_port = NULL;
 
 		phy->sas_phy.enabled = 0;
 		phy->sas_phy.id = i;
@@ -658,6 +674,8 @@
 		goto Out;
 	}
 
+	asd_init_ports(asd_ha);
+
 	err = asd_init_scbs(asd_ha);
 	if (err) {
 		asd_printk("couldn't initialize scbs for %s\n",
diff -urN linux-2.6.19-rc6/drivers/scsi/aic94xx/aic94xx_hwi.h linux-2.6.19/drivers/scsi/aic94xx/aic94xx_hwi.h
--- linux-2.6.19-rc6/drivers/scsi/aic94xx/aic94xx_hwi.h	2006-11-29 22:48:08.948730170 +0000
+++ linux-2.6.19/drivers/scsi/aic94xx/aic94xx_hwi.h	2006-11-29 22:48:13.741250863 +0000
@@ -193,6 +193,16 @@
 	struct asd_ascb **escb_arr; /* array of pointers to escbs */
 };
 
+/* This is an internal port structure. These are used to get accurate
+ * phy_mask for updating DDB 0.
+ */
+struct asd_port {
+	u8  sas_addr[SAS_ADDR_SIZE];
+	u8  attached_sas_addr[SAS_ADDR_SIZE];
+	u32 phy_mask;
+	int num_phys;
+};
+
 /* This is the Host Adapter structure.  It describes the hardware
  * SAS adapter.
  */
@@ -211,6 +221,8 @@
 	struct hw_profile hw_prof;
 
 	struct asd_phy    phys[ASD_MAX_PHYS];
+	spinlock_t        asd_ports_lock;
+	struct asd_port   asd_ports[ASD_MAX_PHYS];
 	struct asd_sas_port   ports[ASD_MAX_PHYS];
 
 	struct dma_pool  *scb_pool;
diff -urN linux-2.6.19-rc6/drivers/scsi/aic94xx/aic94xx_init.c linux-2.6.19/drivers/scsi/aic94xx/aic94xx_init.c
--- linux-2.6.19-rc6/drivers/scsi/aic94xx/aic94xx_init.c	2006-11-29 22:48:08.952730604 +0000
+++ linux-2.6.19/drivers/scsi/aic94xx/aic94xx_init.c	2006-11-29 22:48:13.741250863 +0000
@@ -786,8 +786,6 @@
 }
 
 static struct sas_domain_function_template aic94xx_transport_functions = {
-	.lldd_port_formed	= asd_update_port_links,
-
 	.lldd_dev_found		= asd_dev_found,
 	.lldd_dev_gone		= asd_dev_gone,
 
diff -urN linux-2.6.19-rc6/drivers/scsi/aic94xx/aic94xx_sas.h linux-2.6.19/drivers/scsi/aic94xx/aic94xx_sas.h
--- linux-2.6.19-rc6/drivers/scsi/aic94xx/aic94xx_sas.h	2006-11-29 22:48:08.952730604 +0000
+++ linux-2.6.19/drivers/scsi/aic94xx/aic94xx_sas.h	2006-11-29 22:48:13.745251298 +0000
@@ -733,6 +733,7 @@
 
 	struct sas_identify_frame *identify_frame;
 	struct asd_dma_tok  *id_frm_tok;
+	struct asd_port     *asd_port;
 
 	u8         frame_rcvd[ASD_EDB_SIZE];
 };
diff -urN linux-2.6.19-rc6/drivers/scsi/aic94xx/aic94xx_scb.c linux-2.6.19/drivers/scsi/aic94xx/aic94xx_scb.c
--- linux-2.6.19-rc6/drivers/scsi/aic94xx/aic94xx_scb.c	2006-11-29 22:48:08.956731039 +0000
+++ linux-2.6.19/drivers/scsi/aic94xx/aic94xx_scb.c	2006-11-29 22:48:13.745251298 +0000
@@ -168,6 +168,70 @@
 	}
 }
 
+static void asd_form_port(struct asd_ha_struct *asd_ha, struct asd_phy *phy)
+{
+	int i;
+	struct asd_port *free_port = NULL;
+	struct asd_port *port;
+	struct asd_sas_phy *sas_phy = &phy->sas_phy;
+	unsigned long flags;
+
+	spin_lock_irqsave(&asd_ha->asd_ports_lock, flags);
+	if (!phy->asd_port) {
+		for (i = 0; i < ASD_MAX_PHYS; i++) {
+			port = &asd_ha->asd_ports[i];
+
+			/* Check for wide port */
+			if (port->num_phys > 0 &&
+			    memcmp(port->sas_addr, sas_phy->sas_addr,
+				   SAS_ADDR_SIZE) == 0 &&
+			    memcmp(port->attached_sas_addr,
+				   sas_phy->attached_sas_addr,
+				   SAS_ADDR_SIZE) == 0) {
+				break;
+			}
+
+			/* Find a free port */
+			if (port->num_phys == 0 && free_port == NULL) {
+				free_port = port;
+			}
+		}
+
+		/* Use a free port if this doesn't form a wide port */
+		if (i >= ASD_MAX_PHYS) {
+			port = free_port;
+			BUG_ON(!port);
+			memcpy(port->sas_addr, sas_phy->sas_addr,
+			       SAS_ADDR_SIZE);
+			memcpy(port->attached_sas_addr,
+			       sas_phy->attached_sas_addr,
+			       SAS_ADDR_SIZE);
+		}
+		port->num_phys++;
+		port->phy_mask |= (1U << sas_phy->id);
+		phy->asd_port = port;
+	}
+	ASD_DPRINTK("%s: updating phy_mask 0x%x for phy%d\n",
+		    __FUNCTION__, phy->asd_port->phy_mask, sas_phy->id);
+	asd_update_port_links(asd_ha, phy);
+	spin_unlock_irqrestore(&asd_ha->asd_ports_lock, flags);
+}
+
+static void asd_deform_port(struct asd_ha_struct *asd_ha, struct asd_phy *phy)
+{
+	struct asd_port *port = phy->asd_port;
+	struct asd_sas_phy *sas_phy = &phy->sas_phy;
+	unsigned long flags;
+
+	spin_lock_irqsave(&asd_ha->asd_ports_lock, flags);
+	if (port) {
+		port->num_phys--;
+		port->phy_mask &= ~(1U << sas_phy->id);
+		phy->asd_port = NULL;
+	}
+	spin_unlock_irqrestore(&asd_ha->asd_ports_lock, flags);
+}
+
 static inline void asd_bytes_dmaed_tasklet(struct asd_ascb *ascb,
 					   struct done_list_struct *dl,
 					   int edb_id, int phy_id)
@@ -187,6 +251,7 @@
 	asd_get_attached_sas_addr(phy, phy->sas_phy.attached_sas_addr);
 	spin_unlock_irqrestore(&phy->sas_phy.frame_rcvd_lock, flags);
 	asd_dump_frame_rcvd(phy, dl);
+	asd_form_port(ascb->ha, phy);
 	sas_ha->notify_port_event(&phy->sas_phy, PORTE_BYTES_DMAED);
 }
 
@@ -197,6 +262,7 @@
 	struct asd_ha_struct *asd_ha = ascb->ha;
 	struct sas_ha_struct *sas_ha = &asd_ha->sas_ha;
 	struct asd_sas_phy *sas_phy = sas_ha->sas_phy[phy_id];
+	struct asd_phy *phy = &asd_ha->phys[phy_id];
 	u8 lr_error = dl->status_block[1];
 	u8 retries_left = dl->status_block[2];
 
@@ -221,6 +287,7 @@
 
 	asd_turn_led(asd_ha, phy_id, 0);
 	sas_phy_disconnected(sas_phy);
+	asd_deform_port(asd_ha, phy);
 	sas_ha->notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
 
 	if (retries_left == 0) {
@@ -248,6 +315,8 @@
 	unsigned long flags;
 	struct sas_ha_struct *sas_ha = &ascb->ha->sas_ha;
 	struct asd_sas_phy *sas_phy = sas_ha->sas_phy[phy_id];
+	struct asd_ha_struct *asd_ha = ascb->ha;
+	struct asd_phy *phy = &asd_ha->phys[phy_id];
 	u8  reg  = dl->status_block[1];
 	u32 cont = dl->status_block[2] << ((reg & 3)*8);
 
@@ -284,6 +353,7 @@
 				    phy_id);
 			/* The sequencer disables all phys on that port.
 			 * We have to re-enable the phys ourselves. */
+			asd_deform_port(asd_ha, phy);
 			sas_ha->notify_port_event(sas_phy, PORTE_HARD_RESET);
 			break;
 
@@ -351,6 +421,7 @@
 	u8  sb_opcode = dl->status_block[0];
 	int phy_id = sb_opcode & DL_PHY_MASK;
 	struct asd_sas_phy *sas_phy = sas_ha->sas_phy[phy_id];
+	struct asd_phy *phy = &asd_ha->phys[phy_id];
 
 	if (edb > 6 || edb < 0) {
 		ASD_DPRINTK("edb is 0x%x! dl->opcode is 0x%x\n",
@@ -395,6 +466,7 @@
 		asd_turn_led(asd_ha, phy_id, 0);
 		/* the device is gone */
 		sas_phy_disconnected(sas_phy);
+		asd_deform_port(asd_ha, phy);
 		sas_ha->notify_port_event(sas_phy, PORTE_TIMER_EVENT);
 		break;
 	case REQ_TASK_ABORT:
diff -urN linux-2.6.19-rc6/drivers/scsi/aic94xx/aic94xx_seq.c linux-2.6.19/drivers/scsi/aic94xx/aic94xx_seq.c
--- linux-2.6.19-rc6/drivers/scsi/aic94xx/aic94xx_seq.c	2006-11-29 22:48:08.956731039 +0000
+++ linux-2.6.19/drivers/scsi/aic94xx/aic94xx_seq.c	2006-11-29 22:48:13.745251298 +0000
@@ -1369,10 +1369,9 @@
  * port_map_by_links is also used as the conn_mask byte in the
  * initiator/target port DDB.
  */
-void asd_update_port_links(struct asd_sas_phy *sas_phy)
+void asd_update_port_links(struct asd_ha_struct *asd_ha, struct asd_phy *phy)
 {
-	struct asd_ha_struct *asd_ha = sas_phy->ha->lldd_ha;
-	const u8 phy_mask = (u8) sas_phy->port->phy_mask;
+	const u8 phy_mask = (u8) phy->asd_port->phy_mask;
 	u8  phy_is_up;
 	u8  mask;
 	int i, err;
diff -urN linux-2.6.19-rc6/drivers/scsi/aic94xx/aic94xx_seq.h linux-2.6.19/drivers/scsi/aic94xx/aic94xx_seq.h
--- linux-2.6.19-rc6/drivers/scsi/aic94xx/aic94xx_seq.h	2006-11-29 22:48:08.956731039 +0000
+++ linux-2.6.19/drivers/scsi/aic94xx/aic94xx_seq.h	2006-11-29 22:48:13.745251298 +0000
@@ -64,7 +64,7 @@
 int asd_init_seqs(struct asd_ha_struct *asd_ha);
 int asd_start_seqs(struct asd_ha_struct *asd_ha);
 
-void asd_update_port_links(struct asd_sas_phy *phy);
+void asd_update_port_links(struct asd_ha_struct *asd_ha, struct asd_phy *phy);
 #endif
 
 #endif
diff -urN linux-2.6.19-rc6/drivers/scsi/gdth.c linux-2.6.19/drivers/scsi/gdth.c
--- linux-2.6.19-rc6/drivers/scsi/gdth.c	2006-11-29 22:48:08.976733212 +0000
+++ linux-2.6.19/drivers/scsi/gdth.c	2006-11-29 22:48:13.769253906 +0000
@@ -3531,7 +3531,7 @@
                 IStatus &= ~0x80;
 #ifdef INT_COAL
                 if (coalesced)
-                    ha->status = pcs->ext_status && 0xffff;
+                    ha->status = pcs->ext_status & 0xffff;
                 else 
 #endif
                     ha->status = gdth_readw(&dp6m_ptr->i960r.status);
@@ -3543,7 +3543,7 @@
             if (coalesced) {    
                 ha->info = pcs->info0;
                 ha->info2 = pcs->info1;
-                ha->service = (pcs->ext_status >> 16) && 0xffff;
+                ha->service = (pcs->ext_status >> 16) & 0xffff;
             } else
 #endif
             {
diff -urN linux-2.6.19-rc6/drivers/scsi/iscsi_tcp.c linux-2.6.19/drivers/scsi/iscsi_tcp.c
--- linux-2.6.19-rc6/drivers/scsi/iscsi_tcp.c	2006-11-29 22:48:08.992734951 +0000
+++ linux-2.6.19/drivers/scsi/iscsi_tcp.c	2006-11-29 22:48:13.781255210 +0000
@@ -415,8 +415,8 @@
 	iscsi_solicit_data_init(conn, ctask, r2t);
 
 	tcp_ctask->exp_r2tsn = r2tsn + 1;
-	tcp_ctask->xmstate |= XMSTATE_SOL_HDR;
 	__kfifo_put(tcp_ctask->r2tqueue, (void*)&r2t, sizeof(void*));
+	tcp_ctask->xmstate |= XMSTATE_SOL_HDR;
 	list_move_tail(&ctask->running, &conn->xmitqueue);
 
 	scsi_queue_work(session->host, &conn->xmitwork);
@@ -1627,9 +1627,12 @@
 	if (tcp_ctask->xmstate & XMSTATE_SOL_HDR) {
 		tcp_ctask->xmstate &= ~XMSTATE_SOL_HDR;
 		tcp_ctask->xmstate |= XMSTATE_SOL_DATA;
-		if (!tcp_ctask->r2t)
+		if (!tcp_ctask->r2t) {
+			spin_lock_bh(&session->lock);
 			__kfifo_get(tcp_ctask->r2tqueue, (void*)&tcp_ctask->r2t,
 				    sizeof(void*));
+			spin_unlock_bh(&session->lock);
+		}
 send_hdr:
 		r2t = tcp_ctask->r2t;
 		dtask = &r2t->dtask;
@@ -1816,21 +1819,14 @@
 {
 	struct iscsi_conn *conn = cls_conn->dd_data;
 	struct iscsi_tcp_conn *tcp_conn = conn->dd_data;
-	int digest = 0;
-
-	if (conn->hdrdgst_en || conn->datadgst_en)
-		digest = 1;
 
 	iscsi_tcp_release_conn(conn);
 	iscsi_conn_teardown(cls_conn);
 
-	/* now free tcp_conn */
-	if (digest) {
-		if (tcp_conn->tx_hash.tfm)
-			crypto_free_hash(tcp_conn->tx_hash.tfm);
-		if (tcp_conn->rx_hash.tfm)
-			crypto_free_hash(tcp_conn->rx_hash.tfm);
-	}
+	if (tcp_conn->tx_hash.tfm)
+		crypto_free_hash(tcp_conn->tx_hash.tfm);
+	if (tcp_conn->rx_hash.tfm)
+		crypto_free_hash(tcp_conn->rx_hash.tfm);
 
 	kfree(tcp_conn);
 }
diff -urN linux-2.6.19-rc6/drivers/scsi/libiscsi.c linux-2.6.19/drivers/scsi/libiscsi.c
--- linux-2.6.19-rc6/drivers/scsi/libiscsi.c	2006-11-29 22:48:09.004736255 +0000
+++ linux-2.6.19/drivers/scsi/libiscsi.c	2006-11-29 22:48:13.793256514 +0000
@@ -975,13 +975,13 @@
 	if (session->state == ISCSI_STATE_TERMINATE) {
 failed:
 		debug_scsi("failing host reset: session terminated "
-			   "[CID %d age %d]", conn->id, session->age);
+			   "[CID %d age %d]\n", conn->id, session->age);
 		spin_unlock_bh(&session->lock);
 		return FAILED;
 	}
 
 	if (sc->SCp.phase == session->age) {
-		debug_scsi("failing connection CID %d due to SCSI host reset",
+		debug_scsi("failing connection CID %d due to SCSI host reset\n",
 			   conn->id);
 		fail_session = 1;
 	}
@@ -1054,7 +1054,8 @@
 				     NULL, 0);
 	if (rc) {
 		iscsi_conn_failure(conn, ISCSI_ERR_CONN_FAILED);
-		debug_scsi("abort sent failure [itt 0x%x] %d", ctask->itt, rc);
+		debug_scsi("abort sent failure [itt 0x%x] %d\n", ctask->itt,
+		           rc);
 		return rc;
 	}
 
@@ -1071,7 +1072,7 @@
 		conn->tmabort_timer.function = iscsi_tmabort_timedout;
 		conn->tmabort_timer.data = (unsigned long)ctask;
 		add_timer(&conn->tmabort_timer);
-		debug_scsi("abort set timeout [itt 0x%x]", ctask->itt);
+		debug_scsi("abort set timeout [itt 0x%x]\n", ctask->itt);
 	}
 	spin_unlock_bh(&session->lock);
 	mutex_unlock(&conn->xmitmutex);
diff -urN linux-2.6.19-rc6/drivers/scsi/libsas/sas_expander.c linux-2.6.19/drivers/scsi/libsas/sas_expander.c
--- linux-2.6.19-rc6/drivers/scsi/libsas/sas_expander.c	2006-11-29 22:48:09.008736689 +0000
+++ linux-2.6.19/drivers/scsi/libsas/sas_expander.c	2006-11-29 22:48:13.797256948 +0000
@@ -71,55 +71,65 @@
 static int smp_execute_task(struct domain_device *dev, void *req, int req_size,
 			    void *resp, int resp_size)
 {
-	int res;
-	struct sas_task *task = sas_alloc_task(GFP_KERNEL);
+	int res, retry;
+	struct sas_task *task = NULL;
 	struct sas_internal *i =
 		to_sas_internal(dev->port->ha->core.shost->transportt);
 
-	if (!task)
-		return -ENOMEM;
-
-	task->dev = dev;
-	task->task_proto = dev->tproto;
-	sg_init_one(&task->smp_task.smp_req, req, req_size);
-	sg_init_one(&task->smp_task.smp_resp, resp, resp_size);
-
-	task->task_done = smp_task_done;
-
-	task->timer.data = (unsigned long) task;
-	task->timer.function = smp_task_timedout;
-	task->timer.expires = jiffies + SMP_TIMEOUT*HZ;
-	add_timer(&task->timer);
+	for (retry = 0; retry < 3; retry++) {
+		task = sas_alloc_task(GFP_KERNEL);
+		if (!task)
+			return -ENOMEM;
+
+		task->dev = dev;
+		task->task_proto = dev->tproto;
+		sg_init_one(&task->smp_task.smp_req, req, req_size);
+		sg_init_one(&task->smp_task.smp_resp, resp, resp_size);
+
+		task->task_done = smp_task_done;
+
+		task->timer.data = (unsigned long) task;
+		task->timer.function = smp_task_timedout;
+		task->timer.expires = jiffies + SMP_TIMEOUT*HZ;
+		add_timer(&task->timer);
 
-	res = i->dft->lldd_execute_task(task, 1, GFP_KERNEL);
+		res = i->dft->lldd_execute_task(task, 1, GFP_KERNEL);
 
