--- /dev/null
+diff -Naur linux-2.6.16/arch/alpha/kernel/setup.c linux-2.6.16.16/arch/alpha/kernel/setup.c
+--- linux-2.6.16/arch/alpha/kernel/setup.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/arch/alpha/kernel/setup.c 2006-05-11 04:56:24.000000000 +0300
+@@ -24,6 +24,7 @@
+ #include <linux/config.h> /* CONFIG_ALPHA_LCA etc */
+ #include <linux/mc146818rtc.h>
+ #include <linux/console.h>
++#include <linux/cpu.h>
+ #include <linux/errno.h>
+ #include <linux/init.h>
+ #include <linux/string.h>
+@@ -477,6 +478,22 @@
+ #undef PFN_PHYS
+ #undef PFN_MAX
+
++static int __init
++register_cpus(void)
++{
++ int i;
++
++ for_each_possible_cpu(i) {
++ struct cpu *p = kzalloc(sizeof(*p), GFP_KERNEL);
++ if (!p)
++ return -ENOMEM;
++ register_cpu(p, i, NULL);
++ }
++ return 0;
++}
++
++arch_initcall(register_cpus);
++
+ void __init
+ setup_arch(char **cmdline_p)
+ {
+diff -Naur linux-2.6.16/arch/alpha/kernel/smp.c linux-2.6.16.16/arch/alpha/kernel/smp.c
+--- linux-2.6.16/arch/alpha/kernel/smp.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/arch/alpha/kernel/smp.c 2006-05-11 04:56:24.000000000 +0300
+@@ -439,7 +439,7 @@
+ if ((cpu->flags & 0x1cc) == 0x1cc) {
+ smp_num_probed++;
+ /* Assume here that "whami" == index */
+- cpu_set(i, cpu_possible_map);
++ cpu_set(i, cpu_present_mask);
+ cpu->pal_revision = boot_cpu_palrev;
+ }
+
+@@ -450,9 +450,8 @@
+ }
+ } else {
+ smp_num_probed = 1;
+- cpu_set(boot_cpuid, cpu_possible_map);
++ cpu_set(boot_cpuid, cpu_present_mask);
+ }
+- cpu_present_mask = cpumask_of_cpu(boot_cpuid);
+
+ printk(KERN_INFO "SMP: %d CPUs probed -- cpu_present_mask = %lx\n",
+ smp_num_probed, cpu_possible_map.bits[0]);
+@@ -488,9 +487,8 @@
+ smp_prepare_boot_cpu(void)
+ {
+ /*
+- * Mark the boot cpu (current cpu) as both present and online
++ * Mark the boot cpu (current cpu) as online
+ */
+- cpu_set(smp_processor_id(), cpu_present_mask);
+ cpu_set(smp_processor_id(), cpu_online_map);
+ }
+
+diff -Naur linux-2.6.16/arch/alpha/lib/strncpy.S linux-2.6.16.16/arch/alpha/lib/strncpy.S
+--- linux-2.6.16/arch/alpha/lib/strncpy.S 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/arch/alpha/lib/strncpy.S 2006-05-11 04:56:24.000000000 +0300
+@@ -43,8 +43,8 @@
+
+ .align 4
+ $multiword:
+- subq $24, 1, $2 # clear the final bits in the prev word
+- or $2, $24, $2
++ subq $27, 1, $2 # clear the final bits in the prev word
++ or $2, $27, $2
+ zapnot $1, $2, $1
+ subq $18, 1, $18
+
+@@ -70,8 +70,8 @@
+ bne $18, 0b
+
+ 1: ldq_u $1, 0($16) # clear the leading bits in the final word
+- subq $27, 1, $2
+- or $2, $27, $2
++ subq $24, 1, $2
++ or $2, $24, $2
+
+ zap $1, $2, $1
+ stq_u $1, 0($16)
+diff -Naur linux-2.6.16/arch/i386/kernel/apm.c linux-2.6.16.16/arch/i386/kernel/apm.c
+--- linux-2.6.16/arch/i386/kernel/apm.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/arch/i386/kernel/apm.c 2006-05-11 04:56:24.000000000 +0300
+@@ -1081,7 +1081,7 @@
+ break;
+ }
+
+- if (error == APM_NOT_ENGAGED && state != APM_STATE_READY) {
++ if (error == APM_NOT_ENGAGED) {
+ static int tried;
+ int eng_error;
+ if (tried++ == 0) {
+diff -Naur linux-2.6.16/arch/i386/kernel/cpu/amd.c linux-2.6.16.16/arch/i386/kernel/cpu/amd.c
+--- linux-2.6.16/arch/i386/kernel/cpu/amd.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/arch/i386/kernel/cpu/amd.c 2006-05-11 04:56:24.000000000 +0300
+@@ -207,6 +207,8 @@
+ set_bit(X86_FEATURE_K7, c->x86_capability);
+ break;
+ }
++ if (c->x86 >= 6)
++ set_bit(X86_FEATURE_FXSAVE_LEAK, c->x86_capability);
+
+ display_cacheinfo(c);
+
+diff -Naur linux-2.6.16/arch/i386/kernel/cpu/cpufreq/Kconfig linux-2.6.16.16/arch/i386/kernel/cpu/cpufreq/Kconfig
+--- linux-2.6.16/arch/i386/kernel/cpu/cpufreq/Kconfig 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/arch/i386/kernel/cpu/cpufreq/Kconfig 2006-05-11 04:56:24.000000000 +0300
+@@ -203,6 +203,7 @@
+ config X86_LONGHAUL
+ tristate "VIA Cyrix III Longhaul"
+ select CPU_FREQ_TABLE
++ depends on BROKEN
+ help
+ This adds the CPUFreq driver for VIA Samuel/CyrixIII,
+ VIA Cyrix Samuel/C3, VIA Cyrix Ezra and VIA Cyrix Ezra-T
+diff -Naur linux-2.6.16/arch/i386/kernel/cpu/cpufreq/p4-clockmod.c linux-2.6.16.16/arch/i386/kernel/cpu/cpufreq/p4-clockmod.c
+--- linux-2.6.16/arch/i386/kernel/cpu/cpufreq/p4-clockmod.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/arch/i386/kernel/cpu/cpufreq/p4-clockmod.c 2006-05-11 04:56:24.000000000 +0300
+@@ -244,7 +244,7 @@
+ for (i=1; (p4clockmod_table[i].frequency != CPUFREQ_TABLE_END); i++) {
+ if ((i<2) && (has_N44_O17_errata[policy->cpu]))
+ p4clockmod_table[i].frequency = CPUFREQ_ENTRY_INVALID;
+- else if (has_N60_errata[policy->cpu] && p4clockmod_table[i].frequency < 2000000)
++ else if (has_N60_errata[policy->cpu] && ((stock_freq * i)/8) < 2000000)
+ p4clockmod_table[i].frequency = CPUFREQ_ENTRY_INVALID;
+ else
+ p4clockmod_table[i].frequency = (stock_freq * i)/8;
+diff -Naur linux-2.6.16/arch/i386/kernel/cpu/cpufreq/speedstep-smi.c linux-2.6.16.16/arch/i386/kernel/cpu/cpufreq/speedstep-smi.c
+--- linux-2.6.16/arch/i386/kernel/cpu/cpufreq/speedstep-smi.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/arch/i386/kernel/cpu/cpufreq/speedstep-smi.c 2006-05-11 04:56:24.000000000 +0300
+@@ -75,7 +75,9 @@
+ __asm__ __volatile__(
+ "out %%al, (%%dx)\n"
+ : "=D" (result)
+- : "a" (command), "b" (function), "c" (0), "d" (smi_port), "D" (0), "S" (magic)
++ : "a" (command), "b" (function), "c" (0), "d" (smi_port),
++ "D" (0), "S" (magic)
++ : "memory"
+ );
+
+ dprintk("result is %x\n", result);
+diff -Naur linux-2.6.16/arch/i386/kernel/dmi_scan.c linux-2.6.16.16/arch/i386/kernel/dmi_scan.c
+--- linux-2.6.16/arch/i386/kernel/dmi_scan.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/arch/i386/kernel/dmi_scan.c 2006-05-11 04:56:24.000000000 +0300
+@@ -106,7 +106,7 @@
+ struct dmi_device *dev;
+
+ for (i = 0; i < count; i++) {
+- char *d = ((char *) dm) + (i * 2);
++ char *d = (char *)(dm + 1) + (i * 2);
+
+ /* Skip disabled device */
+ if ((*d & 0x80) == 0)
+diff -Naur linux-2.6.16/arch/i386/kernel/vm86.c linux-2.6.16.16/arch/i386/kernel/vm86.c
+--- linux-2.6.16/arch/i386/kernel/vm86.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/arch/i386/kernel/vm86.c 2006-05-11 04:56:24.000000000 +0300
+@@ -43,6 +43,7 @@
+ #include <linux/smp_lock.h>
+ #include <linux/highmem.h>
+ #include <linux/ptrace.h>
++#include <linux/audit.h>
+
+ #include <asm/uaccess.h>
+ #include <asm/io.h>
+@@ -252,6 +253,7 @@
+ static void do_sys_vm86(struct kernel_vm86_struct *info, struct task_struct *tsk)
+ {
+ struct tss_struct *tss;
++ long eax;