-	if (res) {
-		del_timer(&task->timer);
-		SAS_DPRINTK("executing SMP task failed:%d\n", res);
-		goto ex_err;
-	}
-
-	wait_for_completion(&task->completion);
-	res = -ETASK;
-	if ((task->task_state_flags & SAS_TASK_STATE_ABORTED)) {
-		SAS_DPRINTK("smp task timed out or aborted\n");
-		i->dft->lldd_abort_task(task);
-		if (!(task->task_state_flags & SAS_TASK_STATE_DONE)) {
-			SAS_DPRINTK("SMP task aborted and not done\n");
+		if (res) {
+			del_timer(&task->timer);
+			SAS_DPRINTK("executing SMP task failed:%d\n", res);
 			goto ex_err;
 		}
+
+		wait_for_completion(&task->completion);
+		res = -ETASK;
+		if ((task->task_state_flags & SAS_TASK_STATE_ABORTED)) {
+			SAS_DPRINTK("smp task timed out or aborted\n");
+			i->dft->lldd_abort_task(task);
+			if (!(task->task_state_flags & SAS_TASK_STATE_DONE)) {
+				SAS_DPRINTK("SMP task aborted and not done\n");
+				goto ex_err;
+			}
+		}
+		if (task->task_status.resp == SAS_TASK_COMPLETE &&
+		    task->task_status.stat == SAM_GOOD) {
+			res = 0;
+			break;
+		} else {
+			SAS_DPRINTK("%s: task to dev %016llx response: 0x%x "
+				    "status 0x%x\n", __FUNCTION__,
+				    SAS_ADDR(dev->sas_addr),
+				    task->task_status.resp,
+				    task->task_status.stat);
+			sas_free_task(task);
+			task = NULL;
+		}
 	}
-	if (task->task_status.resp == SAS_TASK_COMPLETE &&
-	    task->task_status.stat == SAM_GOOD)
-		res = 0;
-	else
-		SAS_DPRINTK("%s: task to dev %016llx response: 0x%x "
-			    "status 0x%x\n", __FUNCTION__,
-			    SAS_ADDR(dev->sas_addr),
-			    task->task_status.resp,
-			    task->task_status.stat);
 ex_err:
-	sas_free_task(task);
+	BUG_ON(retry == 3 && task != NULL);
+	if (task != NULL) {
+		sas_free_task(task);
+	}
 	return res;
 }
 
diff -urN linux-2.6.19-rc6/drivers/scsi/psi240i.c linux-2.6.19/drivers/scsi/psi240i.c
--- linux-2.6.19-rc6/drivers/scsi/psi240i.c	2006-11-29 22:48:09.032739297 +0000
+++ linux-2.6.19/drivers/scsi/psi240i.c	2006-11-29 22:48:13.821259556 +0000
@@ -328,7 +328,7 @@
 				pinquiryData->AdditionalLength = 35 - 4;
 
 				// Fill in vendor identification fields.
-				for ( z = 0;  z < 20;  z += 2 )
+				for ( z = 0;  z < 8;  z += 2 )
 					{
 					pinquiryData->VendorId[z]	  = ((UCHAR *)identifyData.ModelNumber)[z + 1];
 					pinquiryData->VendorId[z + 1] = ((UCHAR *)identifyData.ModelNumber)[z];
diff -urN linux-2.6.19-rc6/drivers/scsi/scsi_lib.c linux-2.6.19/drivers/scsi/scsi_lib.c
--- linux-2.6.19-rc6/drivers/scsi/scsi_lib.c	2006-11-29 22:48:09.068743209 +0000
+++ linux-2.6.19/drivers/scsi/scsi_lib.c	2006-11-29 22:48:13.861263902 +0000
@@ -410,6 +410,7 @@
 		goto free_req;
 
 	req->cmd_len = cmd_len;
+	memset(req->cmd, 0, BLK_MAX_CDB); /* ATAPI hates garbage after CDB */
 	memcpy(req->cmd, cmd, req->cmd_len);
 	req->sense = sioc->sense;
 	req->sense_len = 0;
diff -urN linux-2.6.19-rc6/drivers/scsi/scsi_transport_iscsi.c linux-2.6.19/drivers/scsi/scsi_transport_iscsi.c
--- linux-2.6.19-rc6/drivers/scsi/scsi_transport_iscsi.c	2006-11-29 22:48:09.068743209 +0000
+++ linux-2.6.19/drivers/scsi/scsi_transport_iscsi.c	2006-11-29 22:48:13.865264337 +0000
@@ -33,7 +33,7 @@
 #define ISCSI_SESSION_ATTRS 11
 #define ISCSI_CONN_ATTRS 11
 #define ISCSI_HOST_ATTRS 0
-#define ISCSI_TRANSPORT_VERSION "2.0-685"
+#define ISCSI_TRANSPORT_VERSION "2.0-724"
 
 struct iscsi_internal {
 	int daemon_pid;
diff -urN linux-2.6.19-rc6/drivers/scsi/sg.c linux-2.6.19/drivers/scsi/sg.c
--- linux-2.6.19-rc6/drivers/scsi/sg.c	2006-11-29 22:48:09.072743644 +0000
+++ linux-2.6.19/drivers/scsi/sg.c	2006-11-29 22:48:13.869264772 +0000
@@ -60,7 +60,7 @@
 
 #ifdef CONFIG_SCSI_PROC_FS
 #include <linux/proc_fs.h>
-static char *sg_version_date = "20060920";
+static char *sg_version_date = "20061027";
 
 static int sg_proc_init(void);
 static void sg_proc_cleanup(void);
@@ -710,12 +710,12 @@
 			  (int) cmnd[0], (int) hp->cmd_len));
 
 	if ((k = sg_start_req(srp))) {
-		SCSI_LOG_TIMEOUT(1, printk("sg_write: start_req err=%d\n", k));
+		SCSI_LOG_TIMEOUT(1, printk("sg_common_write: start_req err=%d\n", k));
 		sg_finish_rem_req(srp);
 		return k;	/* probably out of space --> ENOMEM */
 	}
 	if ((k = sg_write_xfer(srp))) {
-		SCSI_LOG_TIMEOUT(1, printk("sg_write: write_xfer, bad address\n"));
+		SCSI_LOG_TIMEOUT(1, printk("sg_common_write: write_xfer, bad address\n"));
 		sg_finish_rem_req(srp);
 		return k;
 	}
@@ -746,7 +746,7 @@
 				hp->dxfer_len, srp->data.k_use_sg, timeout,
 				SG_DEFAULT_RETRIES, srp, sg_cmd_done,
 				GFP_ATOMIC)) {
-		SCSI_LOG_TIMEOUT(1, printk("sg_write: scsi_execute_async failed\n"));
+		SCSI_LOG_TIMEOUT(1, printk("sg_common_write: scsi_execute_async failed\n"));
 		/*
 		 * most likely out of mem, but could also be a bad map
 		 */
@@ -1283,7 +1283,7 @@
 		sg_finish_rem_req(srp);
 		srp = NULL;
 		if (NULL == sfp->headrp) {
-			SCSI_LOG_TIMEOUT(1, printk("sg...bh: already closed, final cleanup\n"));
+			SCSI_LOG_TIMEOUT(1, printk("sg_cmd_done: already closed, final cleanup\n"));
 			if (0 == sg_remove_sfp(sdp, sfp)) {	/* device still present */
 				scsi_device_put(sdp->device);
 			}
@@ -1512,12 +1512,12 @@
 						    POLL_HUP);
 				}
 			}
-			SCSI_LOG_TIMEOUT(3, printk("sg_detach: dev=%d, dirty\n", k));
+			SCSI_LOG_TIMEOUT(3, printk("sg_remove: dev=%d, dirty\n", k));
 			if (NULL == sdp->headfp) {
 				sg_dev_arr[k] = NULL;
 			}
 		} else {	/* nothing active, simple case */
-			SCSI_LOG_TIMEOUT(3, printk("sg_detach: dev=%d\n", k));
+			SCSI_LOG_TIMEOUT(3, printk("sg_remove: dev=%d\n", k));
 			sg_dev_arr[k] = NULL;
 		}
 		sg_nr_dev--;
@@ -1876,14 +1876,15 @@
 			}
 		}
 		sg->page = p;
-		sg->length = ret_sz;
+		sg->length = (ret_sz > num) ? num : ret_sz;
 
-		SCSI_LOG_TIMEOUT(5, printk("sg_build_build: k=%d, a=0x%p, len=%d\n",
-				  k, p, ret_sz));
+		SCSI_LOG_TIMEOUT(5, printk("sg_build_indirect: k=%d, num=%d, "
+				 "ret_sz=%d\n", k, num, ret_sz));
 	}		/* end of for loop */
 
 	schp->k_use_sg = k;
-	SCSI_LOG_TIMEOUT(5, printk("sg_build_indirect: k_use_sg=%d, rem_sz=%d\n", k, rem_sz));
+	SCSI_LOG_TIMEOUT(5, printk("sg_build_indirect: k_use_sg=%d, "
+			 "rem_sz=%d\n", k, rem_sz));
 
 	schp->bufflen = blk_size;
 	if (rem_sz > 0)	/* must have failed */
@@ -2014,7 +2015,7 @@
 			for (k = 0; (k < schp->k_use_sg) && sg->page;
 			     ++k, ++sg) {
 				SCSI_LOG_TIMEOUT(5, printk(
-				    "sg_remove_scat: k=%d, a=0x%p, len=%d\n",
+				    "sg_remove_scat: k=%d, pg=0x%p, len=%d\n",
 				    k, sg->page, sg->length));
 				sg_page_free(sg->page, sg->length);
 			}
diff -urN linux-2.6.19-rc6/drivers/usb/core/message.c linux-2.6.19/drivers/usb/core/message.c
--- linux-2.6.19-rc6/drivers/usb/core/message.c	2006-11-29 22:48:09.124749294 +0000
+++ linux-2.6.19/drivers/usb/core/message.c	2006-11-29 22:48:13.917269987 +0000
@@ -828,10 +828,7 @@
  * Context: !in_interrupt ()
  *
  * Updates the copy of the device descriptor stored in the device structure,
- * which dedicates space for this purpose.  Note that several fields are
- * converted to the host CPU's byte order:  the USB version (bcdUSB), and
- * vendors product and version fields (idVendor, idProduct, and bcdDevice).
- * That lets device drivers compare against non-byteswapped constants.
+ * which dedicates space for this purpose.
  *
  * Not exported, only for use by the core.  If drivers really want to read
  * the device descriptor directly, they can call usb_get_descriptor() with
diff -urN linux-2.6.19-rc6/drivers/usb/host/ohci-hcd.c linux-2.6.19/drivers/usb/host/ohci-hcd.c
--- linux-2.6.19-rc6/drivers/usb/host/ohci-hcd.c	2006-11-29 22:48:09.144751467 +0000
+++ linux-2.6.19/drivers/usb/host/ohci-hcd.c	2006-11-29 22:48:13.937272161 +0000
@@ -715,13 +715,6 @@
 		return IRQ_NOTMINE;
 	}
 
-	if (ints & OHCI_INTR_RHSC) {
-		ohci_vdbg (ohci, "rhsc\n");
-		ohci->next_statechange = jiffies + STATECHANGE_DELAY;
-		ohci_writel (ohci, OHCI_INTR_RHSC, &regs->intrstatus);
-		usb_hcd_poll_rh_status(hcd);
-	}
-
 	if (ints & OHCI_INTR_UE) {
 		disable (ohci);
 		ohci_err (ohci, "OHCI Unrecoverable Error, disabled\n");
@@ -731,9 +724,21 @@
 		ohci_usb_reset (ohci);
 	}
 
-	if (ints & OHCI_INTR_RD) {
-		ohci_vdbg (ohci, "resume detect\n");
-		ohci_writel (ohci, OHCI_INTR_RD, &regs->intrstatus);
+	if (ints & OHCI_INTR_RHSC) {
+		ohci_vdbg(ohci, "rhsc\n");
+		ohci->next_statechange = jiffies + STATECHANGE_DELAY;
+		ohci_writel(ohci, OHCI_INTR_RD | OHCI_INTR_RHSC,
+				&regs->intrstatus);
+		usb_hcd_poll_rh_status(hcd);
+	}
+
+	/* For connect and disconnect events, we expect the controller
+	 * to turn on RHSC along with RD.  But for remote wakeup events
+	 * this might not happen.
+	 */
+	else if (ints & OHCI_INTR_RD) {
+		ohci_vdbg(ohci, "resume detect\n");
+		ohci_writel(ohci, OHCI_INTR_RD, &regs->intrstatus);
 		hcd->poll_rh = 1;
 		if (ohci->autostop) {
 			spin_lock (&ohci->lock);
diff -urN linux-2.6.19-rc6/drivers/usb/host/ohci-hub.c linux-2.6.19/drivers/usb/host/ohci-hub.c
--- linux-2.6.19-rc6/drivers/usb/host/ohci-hub.c	2006-11-29 22:48:09.144751467 +0000
+++ linux-2.6.19/drivers/usb/host/ohci-hub.c	2006-11-29 22:48:13.937272161 +0000
@@ -169,7 +169,8 @@
 		break;
 	case OHCI_USB_RESUME:
 		/* HCFS changes sometime after INTR_RD */
-		ohci_info (ohci, "wakeup\n");
+		ohci_info(ohci, "%swakeup\n",
+				autostopped ? "auto-" : "");
 		break;
 	case OHCI_USB_OPER:
 		/* this can happen after resuming a swsusp snapshot */
@@ -422,7 +423,8 @@
 				ohci->autostop = 0;
 				ohci->next_statechange = jiffies +
 						STATECHANGE_DELAY;
-			} else if (time_after_eq (jiffies,
+			} else if (device_may_wakeup(&hcd->self.root_hub->dev)
+					&& time_after_eq(jiffies,
 						ohci->next_statechange)
 					&& !ohci->ed_rm_list
 					&& !(ohci->hc_control &
diff -urN linux-2.6.19-rc6/drivers/usb/input/ati_remote.c linux-2.6.19/drivers/usb/input/ati_remote.c
--- linux-2.6.19-rc6/drivers/usb/input/ati_remote.c	2006-11-29 22:48:09.156752771 +0000
+++ linux-2.6.19/drivers/usb/input/ati_remote.c	2006-11-29 22:48:13.949273464 +0000
@@ -636,13 +636,11 @@
 	if (ati_remote->out_urb)
 		usb_free_urb(ati_remote->out_urb);
 
-	if (ati_remote->inbuf)
-		usb_buffer_free(ati_remote->udev, DATA_BUFSIZE,
-				ati_remote->inbuf, ati_remote->inbuf_dma);
-
-	if (ati_remote->outbuf)
-		usb_buffer_free(ati_remote->udev, DATA_BUFSIZE,
-				ati_remote->inbuf, ati_remote->outbuf_dma);
+	usb_buffer_free(ati_remote->udev, DATA_BUFSIZE,
+		ati_remote->inbuf, ati_remote->inbuf_dma);
+
+	usb_buffer_free(ati_remote->udev, DATA_BUFSIZE,
+		ati_remote->outbuf, ati_remote->outbuf_dma);
 }
 
 static void ati_remote_input_init(struct ati_remote *ati_remote)
diff -urN linux-2.6.19-rc6/drivers/usb/input/hid-core.c linux-2.6.19/drivers/usb/input/hid-core.c
--- linux-2.6.19-rc6/drivers/usb/input/hid-core.c	2006-11-29 22:48:09.156752771 +0000
+++ linux-2.6.19/drivers/usb/input/hid-core.c	2006-11-29 22:48:13.953273899 +0000
@@ -1797,11 +1797,12 @@
 	{ USB_VENDOR_ID_APPLE, 0x020E, HID_QUIRK_POWERBOOK_HAS_FN },
 	{ USB_VENDOR_ID_APPLE, 0x020F, HID_QUIRK_POWERBOOK_HAS_FN },
 	{ USB_VENDOR_ID_APPLE, 0x0214, HID_QUIRK_POWERBOOK_HAS_FN },
-	{ USB_VENDOR_ID_APPLE, 0x0215, HID_QUIRK_POWERBOOK_HAS_FN },
+	{ USB_VENDOR_ID_APPLE, 0x0215, HID_QUIRK_POWERBOOK_HAS_FN | HID_QUIRK_POWERBOOK_ISO_KEYBOARD},
 	{ USB_VENDOR_ID_APPLE, 0x0216, HID_QUIRK_POWERBOOK_HAS_FN },
 	{ USB_VENDOR_ID_APPLE, 0x0217, HID_QUIRK_POWERBOOK_HAS_FN },
-	{ USB_VENDOR_ID_APPLE, 0x0218, HID_QUIRK_POWERBOOK_HAS_FN },
+	{ USB_VENDOR_ID_APPLE, 0x0218, HID_QUIRK_POWERBOOK_HAS_FN | HID_QUIRK_POWERBOOK_ISO_KEYBOARD},
 	{ USB_VENDOR_ID_APPLE, 0x0219, HID_QUIRK_POWERBOOK_HAS_FN },
+	{ USB_VENDOR_ID_APPLE, 0x021B, HID_QUIRK_POWERBOOK_HAS_FN },
 	{ USB_VENDOR_ID_APPLE, 0x030A, HID_QUIRK_POWERBOOK_HAS_FN },
 	{ USB_VENDOR_ID_APPLE, 0x030B, HID_QUIRK_POWERBOOK_HAS_FN },
 
diff -urN linux-2.6.19-rc6/drivers/usb/input/hid-input.c linux-2.6.19/drivers/usb/input/hid-input.c
--- linux-2.6.19-rc6/drivers/usb/input/hid-input.c	2006-11-29 22:48:09.156752771 +0000
+++ linux-2.6.19/drivers/usb/input/hid-input.c	2006-11-29 22:48:13.953273899 +0000
@@ -121,6 +121,12 @@
 	{ }
 };
 
+static struct hidinput_key_translation powerbook_iso_keyboard[] = {
+	{ KEY_GRAVE,    KEY_102ND },
+	{ KEY_102ND,    KEY_GRAVE },
+	{ }
+};
+
 static int usbhid_pb_fnmode = 1;
 module_param_named(pb_fnmode, usbhid_pb_fnmode, int, 0644);
 MODULE_PARM_DESC(pb_fnmode,
@@ -195,6 +201,14 @@
 		}
 	}
 
+	if (hid->quirks & HID_QUIRK_POWERBOOK_ISO_KEYBOARD) {
+		trans = find_translation(powerbook_iso_keyboard, usage->code);
+		if (trans) {
+			input_event(input, usage->type, trans->to, value);
+			return 1;
+		}
+	}
+
 	return 0;
 }
 
@@ -210,6 +224,9 @@
 
 	for (trans = powerbook_numlock_keys; trans->from; trans++)
 		set_bit(trans->to, input->keybit);
+
+	for (trans = powerbook_iso_keyboard; trans->from; trans++)
+		set_bit(trans->to, input->keybit);
 }
 #else
 static inline int hidinput_pb_event(struct hid_device *hid, struct input_dev *input,
diff -urN linux-2.6.19-rc6/drivers/usb/input/hid.h linux-2.6.19/drivers/usb/input/hid.h
--- linux-2.6.19-rc6/drivers/usb/input/hid.h	2006-11-29 22:48:09.160753206 +0000
+++ linux-2.6.19/drivers/usb/input/hid.h	2006-11-29 22:48:13.953273899 +0000
@@ -260,6 +260,7 @@
 #define HID_QUIRK_POWERBOOK_HAS_FN		0x00001000
 #define HID_QUIRK_POWERBOOK_FN_ON		0x00002000
 #define HID_QUIRK_INVERT_HWHEEL			0x00004000
+#define HID_QUIRK_POWERBOOK_ISO_KEYBOARD	0x00008000
 
 /*
  * This is the global environment of the parser. This information is
diff -urN linux-2.6.19-rc6/drivers/usb/misc/auerswald.c linux-2.6.19/drivers/usb/misc/auerswald.c
--- linux-2.6.19-rc6/drivers/usb/misc/auerswald.c	2006-11-29 22:48:09.168754075 +0000
+++ linux-2.6.19/drivers/usb/misc/auerswald.c	2006-11-29 22:48:13.965275203 +0000
@@ -780,7 +780,7 @@
 
 bl_fail:/* not enough memory. Free allocated elements */
         dbg ("auerbuf_setup: no more memory");
-	kfree(bep);
+	auerbuf_free(bep);
         auerbuf_free_buffers (bcp);
         return -ENOMEM;
 }
diff -urN linux-2.6.19-rc6/drivers/usb/serial/ftdi_sio.c linux-2.6.19/drivers/usb/serial/ftdi_sio.c
--- linux-2.6.19-rc6/drivers/usb/serial/ftdi_sio.c	2006-11-29 22:48:09.188756248 +0000
+++ linux-2.6.19/drivers/usb/serial/ftdi_sio.c	2006-11-29 22:48:13.985277376 +0000
@@ -311,6 +311,7 @@
 	{ USB_DEVICE(FTDI_VID, FTDI_ACTZWAVE_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_IRTRANS_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_IPLUS_PID) },
+	{ USB_DEVICE(FTDI_VID, FTDI_DMX4ALL) },
 	{ USB_DEVICE(FTDI_VID, FTDI_SIO_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_8U232AM_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_8U232AM_ALT_PID) },
@@ -511,6 +512,7 @@
 	{ USB_DEVICE(FTDI_VID, FTDI_TACTRIX_OPENPORT_13M_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_TACTRIX_OPENPORT_13S_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_TACTRIX_OPENPORT_13U_PID) },
+	{ USB_DEVICE(ELEKTOR_VID, ELEKTOR_FT323R_PID) },
 	{ },					/* Optional parameter entry */
 	{ }					/* Terminating entry */
 };
diff -urN linux-2.6.19-rc6/drivers/usb/serial/ftdi_sio.h linux-2.6.19/drivers/usb/serial/ftdi_sio.h
--- linux-2.6.19-rc6/drivers/usb/serial/ftdi_sio.h	2006-11-29 22:48:09.188756248 +0000
+++ linux-2.6.19/drivers/usb/serial/ftdi_sio.h	2006-11-29 22:48:13.985277376 +0000
@@ -55,6 +55,9 @@
 /* iPlus device */
 #define FTDI_IPLUS_PID 0xD070 /* Product Id */
 
+/* DMX4ALL DMX Interfaces */
+#define FTDI_DMX4ALL 0xC850
+
 /* www.crystalfontz.com devices - thanx for providing free devices for evaluation ! */
 /* they use the ftdi chipset for the USB interface and the vendor id is the same */
 #define FTDI_XF_632_PID 0xFC08	/* 632: 16x2 Character Display */
@@ -175,9 +178,15 @@
 #define FTDI_ASK_RDR400_PID	0xC991	/* ASK RDR 400 series card reader */
 
 /*
+ * FTDI USB UART chips used in construction projects from the
+ * Elektor Electronics magazine (http://elektor-electronics.co.uk)
+ */
+#define ELEKTOR_VID		0x0C7D
+#define ELEKTOR_FT323R_PID	0x0005	/* RFID-Reader, issue 09-2006 */
+
+/*
  * DSS-20 Sync Station for Sony Ericsson P800
  */
- 
 #define FTDI_DSS20_PID          0xFC82  
 
 /*
diff -urN linux-2.6.19-rc6/drivers/usb/serial/ipaq.c linux-2.6.19/drivers/usb/serial/ipaq.c
--- linux-2.6.19-rc6/drivers/usb/serial/ipaq.c	2006-11-29 22:48:09.192756683 +0000
+++ linux-2.6.19/drivers/usb/serial/ipaq.c	2006-11-29 22:48:13.989277811 +0000
@@ -320,6 +320,7 @@
 	{ USB_DEVICE(0x0B05, 0x9200) }, /* ASUS USB Sync */
 	{ USB_DEVICE(0x0B05, 0x9202) }, /* ASUS USB Sync */
 	{ USB_DEVICE(0x0BB4, 0x00CE) }, /* HTC USB Sync */
+	{ USB_DEVICE(0x0BB4, 0x00CF) }, /* HTC USB Modem */
 	{ USB_DEVICE(0x0BB4, 0x0A01) }, /* PocketPC USB Sync */
 	{ USB_DEVICE(0x0BB4, 0x0A02) }, /* PocketPC USB Sync */
 	{ USB_DEVICE(0x0BB4, 0x0A03) }, /* PocketPC USB Sync */
diff -urN linux-2.6.19-rc6/drivers/usb/storage/unusual_devs.h linux-2.6.19/drivers/usb/storage/unusual_devs.h
--- linux-2.6.19-rc6/drivers/usb/storage/unusual_devs.h	2006-11-29 22:48:09.204757986 +0000
+++ linux-2.6.19/drivers/usb/storage/unusual_devs.h	2006-11-29 22:48:14.001279115 +0000
@@ -1306,25 +1306,13 @@
 		US_SC_DEVICE, US_PR_DEVICE, NULL,
 		US_FL_FIX_CAPACITY ),
 
-/* Reported by Jan Mate <mate@fiit.stuba.sk> */
-UNUSUAL_DEV(  0x0fce, 0xe030, 0x0000, 0x0000,
-		"Sony Ericsson",
-		"P990i",
-		US_SC_DEVICE, US_PR_DEVICE, NULL,
-		US_FL_FIX_CAPACITY ),
-
-/* Reported by Jan Mate <mate@fiit.stuba.sk> */
-UNUSUAL_DEV(  0x0fce, 0xe030, 0x0000, 0x0000,
-		"Sony Ericsson",
-		"P990i",
-		US_SC_DEVICE, US_PR_DEVICE, NULL,
-		US_FL_FIX_CAPACITY ),
-
 /* Reported by Kevin Cernekee <kpc-usbdev@gelato.uiuc.edu>
  * Tested on hardware version 1.10.
  * Entry is needed only for the initializer function override.
+ * Devices with bcd > 110 seem to not need it while those
+ * with bcd < 110 appear to need it.
  */
-UNUSUAL_DEV(  0x1019, 0x0c55, 0x0110, 0x0110,
+UNUSUAL_DEV(  0x1019, 0x0c55, 0x0000, 0x0110,
 		"Desknote",
 		"UCR-61S2B",
 		US_SC_DEVICE, US_PR_DEVICE, usb_stor_ucr61s2b_init,
diff -urN linux-2.6.19-rc6/drivers/video/aty/atyfb_base.c linux-2.6.19/drivers/video/aty/atyfb_base.c
--- linux-2.6.19-rc6/drivers/video/aty/atyfb_base.c	2006-11-29 22:48:09.212758856 +0000
+++ linux-2.6.19/drivers/video/aty/atyfb_base.c	2006-11-29 22:48:14.005279549 +0000
@@ -406,7 +406,7 @@
 	{ PCI_CHIP_MACH64LB, "3D RAGE LT PRO (Mach64 LB, AGP)", 236, 75, 100, 135, ATI_CHIP_264LTPRO },
 	{ PCI_CHIP_MACH64LD, "3D RAGE LT PRO (Mach64 LD, AGP)", 230, 100, 100, 135, ATI_CHIP_264LTPRO },
 	{ PCI_CHIP_MACH64LI, "3D RAGE LT PRO (Mach64 LI, PCI)", 230, 100, 100, 135, ATI_CHIP_264LTPRO | M64F_G3_PB_1_1 | M64F_G3_PB_1024x768 },
-	{ PCI_CHIP_MACH64LP, "3D RAGE LT PRO (Mach64 LP, PCI)", 230, 100, 100, 135, ATI_CHIP_264LTPRO },
+	{ PCI_CHIP_MACH64LP, "3D RAGE LT PRO (Mach64 LP, PCI)", 230, 100, 100, 135, ATI_CHIP_264LTPRO | M64F_G3_PB_1024x768 },
 	{ PCI_CHIP_MACH64LQ, "3D RAGE LT PRO (Mach64 LQ, PCI)", 230, 100, 100, 135, ATI_CHIP_264LTPRO },
 
 	{ PCI_CHIP_MACH64GM, "3D RAGE XL (Mach64 GM, AGP 2x)", 230, 83, 63, 135, ATI_CHIP_264XL },
diff -urN linux-2.6.19-rc6/drivers/video/aty/radeon_i2c.c linux-2.6.19/drivers/video/aty/radeon_i2c.c
--- linux-2.6.19-rc6/drivers/video/aty/radeon_i2c.c	2006-11-29 22:48:09.212758856 +0000
+++ linux-2.6.19/drivers/video/aty/radeon_i2c.c	2006-11-29 22:48:14.005279549 +0000
@@ -139,7 +139,13 @@
 int radeon_probe_i2c_connector(struct radeonfb_info *rinfo, int conn,
 			       u8 **out_edid)
 {
-	u8 *edid = fb_ddc_read(&rinfo->i2c[conn-1].adapter);
+	u32 reg = rinfo->i2c[conn-1].ddc_reg;
+	u8 *edid;
+
+	OUTREG(reg, INREG(reg) &
+			~(VGA_DDC_DATA_OUTPUT | VGA_DDC_CLK_OUTPUT));
+
+	edid = fb_ddc_read(&rinfo->i2c[conn-1].adapter);
 
 	if (out_edid)
 		*out_edid = edid;
diff -urN linux-2.6.19-rc6/drivers/video/fb_ddc.c linux-2.6.19/drivers/video/fb_ddc.c
--- linux-2.6.19-rc6/drivers/video/fb_ddc.c	2006-11-29 22:48:09.216759290 +0000
+++ linux-2.6.19/drivers/video/fb_ddc.c	2006-11-29 22:48:14.013280419 +0000
@@ -20,26 +20,26 @@
 static unsigned char *fb_do_probe_ddc_edid(struct i2c_adapter *adapter)
 {
 	unsigned char start = 0x0;
+	unsigned char *buf = kmalloc(EDID_LENGTH, GFP_KERNEL);
 	struct i2c_msg msgs[] = {
 		{
 			.addr	= DDC_ADDR,
+			.flags	= 0,
 			.len	= 1,
 			.buf	= &start,
 		}, {
 			.addr	= DDC_ADDR,
 			.flags	= I2C_M_RD,
 			.len	= EDID_LENGTH,
+			.buf	= buf,
 		}
 	};
-	unsigned char *buf;
 
-	buf = kmalloc(EDID_LENGTH, GFP_KERNEL);
 	if (!buf) {
 		dev_warn(&adapter->dev, "unable to allocate memory for EDID "
 			 "block.\n");
 		return NULL;
 	}
-	msgs[1].buf = buf;
 
 	if (i2c_transfer(adapter, msgs, 2) == 2)
 		return buf;
diff -urN linux-2.6.19-rc6/drivers/video/pnx4008/pnxrgbfb.c linux-2.6.19/drivers/video/pnx4008/pnxrgbfb.c
--- linux-2.6.19-rc6/drivers/video/pnx4008/pnxrgbfb.c	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/drivers/video/pnx4008/pnxrgbfb.c	2006-11-29 22:48:14.017280853 +0000
@@ -154,7 +154,8 @@
 			goto err1;
 	}
 
-	if (!fb_get_options("pnxrgbfb", &option) && !strcmp(option, "nocursor"))
+	if (!fb_get_options("pnxrgbfb", &option) && option &&
+			!strcmp(option, "nocursor"))
 		rgbfb_ops.fb_cursor = no_cursor;
 
 	info->node = -1;
@@ -191,7 +192,7 @@
 
 static struct platform_driver rgbfb_driver = {
 	.driver = {
-		.name = "rgbfb",
+		.name = "pnx4008-rgbfb",
 	},
 	.probe = rgbfb_probe,
 	.remove = rgbfb_remove,
diff -urN linux-2.6.19-rc6/drivers/video/pnx4008/sdum.c linux-2.6.19/drivers/video/pnx4008/sdum.c
--- linux-2.6.19-rc6/drivers/video/pnx4008/sdum.c	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/drivers/video/pnx4008/sdum.c	2006-11-29 22:48:14.017280853 +0000
@@ -848,7 +848,7 @@
 
 static struct platform_driver sdum_driver = {
 	.driver = {
-		.name = "sdum",
+		.name = "pnx4008-sdum",
 	},
 	.probe = sdum_probe,
 	.remove = sdum_remove,
diff -urN linux-2.6.19-rc6/drivers/w1/masters/matrox_w1.c linux-2.6.19/drivers/w1/masters/matrox_w1.c
--- linux-2.6.19-rc6/drivers/w1/masters/matrox_w1.c	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/drivers/w1/masters/matrox_w1.c	2006-11-29 22:48:14.029282157 +0000
@@ -215,6 +215,8 @@
 	return 0;
 
 err_out_free_device:
+	if (dev->virt_addr)
+		iounmap(dev->virt_addr);
 	kfree(dev);
 
 	return err;
diff -urN linux-2.6.19-rc6/fs/Kconfig linux-2.6.19/fs/Kconfig
--- linux-2.6.19-rc6/fs/Kconfig	2006-11-29 22:48:09.236761464 +0000
+++ linux-2.6.19/fs/Kconfig	2006-11-29 22:48:14.029282157 +0000
@@ -2060,8 +2060,7 @@
 	  For most cases you probably want to say N.
 
 config AFS_FS
-# for fs/nls/Config.in
-	tristate "Andrew File System support (AFS) (Experimental)"
+	tristate "Andrew File System support (AFS) (EXPERIMENTAL)"
 	depends on INET && EXPERIMENTAL
 	select RXRPC
 	help
diff -urN linux-2.6.19-rc6/fs/debugfs/inode.c linux-2.6.19/fs/debugfs/inode.c
--- linux-2.6.19-rc6/fs/debugfs/inode.c	2006-11-29 22:48:09.264764506 +0000
+++ linux-2.6.19/fs/debugfs/inode.c	2006-11-29 22:48:14.057285200 +0000
@@ -21,6 +21,7 @@
 #include <linux/mount.h>
 #include <linux/pagemap.h>
 #include <linux/init.h>
+#include <linux/kobject.h>
 #include <linux/namei.h>
 #include <linux/debugfs.h>
 
@@ -147,13 +148,13 @@
 	*dentry = NULL;
 	mutex_lock(&parent->d_inode->i_mutex);
 	*dentry = lookup_one_len(name, parent, strlen(name));
-	if (!IS_ERR(dentry)) {
+	if (!IS_ERR(*dentry)) {
 		if ((mode & S_IFMT) == S_IFDIR)
 			error = debugfs_mkdir(parent->d_inode, *dentry, mode);
 		else 
 			error = debugfs_create(parent->d_inode, *dentry, mode);
 	} else
-		error = PTR_ERR(dentry);
+		error = PTR_ERR(*dentry);
 	mutex_unlock(&parent->d_inode->i_mutex);
 
 	return error;
diff -urN linux-2.6.19-rc6/fs/ecryptfs/crypto.c linux-2.6.19/fs/ecryptfs/crypto.c
--- linux-2.6.19-rc6/fs/ecryptfs/crypto.c	2006-11-29 22:48:09.276765810 +0000
+++ linux-2.6.19/fs/ecryptfs/crypto.c	2006-11-29 22:48:14.069286504 +0000
@@ -820,7 +820,8 @@
 	crypt_stat->tfm = crypto_alloc_blkcipher(full_alg_name, 0,
 						 CRYPTO_ALG_ASYNC);
 	kfree(full_alg_name);
-	if (!crypt_stat->tfm) {
+	if (IS_ERR(crypt_stat->tfm)) {
+		rc = PTR_ERR(crypt_stat->tfm);
 		ecryptfs_printk(KERN_ERR, "cryptfs: init_crypt_ctx(): "
 				"Error initializing cipher [%s]\n",
 				crypt_stat->cipher);
diff -urN linux-2.6.19-rc6/fs/ecryptfs/dentry.c linux-2.6.19/fs/ecryptfs/dentry.c
--- linux-2.6.19-rc6/fs/ecryptfs/dentry.c	2006-11-29 22:48:09.276765810 +0000
+++ linux-2.6.19/fs/ecryptfs/dentry.c	2006-11-29 22:48:14.069286504 +0000
@@ -57,6 +57,12 @@
 	rc = lower_dentry->d_op->d_revalidate(lower_dentry, nd);
 	nd->dentry = dentry_save;
 	nd->mnt = vfsmount_save;
+	if (dentry->d_inode) {
+		struct inode *lower_inode =
+			ecryptfs_inode_to_lower(dentry->d_inode);
+
+		ecryptfs_copy_attr_all(dentry->d_inode, lower_inode);
+	}
 out:
 	return rc;
 }
diff -urN linux-2.6.19-rc6/fs/ecryptfs/inode.c linux-2.6.19/fs/ecryptfs/inode.c
--- linux-2.6.19-rc6/fs/ecryptfs/inode.c	2006-11-29 22:48:09.280766245 +0000
+++ linux-2.6.19/fs/ecryptfs/inode.c	2006-11-29 22:48:14.073286938 +0000
@@ -470,6 +470,7 @@
 	unlock_dir(lower_dir_dentry);
 	dput(lower_new_dentry);
 	dput(lower_old_dentry);
+	d_drop(lower_old_dentry);
 	d_drop(new_dentry);
 	d_drop(old_dentry);
 	return rc;
@@ -484,7 +485,7 @@
 	lock_parent(lower_dentry);
 	rc = vfs_unlink(lower_dir_inode, lower_dentry);
 	if (rc) {
-		ecryptfs_printk(KERN_ERR, "Error in vfs_unlink\n");
+		printk(KERN_ERR "Error in vfs_unlink; rc = [%d]\n", rc);
 		goto out_unlock;
 	}
 	ecryptfs_copy_attr_times(dir, lower_dir_inode);
@@ -630,6 +631,8 @@
 		ecryptfs_copy_attr_all(old_dir, lower_old_dir_dentry->d_inode);
 out_lock:
 	unlock_rename(lower_old_dir_dentry, lower_new_dir_dentry);
+	dput(lower_new_dentry->d_parent);
+	dput(lower_old_dentry->d_parent);
 	dput(lower_new_dentry);
 	dput(lower_old_dentry);
 	return rc;
diff -urN linux-2.6.19-rc6/fs/fat/file.c linux-2.6.19/fs/fat/file.c
--- linux-2.6.19-rc6/fs/fat/file.c	2006-11-29 22:48:09.308769287 +0000
+++ linux-2.6.19/fs/fat/file.c	2006-11-29 22:48:14.101289981 +0000
@@ -303,7 +303,17 @@
 	fat_flush_inodes(inode->i_sb, inode, NULL);
 }
 
+int fat_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
+{
+	struct inode *inode = dentry->d_inode;
+	generic_fillattr(inode, stat);
+	stat->blksize = MSDOS_SB(inode->i_sb)->cluster_size;
+	return 0;
+}
+EXPORT_SYMBOL_GPL(fat_getattr);
+
 struct inode_operations fat_file_inode_operations = {
 	.truncate	= fat_truncate,
 	.setattr	= fat_notify_change,
+	.getattr	= fat_getattr,
 };
diff -urN linux-2.6.19-rc6/fs/fuse/dir.c linux-2.6.19/fs/fuse/dir.c
--- linux-2.6.19-rc6/fs/fuse/dir.c	2006-11-29 22:48:09.308769287 +0000
+++ linux-2.6.19/fs/fuse/dir.c	2006-11-29 22:48:14.105290415 +0000
@@ -138,6 +138,7 @@
 		struct fuse_entry_out outarg;
 		struct fuse_conn *fc;
 		struct fuse_req *req;
+		struct fuse_req *forget_req;
 		struct dentry *parent;
 
 		/* Doesn't hurt to "reset" the validity timeout */
@@ -152,25 +153,33 @@
 		if (IS_ERR(req))
 			return 0;
 
+		forget_req = fuse_get_req(fc);
+		if (IS_ERR(forget_req)) {
+			fuse_put_request(fc, req);
+			return 0;
+		}
+
 		parent = dget_parent(entry);
 		fuse_lookup_init(req, parent->d_inode, entry, &outarg);
 		request_send(fc, req);
 		dput(parent);
 		err = req->out.h.error;
+		fuse_put_request(fc, req);
 		/* Zero nodeid is same as -ENOENT */
 		if (!err && !outarg.nodeid)
 			err = -ENOENT;
 		if (!err) {
 			struct fuse_inode *fi = get_fuse_inode(inode);
 			if (outarg.nodeid != get_node_id(inode)) {
-				fuse_send_forget(fc, req, outarg.nodeid, 1);
+				fuse_send_forget(fc, forget_req,
+						 outarg.nodeid, 1);
 				return 0;
 			}
 			spin_lock(&fc->lock);
 			fi->nlookup ++;
 			spin_unlock(&fc->lock);
 		}
-		fuse_put_request(fc, req);
+		fuse_put_request(fc, forget_req);
 		if (err || (outarg.attr.mode ^ inode->i_mode) & S_IFMT)
 			return 0;
 
@@ -221,6 +230,7 @@
 	struct inode *inode = NULL;
 	struct fuse_conn *fc = get_fuse_conn(dir);
 	struct fuse_req *req;
+	struct fuse_req *forget_req;
 
 	if (entry->d_name.len > FUSE_NAME_MAX)
 		return ERR_PTR(-ENAMETOOLONG);
@@ -229,9 +239,16 @@
 	if (IS_ERR(req))
 		return ERR_PTR(PTR_ERR(req));
 