+ /*
+ * make sure the vm86() system call doesn't try to do anything silly
+ */
+@@ -305,13 +307,19 @@
+ tsk->thread.screen_bitmap = info->screen_bitmap;
+ if (info->flags & VM86_SCREEN_BITMAP)
+ mark_screen_rdonly(tsk->mm);
++ __asm__ __volatile__("xorl %eax,%eax; movl %eax,%fs; movl %eax,%gs\n\t");
++ __asm__ __volatile__("movl %%eax, %0\n" :"=r"(eax));
++
++ /*call audit_syscall_exit since we do not exit via the normal paths */
++ if (unlikely(current->audit_context))
++ audit_syscall_exit(current, AUDITSC_RESULT(eax), eax);
++
+ __asm__ __volatile__(
+- "xorl %%eax,%%eax; movl %%eax,%%fs; movl %%eax,%%gs\n\t"
+ "movl %0,%%esp\n\t"
+ "movl %1,%%ebp\n\t"
+ "jmp resume_userspace"
+ : /* no outputs */
+- :"r" (&info->regs), "r" (task_thread_info(tsk)) : "ax");
++ :"r" (&info->regs), "r" (task_thread_info(tsk)));
+ /* we never return here */
+ }
+
+diff -Naur linux-2.6.16/arch/m32r/kernel/m32r_ksyms.c linux-2.6.16.16/arch/m32r/kernel/m32r_ksyms.c
+--- linux-2.6.16/arch/m32r/kernel/m32r_ksyms.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/arch/m32r/kernel/m32r_ksyms.c 2006-05-11 04:56:24.000000000 +0300
+@@ -38,10 +38,6 @@
+ EXPORT_SYMBOL(__delay);
+ EXPORT_SYMBOL(__const_udelay);
+
+-EXPORT_SYMBOL(__get_user_1);
+-EXPORT_SYMBOL(__get_user_2);
+-EXPORT_SYMBOL(__get_user_4);
+-
+ EXPORT_SYMBOL(strpbrk);
+ EXPORT_SYMBOL(strstr);
+
+diff -Naur linux-2.6.16/arch/m32r/kernel/setup.c linux-2.6.16.16/arch/m32r/kernel/setup.c
+--- linux-2.6.16/arch/m32r/kernel/setup.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/arch/m32r/kernel/setup.c 2006-05-11 04:56:24.000000000 +0300
+@@ -9,6 +9,7 @@
+
+ #include <linux/config.h>
+ #include <linux/init.h>
++#include <linux/kernel.h>
+ #include <linux/stddef.h>
+ #include <linux/fs.h>
+ #include <linux/sched.h>
+@@ -218,8 +219,6 @@
+ extern unsigned long setup_memory(void);
+ #endif /* CONFIG_DISCONTIGMEM */
+
+-#define M32R_PCC_PCATCR 0x00ef7014 /* will move to m32r.h */
+-
+ void __init setup_arch(char **cmdline_p)
+ {
+ ROOT_DEV = old_decode_dev(ORIG_ROOT_DEV);
+@@ -268,15 +267,14 @@
+ paging_init();
+ }
+
+-static struct cpu cpu[NR_CPUS];
++static struct cpu cpu_devices[NR_CPUS];
+
+ static int __init topology_init(void)
+ {
+- int cpu_id;
++ int i;
+
+- for (cpu_id = 0; cpu_id < NR_CPUS; cpu_id++)
+- if (cpu_possible(cpu_id))
+- register_cpu(&cpu[cpu_id], cpu_id, NULL);
++ for_each_present_cpu(i)
++ register_cpu(&cpu_devices[i], i, NULL);
+
+ return 0;
+ }
+diff -Naur linux-2.6.16/arch/m32r/kernel/smpboot.c linux-2.6.16.16/arch/m32r/kernel/smpboot.c
+--- linux-2.6.16/arch/m32r/kernel/smpboot.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/arch/m32r/kernel/smpboot.c 2006-05-11 04:56:24.000000000 +0300
+@@ -39,8 +39,10 @@
+ * Martin J. Bligh : Added support for multi-quad systems
+ */
+
++#include <linux/module.h>
+ #include <linux/config.h>
+ #include <linux/init.h>
++#include <linux/kernel.h>
+ #include <linux/mm.h>
+ #include <linux/smp_lock.h>
+ #include <linux/irq.h>
+@@ -72,11 +74,15 @@
+
+ /* Bitmask of currently online CPUs */
+ cpumask_t cpu_online_map;
++EXPORT_SYMBOL(cpu_online_map);
+
+ cpumask_t cpu_bootout_map;
+ cpumask_t cpu_bootin_map;
+-cpumask_t cpu_callout_map;
+ static cpumask_t cpu_callin_map;
++cpumask_t cpu_callout_map;
++EXPORT_SYMBOL(cpu_callout_map);
++cpumask_t cpu_possible_map = CPU_MASK_ALL;
++EXPORT_SYMBOL(cpu_possible_map);
+
+ /* Per CPU bogomips and other parameters */
+ struct cpuinfo_m32r cpu_data[NR_CPUS] __cacheline_aligned;
+@@ -110,7 +116,6 @@
+
+ void smp_prepare_boot_cpu(void);
+ void smp_prepare_cpus(unsigned int);
+-static void smp_tune_scheduling(void);
+ static void init_ipi_lock(void);
+ static void do_boot_cpu(int);
+ int __cpu_up(unsigned int);
+@@ -177,6 +182,9 @@
+ }
+ for (phys_id = 0 ; phys_id < nr_cpu ; phys_id++)
+ physid_set(phys_id, phys_cpu_present_map);
++#ifndef CONFIG_HOTPLUG_CPU
++ cpu_present_map = cpu_possible_map;
++#endif
+
+ show_mp_info(nr_cpu);
+
+@@ -186,7 +194,6 @@
+ * Setup boot CPU information
+ */
+ smp_store_cpu_info(0); /* Final full version of the data */
+- smp_tune_scheduling();
+
+ /*
+ * If SMP should be disabled, then really disable it!
+@@ -230,11 +237,6 @@
+ Dprintk("Boot done.\n");
+ }
+
+-static void __init smp_tune_scheduling(void)
+-{
+- /* Nothing to do. */
+-}
+-
+ /*
+ * init_ipi_lock : Initialize IPI locks.
+ */
+@@ -629,4 +631,3 @@
+ physid_2_cpu[phys_id] = -1;
+ cpu_2_physid[cpu_id] = -1;
+ }
+-
+diff -Naur linux-2.6.16/arch/m32r/lib/getuser.S linux-2.6.16.16/arch/m32r/lib/getuser.S
+--- linux-2.6.16/arch/m32r/lib/getuser.S 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/arch/m32r/lib/getuser.S 1970-01-01 02:00:00.000000000 +0200
+@@ -1,88 +0,0 @@
+-/*
+- * __get_user functions.
+- *
+- * (C) Copyright 2001 Hirokazu Takata
+- *
+- * These functions have a non-standard call interface
+- * to make them more efficient, especially as they
+- * return an error value in addition to the "real"
+- * return value.
+- */
+-
+-#include <linux/config.h>
+-
+-/*
+- * __get_user_X
+- *
+- * Inputs: r0 contains the address
+- *
+- * Outputs: r0 is error code (0 or -EFAULT)
+- * r1 contains zero-extended value
+- *
+- * These functions should not modify any other registers,
+- * as they get called from within inline assembly.
+- */
+-
+-#ifdef CONFIG_ISA_DUAL_ISSUE
+-
+- .text
+- .balign 4
+- .globl __get_user_1
+-__get_user_1:
+-1: ldub r1, @r0 || ldi r0, #0
+- jmp r14
+-
+- .balign 4
+- .globl __get_user_2
+-__get_user_2:
+-2: lduh r1, @r0 || ldi r0, #0
+- jmp r14
+-
+- .balign 4
+- .globl __get_user_4
+-__get_user_4:
+-3: ld r1, @r0 || ldi r0, #0
+- jmp r14
+-
+-bad_get_user:
+- ldi r1, #0 || ldi r0, #-14
+- jmp r14
+-
+-#else /* not CONFIG_ISA_DUAL_ISSUE */
+-
+- .text
+- .balign 4
+- .globl __get_user_1
+-__get_user_1:
+-1: ldub r1, @r0
+- ldi r0, #0
+- jmp r14
+-
+- .balign 4
+- .globl __get_user_2
+-__get_user_2:
+-2: lduh r1, @r0
+- ldi r0, #0
+- jmp r14
+-
+- .balign 4
+- .globl __get_user_4
+-__get_user_4:
+-3: ld r1, @r0
+- ldi r0, #0
+- jmp r14
+-
+-bad_get_user:
+- ldi r1, #0
+- ldi r0, #-14
+- jmp r14
+-
+-#endif /* not CONFIG_ISA_DUAL_ISSUE */
+-
+-.section __ex_table,"a"
+- .long 1b,bad_get_user
+- .long 2b,bad_get_user
+- .long 3b,bad_get_user
+-.previous
+-
+- .end
+diff -Naur linux-2.6.16/arch/m32r/lib/Makefile linux-2.6.16.16/arch/m32r/lib/Makefile
+--- linux-2.6.16/arch/m32r/lib/Makefile 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/arch/m32r/lib/Makefile 2006-05-11 04:56:24.000000000 +0300
+@@ -2,6 +2,6 @@
+ # Makefile for M32R-specific library files..
+ #
+
+-lib-y := checksum.o ashxdi3.o memset.o memcpy.o getuser.o \
+- putuser.o delay.o strlen.o usercopy.o csum_partial_copy.o
++lib-y := checksum.o ashxdi3.o memset.o memcpy.o \
++ delay.o strlen.o usercopy.o csum_partial_copy.o
+
+diff -Naur linux-2.6.16/arch/m32r/lib/putuser.S linux-2.6.16.16/arch/m32r/lib/putuser.S
+--- linux-2.6.16/arch/m32r/lib/putuser.S 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/arch/m32r/lib/putuser.S 1970-01-01 02:00:00.000000000 +0200
+@@ -1,84 +0,0 @@
+-/*
+- * __put_user functions.
+- *
+- * (C) Copyright 1998 Linus Torvalds
+- * (C) Copyright 2001 Hirokazu Takata
+- *
+- * These functions have a non-standard call interface
+- * to make them more efficient.
+- */
+-
+-#include <linux/config.h>
+-
+-/*
+- * __put_user_X
+- *
+- * Inputs: r0 contains the address
+- * r1 contains the value
+- *
+- * Outputs: r0 is error code (0 or -EFAULT)
+- * r1 is corrupted (will contain "current_task").
+- *
+- * These functions should not modify any other registers,
+- * as they get called from within inline assembly.
+- */
+-
+-#ifdef CONFIG_ISA_DUAL_ISSUE
+-
+- .text
+- .balign 4
+- .globl __put_user_1
+-__put_user_1:
+-1: stb r1, @r0 || ldi r0, #0
+- jmp r14
+-
+- .balign 4
+- .globl __put_user_2
+-__put_user_2:
+-2: sth r1, @r0 || ldi r0, #0
+- jmp r14
+-
+- .balign 4
+- .globl __put_user_4
+-__put_user_4:
+-3: st r1, @r0 || ldi r0, #0
+- jmp r14
+-
+-bad_put_user:
+- ldi r0, #-14 || jmp r14
+-
+-#else /* not CONFIG_ISA_DUAL_ISSUE */
+-
+- .text
+- .balign 4
+- .globl __put_user_1
+-__put_user_1:
+-1: stb r1, @r0
+- ldi r0, #0
+- jmp r14
+-
+- .balign 4
+- .globl __put_user_2
+-__put_user_2:
+-2: sth r1, @r0
+- ldi r0, #0
+- jmp r14
+-
+- .balign 4
+- .globl __put_user_4
+-__put_user_4:
+-3: st r1, @r0
+- ldi r0, #0
+- jmp r14
+-
+-bad_put_user:
+- ldi r0, #-14
+- jmp r14
+-
+-#endif /* not CONFIG_ISA_DUAL_ISSUE */
+-
+-.section __ex_table,"a"
+- .long 1b,bad_put_user
+- .long 2b,bad_put_user
+- .long 3b,bad_put_user
+-.previous
+diff -Naur linux-2.6.16/arch/mips/kernel/branch.c linux-2.6.16.16/arch/mips/kernel/branch.c
+--- linux-2.6.16/arch/mips/kernel/branch.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/arch/mips/kernel/branch.c 2006-05-11 04:56:24.000000000 +0300
+@@ -184,7 +184,7 @@
+ bit = (insn.i_format.rt >> 2);
+ bit += (bit != 0);
+ bit += 23;
+- switch (insn.i_format.rt) {
++ switch (insn.i_format.rt & 3) {
+ case 0: /* bc1f */
+ case 2: /* bc1fl */
+ if (~fcr31 & (1 << bit))
+diff -Naur linux-2.6.16/arch/mips/mm/c-r4k.c linux-2.6.16.16/arch/mips/mm/c-r4k.c
+--- linux-2.6.16/arch/mips/mm/c-r4k.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/arch/mips/mm/c-r4k.c 2006-05-11 04:56:24.000000000 +0300
+@@ -154,7 +154,8 @@
+
+ static inline void tx49_blast_icache32_page_indexed(unsigned long page)
+ {
+- unsigned long start = page;
++ unsigned long indexmask = current_cpu_data.icache.waysize - 1;
++ unsigned long start = INDEX_BASE + (page & indexmask);
+ unsigned long end = start + PAGE_SIZE;
+ unsigned long ws_inc = 1UL << current_cpu_data.icache.waybit;
+ unsigned long ws_end = current_cpu_data.icache.ways <<
+diff -Naur linux-2.6.16/arch/powerpc/kernel/pci_64.c linux-2.6.16.16/arch/powerpc/kernel/pci_64.c
+--- linux-2.6.16/arch/powerpc/kernel/pci_64.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/arch/powerpc/kernel/pci_64.c 2006-05-11 04:56:24.000000000 +0300
+@@ -78,6 +78,7 @@
+
+ /* Cached ISA bridge dev. */
+ struct pci_dev *ppc64_isabridge_dev = NULL;
++EXPORT_SYMBOL_GPL(ppc64_isabridge_dev);
+
+ static void fixup_broken_pcnet32(struct pci_dev* dev)
+ {
+diff -Naur linux-2.6.16/arch/powerpc/kernel/setup_64.c linux-2.6.16.16/arch/powerpc/kernel/setup_64.c
+--- linux-2.6.16/arch/powerpc/kernel/setup_64.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/arch/powerpc/kernel/setup_64.c 2006-05-11 04:56:24.000000000 +0300
+@@ -256,12 +256,10 @@
+ /*
+ * Initialize stab / SLB management except on iSeries
+ */
+- if (!firmware_has_feature(FW_FEATURE_ISERIES)) {
+- if (cpu_has_feature(CPU_FTR_SLB))
+- slb_initialize();
+- else
+- stab_initialize(lpaca->stab_real);
+- }
++ if (cpu_has_feature(CPU_FTR_SLB))
++ slb_initialize();
++ else if (!firmware_has_feature(FW_FEATURE_ISERIES))
++ stab_initialize(lpaca->stab_real);
+
+ DBG(" <- early_setup()\n");
+ }
+diff -Naur linux-2.6.16/arch/powerpc/kernel/signal_64.c linux-2.6.16.16/arch/powerpc/kernel/signal_64.c
+--- linux-2.6.16/arch/powerpc/kernel/signal_64.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/arch/powerpc/kernel/signal_64.c 2006-05-11 04:56:24.000000000 +0300
+@@ -213,7 +213,7 @@
+ /* Default to using normal stack */
+ newsp = regs->gpr[1];
+
+- if (ka->sa.sa_flags & SA_ONSTACK) {
++ if ((ka->sa.sa_flags & SA_ONSTACK) && current->sas_ss_size) {
+ if (! on_sig_stack(regs->gpr[1]))
+ newsp = (current->sas_ss_sp + current->sas_ss_size);
+ }
+diff -Naur linux-2.6.16/arch/x86_64/ia32/Makefile linux-2.6.16.16/arch/x86_64/ia32/Makefile
+--- linux-2.6.16/arch/x86_64/ia32/Makefile 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/arch/x86_64/ia32/Makefile 2006-05-11 04:56:24.000000000 +0300
+@@ -27,5 +27,5 @@
+ $(obj)/vsyscall-%.so: $(src)/vsyscall.lds $(obj)/vsyscall-%.o FORCE
+ $(call if_changed,syscall)
+
+-AFLAGS_vsyscall-sysenter.o = -m32
+-AFLAGS_vsyscall-syscall.o = -m32
++AFLAGS_vsyscall-sysenter.o = -m32 -Wa,-32
++AFLAGS_vsyscall-syscall.o = -m32 -Wa,-32
+diff -Naur linux-2.6.16/arch/x86_64/kernel/entry.S linux-2.6.16.16/arch/x86_64/kernel/entry.S
+--- linux-2.6.16/arch/x86_64/kernel/entry.S 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/arch/x86_64/kernel/entry.S 2006-05-11 04:56:24.000000000 +0300
+@@ -180,6 +180,10 @@
+ *
+ * XXX if we had a free scratch register we could save the RSP into the stack frame
+ * and report it properly in ps. Unfortunately we haven't.
++ *
++ * When user can change the frames always force IRET. That is because
++ * it deals with uncanonical addresses better. SYSRET has trouble
++ * with them due to bugs in both AMD and Intel CPUs.