+	forget_req = fuse_get_req(fc);
+	if (IS_ERR(forget_req)) {
+		fuse_put_request(fc, req);
+		return ERR_PTR(PTR_ERR(forget_req));
+	}
+
 	fuse_lookup_init(req, dir, entry, &outarg);
 	request_send(fc, req);
 	err = req->out.h.error;
+	fuse_put_request(fc, req);
 	/* Zero nodeid is same as -ENOENT, but with valid timeout */
 	if (!err && outarg.nodeid &&
 	    (invalid_nodeid(outarg.nodeid) || !valid_mode(outarg.attr.mode)))
@@ -240,11 +257,11 @@
 		inode = fuse_iget(dir->i_sb, outarg.nodeid, outarg.generation,
 				  &outarg.attr);
 		if (!inode) {
-			fuse_send_forget(fc, req, outarg.nodeid, 1);
+			fuse_send_forget(fc, forget_req, outarg.nodeid, 1);
 			return ERR_PTR(-ENOMEM);
 		}
 	}
-	fuse_put_request(fc, req);
+	fuse_put_request(fc, forget_req);
 	if (err && err != -ENOENT)
 		return ERR_PTR(err);
 
@@ -388,6 +405,13 @@
 	struct fuse_entry_out outarg;
 	struct inode *inode;
 	int err;
+	struct fuse_req *forget_req;
+
+	forget_req = fuse_get_req(fc);
+	if (IS_ERR(forget_req)) {
+		fuse_put_request(fc, req);
+		return PTR_ERR(forget_req);
+	}
 
 	req->in.h.nodeid = get_node_id(dir);
 	req->out.numargs = 1;
@@ -395,24 +419,24 @@
 	req->out.args[0].value = &outarg;
 	request_send(fc, req);
 	err = req->out.h.error;
-	if (err) {
-		fuse_put_request(fc, req);
-		return err;
-	}
+	fuse_put_request(fc, req);
+	if (err)
+		goto out_put_forget_req;
+
 	err = -EIO;
 	if (invalid_nodeid(outarg.nodeid))
-		goto out_put_request;
+		goto out_put_forget_req;
 
 	if ((outarg.attr.mode ^ mode) & S_IFMT)
-		goto out_put_request;
+		goto out_put_forget_req;
 
 	inode = fuse_iget(dir->i_sb, outarg.nodeid, outarg.generation,
 			  &outarg.attr);
 	if (!inode) {
-		fuse_send_forget(fc, req, outarg.nodeid, 1);
+		fuse_send_forget(fc, forget_req, outarg.nodeid, 1);
 		return -ENOMEM;
 	}
-	fuse_put_request(fc, req);
+	fuse_put_request(fc, forget_req);
 
 	if (S_ISDIR(inode->i_mode)) {
 		struct dentry *alias;
@@ -434,8 +458,8 @@
 	fuse_invalidate_attr(dir);
 	return 0;
 
- out_put_request:
-	fuse_put_request(fc, req);
+ out_put_forget_req:
+	fuse_put_request(fc, forget_req);
 	return err;
 }
 
diff -urN linux-2.6.19-rc6/fs/hfs/super.c linux-2.6.19/fs/hfs/super.c
--- linux-2.6.19-rc6/fs/hfs/super.c	2006-11-29 22:48:09.336772329 +0000
+++ linux-2.6.19/fs/hfs/super.c	2006-11-29 22:48:14.129293023 +0000
@@ -390,11 +390,13 @@
 		hfs_find_exit(&fd);
 		goto bail_no_root;
 	}
+	res = -EINVAL;
 	root_inode = hfs_iget(sb, &fd.search_key->cat, &rec);
 	hfs_find_exit(&fd);
 	if (!root_inode)
 		goto bail_no_root;
 
+	res = -ENOMEM;
 	sb->s_root = d_alloc_root(root_inode);
 	if (!sb->s_root)
 		goto bail_iput;
diff -urN linux-2.6.19-rc6/fs/msdos/namei.c linux-2.6.19/fs/msdos/namei.c
--- linux-2.6.19-rc6/fs/msdos/namei.c	2006-11-29 22:48:09.372776241 +0000
+++ linux-2.6.19/fs/msdos/namei.c	2006-11-29 22:48:14.169297369 +0000
@@ -654,6 +654,7 @@
 	.rmdir		= msdos_rmdir,
 	.rename		= msdos_rename,
 	.setattr	= fat_notify_change,
+	.getattr	= fat_getattr,
 };
 
 static int msdos_fill_super(struct super_block *sb, void *data, int silent)
diff -urN linux-2.6.19-rc6/fs/proc/base.c linux-2.6.19/fs/proc/base.c
--- linux-2.6.19-rc6/fs/proc/base.c	2006-11-29 22:48:09.460785803 +0000
+++ linux-2.6.19/fs/proc/base.c	2006-11-29 22:48:14.257306931 +0000
@@ -442,7 +442,8 @@
 
 		if (task) {
 			task_lock(task);
-			namespace = task->nsproxy->namespace;
+			if (task->nsproxy)
+				namespace = task->nsproxy->namespace;
 			if (namespace)
 				get_namespace(namespace);
 			task_unlock(task);
diff -urN linux-2.6.19-rc6/fs/reiserfs/file.c linux-2.6.19/fs/reiserfs/file.c
--- linux-2.6.19-rc6/fs/reiserfs/file.c	2006-11-29 22:48:09.468786672 +0000
+++ linux-2.6.19/fs/reiserfs/file.c	2006-11-29 22:48:14.261307366 +0000
@@ -74,7 +74,8 @@
 			igrab(inode);
 			reiserfs_warning(inode->i_sb,
 					 "pinning inode %lu because the "
-					 "preallocation can't be freed");
+					 "preallocation can't be freed",
+					 inode->i_ino);
 			goto out;
 		}
 	}
diff -urN linux-2.6.19-rc6/fs/vfat/namei.c linux-2.6.19/fs/vfat/namei.c
--- linux-2.6.19-rc6/fs/vfat/namei.c	2006-11-29 22:48:09.480787976 +0000
+++ linux-2.6.19/fs/vfat/namei.c	2006-11-29 22:48:14.277309105 +0000
@@ -1004,6 +1004,7 @@
 	.rmdir		= vfat_rmdir,
 	.rename		= vfat_rename,
 	.setattr	= fat_notify_change,
+	.getattr	= fat_getattr,
 };
 
 static int vfat_fill_super(struct super_block *sb, void *data, int silent)
diff -urN linux-2.6.19-rc6/fs/xfs/xfs_bmap.c linux-2.6.19/fs/xfs/xfs_bmap.c
--- linux-2.6.19-rc6/fs/xfs/xfs_bmap.c	2006-11-29 22:48:09.496789715 +0000
+++ linux-2.6.19/fs/xfs/xfs_bmap.c	2006-11-29 22:48:14.289310409 +0000
@@ -1171,6 +1171,8 @@
 		xfs_bmap_trace_pre_update(fname, "0", ip, idx, XFS_DATA_FORK);
 		xfs_bmbt_set_blockcount(ep, temp);
 		r[0] = *new;
+		r[1].br_state = PREV.br_state;
+		r[1].br_startblock = 0;
 		r[1].br_startoff = new_endoff;
 		temp2 = PREV.br_startoff + PREV.br_blockcount - new_endoff;
 		r[1].br_blockcount = temp2;
diff -urN linux-2.6.19-rc6/fs/xfs/xfs_inode.c linux-2.6.19/fs/xfs/xfs_inode.c
--- linux-2.6.19-rc6/fs/xfs/xfs_inode.c	2006-11-29 22:48:09.504790584 +0000
+++ linux-2.6.19/fs/xfs/xfs_inode.c	2006-11-29 22:48:14.297311278 +0000
@@ -2258,7 +2258,7 @@
 				AIL_LOCK(mp,s);
 				iip->ili_flush_lsn = iip->ili_item.li_lsn;
 				AIL_UNLOCK(mp, s);
-				xfs_iflags_set(ip, XFS_ISTALE);
+				xfs_iflags_set(iip->ili_inode, XFS_ISTALE);
 				pre_flushed++;
 			}
 			lip = lip->li_bio_list;
diff -urN linux-2.6.19-rc6/include/asm-arm/arch-ebsa110/io.h linux-2.6.19/include/asm-arm/arch-ebsa110/io.h
--- linux-2.6.19-rc6/include/asm-arm/arch-ebsa110/io.h	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/include/asm-arm/arch-ebsa110/io.h	2006-11-29 22:48:14.309312582 +0000
@@ -27,9 +27,9 @@
 u32 __inl(unsigned int port);
 void __outl(u32 val, unsigned int port);
 
-u8  __readb(void __iomem *addr);
-u16 __readw(void __iomem *addr);
-u32 __readl(void __iomem *addr);
+u8  __readb(const volatile void __iomem *addr);
+u16 __readw(const volatile void __iomem *addr);
+u32 __readl(const volatile void __iomem *addr);
 
 void __writeb(u8  val, void __iomem *addr);
 void __writew(u16 val, void __iomem *addr);
@@ -64,8 +64,14 @@
 #define writew(v,b)		__writew(v,b)
 #define writel(v,b)		__writel(v,b)
 
-#define __arch_ioremap(cookie,sz,c)	((void __iomem *)(cookie))
-#define __arch_iounmap(cookie)		do { } while (0)
+static inline void __iomem *__arch_ioremap(unsigned long cookie, size_t size,
+					   unsigned int flags)
+{
+	return (void __iomem *)cookie;
+}
+
+#define __arch_ioremap		__arch_ioremap
+#define __arch_iounmap(cookie)	do { } while (0)
 
 extern void insb(unsigned int port, void *buf, int sz);
 extern void insw(unsigned int port, void *buf, int sz);
diff -urN linux-2.6.19-rc6/include/asm-arm/arch-pxa/udc.h linux-2.6.19/include/asm-arm/arch-pxa/udc.h
--- linux-2.6.19-rc6/include/asm-arm/arch-pxa/udc.h	2006-11-29 22:48:09.536794061 +0000
+++ linux-2.6.19/include/asm-arm/arch-pxa/udc.h	2006-11-29 22:48:14.329314755 +0000
@@ -4,23 +4,8 @@
  * This supports machine-specific differences in how the PXA2xx
  * USB Device Controller (UDC) is wired.
  *
- * It is set in linux/arch/arm/mach-pxa/<machine>.c and used in
- * the probe routine of linux/drivers/usb/gadget/pxa2xx_udc.c
  */
-struct pxa2xx_udc_mach_info {
-        int  (*udc_is_connected)(void);		/* do we see host? */
-        void (*udc_command)(int cmd);
-#define	PXA2XX_UDC_CMD_CONNECT		0	/* let host see us */
-#define	PXA2XX_UDC_CMD_DISCONNECT	1	/* so host won't see us */
-
-	/* Boards following the design guidelines in the developer's manual,
-	 * with on-chip GPIOs not Lubbock's wierd hardware, can have a sane
-	 * VBUS IRQ and omit the methods above.  Store the GPIO number
-	 * here; for GPIO 0, also mask in one of the pxa_gpio_mode() bits.
-	 */
-	u16	gpio_vbus;			/* high == vbus present */
-	u16	gpio_pullup;			/* high == pullup activated */
-};
+#include <asm/mach/udc_pxa2xx.h>
 
 extern void pxa_set_udc_info(struct pxa2xx_udc_mach_info *info);
 
diff -urN linux-2.6.19-rc6/include/asm-arm/dma-mapping.h linux-2.6.19/include/asm-arm/dma-mapping.h
--- linux-2.6.19-rc6/include/asm-arm/dma-mapping.h	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/include/asm-arm/dma-mapping.h	2006-11-29 22:48:14.333315190 +0000
@@ -12,6 +12,10 @@
  * uncached, unwrite-buffered mapped memory space for use with DMA
  * devices.  This is the "generic" version.  The PCI specific version
  * is in pci.h
+ *
+ * Note: Drivers should NOT use this function directly, as it will break
+ * platforms with CONFIG_DMABOUNCE.
+ * Use the driver DMA support - see dma-mapping.h (dma_sync_*)
  */
 extern void consistent_sync(void *kaddr, size_t size, int rw);
 
diff -urN linux-2.6.19-rc6/include/asm-arm/mach/udc_pxa2xx.h linux-2.6.19/include/asm-arm/mach/udc_pxa2xx.h
--- linux-2.6.19-rc6/include/asm-arm/mach/udc_pxa2xx.h	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.19/include/asm-arm/mach/udc_pxa2xx.h	2006-11-29 22:48:14.333315190 +0000
@@ -0,0 +1,26 @@
+/*
+ * linux/include/asm-arm/mach/udc_pxa2xx.h
+ *
+ * This supports machine-specific differences in how the PXA2xx
+ * USB Device Controller (UDC) is wired.
+ *
+ * It is set in linux/arch/arm/mach-pxa/<machine>.c or in
+ * linux/arch/mach-ixp4xx/<machine>.c and used in
+ * the probe routine of linux/drivers/usb/gadget/pxa2xx_udc.c
+ */
+
+struct pxa2xx_udc_mach_info {
+        int  (*udc_is_connected)(void);		/* do we see host? */
+        void (*udc_command)(int cmd);
+#define	PXA2XX_UDC_CMD_CONNECT		0	/* let host see us */
+#define	PXA2XX_UDC_CMD_DISCONNECT	1	/* so host won't see us */
+
+	/* Boards following the design guidelines in the developer's manual,
+	 * with on-chip GPIOs not Lubbock's wierd hardware, can have a sane
+	 * VBUS IRQ and omit the methods above.  Store the GPIO number
+	 * here; for GPIO 0, also mask in one of the pxa_gpio_mode() bits.
+	 */
+	u16	gpio_vbus;			/* high == vbus present */
+	u16	gpio_pullup;			/* high == pullup activated */
+};
+
diff -urN linux-2.6.19-rc6/include/asm-generic/vmlinux.lds.h linux-2.6.19/include/asm-generic/vmlinux.lds.h
--- linux-2.6.19-rc6/include/asm-generic/vmlinux.lds.h	2006-11-29 22:48:09.564797104 +0000
+++ linux-2.6.19/include/asm-generic/vmlinux.lds.h	2006-11-29 22:48:14.357317797 +0000
@@ -215,6 +215,8 @@
 		.notes : { *(.note.*) } :note
 
 #define INITCALLS							\
+  	*(.initcall0.init)						\
+  	*(.initcall0s.init)						\
   	*(.initcall1.init)						\
   	*(.initcall1s.init)						\
   	*(.initcall2.init)						\
diff -urN linux-2.6.19-rc6/include/asm-i386/mach-summit/mach_apic.h linux-2.6.19/include/asm-i386/mach-summit/mach_apic.h
--- linux-2.6.19-rc6/include/asm-i386/mach-summit/mach_apic.h	2006-11-29 22:48:09.568797538 +0000
+++ linux-2.6.19/include/asm-i386/mach-summit/mach_apic.h	2006-11-29 22:48:14.361318232 +0000
@@ -88,7 +88,11 @@
 
 static inline int apicid_to_node(int logical_apicid)
 {
+#ifdef CONFIG_SMP
 	return apicid_2_node[hard_smp_processor_id()];
+#else
+	return 0;
+#endif
 }
 
 /* Mapping from cpu number to logical apicid */
diff -urN linux-2.6.19-rc6/include/asm-m68knommu/irq_regs.h linux-2.6.19/include/asm-m68knommu/irq_regs.h
--- linux-2.6.19-rc6/include/asm-m68knommu/irq_regs.h	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.19/include/asm-m68knommu/irq_regs.h	2006-11-29 22:48:14.381320405 +0000
@@ -0,0 +1 @@
+#include <asm-generic/irq_regs.h>
diff -urN linux-2.6.19-rc6/include/asm-m68knommu/irqnode.h linux-2.6.19/include/asm-m68knommu/irqnode.h
--- linux-2.6.19-rc6/include/asm-m68knommu/irqnode.h	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/include/asm-m68knommu/irqnode.h	2006-11-29 22:48:14.381320405 +0000
@@ -8,7 +8,7 @@
  * interrupt source (if it supports chaining).
  */
 typedef struct irq_node {
-	irqreturn_t	(*handler)(int, void *, struct pt_regs *);
+	irq_handler_t	handler;
 	unsigned long	flags;
 	void		*dev_id;
 	const char	*devname;
@@ -18,12 +18,12 @@
 /*
  * This structure has only 4 elements for speed reasons
  */
-typedef struct irq_handler {
-	irqreturn_t	(*handler)(int, void *, struct pt_regs *);
+struct irq_entry {
+	irq_handler_t	handler;
 	unsigned long	flags;
 	void		*dev_id;
 	const char	*devname;
-} irq_handler_t;
+};
 
 /* count of spurious interrupts */
 extern volatile unsigned int num_spurious;
diff -urN linux-2.6.19-rc6/include/asm-m68knommu/machdep.h linux-2.6.19/include/asm-m68knommu/machdep.h
--- linux-2.6.19-rc6/include/asm-m68knommu/machdep.h	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/include/asm-m68knommu/machdep.h	2006-11-29 22:48:14.381320405 +0000
@@ -18,7 +18,7 @@
 extern void (*mach_kbd_leds) (unsigned int);
 /* machine dependent irq functions */
 extern void (*mach_init_IRQ) (void);
-extern irqreturn_t (*(*mach_default_handler)[]) (int, void *, struct pt_regs *);
+extern irq_handler_t mach_default_handler;
 extern int (*mach_request_irq) (unsigned int irq, void (*handler)(int, void *, struct pt_regs *),
                                 unsigned long flags, const char *devname, void *dev_id);
 extern void (*mach_free_irq) (unsigned int irq, void *dev_id);
diff -urN linux-2.6.19-rc6/include/asm-mips/mach-au1x00/au1xxx_ide.h linux-2.6.19/include/asm-mips/mach-au1x00/au1xxx_ide.h
--- linux-2.6.19-rc6/include/asm-mips/mach-au1x00/au1xxx_ide.h	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/include/asm-mips/mach-au1x00/au1xxx_ide.h	2006-11-29 22:48:14.389321274 +0000
@@ -170,10 +170,8 @@
         static int auide_dma_host_on(ide_drive_t *drive);
         static int auide_dma_lostirq(ide_drive_t *drive);
         static int auide_dma_on(ide_drive_t *drive);
-        static void auide_ddma_tx_callback(int irq, void *param,
-                                           struct pt_regs *regs);
-        static void auide_ddma_rx_callback(int irq, void *param,
-                                           struct pt_regs *regs);
+        static void auide_ddma_tx_callback(int irq, void *param);
+        static void auide_ddma_rx_callback(int irq, void *param);
         static int auide_dma_off_quietly(ide_drive_t *drive);
 #endif /* end CONFIG_BLK_DEV_IDE_AU1XXX_MDMA2_DBDMA */
 
diff -urN linux-2.6.19-rc6/include/asm-parisc/semaphore.h linux-2.6.19/include/asm-parisc/semaphore.h
--- linux-2.6.19-rc6/include/asm-parisc/semaphore.h	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/include/asm-parisc/semaphore.h	2006-11-29 22:48:14.401322578 +0000
@@ -115,7 +115,8 @@
  */
 extern __inline__ int down_trylock(struct semaphore * sem)
 {
-	int flags, count;
+	unsigned long flags;
+	int count;
 
 	spin_lock_irqsave(&sem->sentry, flags);
 	count = sem->count - 1;
@@ -131,7 +132,8 @@
  */
 extern __inline__ void up(struct semaphore * sem)
 {
-	int flags;
+	unsigned long flags;
+
 	spin_lock_irqsave(&sem->sentry, flags);
 	if (sem->count < 0) {
 		__up(sem);
diff -urN linux-2.6.19-rc6/include/asm-powerpc/time.h linux-2.6.19/include/asm-powerpc/time.h
--- linux-2.6.19-rc6/include/asm-powerpc/time.h	2006-11-29 22:48:09.620803189 +0000
+++ linux-2.6.19/include/asm-powerpc/time.h	2006-11-29 22:48:14.413323882 +0000
@@ -39,10 +39,6 @@
 extern void wakeup_decrementer(void);
 extern void snapshot_timebase(void);
 