+ */
+
+ ENTRY(system_call)
+@@ -254,7 +258,10 @@
+ xorl %esi,%esi # oldset -> arg2
+ call ptregscall_common
+ 1: movl $_TIF_NEED_RESCHED,%edi
+- jmp sysret_check
++ /* Use IRET because user could have changed frame. This
++ works because ptregscall_common has called FIXUP_TOP_OF_STACK. */
++ cli
++ jmp int_with_check
+
+ badsys:
+ movq $-ENOSYS,RAX-ARGOFFSET(%rsp)
+@@ -280,7 +287,8 @@
+ call syscall_trace_leave
+ RESTORE_TOP_OF_STACK %rbx
+ RESTORE_REST
+- jmp ret_from_sys_call
++ /* Use IRET because user could have changed frame */
++ jmp int_ret_from_sys_call
+ CFI_ENDPROC
+
+ /*
+@@ -408,25 +416,9 @@
+ CFI_ADJUST_CFA_OFFSET -8
+ CFI_REGISTER rip, r11
+ SAVE_REST
+- movq %r11, %r15
+- CFI_REGISTER rip, r15
+ FIXUP_TOP_OF_STACK %r11
+ call sys_execve
+- GET_THREAD_INFO(%rcx)
+- bt $TIF_IA32,threadinfo_flags(%rcx)
+- CFI_REMEMBER_STATE
+- jc exec_32bit
+ RESTORE_TOP_OF_STACK %r11
+- movq %r15, %r11
+- CFI_REGISTER rip, r11
+- RESTORE_REST
+- pushq %r11
+- CFI_ADJUST_CFA_OFFSET 8
+- CFI_REL_OFFSET rip, 0
+- ret
+-
+-exec_32bit:
+- CFI_RESTORE_STATE
+ movq %rax,RAX(%rsp)
+ RESTORE_REST
+ jmp int_ret_from_sys_call
+diff -Naur linux-2.6.16/arch/x86_64/kernel/pci-gart.c linux-2.6.16.16/arch/x86_64/kernel/pci-gart.c
+--- linux-2.6.16/arch/x86_64/kernel/pci-gart.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/arch/x86_64/kernel/pci-gart.c 2006-05-11 04:56:24.000000000 +0300
+@@ -114,10 +114,6 @@
+ static void free_iommu(unsigned long offset, int size)
+ {
+ unsigned long flags;
+- if (size == 1) {
+- clear_bit(offset, iommu_gart_bitmap);
+- return;
+- }
+ spin_lock_irqsave(&iommu_bitmap_lock, flags);
+ __clear_bit_string(iommu_gart_bitmap, offset, size);
+ spin_unlock_irqrestore(&iommu_bitmap_lock, flags);
+diff -Naur linux-2.6.16/arch/x86_64/kernel/process.c linux-2.6.16.16/arch/x86_64/kernel/process.c
+--- linux-2.6.16/arch/x86_64/kernel/process.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/arch/x86_64/kernel/process.c 2006-05-11 04:56:24.000000000 +0300
+@@ -527,8 +527,6 @@
+ int cpu = smp_processor_id();
+ struct tss_struct *tss = &per_cpu(init_tss, cpu);
+
+- unlazy_fpu(prev_p);
+-
+ /*
+ * Reload esp0, LDT and the page table pointer:
+ */
+@@ -591,6 +589,12 @@
+ prev->userrsp = read_pda(oldrsp);
+ write_pda(oldrsp, next->userrsp);
+ write_pda(pcurrent, next_p);
++
++ /* This must be here to ensure both math_state_restore() and
++ kernel_fpu_begin() work consistently.
++ And the AMD workaround requires it to be after DS reload. */
++ unlazy_fpu(prev_p);
++
+ write_pda(kernelstack,
+ task_stack_page(next_p) + THREAD_SIZE - PDA_STACKOFFSET);
+
+diff -Naur linux-2.6.16/arch/x86_64/kernel/setup.c linux-2.6.16.16/arch/x86_64/kernel/setup.c
+--- linux-2.6.16/arch/x86_64/kernel/setup.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/arch/x86_64/kernel/setup.c 2006-05-11 04:56:24.000000000 +0300
+@@ -909,6 +909,10 @@
+ if (c->x86 == 15 && ((level >= 0x0f48 && level < 0x0f50) || level >= 0x0f58))
+ set_bit(X86_FEATURE_REP_GOOD, &c->x86_capability);
+
++ /* Enable workaround for FXSAVE leak */
++ if (c->x86 >= 6)
++ set_bit(X86_FEATURE_FXSAVE_LEAK, &c->x86_capability);
++
+ r = get_model_name(c);
+ if (!r) {
+ switch (c->x86) {
+diff -Naur linux-2.6.16/block/genhd.c linux-2.6.16.16/block/genhd.c
+--- linux-2.6.16/block/genhd.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/block/genhd.c 2006-05-11 04:56:24.000000000 +0300
+@@ -16,8 +16,6 @@
+ #include <linux/kobj_map.h>
+ #include <linux/buffer_head.h>
+
+-#define MAX_PROBE_HASH 255 /* random */
+-
+ static struct subsystem block_subsys;
+
+ static DECLARE_MUTEX(block_subsys_sem);
+@@ -30,108 +28,29 @@
+ struct blk_major_name *next;
+ int major;
+ char name[16];
+-} *major_names[MAX_PROBE_HASH];
++} *major_names[BLKDEV_MAJOR_HASH_SIZE];
+
+ /* index in the above - for now: assume no multimajor ranges */
+ static inline int major_to_index(int major)
+ {
+- return major % MAX_PROBE_HASH;
+-}
+-
+-struct blkdev_info {
+- int index;
+- struct blk_major_name *bd;
+-};
+-
+-/*
+- * iterate over a list of blkdev_info structures. allows
+- * the major_names array to be iterated over from outside this file
+- * must be called with the block_subsys_sem held
+- */
+-void *get_next_blkdev(void *dev)
+-{
+- struct blkdev_info *info;
+-
+- if (dev == NULL) {
+- info = kmalloc(sizeof(*info), GFP_KERNEL);
+- if (!info)
+- goto out;
+- info->index=0;
+- info->bd = major_names[info->index];
+- if (info->bd)
+- goto out;
+- } else {
+- info = dev;
+- }
+-
+- while (info->index < ARRAY_SIZE(major_names)) {
+- if (info->bd)
+- info->bd = info->bd->next;
+- if (info->bd)
+- goto out;
+- /*
+- * No devices on this chain, move to the next
+- */
+- info->index++;
+- info->bd = (info->index < ARRAY_SIZE(major_names)) ?
+- major_names[info->index] : NULL;
+- if (info->bd)
+- goto out;
+- }
+-
+-out:
+- return info;
+-}
+-
+-void *acquire_blkdev_list(void)
+-{
+- down(&block_subsys_sem);
+- return get_next_blkdev(NULL);
+-}
+-
+-void release_blkdev_list(void *dev)
+-{
+- up(&block_subsys_sem);
+- kfree(dev);
++ return major % BLKDEV_MAJOR_HASH_SIZE;
+ }
+
++#ifdef CONFIG_PROC_FS
+
+-/*
+- * Count the number of records in the blkdev_list.
+- * must be called with the block_subsys_sem held
+- */
+-int count_blkdev_list(void)
++void blkdev_show(struct seq_file *f, off_t offset)
+ {
+- struct blk_major_name *n;
+- int i, count;
+-
+- count = 0;
++ struct blk_major_name *dp;
+
+- for (i = 0; i < ARRAY_SIZE(major_names); i++) {
+- for (n = major_names[i]; n; n = n->next)
+- count++;
++ if (offset < BLKDEV_MAJOR_HASH_SIZE) {
++ down(&block_subsys_sem);
++ for (dp = major_names[offset]; dp; dp = dp->next)
++ seq_printf(f, "%3d %s\n", dp->major, dp->name);
++ up(&block_subsys_sem);
+ }
+-
+- return count;
+-}
+-
+-/*
+- * extract the major and name values from a blkdev_info struct
+- * passed in as a void to *dev. Must be called with
+- * block_subsys_sem held
+- */
+-int get_blkdev_info(void *dev, int *major, char **name)
+-{
+- struct blkdev_info *info = dev;
+-
+- if (info->bd == NULL)
+- return 1;
+-
+- *major = info->bd->major;
+- *name = info->bd->name;
+- return 0;
+ }
+
++#endif /* CONFIG_PROC_FS */
+
+ int register_blkdev(unsigned int major, const char *name)
+ {
+diff -Naur linux-2.6.16/Documentation/dvb/get_dvb_firmware linux-2.6.16.16/Documentation/dvb/get_dvb_firmware
+--- linux-2.6.16/Documentation/dvb/get_dvb_firmware 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/Documentation/dvb/get_dvb_firmware 2006-05-11 04:56:24.000000000 +0300
+@@ -240,9 +240,9 @@
+ }
+
+ sub nxt2002 {
+- my $sourcefile = "Broadband4PC_4_2_11.zip";
++ my $sourcefile = "Technisat_DVB-PC_4_4_COMPACT.zip";
+ my $url = "http://www.bbti.us/download/windows/$sourcefile";
+- my $hash = "c6d2ea47a8f456d887ada0cfb718ff2a";
++ my $hash = "476befae8c7c1bb9648954060b1eec1f";
+ my $outfile = "dvb-fe-nxt2002.fw";
+ my $tmpdir = tempdir(DIR => "/tmp", CLEANUP => 1);
+
+@@ -250,8 +250,8 @@
+
+ wgetfile($sourcefile, $url);
+ unzip($sourcefile, $tmpdir);
+- verify("$tmpdir/SkyNETU.sys", $hash);
+- extract("$tmpdir/SkyNETU.sys", 375832, 5908, $outfile);
++ verify("$tmpdir/SkyNET.sys", $hash);
++ extract("$tmpdir/SkyNET.sys", 331624, 5908, $outfile);
+
+ $outfile;
+ }
+diff -Naur linux-2.6.16/drivers/base/cpu.c linux-2.6.16.16/drivers/base/cpu.c
+--- linux-2.6.16/drivers/base/cpu.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/base/cpu.c 2006-05-11 04:56:24.000000000 +0300
+@@ -141,7 +141,7 @@
+ return error;
+ }
+
+-struct sys_device *get_cpu_sysdev(int cpu)
++struct sys_device *get_cpu_sysdev(unsigned cpu)
+ {
+ if (cpu < NR_CPUS)
+ return cpu_sys_devices[cpu];
+diff -Naur linux-2.6.16/drivers/base/firmware_class.c linux-2.6.16.16/drivers/base/firmware_class.c
+--- linux-2.6.16/drivers/base/firmware_class.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/base/firmware_class.c 2006-05-11 04:56:24.000000000 +0300
+@@ -211,18 +211,20 @@
+ fw_realloc_buffer(struct firmware_priv *fw_priv, int min_size)
+ {
+ u8 *new_data;
++ int new_size = fw_priv->alloc_size;
+
+ if (min_size <= fw_priv->alloc_size)
+ return 0;
+
+- new_data = vmalloc(fw_priv->alloc_size + PAGE_SIZE);
++ new_size = ALIGN(min_size, PAGE_SIZE);
++ new_data = vmalloc(new_size);
+ if (!new_data) {
+ printk(KERN_ERR "%s: unable to alloc buffer\n", __FUNCTION__);
+ /* Make sure that we don't keep incomplete data */
+ fw_load_abort(fw_priv);
+ return -ENOMEM;
+ }
+- fw_priv->alloc_size += PAGE_SIZE;
++ fw_priv->alloc_size = new_size;
+ if (fw_priv->fw->data) {
+ memcpy(new_data, fw_priv->fw->data, fw_priv->fw->size);
+ vfree(fw_priv->fw->data);
+diff -Naur linux-2.6.16/drivers/base/node.c linux-2.6.16.16/drivers/base/node.c
+--- linux-2.6.16/drivers/base/node.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/base/node.c 2006-05-11 04:56:24.000000000 +0300
+@@ -106,7 +106,7 @@
+ other_node = 0;
+ for (i = 0; i < MAX_NR_ZONES; i++) {
+ struct zone *z = &pg->node_zones[i];
+- for (cpu = 0; cpu < NR_CPUS; cpu++) {
++ for_each_online_cpu(cpu) {
+ struct per_cpu_pageset *ps = zone_pcp(z,cpu);
+ numa_hit += ps->numa_hit;
+ numa_miss += ps->numa_miss;
+diff -Naur linux-2.6.16/drivers/block/cciss.c linux-2.6.16.16/drivers/block/cciss.c
+--- linux-2.6.16/drivers/block/cciss.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/block/cciss.c 2006-05-11 04:56:24.000000000 +0300
+@@ -1181,6 +1181,53 @@
+ return 0;
+ }
+
++static inline void complete_buffers(struct bio *bio, int status)
++{
++ while (bio) {
++ struct bio *xbh = bio->bi_next;
++ int nr_sectors = bio_sectors(bio);
++
++ bio->bi_next = NULL;
++ blk_finished_io(len);
++ bio_endio(bio, nr_sectors << 9, status ? 0 : -EIO);
++ bio = xbh;
++ }
++
++}
++
++static void cciss_softirq_done(struct request *rq)
++{
++ CommandList_struct *cmd = rq->completion_data;
++ ctlr_info_t *h = hba[cmd->ctlr];
++ unsigned long flags;
++ u64bit temp64;
++ int i, ddir;
++
++ if (cmd->Request.Type.Direction == XFER_READ)
++ ddir = PCI_DMA_FROMDEVICE;
++ else
++ ddir = PCI_DMA_TODEVICE;
++
++ /* command did not need to be retried */
++ /* unmap the DMA mapping for all the scatter gather elements */
++ for(i=0; i<cmd->Header.SGList; i++) {
++ temp64.val32.lower = cmd->SG[i].Addr.lower;
++ temp64.val32.upper = cmd->SG[i].Addr.upper;
++ pci_unmap_page(h->pdev, temp64.val, cmd->SG[i].Len, ddir);
++ }
++
++ complete_buffers(rq->bio, rq->errors);
++
++#ifdef CCISS_DEBUG
++ printk("Done with %p\n", rq);
++#endif /* CCISS_DEBUG */
++
++ spin_lock_irqsave(&h->lock, flags);
++ end_that_request_last(rq, rq->errors);
++ cmd_free(h, cmd,1);
++ spin_unlock_irqrestore(&h->lock, flags);
++}
++
+ /* This function will check the usage_count of the drive to be updated/added.
+ * If the usage_count is zero then the drive information will be updated and
+ * the disk will be re-registered with the kernel. If not then it will be
+@@ -1249,6 +1296,8 @@
+
+ blk_queue_max_sectors(disk->queue, 512);
+
++ blk_queue_softirq_done(disk->queue, cciss_softirq_done);
++
+ disk->queue->queuedata = hba[ctlr];
+
+ blk_queue_hardsect_size(disk->queue,
+@@ -2148,20 +2197,6 @@
+ addQ (&(h->cmpQ), c);
+ }
+ }
+-
+-static inline void complete_buffers(struct bio *bio, int status)
+-{
+- while (bio) {
+- struct bio *xbh = bio->bi_next;
+- int nr_sectors = bio_sectors(bio);
+-
+- bio->bi_next = NULL;
+- blk_finished_io(len);
+- bio_endio(bio, nr_sectors << 9, status ? 0 : -EIO);
+- bio = xbh;
+- }
+-
+-}
+ /* Assumes that CCISS_LOCK(h->ctlr) is held. */
+ /* Zeros out the error record and then resends the command back */
+ /* to the controller */
+@@ -2179,39 +2214,6 @@
+ start_io(h);
+ }
+
+-static void cciss_softirq_done(struct request *rq)
+-{
+- CommandList_struct *cmd = rq->completion_data;
+- ctlr_info_t *h = hba[cmd->ctlr];
+- unsigned long flags;
+- u64bit temp64;
+- int i, ddir;
+-
+- if (cmd->Request.Type.Direction == XFER_READ)
+- ddir = PCI_DMA_FROMDEVICE;
+- else
+- ddir = PCI_DMA_TODEVICE;
+-
+- /* command did not need to be retried */
+- /* unmap the DMA mapping for all the scatter gather elements */
+- for(i=0; i<cmd->Header.SGList; i++) {
+- temp64.val32.lower = cmd->SG[i].Addr.lower;
+- temp64.val32.upper = cmd->SG[i].Addr.upper;
+- pci_unmap_page(h->pdev, temp64.val, cmd->SG[i].Len, ddir);
+- }
+-
+- complete_buffers(rq->bio, rq->errors);
+-
+-#ifdef CCISS_DEBUG
+- printk("Done with %p\n", rq);
+-#endif /* CCISS_DEBUG */
+-
+- spin_lock_irqsave(&h->lock, flags);
+- end_that_request_last(rq, rq->errors);
+- cmd_free(h, cmd,1);
+- spin_unlock_irqrestore(&h->lock, flags);
+-}
+-
+ /* checks the status of the job and calls complete buffers to mark all
+ * buffers for the completed job. Note that this function does not need
+ * to hold the hba/queue lock.