-#ifdef CONFIG_RTC_CLASS
-extern int __init rtc_class_hookup(void);
-#endif
-
 /* Some sane defaults: 125 MHz timebase, 1GHz processor */
 extern unsigned long ppc_proc_freq;
 #define DEFAULT_PROC_FREQ	(DEFAULT_TB_FREQ * 8)
diff -urN linux-2.6.19-rc6/include/linux/crypto.h linux-2.6.19/include/linux/crypto.h
--- linux-2.6.19-rc6/include/linux/crypto.h	2006-11-29 22:48:09.704812316 +0000
+++ linux-2.6.19/include/linux/crypto.h	2006-11-29 22:48:14.497333010 +0000
@@ -245,7 +245,7 @@
 	__deprecated_for_modules;
 int crypto_has_alg(const char *name, u32 type, u32 mask);
 #else
-static int crypto_alg_available(const char *name, u32 flags);
+static int crypto_alg_available(const char *name, u32 flags)
 	__deprecated_for_modules;
 static inline int crypto_alg_available(const char *name, u32 flags)
 {
diff -urN linux-2.6.19-rc6/include/linux/igmp.h linux-2.6.19/include/linux/igmp.h
--- linux-2.6.19-rc6/include/linux/igmp.h	2006-11-29 22:48:09.720814055 +0000
+++ linux-2.6.19/include/linux/igmp.h	2006-11-29 22:48:14.509334313 +0000
@@ -191,7 +191,7 @@
 #define IGMPV3_MASK(value, nb) ((nb)>=32 ? (value) : ((1<<(nb))-1) & (value))
 #define IGMPV3_EXP(thresh, nbmant, nbexp, value) \
 	((value) < (thresh) ? (value) : \
-        ((IGMPV3_MASK(value, nbmant) | (1<<(nbmant+nbexp))) << \
+        ((IGMPV3_MASK(value, nbmant) | (1<<(nbmant))) << \
          (IGMPV3_MASK((value) >> (nbmant), nbexp) + (nbexp))))
 
 #define IGMPV3_QQIC(value) IGMPV3_EXP(0x80, 4, 3, value)
diff -urN linux-2.6.19-rc6/include/linux/in6.h linux-2.6.19/include/linux/in6.h
--- linux-2.6.19-rc6/include/linux/in6.h	2006-11-29 22:48:09.720814055 +0000
+++ linux-2.6.19/include/linux/in6.h	2006-11-29 22:48:14.513334748 +0000
@@ -225,7 +225,7 @@
 #endif
 
 /*
- * Netfilter
+ * Netfilter (1)
  *
  * Following socket options are used in ip6_tables;
  * see include/linux/netfilter_ipv6/ip6_tables.h.
@@ -240,4 +240,14 @@
 #define IPV6_RECVTCLASS		66
 #define IPV6_TCLASS		67
 
+/*
+ * Netfilter (2)
+ *
+ * Following socket options are used in ip6_tables;
+ * see include/linux/netfilter_ipv6/ip6_tables.h.
+ *
+ * IP6T_SO_GET_REVISION_MATCH	68
+ * IP6T_SO_GET_REVISION_TARGET	69
+ */
+
 #endif
diff -urN linux-2.6.19-rc6/include/linux/init.h linux-2.6.19/include/linux/init.h
--- linux-2.6.19-rc6/include/linux/init.h	2006-11-29 22:48:09.720814055 +0000
+++ linux-2.6.19/include/linux/init.h	2006-11-29 22:48:14.513334748 +0000
@@ -93,6 +93,14 @@
 	static initcall_t __initcall_##fn##id __attribute_used__ \
 	__attribute__((__section__(".initcall" level ".init"))) = fn
 
+/*
+ * A "pure" initcall has no dependencies on anything else, and purely
+ * initializes variables that couldn't be statically initialized.
+ *
+ * This only exists for built-in code, not for modules.
+ */
+#define pure_initcall(fn)		__define_initcall("0",fn,1)
+
 #define core_initcall(fn)		__define_initcall("1",fn,1)
 #define core_initcall_sync(fn)		__define_initcall("1s",fn,1s)
 #define postcore_initcall(fn)		__define_initcall("2",fn,2)
diff -urN linux-2.6.19-rc6/include/linux/kernel.h linux-2.6.19/include/linux/kernel.h
--- linux-2.6.19-rc6/include/linux/kernel.h	2006-11-29 22:48:09.728814924 +0000
+++ linux-2.6.19/include/linux/kernel.h	2006-11-29 22:48:14.517335183 +0000
@@ -30,8 +30,10 @@
 
 #define STACK_MAGIC	0xdeadbeef
 
+#define ALIGN(x,a)		__ALIGN_MASK(x,(typeof(x))(a)-1)
+#define __ALIGN_MASK(x,mask)	(((x)+(mask))&~(mask))
+
 #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
-#define ALIGN(x,a) (((x)+(a)-1UL)&~((a)-1UL))
 #define FIELD_SIZEOF(t, f) (sizeof(((t*)0)->f))
 #define DIV_ROUND_UP(n,d) (((n) + (d) - 1) / (d))
 #define roundup(x, y) ((((x) + ((y) - 1)) / (y)) * (y))
diff -urN linux-2.6.19-rc6/include/linux/msdos_fs.h linux-2.6.19/include/linux/msdos_fs.h
--- linux-2.6.19-rc6/include/linux/msdos_fs.h	2006-11-29 22:48:09.736815793 +0000
+++ linux-2.6.19/include/linux/msdos_fs.h	2006-11-29 22:48:14.525336052 +0000
@@ -402,6 +402,8 @@
 extern struct inode_operations fat_file_inode_operations;
 extern int fat_notify_change(struct dentry * dentry, struct iattr * attr);
 extern void fat_truncate(struct inode *inode);
+extern int fat_getattr(struct vfsmount *mnt, struct dentry *dentry,
+		       struct kstat *stat);
 
 /* fat/inode.c */
 extern void fat_attach(struct inode *inode, loff_t i_pos);
diff -urN linux-2.6.19-rc6/include/linux/netdevice.h linux-2.6.19/include/linux/netdevice.h
--- linux-2.6.19-rc6/include/linux/netdevice.h	2006-11-29 22:48:09.736815793 +0000
+++ linux-2.6.19/include/linux/netdevice.h	2006-11-29 22:48:14.525336052 +0000
@@ -93,8 +93,10 @@
 #endif
 #endif
 
-#if !defined(CONFIG_NET_IPIP) && \
-    !defined(CONFIG_IPV6) && !defined(CONFIG_IPV6_MODULE)
+#if !defined(CONFIG_NET_IPIP) && !defined(CONFIG_NET_IPIP_MODULE) && \
+    !defined(CONFIG_NET_IPGRE) &&  !defined(CONFIG_NET_IPGRE_MODULE) && \
+    !defined(CONFIG_IPV6_SIT) && !defined(CONFIG_IPV6_SIT_MODULE) && \
+    !defined(CONFIG_IPV6_TUNNEL) && !defined(CONFIG_IPV6_TUNNEL_MODULE)
 #define MAX_HEADER LL_MAX_HEADER
 #else
 #define MAX_HEADER (LL_MAX_HEADER + 48)
diff -urN linux-2.6.19-rc6/include/linux/netfilter/x_tables.h linux-2.6.19/include/linux/netfilter/x_tables.h
--- linux-2.6.19-rc6/include/linux/netfilter/x_tables.h	2006-11-29 22:48:09.740816228 +0000
+++ linux-2.6.19/include/linux/netfilter/x_tables.h	2006-11-29 22:48:14.529336487 +0000
@@ -96,22 +96,6 @@
 /* Error verdict. */
 #define XT_ERROR_TARGET "ERROR"
 
-/*
- * New IP firewall options for [gs]etsockopt at the RAW IP level.
- * Unlike BSD Linux inherits IP options so you don't have to use a raw
- * socket for this. Instead we check rights in the calls. */
-#define XT_BASE_CTL		64	/* base for firewall socket options */
-
-#define XT_SO_SET_REPLACE	(XT_BASE_CTL)
-#define XT_SO_SET_ADD_COUNTERS	(XT_BASE_CTL + 1)
-#define XT_SO_SET_MAX		XT_SO_SET_ADD_COUNTERS
-
-#define XT_SO_GET_INFO			(XT_BASE_CTL)
-#define XT_SO_GET_ENTRIES		(XT_BASE_CTL + 1)
-#define XT_SO_GET_REVISION_MATCH	(XT_BASE_CTL + 2)
-#define XT_SO_GET_REVISION_TARGET	(XT_BASE_CTL + 3)
-#define XT_SO_GET_MAX			XT_SO_GET_REVISION_TARGET
-
 #define SET_COUNTER(c,b,p) do { (c).bcnt = (b); (c).pcnt = (p); } while(0)
 #define ADD_COUNTER(c,b,p) do { (c).bcnt += (b); (c).pcnt += (p); } while(0)
 
diff -urN linux-2.6.19-rc6/include/linux/netfilter_arp/arp_tables.h linux-2.6.19/include/linux/netfilter_arp/arp_tables.h
--- linux-2.6.19-rc6/include/linux/netfilter_arp/arp_tables.h	2006-11-29 22:48:09.740816228 +0000
+++ linux-2.6.19/include/linux/netfilter_arp/arp_tables.h	2006-11-29 22:48:14.529336487 +0000
@@ -112,19 +112,20 @@
  * New IP firewall options for [gs]etsockopt at the RAW IP level.
  * Unlike BSD Linux inherits IP options so you don't have to use a raw
  * socket for this. Instead we check rights in the calls.
+ *
+ * ATTENTION: check linux/in.h before adding new number here.
  */
-#define ARPT_CTL_OFFSET		32
-#define ARPT_BASE_CTL		(XT_BASE_CTL+ARPT_CTL_OFFSET)
+#define ARPT_BASE_CTL		96
 
-#define ARPT_SO_SET_REPLACE		(XT_SO_SET_REPLACE+ARPT_CTL_OFFSET)
-#define ARPT_SO_SET_ADD_COUNTERS	(XT_SO_SET_ADD_COUNTERS+ARPT_CTL_OFFSET)
-#define ARPT_SO_SET_MAX			(XT_SO_SET_MAX+ARPT_CTL_OFFSET)
-
-#define ARPT_SO_GET_INFO		(XT_SO_GET_INFO+ARPT_CTL_OFFSET)
-#define ARPT_SO_GET_ENTRIES		(XT_SO_GET_ENTRIES+ARPT_CTL_OFFSET)
-/* #define ARPT_SO_GET_REVISION_MATCH	XT_SO_GET_REVISION_MATCH  */
-#define ARPT_SO_GET_REVISION_TARGET	(XT_SO_GET_REVISION_TARGET+ARPT_CTL_OFFSET)
-#define ARPT_SO_GET_MAX			(XT_SO_GET_REVISION_TARGET+ARPT_CTL_OFFSET)
+#define ARPT_SO_SET_REPLACE		(ARPT_BASE_CTL)
+#define ARPT_SO_SET_ADD_COUNTERS	(ARPT_BASE_CTL + 1)
+#define ARPT_SO_SET_MAX			ARPT_SO_SET_ADD_COUNTERS
+
+#define ARPT_SO_GET_INFO		(ARPT_BASE_CTL)
+#define ARPT_SO_GET_ENTRIES		(ARPT_BASE_CTL + 1)
+/* #define ARPT_SO_GET_REVISION_MATCH	(APRT_BASE_CTL + 2) */
+#define ARPT_SO_GET_REVISION_TARGET	(ARPT_BASE_CTL + 3)
+#define ARPT_SO_GET_MAX			(ARPT_SO_GET_REVISION_TARGET)
 
 /* CONTINUE verdict for targets */
 #define ARPT_CONTINUE XT_CONTINUE
diff -urN linux-2.6.19-rc6/include/linux/netfilter_ipv4/ip_tables.h linux-2.6.19/include/linux/netfilter_ipv4/ip_tables.h
--- linux-2.6.19-rc6/include/linux/netfilter_ipv4/ip_tables.h	2006-11-29 22:48:09.740816228 +0000
+++ linux-2.6.19/include/linux/netfilter_ipv4/ip_tables.h	2006-11-29 22:48:14.529336487 +0000
@@ -101,18 +101,21 @@
 /*
  * New IP firewall options for [gs]etsockopt at the RAW IP level.
  * Unlike BSD Linux inherits IP options so you don't have to use a raw
- * socket for this. Instead we check rights in the calls. */
-#define IPT_BASE_CTL		XT_BASE_CTL
+ * socket for this. Instead we check rights in the calls.
+ *
+ * ATTENTION: check linux/in.h before adding new number here.
+ */
+#define IPT_BASE_CTL		64
 
-#define IPT_SO_SET_REPLACE	XT_SO_SET_REPLACE
-#define IPT_SO_SET_ADD_COUNTERS	XT_SO_SET_ADD_COUNTERS
-#define IPT_SO_SET_MAX		XT_SO_SET_MAX
-
-#define IPT_SO_GET_INFO			XT_SO_GET_INFO
-#define IPT_SO_GET_ENTRIES		XT_SO_GET_ENTRIES
-#define IPT_SO_GET_REVISION_MATCH	XT_SO_GET_REVISION_MATCH
-#define IPT_SO_GET_REVISION_TARGET	XT_SO_GET_REVISION_TARGET
-#define IPT_SO_GET_MAX			XT_SO_GET_REVISION_TARGET
+#define IPT_SO_SET_REPLACE	(IPT_BASE_CTL)
+#define IPT_SO_SET_ADD_COUNTERS	(IPT_BASE_CTL + 1)
+#define IPT_SO_SET_MAX		IPT_SO_SET_ADD_COUNTERS
+
+#define IPT_SO_GET_INFO			(IPT_BASE_CTL)
+#define IPT_SO_GET_ENTRIES		(IPT_BASE_CTL + 1)
+#define IPT_SO_GET_REVISION_MATCH	(IPT_BASE_CTL + 2)
+#define IPT_SO_GET_REVISION_TARGET	(IPT_BASE_CTL + 3)
+#define IPT_SO_GET_MAX			IPT_SO_GET_REVISION_TARGET
 
 #define IPT_CONTINUE XT_CONTINUE
 #define IPT_RETURN XT_RETURN
diff -urN linux-2.6.19-rc6/include/linux/netfilter_ipv6/ip6_tables.h linux-2.6.19/include/linux/netfilter_ipv6/ip6_tables.h
--- linux-2.6.19-rc6/include/linux/netfilter_ipv6/ip6_tables.h	2006-11-29 22:48:09.744816662 +0000
+++ linux-2.6.19/include/linux/netfilter_ipv6/ip6_tables.h	2006-11-29 22:48:14.533336921 +0000
@@ -107,18 +107,21 @@
 /*
  * New IP firewall options for [gs]etsockopt at the RAW IP level.
  * Unlike BSD Linux inherits IP options so you don't have to use
- * a raw socket for this. Instead we check rights in the calls. */
-#define IP6T_BASE_CTL			XT_BASE_CTL
+ * a raw socket for this. Instead we check rights in the calls.
+ *
+ * ATTENTION: check linux/in6.h before adding new number here.
+ */
+#define IP6T_BASE_CTL			64
 
-#define IP6T_SO_SET_REPLACE		XT_SO_SET_REPLACE
-#define IP6T_SO_SET_ADD_COUNTERS	XT_SO_SET_ADD_COUNTERS
-#define IP6T_SO_SET_MAX			XT_SO_SET_MAX
-
-#define IP6T_SO_GET_INFO		XT_SO_GET_INFO
-#define IP6T_SO_GET_ENTRIES		XT_SO_GET_ENTRIES
-#define	IP6T_SO_GET_REVISION_MATCH	XT_SO_GET_REVISION_MATCH
-#define	IP6T_SO_GET_REVISION_TARGET	XT_SO_GET_REVISION_TARGET
-#define IP6T_SO_GET_MAX			XT_SO_GET_REVISION_TARGET
+#define IP6T_SO_SET_REPLACE		(IP6T_BASE_CTL)
+#define IP6T_SO_SET_ADD_COUNTERS	(IP6T_BASE_CTL + 1)
+#define IP6T_SO_SET_MAX			IP6T_SO_SET_ADD_COUNTERS
+
+#define IP6T_SO_GET_INFO		(IP6T_BASE_CTL)
+#define IP6T_SO_GET_ENTRIES		(IP6T_BASE_CTL + 1)
+#define IP6T_SO_GET_REVISION_MATCH	(IP6T_BASE_CTL + 4)
+#define IP6T_SO_GET_REVISION_TARGET	(IP6T_BASE_CTL + 5)
+#define IP6T_SO_GET_MAX			IP6T_SO_GET_REVISION_TARGET
 
 /* CONTINUE verdict for targets */
 #define IP6T_CONTINUE XT_CONTINUE
diff -urN linux-2.6.19-rc6/include/linux/nsproxy.h linux-2.6.19/include/linux/nsproxy.h
--- linux-2.6.19-rc6/include/linux/nsproxy.h	2006-11-29 22:48:09.748817097 +0000
+++ linux-2.6.19/include/linux/nsproxy.h	2006-11-29 22:48:14.537337356 +0000
@@ -45,8 +45,10 @@
 {
 	struct nsproxy *ns = p->nsproxy;
 	if (ns) {
-		put_nsproxy(ns);
+		task_lock(p);
 		p->nsproxy = NULL;
+		task_unlock(p);
+		put_nsproxy(ns);
 	}
 }
 #endif
diff -urN linux-2.6.19-rc6/include/linux/pci_regs.h linux-2.6.19/include/linux/pci_regs.h
--- linux-2.6.19-rc6/include/linux/pci_regs.h	2006-11-29 22:48:09.752817532 +0000
+++ linux-2.6.19/include/linux/pci_regs.h	2006-11-29 22:48:14.541337791 +0000
@@ -371,6 +371,7 @@
 #define  PCI_EXP_DEVSTA_TRPND	0x20	/* Transactions Pending */
 #define PCI_EXP_LNKCAP		12	/* Link Capabilities */
 #define PCI_EXP_LNKCTL		16	/* Link Control */
+#define  PCI_EXP_LNKCTL_CLKREQ_EN 0x100	/* Enable clkreq */
 #define PCI_EXP_LNKSTA		18	/* Link Status */
 #define PCI_EXP_SLTCAP		20	/* Slot Capabilities */
 #define PCI_EXP_SLTCTL		24	/* Slot Control */
diff -urN linux-2.6.19-rc6/include/linux/spinlock.h linux-2.6.19/include/linux/spinlock.h
--- linux-2.6.19-rc6/include/linux/spinlock.h	2006-11-29 22:48:09.760818401 +0000
+++ linux-2.6.19/include/linux/spinlock.h	2006-11-29 22:48:14.553339094 +0000
@@ -183,13 +183,27 @@
 #define read_lock(lock)			_read_lock(lock)
 
 #if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)
+
 #define spin_lock_irqsave(lock, flags)	flags = _spin_lock_irqsave(lock)
 #define read_lock_irqsave(lock, flags)	flags = _read_lock_irqsave(lock)
 #define write_lock_irqsave(lock, flags)	flags = _write_lock_irqsave(lock)
+
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+#define spin_lock_irqsave_nested(lock, flags, subclass) \
+	flags = _spin_lock_irqsave_nested(lock, subclass)
 #else
+#define spin_lock_irqsave_nested(lock, flags, subclass) \
+	flags = _spin_lock_irqsave(lock)
+#endif
+
+#else
+
 #define spin_lock_irqsave(lock, flags)	_spin_lock_irqsave(lock, flags)
 #define read_lock_irqsave(lock, flags)	_read_lock_irqsave(lock, flags)
 #define write_lock_irqsave(lock, flags)	_write_lock_irqsave(lock, flags)
+#define spin_lock_irqsave_nested(lock, flags, subclass)	\
+	spin_lock_irqsave(lock, flags)
+
 #endif
 
 #define spin_lock_irq(lock)		_spin_lock_irq(lock)
diff -urN linux-2.6.19-rc6/include/linux/spinlock_api_smp.h linux-2.6.19/include/linux/spinlock_api_smp.h
--- linux-2.6.19-rc6/include/linux/spinlock_api_smp.h	2006-11-29 22:48:09.764818835 +0000
+++ linux-2.6.19/include/linux/spinlock_api_smp.h	2006-11-29 22:48:14.553339094 +0000
@@ -32,6 +32,8 @@
 void __lockfunc _write_lock_irq(rwlock_t *lock)		__acquires(lock);
 unsigned long __lockfunc _spin_lock_irqsave(spinlock_t *lock)
 							__acquires(lock);
+unsigned long __lockfunc _spin_lock_irqsave_nested(spinlock_t *lock, int subclass)
+							__acquires(lock);
 unsigned long __lockfunc _read_lock_irqsave(rwlock_t *lock)
 							__acquires(lock);
 unsigned long __lockfunc _write_lock_irqsave(rwlock_t *lock)
diff -urN linux-2.6.19-rc6/include/net/sock.h linux-2.6.19/include/net/sock.h
--- linux-2.6.19-rc6/include/net/sock.h	2006-11-29 22:48:09.792821878 +0000
+++ linux-2.6.19/include/net/sock.h	2006-11-29 22:48:14.581342137 +0000
@@ -883,18 +883,23 @@
 }
 