+@@ -3269,8 +3271,8 @@
+ unregister_blkdev(hba[i]->major, hba[i]->devname);
+ clean1:
+ release_io_mem(hba[i]);
+- free_hba(i);
+ hba[i]->busy_initializing = 0;
++ free_hba(i);
+ return(-1);
+ }
+
+diff -Naur linux-2.6.16/drivers/char/agp/efficeon-agp.c linux-2.6.16.16/drivers/char/agp/efficeon-agp.c
+--- linux-2.6.16/drivers/char/agp/efficeon-agp.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/char/agp/efficeon-agp.c 2006-05-11 04:56:24.000000000 +0300
+@@ -64,6 +64,12 @@
+ {.mask = 0x00000001, .type = 0}
+ };
+
++/* This function does the same thing as mask_memory() for this chipset... */
++static inline unsigned long efficeon_mask_memory(unsigned long addr)
++{
++ return addr | 0x00000001;
++}
++
+ static struct aper_size_info_lvl2 efficeon_generic_sizes[4] =
+ {
+ {256, 65536, 0},
+@@ -251,7 +257,7 @@
+ last_page = NULL;
+ for (i = 0; i < count; i++) {
+ int index = pg_start + i;
+- unsigned long insert = mem->memory[i];
++ unsigned long insert = efficeon_mask_memory(mem->memory[i]);
+
+ page = (unsigned int *) efficeon_private.l1_table[index >> 10];
+
+diff -Naur linux-2.6.16/drivers/char/cs5535_gpio.c linux-2.6.16.16/drivers/char/cs5535_gpio.c
+--- linux-2.6.16/drivers/char/cs5535_gpio.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/char/cs5535_gpio.c 2006-05-11 04:56:24.000000000 +0300
+@@ -241,9 +241,10 @@
+ static void __exit cs5535_gpio_cleanup(void)
+ {
+ dev_t dev_id = MKDEV(major, 0);
++
++ cdev_del(&cs5535_gpio_cdev);
+ unregister_chrdev_region(dev_id, CS5535_GPIO_COUNT);
+- if (gpio_base != 0)
+- release_region(gpio_base, CS5535_GPIO_SIZE);
++ release_region(gpio_base, CS5535_GPIO_SIZE);
+ }
+
+ module_init(cs5535_gpio_init);
+diff -Naur linux-2.6.16/drivers/char/ipmi/ipmi_bt_sm.c linux-2.6.16.16/drivers/char/ipmi/ipmi_bt_sm.c
+--- linux-2.6.16/drivers/char/ipmi/ipmi_bt_sm.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/char/ipmi/ipmi_bt_sm.c 2006-05-11 04:56:24.000000000 +0300
+@@ -165,7 +165,7 @@
+ {
+ unsigned int i;
+
+- if ((size < 2) || (size > IPMI_MAX_MSG_LENGTH))
++ if ((size < 2) || (size > (IPMI_MAX_MSG_LENGTH - 2)))
+ return -1;
+
+ if ((bt->state != BT_STATE_IDLE) && (bt->state != BT_STATE_HOSED))
+diff -Naur linux-2.6.16/drivers/char/Kconfig linux-2.6.16.16/drivers/char/Kconfig
+--- linux-2.6.16/drivers/char/Kconfig 2006-05-18 01:12:22.000000000 +0300
++++ linux-2.6.16.16/drivers/char/Kconfig 2006-05-17 21:41:29.000000000 +0300
+@@ -187,6 +187,7 @@
+ config ISI
+ tristate "Multi-Tech multiport card support (EXPERIMENTAL)"
+ depends on SERIAL_NONSTANDARD
++ select FW_LOADER
+ help
+ This is a driver for the Multi-Tech cards which provide several
+ serial ports. The driver is experimental and can currently only be
+diff -Naur linux-2.6.16/drivers/char/snsc.c linux-2.6.16.16/drivers/char/snsc.c
+--- linux-2.6.16/drivers/char/snsc.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/char/snsc.c 2006-05-11 04:56:24.000000000 +0300
+@@ -391,7 +391,8 @@
+ format_module_id(devnamep, geo_module(geoid),
+ MODULE_FORMAT_BRIEF);
+ devnamep = devname + strlen(devname);
+- sprintf(devnamep, "#%d", geo_slab(geoid));
++ sprintf(devnamep, "^%d#%d", geo_slot(geoid),
++ geo_slab(geoid));
+
+ /* allocate sysctl device data */
+ scd = kmalloc(sizeof (struct sysctl_data_s),
+diff -Naur linux-2.6.16/drivers/char/sonypi.c linux-2.6.16.16/drivers/char/sonypi.c
+--- linux-2.6.16/drivers/char/sonypi.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/char/sonypi.c 2006-05-11 04:56:24.000000000 +0300
+@@ -1341,6 +1341,9 @@
+ else if ((pcidev = pci_get_device(PCI_VENDOR_ID_INTEL,
+ PCI_DEVICE_ID_INTEL_ICH6_1, NULL)))
+ sonypi_device.model = SONYPI_DEVICE_MODEL_TYPE3;
++ else if ((pcidev = pci_get_device(PCI_VENDOR_ID_INTEL,
++ PCI_DEVICE_ID_INTEL_ICH7_1, NULL)))
++ sonypi_device.model = SONYPI_DEVICE_MODEL_TYPE3;
+ else
+ sonypi_device.model = SONYPI_DEVICE_MODEL_TYPE2;
+
+diff -Naur linux-2.6.16/drivers/char/tipar.c linux-2.6.16.16/drivers/char/tipar.c
+--- linux-2.6.16/drivers/char/tipar.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/char/tipar.c 2006-05-11 04:56:24.000000000 +0300
+@@ -515,7 +515,7 @@
+ err = PTR_ERR(tipar_class);
+ goto out_chrdev;
+ }
+- if (parport_register_driver(&tipar_driver) || tp_count == 0) {
++ if (parport_register_driver(&tipar_driver)) {
+ printk(KERN_ERR "tipar: unable to register with parport\n");
+ err = -EIO;
+ goto out_class;
+diff -Naur linux-2.6.16/drivers/char/tlclk.c linux-2.6.16.16/drivers/char/tlclk.c
+--- linux-2.6.16/drivers/char/tlclk.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/char/tlclk.c 2006-05-11 04:56:24.000000000 +0300
+@@ -327,7 +327,7 @@
+ return strnlen(buf, count);
+ }
+
+-static DEVICE_ATTR(received_ref_clk3a, S_IWUGO, NULL,
++static DEVICE_ATTR(received_ref_clk3a, (S_IWUSR|S_IWGRP), NULL,
+ store_received_ref_clk3a);
+
+
+@@ -349,7 +349,7 @@
+ return strnlen(buf, count);
+ }
+
+-static DEVICE_ATTR(received_ref_clk3b, S_IWUGO, NULL,
++static DEVICE_ATTR(received_ref_clk3b, (S_IWUSR|S_IWGRP), NULL,
+ store_received_ref_clk3b);
+
+
+@@ -371,7 +371,7 @@
+ return strnlen(buf, count);
+ }
+
+-static DEVICE_ATTR(enable_clk3b_output, S_IWUGO, NULL,
++static DEVICE_ATTR(enable_clk3b_output, (S_IWUSR|S_IWGRP), NULL,
+ store_enable_clk3b_output);
+
+ static ssize_t store_enable_clk3a_output(struct device *d,
+@@ -392,7 +392,7 @@
+ return strnlen(buf, count);
+ }
+
+-static DEVICE_ATTR(enable_clk3a_output, S_IWUGO, NULL,
++static DEVICE_ATTR(enable_clk3a_output, (S_IWUSR|S_IWGRP), NULL,
+ store_enable_clk3a_output);
+
+ static ssize_t store_enable_clkb1_output(struct device *d,
+@@ -413,7 +413,7 @@
+ return strnlen(buf, count);
+ }
+
+-static DEVICE_ATTR(enable_clkb1_output, S_IWUGO, NULL,
++static DEVICE_ATTR(enable_clkb1_output, (S_IWUSR|S_IWGRP), NULL,
+ store_enable_clkb1_output);
+
+
+@@ -435,7 +435,7 @@
+ return strnlen(buf, count);
+ }
+
+-static DEVICE_ATTR(enable_clka1_output, S_IWUGO, NULL,
++static DEVICE_ATTR(enable_clka1_output, (S_IWUSR|S_IWGRP), NULL,
+ store_enable_clka1_output);
+
+ static ssize_t store_enable_clkb0_output(struct device *d,
+@@ -456,7 +456,7 @@
+ return strnlen(buf, count);
+ }
+
+-static DEVICE_ATTR(enable_clkb0_output, S_IWUGO, NULL,
++static DEVICE_ATTR(enable_clkb0_output, (S_IWUSR|S_IWGRP), NULL,
+ store_enable_clkb0_output);
+
+ static ssize_t store_enable_clka0_output(struct device *d,
+@@ -477,7 +477,7 @@
+ return strnlen(buf, count);
+ }
+
+-static DEVICE_ATTR(enable_clka0_output, S_IWUGO, NULL,
++static DEVICE_ATTR(enable_clka0_output, (S_IWUSR|S_IWGRP), NULL,
+ store_enable_clka0_output);
+
+ static ssize_t store_select_amcb2_transmit_clock(struct device *d,
+@@ -519,7 +519,7 @@
+ return strnlen(buf, count);
+ }
+
+-static DEVICE_ATTR(select_amcb2_transmit_clock, S_IWUGO, NULL,
++static DEVICE_ATTR(select_amcb2_transmit_clock, (S_IWUSR|S_IWGRP), NULL,
+ store_select_amcb2_transmit_clock);
+
+ static ssize_t store_select_amcb1_transmit_clock(struct device *d,
+@@ -560,7 +560,7 @@
+ return strnlen(buf, count);
+ }
+
+-static DEVICE_ATTR(select_amcb1_transmit_clock, S_IWUGO, NULL,
++static DEVICE_ATTR(select_amcb1_transmit_clock, (S_IWUSR|S_IWGRP), NULL,
+ store_select_amcb1_transmit_clock);
+
+ static ssize_t store_select_redundant_clock(struct device *d,
+@@ -581,7 +581,7 @@
+ return strnlen(buf, count);
+ }
+
+-static DEVICE_ATTR(select_redundant_clock, S_IWUGO, NULL,
++static DEVICE_ATTR(select_redundant_clock, (S_IWUSR|S_IWGRP), NULL,
+ store_select_redundant_clock);
+
+ static ssize_t store_select_ref_frequency(struct device *d,
+@@ -602,7 +602,7 @@
+ return strnlen(buf, count);
+ }
+
+-static DEVICE_ATTR(select_ref_frequency, S_IWUGO, NULL,
++static DEVICE_ATTR(select_ref_frequency, (S_IWUSR|S_IWGRP), NULL,
+ store_select_ref_frequency);
+
+ static ssize_t store_filter_select(struct device *d,
+@@ -623,7 +623,7 @@
+ return strnlen(buf, count);
+ }
+
+-static DEVICE_ATTR(filter_select, S_IWUGO, NULL, store_filter_select);
++static DEVICE_ATTR(filter_select, (S_IWUSR|S_IWGRP), NULL, store_filter_select);
+
+ static ssize_t store_hardware_switching_mode(struct device *d,
+ struct device_attribute *attr, const char *buf, size_t count)
+@@ -643,7 +643,7 @@
+ return strnlen(buf, count);
+ }
+
+-static DEVICE_ATTR(hardware_switching_mode, S_IWUGO, NULL,
++static DEVICE_ATTR(hardware_switching_mode, (S_IWUSR|S_IWGRP), NULL,
+ store_hardware_switching_mode);
+
+ static ssize_t store_hardware_switching(struct device *d,
+@@ -664,7 +664,7 @@
+ return strnlen(buf, count);
+ }
+
+-static DEVICE_ATTR(hardware_switching, S_IWUGO, NULL,
++static DEVICE_ATTR(hardware_switching, (S_IWUSR|S_IWGRP), NULL,
+ store_hardware_switching);
+
+ static ssize_t store_refalign (struct device *d,
+@@ -684,7 +684,7 @@
+ return strnlen(buf, count);
+ }
+
+-static DEVICE_ATTR(refalign, S_IWUGO, NULL, store_refalign);
++static DEVICE_ATTR(refalign, (S_IWUSR|S_IWGRP), NULL, store_refalign);
+
+ static ssize_t store_mode_select (struct device *d,
+ struct device_attribute *attr, const char *buf, size_t count)
+@@ -704,7 +704,7 @@
+ return strnlen(buf, count);
+ }
+
+-static DEVICE_ATTR(mode_select, S_IWUGO, NULL, store_mode_select);
++static DEVICE_ATTR(mode_select, (S_IWUSR|S_IWGRP), NULL, store_mode_select);
+
+ static ssize_t store_reset (struct device *d,
+ struct device_attribute *attr, const char *buf, size_t count)
+@@ -724,7 +724,7 @@
+ return strnlen(buf, count);
+ }
+
+-static DEVICE_ATTR(reset, S_IWUGO, NULL, store_reset);
++static DEVICE_ATTR(reset, (S_IWUSR|S_IWGRP), NULL, store_reset);
+
+ static struct attribute *tlclk_sysfs_entries[] = {
+ &dev_attr_current_ref.attr,
+@@ -767,6 +767,7 @@
+ printk(KERN_ERR "tlclk: can't get major %d.\n", tlclk_major);
+ return ret;
+ }
++ tlclk_major = ret;
+ alarm_events = kzalloc( sizeof(struct tlclk_alarms), GFP_KERNEL);
+ if (!alarm_events)
+ goto out1;
+diff -Naur linux-2.6.16/drivers/char/tty_io.c linux-2.6.16.16/drivers/char/tty_io.c
+--- linux-2.6.16/drivers/char/tty_io.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/char/tty_io.c 2006-05-11 04:56:24.000000000 +0300
+@@ -2706,7 +2706,11 @@
+ }
+ task_lock(p);
+ if (p->files) {
+- rcu_read_lock();
++ /*
++ * We don't take a ref to the file, so we must
++ * hold ->file_lock instead.
++ */
++ spin_lock(&p->files->file_lock);
+ fdt = files_fdtable(p->files);
+ for (i=0; i < fdt->max_fds; i++) {
+ filp = fcheck_files(p->files, i);
+@@ -2721,7 +2725,7 @@
+ break;
+ }
+ }
+- rcu_read_unlock();
++ spin_unlock(&p->files->file_lock);
+ }
+ task_unlock(p);
+ } while_each_task_pid(session, PIDTYPE_SID, p);
+diff -Naur linux-2.6.16/drivers/edac/Kconfig linux-2.6.16.16/drivers/edac/Kconfig
+--- linux-2.6.16/drivers/edac/Kconfig 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/edac/Kconfig 2006-05-11 04:56:24.000000000 +0300
+@@ -71,7 +71,7 @@
+
+ config EDAC_E752X
+ tristate "Intel e752x (e7520, e7525, e7320)"
+- depends on EDAC_MM_EDAC && PCI
++ depends on EDAC_MM_EDAC && PCI && HOTPLUG
+ help
+ Support for error detection and correction on the Intel
+ E7520, E7525, E7320 server chipsets.
+diff -Naur linux-2.6.16/drivers/i2c/busses/i2c-i801.c linux-2.6.16.16/drivers/i2c/busses/i2c-i801.c
+--- linux-2.6.16/drivers/i2c/busses/i2c-i801.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/i2c/busses/i2c-i801.c 2006-05-11 04:56:24.000000000 +0300
+@@ -478,6 +478,11 @@
+ ret = i801_transaction();
+ }
+
++ /* Some BIOSes don't like it when PEC is enabled at reboot or resume
++ time, so we forcibly disable it after every transaction. */
++ if (hwpec)
++ outb_p(0, SMBAUXCTL);
++
+ if(block)
+ return ret;
+ if(ret)
+diff -Naur linux-2.6.16/drivers/i2c/chips/m41t00.c linux-2.6.16.16/drivers/i2c/chips/m41t00.c
+--- linux-2.6.16/drivers/i2c/chips/m41t00.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/i2c/chips/m41t00.c 2006-05-11 04:56:24.000000000 +0300
+@@ -129,13 +129,13 @@
+ if ((i2c_smbus_write_byte_data(save_client, 0, tm.tm_sec & 0x7f) < 0)
+ || (i2c_smbus_write_byte_data(save_client, 1, tm.tm_min & 0x7f)
+ < 0)
+- || (i2c_smbus_write_byte_data(save_client, 2, tm.tm_hour & 0x7f)
++ || (i2c_smbus_write_byte_data(save_client, 2, tm.tm_hour & 0x3f)
+ < 0)
+- || (i2c_smbus_write_byte_data(save_client, 4, tm.tm_mday & 0x7f)
++ || (i2c_smbus_write_byte_data(save_client, 4, tm.tm_mday & 0x3f)
+ < 0)
+- || (i2c_smbus_write_byte_data(save_client, 5, tm.tm_mon & 0x7f)
++ || (i2c_smbus_write_byte_data(save_client, 5, tm.tm_mon & 0x1f)
+ < 0)
+- || (i2c_smbus_write_byte_data(save_client, 6, tm.tm_year & 0x7f)
++ || (i2c_smbus_write_byte_data(save_client, 6, tm.tm_year & 0xff)
+ < 0))
+
+ dev_warn(&save_client->dev,"m41t00: can't write to rtc chip\n");
+diff -Naur linux-2.6.16/drivers/ide/pci/alim15x3.c linux-2.6.16.16/drivers/ide/pci/alim15x3.c
+--- linux-2.6.16/drivers/ide/pci/alim15x3.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/ide/pci/alim15x3.c 2006-05-11 04:56:24.000000000 +0300
+@@ -731,6 +731,8 @@
+
+ if(m5229_revision <= 0x20)
+ tmpbyte = (tmpbyte & (~0x02)) | 0x01;
++ else if (m5229_revision == 0xc7)
++ tmpbyte |= 0x03;
+ else
+ tmpbyte |= 0x01;
+
+diff -Naur linux-2.6.16/drivers/ieee1394/sbp2.c linux-2.6.16.16/drivers/ieee1394/sbp2.c
+--- linux-2.6.16/drivers/ieee1394/sbp2.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/ieee1394/sbp2.c 2006-05-11 04:56:24.000000000 +0300
+@@ -495,22 +495,17 @@
+ /*
+ * This function finds the sbp2_command for a given outstanding SCpnt.
+ * Only looks at the inuse list.
++ * Must be called with scsi_id->sbp2_command_orb_lock held.