 /**
- *	sk_filter_release: Release a socket filter
- *	@rcu: rcu_head that contains the sk_filter info to remove
- *
- *	Remove a filter from a socket and release its resources.
+ * 	sk_filter_rcu_free: Free a socket filter
+ *	@rcu: rcu_head that contains the sk_filter to free
  */
- 
 static inline void sk_filter_rcu_free(struct rcu_head *rcu)
 {
 	struct sk_filter *fp = container_of(rcu, struct sk_filter, rcu);
 	kfree(fp);
 }
 
+/**
+ *	sk_filter_release: Release a socket filter
+ *	@sk: socket
+ *	@fp: filter to remove
+ *
+ *	Remove a filter from a socket and release its resources.
+ */
+
 static inline void sk_filter_release(struct sock *sk, struct sk_filter *fp)
 {
 	unsigned int size = sk_filter_len(fp);
diff -urN linux-2.6.19-rc6/include/scsi/libsas.h linux-2.6.19/include/scsi/libsas.h
--- linux-2.6.19-rc6/include/scsi/libsas.h	2006-11-29 22:48:09.796822313 +0000
+++ linux-2.6.19/include/scsi/libsas.h	2006-11-29 22:48:14.585342572 +0000
@@ -35,6 +35,7 @@
 #include <scsi/scsi_device.h>
 #include <scsi/scsi_cmnd.h>
 #include <scsi/scsi_transport_sas.h>
+#include <asm/scatterlist.h>
 
 struct block_device;
 
diff -urN linux-2.6.19-rc6/include/sound/version.h linux-2.6.19/include/sound/version.h
--- linux-2.6.19-rc6/include/sound/version.h	2006-11-29 22:48:09.804823182 +0000
+++ linux-2.6.19/include/sound/version.h	2006-11-29 22:48:14.589343006 +0000
@@ -1,3 +1,3 @@
 /* include/version.h.  Generated by alsa/ksync script.  */
 #define CONFIG_SND_VERSION "1.0.13"
-#define CONFIG_SND_DATE " (Sun Oct 22 08:56:16 2006 UTC)"
+#define CONFIG_SND_DATE " (Tue Nov 28 14:07:24 2006 UTC)"
diff -urN linux-2.6.19-rc6/kernel/fork.c linux-2.6.19/kernel/fork.c
--- linux-2.6.19-rc6/kernel/fork.c	2006-11-29 22:48:09.816824486 +0000
+++ linux-2.6.19/kernel/fork.c	2006-11-29 22:48:14.601344310 +0000
@@ -1315,9 +1315,8 @@
 	struct pt_regs regs;
 
 	task = copy_process(CLONE_VM, 0, idle_regs(&regs), 0, NULL, NULL, 0);
-	if (!task)
-		return ERR_PTR(-ENOMEM);
-	init_idle(task, cpu);
+	if (!IS_ERR(task))
+		init_idle(task, cpu);
 
 	return task;
 }
diff -urN linux-2.6.19-rc6/kernel/irq/chip.c linux-2.6.19/kernel/irq/chip.c
--- linux-2.6.19-rc6/kernel/irq/chip.c	2006-11-29 22:48:09.816824486 +0000
+++ linux-2.6.19/kernel/irq/chip.c	2006-11-29 22:48:14.601344310 +0000
@@ -233,6 +233,8 @@
 		chip->shutdown = chip->disable;
 	if (!chip->name)
 		chip->name = chip->typename;
+	if (!chip->end)
+		chip->end = dummy_irq_chip.end;
 }
 
 static inline void mask_ack_irq(struct irq_desc *desc, int irq)
diff -urN linux-2.6.19-rc6/kernel/irq/handle.c linux-2.6.19/kernel/irq/handle.c
--- linux-2.6.19-rc6/kernel/irq/handle.c	2006-11-29 22:48:09.816824486 +0000
+++ linux-2.6.19/kernel/irq/handle.c	2006-11-29 22:48:14.601344310 +0000
@@ -231,10 +231,10 @@
 		spin_unlock(&desc->lock);
 
 		action_ret = handle_IRQ_event(irq, action);
-
-		spin_lock(&desc->lock);
 		if (!noirqdebug)
 			note_interrupt(irq, desc, action_ret);
+
+		spin_lock(&desc->lock);
 		if (likely(!(desc->status & IRQ_PENDING)))
 			break;
 		desc->status &= ~IRQ_PENDING;
diff -urN linux-2.6.19-rc6/kernel/irq/spurious.c linux-2.6.19/kernel/irq/spurious.c
--- linux-2.6.19-rc6/kernel/irq/spurious.c	2006-11-29 22:48:09.816824486 +0000
+++ linux-2.6.19/kernel/irq/spurious.c	2006-11-29 22:48:14.601344310 +0000
@@ -147,11 +147,7 @@
 	if (unlikely(irqfixup)) {
 		/* Don't punish working computers */
 		if ((irqfixup == 2 && irq == 0) || action_ret == IRQ_NONE) {
-			int ok;
-
-			spin_unlock(&desc->lock);
-			ok = misrouted_irq(irq);
-			spin_lock(&desc->lock);
+			int ok = misrouted_irq(irq);
 			if (action_ret == IRQ_NONE)
 				desc->irqs_unhandled -= ok;
 		}
diff -urN linux-2.6.19-rc6/kernel/kmod.c linux-2.6.19/kernel/kmod.c
--- linux-2.6.19-rc6/kernel/kmod.c	2006-11-29 22:48:09.816824486 +0000
+++ linux-2.6.19/kernel/kmod.c	2006-11-29 22:48:14.605344745 +0000
@@ -307,14 +307,14 @@
 		return 0;
 
 	f = create_write_pipe();
-	if (!f)
-		return -ENOMEM;
+	if (IS_ERR(f))
+		return PTR_ERR(f);
 	*filp = f;
 
 	f = create_read_pipe(f);
-	if (!f) {
+	if (IS_ERR(f)) {
 		free_write_pipe(*filp);
-		return -ENOMEM;
+		return PTR_ERR(f);
 	}
 	sub_info.stdin = f;
 
diff -urN linux-2.6.19-rc6/kernel/lockdep.c linux-2.6.19/kernel/lockdep.c
--- linux-2.6.19-rc6/kernel/lockdep.c	2006-11-29 22:48:09.820824920 +0000
+++ linux-2.6.19/kernel/lockdep.c	2006-11-29 22:48:14.605344745 +0000
@@ -1081,7 +1081,8 @@
 	 */
 	for_each_possible_cpu(i) {
 		start = (unsigned long) &__per_cpu_start + per_cpu_offset(i);
-		end   = (unsigned long) &__per_cpu_end   + per_cpu_offset(i);
+		end   = (unsigned long) &__per_cpu_start + PERCPU_ENOUGH_ROOM
+					+ per_cpu_offset(i);
 
 		if ((addr >= start) && (addr < end))
 			return 1;
diff -urN linux-2.6.19-rc6/kernel/spinlock.c linux-2.6.19/kernel/spinlock.c
--- linux-2.6.19-rc6/kernel/spinlock.c	2006-11-29 22:48:09.832826224 +0000
+++ linux-2.6.19/kernel/spinlock.c	2006-11-29 22:48:14.617346049 +0000
@@ -293,6 +293,27 @@
 }
 
 EXPORT_SYMBOL(_spin_lock_nested);
+unsigned long __lockfunc _spin_lock_irqsave_nested(spinlock_t *lock, int subclass)
+{
+	unsigned long flags;
+
+	local_irq_save(flags);
+	preempt_disable();
+	spin_acquire(&lock->dep_map, subclass, 0, _RET_IP_);
+	/*
+	 * On lockdep we dont want the hand-coded irq-enable of
+	 * _raw_spin_lock_flags() code, because lockdep assumes
+	 * that interrupts are not re-enabled during lock-acquire:
+	 */
+#ifdef CONFIG_PROVE_SPIN_LOCKING
+	_raw_spin_lock(lock);
+#else
+	_raw_spin_lock_flags(lock, &flags);
+#endif
+	return flags;
+}
+
+EXPORT_SYMBOL(_spin_lock_irqsave_nested);
 
 #endif
 
diff -urN linux-2.6.19-rc6/kernel/unwind.c linux-2.6.19/kernel/unwind.c
--- linux-2.6.19-rc6/kernel/unwind.c	2006-11-29 22:48:09.840827094 +0000
+++ linux-2.6.19/kernel/unwind.c	2006-11-29 22:48:14.625346918 +0000
@@ -938,8 +938,11 @@
 		else {
 			retAddrReg = state.version <= 1 ? *ptr++ : get_uleb128(&ptr, end);
 			/* skip augmentation */
-			if (((const char *)(cie + 2))[1] == 'z')
-				ptr += get_uleb128(&ptr, end);
+			if (((const char *)(cie + 2))[1] == 'z') {
+				uleb128_t augSize = get_uleb128(&ptr, end);
+
+				ptr += augSize;
+			}
 			if (ptr > end
 			   || retAddrReg >= ARRAY_SIZE(reg_info)
 			   || REG_INVALID(retAddrReg)
@@ -963,9 +966,7 @@
 	if (cie == NULL || fde == NULL) {
 #ifdef CONFIG_FRAME_POINTER
 		unsigned long top, bottom;
-#endif
 
-#ifdef CONFIG_FRAME_POINTER
 		top = STACK_TOP(frame->task);
 		bottom = STACK_BOTTOM(frame->task);
 # if FRAME_RETADDR_OFFSET < 0
diff -urN linux-2.6.19-rc6/mm/page_alloc.c linux-2.6.19/mm/page_alloc.c
--- linux-2.6.19-rc6/mm/page_alloc.c	2006-11-29 22:48:09.852828397 +0000
+++ linux-2.6.19/mm/page_alloc.c	2006-11-29 22:48:14.637348222 +0000
@@ -2612,6 +2612,9 @@
 {
 	int i;
 
+	/* Regions in the early_node_map can be in any order */
+	sort_node_map();
+
 	/* Assuming a sorted map, the first range found has the starting pfn */
 	for_each_active_range_index_in_nid(i, nid)
 		return early_node_map[i].start_pfn;
@@ -2680,9 +2683,6 @@
 			max(max_zone_pfn[i], arch_zone_lowest_possible_pfn[i]);
 	}
 
-	/* Regions in the early_node_map can be in any order */
-	sort_node_map();
-
 	/* Print out the zone ranges */
 	printk("Zone PFN ranges:\n");
 	for (i = 0; i < MAX_NR_ZONES; i++)
diff -urN linux-2.6.19-rc6/mm/vmalloc.c linux-2.6.19/mm/vmalloc.c
--- linux-2.6.19-rc6/mm/vmalloc.c	2006-11-29 22:48:09.860829267 +0000
+++ linux-2.6.19/mm/vmalloc.c	2006-11-29 22:48:14.645349091 +0000
@@ -181,14 +181,13 @@
 	}
 	addr = ALIGN(start, align);
 	size = PAGE_ALIGN(size);
+	if (unlikely(!size))
+		return NULL;
 
 	area = kmalloc_node(sizeof(*area), gfp_mask & GFP_LEVEL_MASK, node);
 	if (unlikely(!area))
 		return NULL;
 
-	if (unlikely(!size))
-		return NULL;
-
 	/*
 	 * We always allocate a guard page.
 	 */
diff -urN linux-2.6.19-rc6/net/bluetooth/hci_event.c linux-2.6.19/net/bluetooth/hci_event.c
--- linux-2.6.19-rc6/net/bluetooth/hci_event.c	2006-11-29 22:48:09.872830571 +0000
+++ linux-2.6.19/net/bluetooth/hci_event.c	2006-11-29 22:48:14.653349960 +0000
@@ -57,6 +57,7 @@
 static void hci_cc_link_ctl(struct hci_dev *hdev, __u16 ocf, struct sk_buff *skb)
 {
 	__u8 status;
+	struct hci_conn *pend;
 
 	BT_DBG("%s ocf 0x%x", hdev->name, ocf);
 
@@ -71,6 +72,15 @@
 			clear_bit(HCI_INQUIRY, &hdev->flags);
 			hci_req_complete(hdev, status);
 		}
+
+		hci_dev_lock(hdev);
+
+		pend = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
+		if (pend)
+			hci_acl_connect(pend);
+
+		hci_dev_unlock(hdev);
+
 		break;
 
 	default:
@@ -565,11 +575,20 @@
 static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
 	__u8 status = *((__u8 *) skb->data);
+	struct hci_conn *pend;
 
 	BT_DBG("%s status %d", hdev->name, status);
 
 	clear_bit(HCI_INQUIRY, &hdev->flags);
 	hci_req_complete(hdev, status);
+
+	hci_dev_lock(hdev);
+
+	pend = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
+	if (pend)
+		hci_acl_connect(pend);
+
+	hci_dev_unlock(hdev);
 }
 
 /* Inquiry Result */
diff -urN linux-2.6.19-rc6/net/bluetooth/hci_sock.c linux-2.6.19/net/bluetooth/hci_sock.c
--- linux-2.6.19-rc6/net/bluetooth/hci_sock.c	2006-11-29 22:48:09.872830571 +0000
+++ linux-2.6.19/net/bluetooth/hci_sock.c	2006-11-29 22:48:14.653349960 +0000
@@ -120,10 +120,13 @@
 			if (!hci_test_bit(evt, &flt->event_mask))
 				continue;
 
-			if (flt->opcode && ((evt == HCI_EV_CMD_COMPLETE && 
-					flt->opcode != *(__u16 *)(skb->data + 3)) ||
-					(evt == HCI_EV_CMD_STATUS && 
-					flt->opcode != *(__u16 *)(skb->data + 4))))
+			if (flt->opcode &&
+			    ((evt == HCI_EV_CMD_COMPLETE &&
+			      flt->opcode !=
+			      get_unaligned((__u16 *)(skb->data + 3))) ||
+			     (evt == HCI_EV_CMD_STATUS &&
+			      flt->opcode !=
+			      get_unaligned((__u16 *)(skb->data + 4)))))
 				continue;
 		}
 
diff -urN linux-2.6.19-rc6/net/bluetooth/hci_sysfs.c linux-2.6.19/net/bluetooth/hci_sysfs.c
--- linux-2.6.19-rc6/net/bluetooth/hci_sysfs.c	2006-11-29 22:48:09.872830571 +0000
+++ linux-2.6.19/net/bluetooth/hci_sysfs.c	2006-11-29 22:48:14.653349960 +0000
@@ -259,7 +259,9 @@
 
 	BT_DBG("conn %p", conn);
 
-	conn->dev.parent  = &hdev->dev;
+	conn->dev.bus = &bt_bus;
+	conn->dev.parent = &hdev->dev;
+
 	conn->dev.release = bt_release;
 
 	snprintf(conn->dev.bus_id, BUS_ID_SIZE,
diff -urN linux-2.6.19-rc6/net/bluetooth/l2cap.c linux-2.6.19/net/bluetooth/l2cap.c
--- linux-2.6.19-rc6/net/bluetooth/l2cap.c	2006-11-29 22:48:09.872830571 +0000
+++ linux-2.6.19/net/bluetooth/l2cap.c	2006-11-29 22:48:14.657350395 +0000
@@ -1353,12 +1353,12 @@
 
 	/* Configure output options and let the other side know
 	 * which ones we don't like. */
-	if (pi->conf_mtu < pi->omtu) {
-		l2cap_add_conf_opt(ptr, L2CAP_CONF_MTU, 2, pi->omtu);
+	if (pi->conf_mtu < pi->omtu)
 		result = L2CAP_CONF_UNACCEPT;
-	} else {
+	else
 		pi->omtu = pi->conf_mtu;
-	}
+
+	l2cap_add_conf_opt(ptr, L2CAP_CONF_MTU, 2, pi->omtu);
 
 	BT_DBG("sk %p result %d", sk, result);
 	return result;
@@ -1533,6 +1533,9 @@
 	if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, dcid)))
 		return -ENOENT;
 
+	if (sk->sk_state == BT_DISCONN)
+		goto unlock;
+
 	l2cap_parse_conf_req(sk, req->data, cmd->len - sizeof(*req));
 
 	if (flags & 0x0001) {
diff -urN linux-2.6.19-rc6/net/bluetooth/rfcomm/tty.c linux-2.6.19/net/bluetooth/rfcomm/tty.c
--- linux-2.6.19-rc6/net/bluetooth/rfcomm/tty.c	2006-11-29 22:48:09.872830571 +0000
+++ linux-2.6.19/net/bluetooth/rfcomm/tty.c	2006-11-29 22:48:14.657350395 +0000
@@ -765,7 +765,7 @@
 
 	BT_DBG("tty %p termios %p", tty, old);
 
-	if (!dev)
+	if (!dev || !dev->dlc || !dev->dlc->session)
 		return;
 
 	/* Handle turning off CRTSCTS */
diff -urN linux-2.6.19-rc6/net/bridge/br_ioctl.c linux-2.6.19/net/bridge/br_ioctl.c
--- linux-2.6.19-rc6/net/bridge/br_ioctl.c	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/net/bridge/br_ioctl.c	2006-11-29 22:48:14.657350395 +0000
@@ -58,12 +58,13 @@
 {
 	int num;
 	void *buf;
-	size_t size = maxnum * sizeof(struct __fdb_entry);
+	size_t size;
 
-	if (size > PAGE_SIZE) {
-		size = PAGE_SIZE;
+	/* Clamp size to PAGE_SIZE, test maxnum to avoid overflow */
+	if (maxnum > PAGE_SIZE/sizeof(struct __fdb_entry))
 		maxnum = PAGE_SIZE/sizeof(struct __fdb_entry);
-	}
+
+	size = maxnum * sizeof(struct __fdb_entry);
 
 	buf = kmalloc(size, GFP_USER);
 	if (!buf)
diff -urN linux-2.6.19-rc6/net/dccp/ipv6.c linux-2.6.19/net/dccp/ipv6.c
--- linux-2.6.19-rc6/net/dccp/ipv6.c	2006-11-29 22:48:09.888832309 +0000
+++ linux-2.6.19/net/dccp/ipv6.c	2006-11-29 22:48:14.673352134 +0000
@@ -277,7 +277,7 @@
 	__u64 seq;
 
 	sk = inet6_lookup(&dccp_hashinfo, &hdr->daddr, dh->dccph_dport,
-			  &hdr->saddr, dh->dccph_sport, skb->dev->ifindex);
+			  &hdr->saddr, dh->dccph_sport, inet6_iif(skb));
 
 	if (sk == NULL) {
 		ICMP6_INC_STATS_BH(__in6_dev_get(skb->dev), ICMP6_MIB_INERRORS);
diff -urN linux-2.6.19-rc6/net/dccp/probe.c linux-2.6.19/net/dccp/probe.c
--- linux-2.6.19-rc6/net/dccp/probe.c	2006-11-29 22:48:09.888832309 +0000
+++ linux-2.6.19/net/dccp/probe.c	2006-11-29 22:48:14.673352134 +0000
@@ -160,6 +160,8 @@
 	init_waitqueue_head(&dccpw.wait);
 	spin_lock_init(&dccpw.lock);
 	dccpw.fifo = kfifo_alloc(bufsize, GFP_KERNEL, &dccpw.lock);
+	if (IS_ERR(dccpw.fifo))
+		return PTR_ERR(dccpw.fifo);
 
 	if (!proc_net_fops_create(procname, S_IRUSR, &dccpprobe_fops))
 		goto err0;
diff -urN linux-2.6.19-rc6/net/ipv4/netfilter/ip_conntrack_core.c linux-2.6.19/net/ipv4/netfilter/ip_conntrack_core.c
--- linux-2.6.19-rc6/net/ipv4/netfilter/ip_conntrack_core.c	2006-11-29 22:48:09.920835786 +0000
+++ linux-2.6.19/net/ipv4/netfilter/ip_conntrack_core.c	2006-11-29 22:48:14.701355176 +0000
@@ -225,10 +225,8 @@
 	struct ip_conntrack_expect *i;
 	
 	list_for_each_entry(i, &ip_conntrack_expect_list, list) {
-		if (ip_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask)) {
-			atomic_inc(&i->use);
+		if (ip_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask))
 			return i;
-		}
 	}
 	return NULL;
 }
@@ -241,6 +239,8 @@
 	
 	read_lock_bh(&ip_conntrack_lock);
 	i = __ip_conntrack_expect_find(tuple);
+	if (i)
+		atomic_inc(&i->use);
 	read_unlock_bh(&ip_conntrack_lock);
 
 	return i;
diff -urN linux-2.6.19-rc6/net/ipv4/netfilter/ip_conntrack_helper_h323.c linux-2.6.19/net/ipv4/netfilter/ip_conntrack_helper_h323.c
--- linux-2.6.19-rc6/net/ipv4/netfilter/ip_conntrack_helper_h323.c	2006-11-29 22:48:09.920835786 +0000
+++ linux-2.6.19/net/ipv4/netfilter/ip_conntrack_helper_h323.c	2006-11-29 22:48:14.701355176 +0000
@@ -1417,7 +1417,7 @@
 		DEBUGP
 		    ("ip_ct_ras: set RAS connection timeout to %u seconds\n",
 		     info->timeout);
-		ip_ct_refresh_acct(ct, ctinfo, NULL, info->timeout * HZ);
+		ip_ct_refresh(ct, *pskb, info->timeout * HZ);
 
 		/* Set expect timeout */
 		read_lock_bh(&ip_conntrack_lock);
@@ -1465,7 +1465,7 @@
 	info->sig_port[!dir] = 0;
 
 	/* Give it 30 seconds for UCF or URJ */
-	ip_ct_refresh_acct(ct, ctinfo, NULL, 30 * HZ);
+	ip_ct_refresh(ct, *pskb, 30 * HZ);
 
 	return 0;
 }
diff -urN linux-2.6.19-rc6/net/ipv4/netfilter/ip_conntrack_netlink.c linux-2.6.19/net/ipv4/netfilter/ip_conntrack_netlink.c
--- linux-2.6.19-rc6/net/ipv4/netfilter/ip_conntrack_netlink.c	2006-11-29 22:48:09.920835786 +0000
+++ linux-2.6.19/net/ipv4/netfilter/ip_conntrack_netlink.c	2006-11-29 22:48:14.705355611 +0000
@@ -153,6 +153,7 @@
 	return ret;
 
 nfattr_failure:
+	ip_conntrack_proto_put(proto);
 	return -1;
 }
 
diff -urN linux-2.6.19-rc6/net/ipv4/netfilter/ip_queue.c linux-2.6.19/net/ipv4/netfilter/ip_queue.c
--- linux-2.6.19-rc6/net/ipv4/netfilter/ip_queue.c	2006-11-29 22:48:09.928836656 +0000
+++ linux-2.6.19/net/ipv4/netfilter/ip_queue.c	2006-11-29 22:48:14.709356045 +0000
@@ -351,9 +351,10 @@
 	if (v->data_len < sizeof(*user_iph))
 		return 0;
 	diff = v->data_len - e->skb->len;
-	if (diff < 0)
-		skb_trim(e->skb, v->data_len);
-	else if (diff > 0) {
+	if (diff < 0) {
+		if (pskb_trim(e->skb, v->data_len))
+			return -ENOMEM;
+	} else if (diff > 0) {
 		if (v->data_len > 0xFFFF)
 			return -EINVAL;
 		if (diff > skb_tailroom(e->skb)) {
diff -urN linux-2.6.19-rc6/net/ipv4/netfilter/ipt_REJECT.c linux-2.6.19/net/ipv4/netfilter/ipt_REJECT.c
--- linux-2.6.19-rc6/net/ipv4/netfilter/ipt_REJECT.c	2006-11-29 22:48:09.928836656 +0000
+++ linux-2.6.19/net/ipv4/netfilter/ipt_REJECT.c	2006-11-29 22:48:14.713356480 +0000
@@ -114,6 +114,14 @@
 	tcph->window = 0;
 	tcph->urg_ptr = 0;
 
+	/* Adjust TCP checksum */
+	tcph->check = 0;
+	tcph->check = tcp_v4_check(tcph, sizeof(struct tcphdr),
+				   nskb->nh.iph->saddr,
+				   nskb->nh.iph->daddr,
+				   csum_partial((char *)tcph,
+						sizeof(struct tcphdr), 0));
+
 	/* Set DF, id = 0 */
 	nskb->nh.iph->frag_off = htons(IP_DF);
 	nskb->nh.iph->id = 0;
@@ -129,14 +137,8 @@
 	if (ip_route_me_harder(&nskb, addr_type))
 		goto free_nskb;
 
-	/* Adjust TCP checksum */
 	nskb->ip_summed = CHECKSUM_NONE;
-	tcph->check = 0;
-	tcph->check = tcp_v4_check(tcph, sizeof(struct tcphdr),
-				   nskb->nh.iph->saddr,
-				   nskb->nh.iph->daddr,
-				   csum_partial((char *)tcph,
-						sizeof(struct tcphdr), 0));
+
 	/* Adjust IP TTL */
 	nskb->nh.iph->ttl = dst_metric(nskb->dst, RTAX_HOPLIMIT);
 
diff -urN linux-2.6.19-rc6/net/ipv4/tcp.c linux-2.6.19/net/ipv4/tcp.c
--- linux-2.6.19-rc6/net/ipv4/tcp.c	2006-11-29 22:48:09.936837525 +0000
+++ linux-2.6.19/net/ipv4/tcp.c	2006-11-29 22:48:14.717356915 +0000
@@ -2316,9 +2316,10 @@
 		sysctl_max_syn_backlog = 128;
 	}
 
-	sysctl_tcp_mem[0] =  768 << order;
-	sysctl_tcp_mem[1] = 1024 << order;
-	sysctl_tcp_mem[2] = 1536 << order;
+	/* Allow no more than 3/4 kernel memory (usually less) allocated to TCP */
+	sysctl_tcp_mem[0] = (1536 / sizeof (struct inet_bind_hashbucket)) << order;
+	sysctl_tcp_mem[1] = sysctl_tcp_mem[0] * 4 / 3;
+	sysctl_tcp_mem[2] = sysctl_tcp_mem[0] * 2;
 
 	limit = ((unsigned long)sysctl_tcp_mem[1]) << (PAGE_SHIFT - 7);
 	max_share = min(4UL*1024*1024, limit);
diff -urN linux-2.6.19-rc6/net/ipv4/tcp_probe.c linux-2.6.19/net/ipv4/tcp_probe.c
--- linux-2.6.19-rc6/net/ipv4/tcp_probe.c	2006-11-29 22:48:09.944838394 +0000
+++ linux-2.6.19/net/ipv4/tcp_probe.c	2006-11-29 22:48:14.725357784 +0000
@@ -156,6 +156,8 @@
 	init_waitqueue_head(&tcpw.wait);
 	spin_lock_init(&tcpw.lock);
 	tcpw.fifo = kfifo_alloc(bufsize, GFP_KERNEL, &tcpw.lock);
+	if (IS_ERR(tcpw.fifo))
+		return PTR_ERR(tcpw.fifo);
 
 	if (!proc_net_fops_create(procname, S_IRUSR, &tcpprobe_fops))
 		goto err0;
diff -urN linux-2.6.19-rc6/net/ipv4/udp.c linux-2.6.19/net/ipv4/udp.c
--- linux-2.6.19-rc6/net/ipv4/udp.c	2006-11-29 22:48:09.944838394 +0000
+++ linux-2.6.19/net/ipv4/udp.c	2006-11-29 22:48:14.725357784 +0000
@@ -928,23 +928,32 @@
 	return 1; 
 #else
 	struct udp_sock *up = udp_sk(sk);
-  	struct udphdr *uh = skb->h.uh;
+  	struct udphdr *uh;
 	struct iphdr *iph;
 	int iphlen, len;
   
-	__u8 *udpdata = (__u8 *)uh + sizeof(struct udphdr);
-	__be32 *udpdata32 = (__be32 *)udpdata;
+	__u8 *udpdata;
+	__be32 *udpdata32;
 	__u16 encap_type = up->encap_type;
 
 	/* if we're overly short, let UDP handle it */
-	if (udpdata > skb->tail)
+	len = skb->len - sizeof(struct udphdr);
+	if (len <= 0)
 		return 1;
 
 	/* if this is not encapsulated socket, then just return now */
 	if (!encap_type)
 		return 1;
 
-	len = skb->tail - udpdata;
+	/* If this is a paged skb, make sure we pull up
+	 * whatever data we need to look at. */
+	if (!pskb_may_pull(skb, sizeof(struct udphdr) + min(len, 8)))
+		return 1;
+
+	/* Now we can get the pointers */
+	uh = skb->h.uh;
+	udpdata = (__u8 *)uh + sizeof(struct udphdr);
+	udpdata32 = (__be32 *)udpdata;
 
 	switch (encap_type) {
 	default:
diff -urN linux-2.6.19-rc6/net/ipv6/ip6_tunnel.c linux-2.6.19/net/ipv6/ip6_tunnel.c
--- linux-2.6.19-rc6/net/ipv6/ip6_tunnel.c	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/net/ipv6/ip6_tunnel.c	2006-11-29 22:48:14.733358653 +0000
@@ -542,6 +542,7 @@
 		skb->dev = t->dev;
 		dst_release(skb->dst);
 		skb->dst = NULL;
+		nf_reset(skb);
 		if (t->parms.flags & IP6_TNL_F_RCV_DSCP_COPY)
 			ipv6_copy_dscp(ipv6h, skb->nh.ipv6h);
 		ip6ip6_ecn_decapsulate(ipv6h, skb);
@@ -1149,6 +1150,20 @@
 	return err;
 }
 
+static void __exit ip6ip6_destroy_tunnels(void)
+{
+	int h;
+	struct ip6_tnl *t;
+
+	for (h = 0; h < HASH_SIZE; h++) {
+		while ((t = tnls_r_l[h]) != NULL)
+			unregister_netdevice(t->dev);
+	}
+
+	t = tnls_wc[0];
+	unregister_netdevice(t->dev);
+}
+
 /**
  * ip6_tunnel_cleanup - free resources and unregister protocol
  **/
@@ -1158,7 +1173,9 @@
 	if (xfrm6_tunnel_deregister(&ip6ip6_handler))
 		printk(KERN_INFO "ip6ip6 close: can't deregister tunnel\n");
 
-	unregister_netdev(ip6ip6_fb_tnl_dev);
+	rtnl_lock();
+	ip6ip6_destroy_tunnels();
+	rtnl_unlock();
 }
 
 module_init(ip6_tunnel_init);
diff -urN linux-2.6.19-rc6/net/ipv6/netfilter/ip6_queue.c linux-2.6.19/net/ipv6/netfilter/ip6_queue.c
--- linux-2.6.19-rc6/net/ipv6/netfilter/ip6_queue.c	2006-11-29 22:48:09.956839698 +0000
+++ linux-2.6.19/net/ipv6/netfilter/ip6_queue.c	2006-11-29 22:48:14.737359088 +0000
@@ -349,9 +349,10 @@
 	if (v->data_len < sizeof(*user_iph))
 		return 0;
 	diff = v->data_len - e->skb->len;
-	if (diff < 0)
-		skb_trim(e->skb, v->data_len);
-	else if (diff > 0) {
+	if (diff < 0) {
+		if (pskb_trim(e->skb, v->data_len))
+			return -ENOMEM;
+	} else if (diff > 0) {
 		if (v->data_len > 0xFFFF)
 			return -EINVAL;
 		if (diff > skb_tailroom(e->skb)) {
diff -urN linux-2.6.19-rc6/net/ipv6/netfilter/ip6_tables.c linux-2.6.19/net/ipv6/netfilter/ip6_tables.c
--- linux-2.6.19-rc6/net/ipv6/netfilter/ip6_tables.c	2006-11-29 22:48:09.956839698 +0000
+++ linux-2.6.19/net/ipv6/netfilter/ip6_tables.c	2006-11-29 22:48:14.737359088 +0000
@@ -1494,7 +1494,7 @@
 			if (_frag_off) {
 				if (target < 0 &&
 				    ((!ipv6_ext_hdr(hp->nexthdr)) ||
-				     nexthdr == NEXTHDR_NONE)) {
+				     hp->nexthdr == NEXTHDR_NONE)) {
 					if (fragoff)
 						*fragoff = _frag_off;
 					return hp->nexthdr;
diff -urN linux-2.6.19-rc6/net/ipv6/route.c linux-2.6.19/net/ipv6/route.c
--- linux-2.6.19-rc6/net/ipv6/route.c	2006-11-29 22:48:09.960840133 +0000
+++ linux-2.6.19/net/ipv6/route.c	2006-11-29 22:48:14.741359522 +0000
@@ -330,6 +330,8 @@
 		read_lock_bh(&neigh->lock);
 		if (neigh->nud_state & NUD_VALID)
 			m = 2;
+		else if (!(neigh->nud_state & NUD_FAILED))
+			m = 1;
 		read_unlock_bh(&neigh->lock);
 	}
 	return m;
@@ -347,9 +349,7 @@
 	m |= IPV6_DECODE_PREF(IPV6_EXTRACT_PREF(rt->rt6i_flags)) << 2;
 #endif
 	n = rt6_check_neigh(rt);
-	if (n > 1)
-		m |= 16;
-	else if (!n && strict & RT6_LOOKUP_F_REACHABLE)
+	if (!n && (strict & RT6_LOOKUP_F_REACHABLE))
 		return -1;
 	return m;
 }
@@ -380,10 +380,11 @@
 			continue;
 
 		if (m > mpri) {
-			rt6_probe(match);
+			if (strict & RT6_LOOKUP_F_REACHABLE)
+				rt6_probe(match);
 			match = rt;
 			mpri = m;
-		} else {
+		} else if (strict & RT6_LOOKUP_F_REACHABLE) {
 			rt6_probe(rt);
 		}
 	}
@@ -636,7 +637,7 @@
 	int strict = 0;
 	int attempts = 3;
 	int err;
-	int reachable = RT6_LOOKUP_F_REACHABLE;
+	int reachable = ipv6_devconf.forwarding ? 0 : RT6_LOOKUP_F_REACHABLE;
 
 	strict |= flags & RT6_LOOKUP_F_IFACE;
 
@@ -733,7 +734,7 @@
 	int strict = 0;
 	int attempts = 3;
 	int err;
-	int reachable = RT6_LOOKUP_F_REACHABLE;
+	int reachable = ipv6_devconf.forwarding ? 0 : RT6_LOOKUP_F_REACHABLE;
 
 	strict |= flags & RT6_LOOKUP_F_IFACE;
 
diff -urN linux-2.6.19-rc6/net/ipv6/udp.c linux-2.6.19/net/ipv6/udp.c
--- linux-2.6.19-rc6/net/ipv6/udp.c	2006-11-29 22:48:09.964840567 +0000
+++ linux-2.6.19/net/ipv6/udp.c	2006-11-29 22:48:14.745359957 +0000
@@ -242,14 +242,13 @@
 {
 	struct ipv6_pinfo *np;
 	struct ipv6hdr *hdr = (struct ipv6hdr*)skb->data;
-	struct net_device *dev = skb->dev;
 	struct in6_addr *saddr = &hdr->saddr;
 	struct in6_addr *daddr = &hdr->daddr;
 	struct udphdr *uh = (struct udphdr*)(skb->data+offset);
 	struct sock *sk;
 	int err;
 
-	sk = udp_v6_lookup(daddr, uh->dest, saddr, uh->source, dev->ifindex);
+	sk = udp_v6_lookup(daddr, uh->dest, saddr, uh->source, inet6_iif(skb));
    
 	if (sk == NULL)
 		return;
@@ -348,7 +347,7 @@
 
 	read_lock(&udp_hash_lock);
 	sk = sk_head(&udp_hash[ntohs(uh->dest) & (UDP_HTABLE_SIZE - 1)]);
-	dif = skb->dev->ifindex;
+	dif = inet6_iif(skb);
 	sk = udp_v6_mcast_next(sk, uh->dest, daddr, uh->source, saddr, dif);
 	if (!sk) {
 		kfree_skb(skb);
@@ -429,7 +428,7 @@
 	 * check socket cache ... must talk to Alan about his plans
 	 * for sock caches... i'll skip this for now.
 	 */
-	sk = udp_v6_lookup(saddr, uh->source, daddr, uh->dest, dev->ifindex);
+	sk = udp_v6_lookup(saddr, uh->source, daddr, uh->dest, inet6_iif(skb));
 
 	if (sk == NULL) {
 		if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
diff -urN linux-2.6.19-rc6/net/irda/irlmp.c linux-2.6.19/net/irda/irlmp.c
--- linux-2.6.19-rc6/net/irda/irlmp.c	2006-11-29 22:48:09.968841002 +0000
+++ linux-2.6.19/net/irda/irlmp.c	2006-11-29 22:48:14.753360826 +0000
@@ -1678,7 +1678,8 @@
 	 *  every IrLAP connection and check every LSAP associated with each
 	 *  the connection.
 	 */
-	spin_lock_irqsave(&irlmp->links->hb_spinlock, flags);
+	spin_lock_irqsave_nested(&irlmp->links->hb_spinlock, flags,
+			SINGLE_DEPTH_NESTING);
 	lap = (struct lap_cb *) hashbin_get_first(irlmp->links);
 	while (lap != NULL) {
 		IRDA_ASSERT(lap->magic == LMP_LAP_MAGIC, goto errlap;);
diff -urN linux-2.6.19-rc6/net/netfilter/nf_conntrack_core.c linux-2.6.19/net/netfilter/nf_conntrack_core.c
--- linux-2.6.19-rc6/net/netfilter/nf_conntrack_core.c	2006-11-29 22:48:09.972841437 +0000
+++ linux-2.6.19/net/netfilter/nf_conntrack_core.c	2006-11-29 22:48:14.753360826 +0000
@@ -469,10 +469,8 @@
 	struct nf_conntrack_expect *i;
 	
 	list_for_each_entry(i, &nf_conntrack_expect_list, list) {
-		if (nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask)) {
-			atomic_inc(&i->use);
+		if (nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask))
 			return i;
-		}
 	}
 	return NULL;
 }
@@ -485,6 +483,8 @@
 	
 	read_lock_bh(&nf_conntrack_lock);
 	i = __nf_conntrack_expect_find(tuple);
+	if (i)
+		atomic_inc(&i->use);
 	read_unlock_bh(&nf_conntrack_lock);
 
 	return i;
@@ -893,12 +893,6 @@
 
 	memset(conntrack, 0, nf_ct_cache[features].size);
 	conntrack->features = features;
-	if (helper) {
-		struct nf_conn_help *help = nfct_help(conntrack);
-		NF_CT_ASSERT(help);
-		help->helper = helper;
-	}
-
 	atomic_set(&conntrack->ct_general.use, 1);
 	conntrack->ct_general.destroy = destroy_conntrack;
 	conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple = *orig;
@@ -982,8 +976,13 @@
 #endif
 		nf_conntrack_get(&conntrack->master->ct_general);
 		NF_CT_STAT_INC(expect_new);
-	} else
+	} else {
+		struct nf_conn_help *help = nfct_help(conntrack);
+
+		if (help)
+			help->helper = __nf_ct_helper_find(&repl_tuple);
 		NF_CT_STAT_INC(new);
+	}
 
 	/* Overload tuple linked list to put us in unconfirmed list. */
 	list_add(&conntrack->tuplehash[IP_CT_DIR_ORIGINAL].list, &unconfirmed);
diff -urN linux-2.6.19-rc6/net/netfilter/nf_conntrack_netlink.c linux-2.6.19/net/netfilter/nf_conntrack_netlink.c
--- linux-2.6.19-rc6/net/netfilter/nf_conntrack_netlink.c	2006-11-29 22:48:09.972841437 +0000
+++ linux-2.6.19/net/netfilter/nf_conntrack_netlink.c	2006-11-29 22:48:14.757361261 +0000
@@ -161,6 +161,7 @@
 	return ret;
 
 nfattr_failure:
+	nf_ct_proto_put(proto);
 	return -1;
 }
 
@@ -949,6 +950,7 @@
 {
 	struct nf_conn *ct;
 	int err = -EINVAL;
+	struct nf_conn_help *help;
 
 	ct = nf_conntrack_alloc(otuple, rtuple);
 	if (ct == NULL || IS_ERR(ct))
@@ -976,9 +978,16 @@
 		ct->mark = ntohl(*(u_int32_t *)NFA_DATA(cda[CTA_MARK-1]));
 #endif
 
+	help = nfct_help(ct);
+	if (help)
+		help->helper = nf_ct_helper_find_get(rtuple);
+
 	add_timer(&ct->timeout);
 	nf_conntrack_hash_insert(ct);
 
+	if (help && help->helper)
+		nf_ct_helper_put(help->helper);
+
 	return 0;
 
 err:	
diff -urN linux-2.6.19-rc6/net/netfilter/nfnetlink_log.c linux-2.6.19/net/netfilter/nfnetlink_log.c
--- linux-2.6.19-rc6/net/netfilter/nfnetlink_log.c	2006-11-29 22:48:09.976841871 +0000
+++ linux-2.6.19/net/netfilter/nfnetlink_log.c	2006-11-29 22:48:14.757361261 +0000
@@ -544,7 +544,7 @@
 	}
 	/* global sequence number */
 	if (inst->flags & NFULNL_CFG_F_SEQ_GLOBAL) {
-		tmp_uint = atomic_inc_return(&global_seq);
+		tmp_uint = htonl(atomic_inc_return(&global_seq));
 		NFA_PUT(inst->skb, NFULA_SEQ_GLOBAL, sizeof(tmp_uint), &tmp_uint);
 	}
 
diff -urN linux-2.6.19-rc6/net/netfilter/nfnetlink_queue.c linux-2.6.19/net/netfilter/nfnetlink_queue.c
--- linux-2.6.19-rc6/net/netfilter/nfnetlink_queue.c	2006-11-29 22:48:09.976841871 +0000
+++ linux-2.6.19/net/netfilter/nfnetlink_queue.c	2006-11-29 22:48:14.757361261 +0000
@@ -622,9 +622,10 @@
 	int diff;
 
 	diff = data_len - e->skb->len;
-	if (diff < 0)
-		skb_trim(e->skb, data_len);
-	else if (diff > 0) {
+	if (diff < 0) {
+		if (pskb_trim(e->skb, data_len))
+			return -ENOMEM;
+	} else if (diff > 0) {
 		if (data_len > 0xFFFF)
 			return -EINVAL;
 		if (diff > skb_tailroom(e->skb)) {
diff -urN linux-2.6.19-rc6/net/xfrm/xfrm_user.c linux-2.6.19/net/xfrm/xfrm_user.c
--- linux-2.6.19-rc6/net/xfrm/xfrm_user.c	2006-11-29 22:48:10.024847087 +0000
+++ linux-2.6.19/net/xfrm/xfrm_user.c	2006-11-29 22:48:14.809366911 +0000
@@ -495,6 +495,7 @@
 			goto out;
 		}
 
+		err = -ESRCH;
 		x = xfrm_state_lookup_byaddr(&p->daddr, saddr, p->proto,
 					     p->family);
 	}
@@ -1927,6 +1928,9 @@
 	len = RTA_SPACE(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
 	len += NLMSG_SPACE(sizeof(struct xfrm_user_acquire));
 	len += RTA_SPACE(xfrm_user_sec_ctx_size(xp));
+#ifdef CONFIG_XFRM_SUB_POLICY
+	len += RTA_SPACE(sizeof(struct xfrm_userpolicy_type));
+#endif
 	skb = alloc_skb(len, GFP_ATOMIC);
 	if (skb == NULL)
 		return -ENOMEM;
@@ -2034,6 +2038,9 @@
 	len = RTA_SPACE(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
 	len += NLMSG_SPACE(sizeof(struct xfrm_user_polexpire));
 	len += RTA_SPACE(xfrm_user_sec_ctx_size(xp));
+#ifdef CONFIG_XFRM_SUB_POLICY
+	len += RTA_SPACE(sizeof(struct xfrm_userpolicy_type));
+#endif
 	skb = alloc_skb(len, GFP_ATOMIC);
 	if (skb == NULL)
 		return -ENOMEM;
@@ -2060,6 +2067,9 @@
 		len += RTA_SPACE(headlen);
 		headlen = sizeof(*id);
 	}
+#ifdef CONFIG_XFRM_SUB_POLICY
+	len += RTA_SPACE(sizeof(struct xfrm_userpolicy_type));
+#endif
 	len += NLMSG_SPACE(headlen);
 
 	skb = alloc_skb(len, GFP_ATOMIC);
@@ -2106,10 +2116,12 @@
 	struct nlmsghdr *nlh;
 	struct sk_buff *skb;
 	unsigned char *b;
+	int len = 0;
 #ifdef CONFIG_XFRM_SUB_POLICY
 	struct xfrm_userpolicy_type upt;
+	len += RTA_SPACE(sizeof(struct xfrm_userpolicy_type));
 #endif
-	int len = NLMSG_LENGTH(0);
+	len += NLMSG_LENGTH(0);
 
 	skb = alloc_skb(len, GFP_ATOMIC);
 	if (skb == NULL)
diff -urN linux-2.6.19-rc6/scripts/gen_initramfs_list.sh linux-2.6.19/scripts/gen_initramfs_list.sh
--- linux-2.6.19-rc6/scripts/gen_initramfs_list.sh	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/scripts/gen_initramfs_list.sh	2006-11-29 22:48:14.809366911 +0000
@@ -158,7 +158,7 @@
 }
 
 list_header() {
-	echo "deps_initramfs := \\"
+	:
 }
 
 header() {
@@ -227,6 +227,7 @@
 case "$arg" in
 	"-l")	# files included in initramfs - used by kbuild
 		dep_list="list_"
+		echo "deps_initramfs := \\"
 		shift
 		;;
 	"-o")	# generate gzipped cpio image named $1
diff -urN linux-2.6.19-rc6/scripts/kconfig/lxdialog/util.c linux-2.6.19/scripts/kconfig/lxdialog/util.c
--- linux-2.6.19-rc6/scripts/kconfig/lxdialog/util.c	2006-11-29 22:48:10.032847956 +0000
+++ linux-2.6.19/scripts/kconfig/lxdialog/util.c	2006-11-29 22:48:14.813367346 +0000
@@ -221,16 +221,14 @@
  */
 static void color_setup(const char *theme)
 {
-	if (set_theme(theme)) {
-		if (has_colors()) {	/* Terminal supports color? */
-			start_color();
-			init_dialog_colors();
-		}
-	}
-	else
-	{
+	int use_color;
+
+	use_color = set_theme(theme);
+	if (use_color && has_colors()) {
+		start_color();
+		init_dialog_colors();
+	} else
 		set_mono_theme();
-	}
 }
 
 /*
diff -urN linux-2.6.19-rc6/scripts/kconfig/qconf.cc linux-2.6.19/scripts/kconfig/qconf.cc
--- linux-2.6.19-rc6/scripts/kconfig/qconf.cc	2006-09-20 03:42:06.000000000 +0000
+++ linux-2.6.19/scripts/kconfig/qconf.cc	2006-11-29 22:48:14.813367346 +0000
@@ -1259,6 +1259,7 @@
  * Construct the complete config widget
  */
 ConfigMainWindow::ConfigMainWindow(void)
+	: searchWindow(0)
 {
 	QMenuBar* menu;
 	bool ok;
diff -urN linux-2.6.19-rc6/security/selinux/hooks.c linux-2.6.19/security/selinux/hooks.c
--- linux-2.6.19-rc6/security/selinux/hooks.c	2006-11-29 22:48:10.040848825 +0000
+++ linux-2.6.19/security/selinux/hooks.c	2006-11-29 22:48:14.821368215 +0000
@@ -1754,7 +1754,8 @@
 						get_file(devnull);
 					} else {
 						devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
-						if (!devnull) {
+						if (IS_ERR(devnull)) {
+							devnull = NULL;
 							put_unused_fd(fd);
 							fput(file);
 							continue;
diff -urN linux-2.6.19-rc6/sound/aoa/codecs/snd-aoa-codec-tas.c linux-2.6.19/sound/aoa/codecs/snd-aoa-codec-tas.c
--- linux-2.6.19-rc6/sound/aoa/codecs/snd-aoa-codec-tas.c	2006-11-29 22:48:10.044849260 +0000
+++ linux-2.6.19/sound/aoa/codecs/snd-aoa-codec-tas.c	2006-11-29 22:48:14.825368650 +0000
@@ -514,9 +514,15 @@
 	mutex_lock(&tas->mtx);
 	oldacr = tas->acr;
 
-	tas->acr &= ~TAS_ACR_INPUT_B;
+	/*
+	 * Despite what the data sheet says in one place, the
+	 * TAS_ACR_B_MONAUREAL bit forces mono output even when
+	 * input A (line in) is selected.
+	 */
+	tas->acr &= ~(TAS_ACR_INPUT_B | TAS_ACR_B_MONAUREAL);
 	if (ucontrol->value.enumerated.item[0])
-		tas->acr |= TAS_ACR_INPUT_B;
+		tas->acr |= TAS_ACR_INPUT_B | TAS_ACR_B_MONAUREAL |
+		      TAS_ACR_B_MON_SEL_RIGHT;
 	if (oldacr == tas->acr) {
 		mutex_unlock(&tas->mtx);
 		return 0;
@@ -686,8 +692,7 @@
 	if (tas_write_reg(tas, TAS_REG_MCS, 1, &tmp))
 		goto outerr;
 
-	tas->acr |= TAS_ACR_ANALOG_PDOWN | TAS_ACR_B_MONAUREAL |
-		TAS_ACR_B_MON_SEL_RIGHT;
+	tas->acr |= TAS_ACR_ANALOG_PDOWN;
 	if (tas_write_reg(tas, TAS_REG_ACR, 1, &tas->acr))
 		goto outerr;
 
diff -urN linux-2.6.19-rc6/sound/core/oss/pcm_oss.c linux-2.6.19/sound/core/oss/pcm_oss.c
--- linux-2.6.19-rc6/sound/core/oss/pcm_oss.c	2006-11-29 22:48:10.048849695 +0000
+++ linux-2.6.19/sound/core/oss/pcm_oss.c	2006-11-29 22:48:14.829369084 +0000
@@ -2359,7 +2359,8 @@
 		substream = pcm_oss_file->streams[SNDRV_PCM_STREAM_CAPTURE];
 	snd_assert(substream != NULL, return -ENXIO);
 	pcm = substream->pcm;
-	snd_pcm_oss_sync(pcm_oss_file);
+	if (!pcm->card->shutdown)
+		snd_pcm_oss_sync(pcm_oss_file);
 	mutex_lock(&pcm->open_mutex);
 	snd_pcm_oss_release_file(pcm_oss_file);
 	mutex_unlock(&pcm->open_mutex);
diff -urN linux-2.6.19-rc6/sound/core/pcm_native.c linux-2.6.19/sound/core/pcm_native.c
--- linux-2.6.19-rc6/sound/core/pcm_native.c	2006-11-29 22:48:10.052850129 +0000
+++ linux-2.6.19/sound/core/pcm_native.c	2006-11-29 22:48:14.833369519 +0000
@@ -1310,7 +1310,8 @@
 			       int f_flags)
 {
 	struct snd_pcm_runtime *runtime = substream->runtime;
-	if (runtime->status->state == SNDRV_PCM_STATE_OPEN)
+	if (runtime->status->state == SNDRV_PCM_STATE_OPEN ||
+	    runtime->status->state == SNDRV_PCM_STATE_DISCONNECTED)
 		return -EBADFD;
 	if (snd_pcm_running(substream))
 		return -EBUSY;
@@ -1568,7 +1569,8 @@
 	runtime = substream->runtime;
 	card = substream->pcm->card;
 
-	if (runtime->status->state == SNDRV_PCM_STATE_OPEN)
+	if (runtime->status->state == SNDRV_PCM_STATE_OPEN ||
+	    runtime->status->state == SNDRV_PCM_STATE_DISCONNECTED)
 		return -EBADFD;
 
 	snd_power_lock(card);
diff -urN linux-2.6.19-rc6/sound/core/rtctimer.c linux-2.6.19/sound/core/rtctimer.c
--- linux-2.6.19-rc6/sound/core/rtctimer.c	2006-11-29 22:48:10.052850129 +0000
+++ linux-2.6.19/sound/core/rtctimer.c	2006-11-29 22:48:14.833369519 +0000
@@ -22,13 +22,10 @@
 
 #include <sound/driver.h>
 #include <linux/init.h>
-#include <linux/time.h>
-#include <linux/threads.h>
 #include <linux/interrupt.h>
 #include <linux/moduleparam.h>
 #include <sound/core.h>
 #include <sound/timer.h>
-#include <sound/info.h>
 
 #if defined(CONFIG_RTC) || defined(CONFIG_RTC_MODULE)
 
@@ -50,7 +47,9 @@
  * The hardware dependent description for this timer.
  */
 static struct snd_timer_hardware rtc_hw = {
-	.flags =	SNDRV_TIMER_HW_FIRST|SNDRV_TIMER_HW_AUTO,
+	.flags =	SNDRV_TIMER_HW_AUTO |
+			SNDRV_TIMER_HW_FIRST |
+			SNDRV_TIMER_HW_TASKLET,
 	.ticks =	100000000L,		/* FIXME: XXX */
 	.open =		rtctimer_open,
 	.close =	rtctimer_close,
@@ -60,6 +59,7 @@
 
 static int rtctimer_freq = RTC_FREQ;		/* frequency */
 static struct snd_timer *rtctimer;
+static struct tasklet_struct rtc_tasklet;
 static rtc_task_t rtc_task;
 
 
@@ -81,6 +81,7 @@
 	rtc_task_t *rtc = t->private_data;
 	if (rtc) {
 		rtc_unregister(rtc);
+		tasklet_kill(&rtc_tasklet);
 		t->private_data = NULL;
 	}
 	return 0;
@@ -105,12 +106,17 @@
 	return 0;
 }
 
+static void rtctimer_tasklet(unsigned long data)
+{
+	snd_timer_interrupt((struct snd_timer *)data, 1);
+}
+
 /*
  * interrupt
  */
 static void rtctimer_interrupt(void *private_data)
 {
-	snd_timer_interrupt(private_data, 1);
+	tasklet_hi_schedule(private_data);
 }
 
 
@@ -139,9 +145,11 @@
 	timer->hw = rtc_hw;
 	timer->hw.resolution = NANO_SEC / rtctimer_freq;
 
+	tasklet_init(&rtc_tasklet, rtctimer_tasklet, (unsigned long)timer);
+
 	/* set up RTC callback */
 	rtc_task.func = rtctimer_interrupt;
-	rtc_task.private_data = timer;
+	rtc_task.private_data = &rtc_tasklet;
 
 	err = snd_timer_global_register(timer);
 	if (err < 0) {
diff -urN linux-2.6.19-rc6/sound/pci/emu10k1/emu10k1_main.c linux-2.6.19/sound/pci/emu10k1/emu10k1_main.c
--- linux-2.6.19-rc6/sound/pci/emu10k1/emu10k1_main.c	2006-11-29 22:48:10.164862299 +0000
+++ linux-2.6.19/sound/pci/emu10k1/emu10k1_main.c	2006-11-29 22:48:14.945381689 +0000
@@ -956,6 +956,7 @@
 	 .ca0151_chip = 1,
 	 .spk71 = 1,
 	 .spdif_bug = 1,
+	 .adc_1361t = 1,  /* 24 bit capture instead of 16bit. Fixes ALSA bug#324 */
 	 .ac97_chip = 1} ,
 	{.vendor = 0x1102, .device = 0x0004, .revision = 0x04,
 	 .driver = "Audigy2", .name = "Audigy 2 [Unknown]",
diff -urN linux-2.6.19-rc6/sound/pci/hda/patch_realtek.c linux-2.6.19/sound/pci/hda/patch_realtek.c
--- linux-2.6.19-rc6/sound/pci/hda/patch_realtek.c	2006-11-29 22:48:10.176863603 +0000
+++ linux-2.6.19/sound/pci/hda/patch_realtek.c	2006-11-29 22:48:14.953382558 +0000
@@ -5870,7 +5870,7 @@
 	{ .pci_subvendor = 0x10cf, .pci_subdevice = 0x1397,
 	  .config = ALC262_FUJITSU },
 	{ .modelname = "hp-bpc", .config = ALC262_HP_BPC },
-	{ .pci_subvendor = 0x103c, .pci_subdevice = 0x208c,
+	{ .pci_subvendor = 0x103c, .pci_subdevice = 0x280c,
 	  .config = ALC262_HP_BPC }, /* xw4400 */
 	{ .pci_subvendor = 0x103c, .pci_subdevice = 0x3014,
 	  .config = ALC262_HP_BPC }, /* xw6400 */
diff -urN linux-2.6.19-rc6/sound/pci/hda/patch_sigmatel.c linux-2.6.19/sound/pci/hda/patch_sigmatel.c
--- linux-2.6.19-rc6/sound/pci/hda/patch_sigmatel.c	2006-11-29 22:48:10.176863603 +0000
+++ linux-2.6.19/sound/pci/hda/patch_sigmatel.c	2006-11-29 22:48:14.957382993 +0000
@@ -336,6 +336,13 @@
 	  .pci_subvendor = PCI_VENDOR_ID_INTEL,
 	  .pci_subdevice = 0x2668,	/* DFI LanParty */
 	  .config = STAC_REF },
+	/* Dell laptops have BIOS problem */
+	{ .pci_subvendor = PCI_VENDOR_ID_DELL, .pci_subdevice = 0x01b5,
+	  .config = STAC_REF },	/* Dell Inspiron 630m */
+	{ .pci_subvendor = PCI_VENDOR_ID_DELL, .pci_subdevice = 0x01c2,
+	  .config = STAC_REF },	/* Dell Latitude D620 */
+	{ .pci_subvendor = PCI_VENDOR_ID_DELL, .pci_subdevice = 0x01cb,
+	  .config = STAC_REF },	/* Dell Latitude 120L */
 	{} /* terminator */
 };
 
@@ -591,13 +598,6 @@
 	  .pci_subvendor = PCI_VENDOR_ID_INTEL,
 	  .pci_subdevice = 0x2668,	/* DFI LanParty */
 	  .config = STAC_REF },		/* SigmaTel reference board */
-	/* Dell laptops have BIOS problem */
-	{ .pci_subvendor = PCI_VENDOR_ID_DELL, .pci_subdevice = 0x01b5,
-	  .config = STAC_REF },	/* Dell Inspiron 630m */
-	{ .pci_subvendor = PCI_VENDOR_ID_DELL, .pci_subdevice = 0x01c2,
-	  .config = STAC_REF },	/* Dell Latitude D620 */
-	{ .pci_subvendor = PCI_VENDOR_ID_DELL, .pci_subdevice = 0x01cb,
-	  .config = STAC_REF },	/* Dell Latitude 120L */
 	{} /* terminator */
 };
 
diff -urN linux-2.6.19-rc6/sound/usb/usbaudio.c linux-2.6.19/sound/usb/usbaudio.c
--- linux-2.6.19-rc6/sound/usb/usbaudio.c	2006-11-29 22:48:10.204866645 +0000
+++ linux-2.6.19/sound/usb/usbaudio.c	2006-11-29 22:48:14.981385601 +0000
@@ -1469,7 +1469,8 @@
 	subs->cur_audiofmt = NULL;
 	subs->cur_rate = 0;
 	subs->period_bytes = 0;
-	release_substream_urbs(subs, 0);
+	if (!subs->stream->chip->shutdown)
+		release_substream_urbs(subs, 0);
 	return snd_pcm_free_vmalloc_buffer(substream);
 }
 
diff -urN linux-2.6.19-rc6/usr/Makefile linux-2.6.19/usr/Makefile
--- linux-2.6.19-rc6/usr/Makefile	2006-11-29 22:48:10.204866645 +0000
+++ linux-2.6.19/usr/Makefile	2006-11-29 22:48:14.985386035 +0000
@@ -20,7 +20,7 @@
 hostprogs-y := gen_init_cpio
 initramfs   := $(CONFIG_SHELL) $(srctree)/scripts/gen_initramfs_list.sh
 ramfs-input := $(if $(filter-out "",$(CONFIG_INITRAMFS_SOURCE)), \
-                    $(CONFIG_INITRAMFS_SOURCE),-d)
+			$(shell echo $(CONFIG_INITRAMFS_SOURCE)),-d)
 ramfs-args  := \
         $(if $(CONFIG_INITRAMFS_ROOT_UID), -u $(CONFIG_INITRAMFS_ROOT_UID)) \
         $(if $(CONFIG_INITRAMFS_ROOT_GID), -g $(CONFIG_INITRAMFS_ROOT_GID))