+ */
+-static struct sbp2_command_info *sbp2util_find_command_for_SCpnt(struct scsi_id_instance_data *scsi_id, void *SCpnt)
++static struct sbp2_command_info *sbp2util_find_command_for_SCpnt(
++ struct scsi_id_instance_data *scsi_id, void *SCpnt)
+ {
+ struct sbp2_command_info *command;
+- unsigned long flags;
+
+- spin_lock_irqsave(&scsi_id->sbp2_command_orb_lock, flags);
+- if (!list_empty(&scsi_id->sbp2_command_orb_inuse)) {
+- list_for_each_entry(command, &scsi_id->sbp2_command_orb_inuse, list) {
+- if (command->Current_SCpnt == SCpnt) {
+- spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags);
++ if (!list_empty(&scsi_id->sbp2_command_orb_inuse))
++ list_for_each_entry(command, &scsi_id->sbp2_command_orb_inuse, list)
++ if (command->Current_SCpnt == SCpnt)
+ return command;
+- }
+- }
+- }
+- spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags);
+ return NULL;
+ }
+
+@@ -579,17 +574,15 @@
+
+ /*
+ * This function moves a command to the completed orb list.
++ * Must be called with scsi_id->sbp2_command_orb_lock held.
+ */
+-static void sbp2util_mark_command_completed(struct scsi_id_instance_data *scsi_id,
+- struct sbp2_command_info *command)
++static void sbp2util_mark_command_completed(
++ struct scsi_id_instance_data *scsi_id,
++ struct sbp2_command_info *command)
+ {
+- unsigned long flags;
+-
+- spin_lock_irqsave(&scsi_id->sbp2_command_orb_lock, flags);
+ list_del(&command->list);
+ sbp2util_free_command_dma(command);
+ list_add_tail(&command->list, &scsi_id->sbp2_command_orb_completed);
+- spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags);
+ }
+
+ /*
+@@ -2177,7 +2170,9 @@
+ * Matched status with command, now grab scsi command pointers and check status
+ */
+ SCpnt = command->Current_SCpnt;
++ spin_lock_irqsave(&scsi_id->sbp2_command_orb_lock, flags);
+ sbp2util_mark_command_completed(scsi_id, command);
++ spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags);
+
+ if (SCpnt) {
+
+@@ -2513,6 +2508,7 @@
+ (struct scsi_id_instance_data *)SCpnt->device->host->hostdata[0];
+ struct sbp2scsi_host_info *hi = scsi_id->hi;
+ struct sbp2_command_info *command;
++ unsigned long flags;
+
+ SBP2_ERR("aborting sbp2 command");
+ scsi_print_command(SCpnt);
+@@ -2523,6 +2519,7 @@
+ * Right now, just return any matching command structures
+ * to the free pool.
+ */
++ spin_lock_irqsave(&scsi_id->sbp2_command_orb_lock, flags);
+ command = sbp2util_find_command_for_SCpnt(scsi_id, SCpnt);
+ if (command) {
+ SBP2_DEBUG("Found command to abort");
+@@ -2540,6 +2537,7 @@
+ command->Current_done(command->Current_SCpnt);
+ }
+ }
++ spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags);
+
+ /*
+ * Initiate a fetch agent reset.
+diff -Naur linux-2.6.16/drivers/macintosh/therm_adt746x.c linux-2.6.16.16/drivers/macintosh/therm_adt746x.c
+--- linux-2.6.16/drivers/macintosh/therm_adt746x.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/macintosh/therm_adt746x.c 2006-05-11 04:56:24.000000000 +0300
+@@ -627,8 +627,8 @@
+ if(therm_type == ADT7460)
+ device_create_file(&of_dev->dev, &dev_attr_sensor2_fan_speed);
+
+-#ifndef CONFIG_I2C_KEYWEST
+- request_module("i2c-keywest");
++#ifndef CONFIG_I2C_POWERMAC
++ request_module("i2c-powermac");
+ #endif
+
+ return i2c_add_driver(&thermostat_driver);
+diff -Naur linux-2.6.16/drivers/md/dm.c linux-2.6.16.16/drivers/md/dm.c
+--- linux-2.6.16/drivers/md/dm.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/md/dm.c 2006-05-11 04:56:24.000000000 +0300
+@@ -533,30 +533,35 @@
+
+ } else {
+ /*
+- * Create two copy bios to deal with io that has
+- * been split across a target.
++ * Handle a bvec that must be split between two or more targets.
+ */
+ struct bio_vec *bv = bio->bi_io_vec + ci->idx;
++ sector_t remaining = to_sector(bv->bv_len);
++ unsigned int offset = 0;
+
+- clone = split_bvec(bio, ci->sector, ci->idx,
+- bv->bv_offset, max);
+- __map_bio(ti, clone, tio);
+-
+- ci->sector += max;
+- ci->sector_count -= max;
+- ti = dm_table_find_target(ci->map, ci->sector);
+-
+- len = to_sector(bv->bv_len) - max;
+- clone = split_bvec(bio, ci->sector, ci->idx,
+- bv->bv_offset + to_bytes(max), len);
+- tio = alloc_tio(ci->md);
+- tio->io = ci->io;
+- tio->ti = ti;
+- memset(&tio->info, 0, sizeof(tio->info));
+- __map_bio(ti, clone, tio);
++ do {
++ if (offset) {
++ ti = dm_table_find_target(ci->map, ci->sector);
++ max = max_io_len(ci->md, ci->sector, ti);
++
++ tio = alloc_tio(ci->md);
++ tio->io = ci->io;
++ tio->ti = ti;
++ memset(&tio->info, 0, sizeof(tio->info));
++ }
++
++ len = min(remaining, max);
++
++ clone = split_bvec(bio, ci->sector, ci->idx,
++ bv->bv_offset + offset, len);
++
++ __map_bio(ti, clone, tio);
++
++ ci->sector += len;
++ ci->sector_count -= len;
++ offset += to_bytes(len);
++ } while (remaining -= len);
+
+- ci->sector += len;
+- ci->sector_count -= len;
+ ci->idx++;
+ }
+ }
+@@ -1093,6 +1098,7 @@
+ {
+ struct dm_table *map = NULL;
+ DECLARE_WAITQUEUE(wait, current);
++ struct bio *def;
+ int r = -EINVAL;
+
+ down(&md->suspend_lock);
+@@ -1152,9 +1158,11 @@
+ /* were we interrupted ? */
+ r = -EINTR;
+ if (atomic_read(&md->pending)) {
++ clear_bit(DMF_BLOCK_IO, &md->flags);
++ def = bio_list_get(&md->deferred);
++ __flush_deferred_io(md, def);
+ up_write(&md->io_lock);
+ unlock_fs(md);
+- clear_bit(DMF_BLOCK_IO, &md->flags);
+ goto out;
+ }
+ up_write(&md->io_lock);
+diff -Naur linux-2.6.16/drivers/md/dm-snap.c linux-2.6.16.16/drivers/md/dm-snap.c
+--- linux-2.6.16/drivers/md/dm-snap.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/md/dm-snap.c 2006-05-11 04:56:24.000000000 +0300
+@@ -542,8 +542,12 @@
+ {
+ struct dm_snapshot *s = (struct dm_snapshot *) ti->private;
+
++ /* Prevent further origin writes from using this snapshot. */
++ /* After this returns there can be no new kcopyd jobs. */
+ unregister_snapshot(s);
+
++ kcopyd_client_destroy(s->kcopyd_client);
++
+ exit_exception_table(&s->pending, pending_cache);
+ exit_exception_table(&s->complete, exception_cache);
+
+@@ -552,7 +556,7 @@
+
+ dm_put_device(ti, s->origin);
+ dm_put_device(ti, s->cow);
+- kcopyd_client_destroy(s->kcopyd_client);
++
+ kfree(s);
+ }
+
+diff -Naur linux-2.6.16/drivers/md/kcopyd.c linux-2.6.16.16/drivers/md/kcopyd.c
+--- linux-2.6.16/drivers/md/kcopyd.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/md/kcopyd.c 2006-05-11 04:56:24.000000000 +0300
+@@ -44,6 +44,9 @@
+ struct page_list *pages;
+ unsigned int nr_pages;
+ unsigned int nr_free_pages;
++
++ wait_queue_head_t destroyq;
++ atomic_t nr_jobs;
+ };
+
+ static struct page_list *alloc_pl(void)
+@@ -293,10 +296,15 @@
+ int read_err = job->read_err;
+ unsigned int write_err = job->write_err;
+ kcopyd_notify_fn fn = job->fn;
++ struct kcopyd_client *kc = job->kc;
+
+- kcopyd_put_pages(job->kc, job->pages);
++ kcopyd_put_pages(kc, job->pages);
+ mempool_free(job, _job_pool);
+ fn(read_err, write_err, context);
++
++ if (atomic_dec_and_test(&kc->nr_jobs))
++ wake_up(&kc->destroyq);
++
+ return 0;
+ }
+
+@@ -431,6 +439,7 @@
+ */
+ static void dispatch_job(struct kcopyd_job *job)
+ {
++ atomic_inc(&job->kc->nr_jobs);
+ push(&_pages_jobs, job);
+ wake();
+ }
+@@ -670,6 +679,9 @@
+ return r;
+ }
+
++ init_waitqueue_head(&kc->destroyq);
++ atomic_set(&kc->nr_jobs, 0);
++
+ client_add(kc);
+ *result = kc;
+ return 0;
+@@ -677,6 +689,9 @@
+
+ void kcopyd_client_destroy(struct kcopyd_client *kc)
+ {
++ /* Wait for completion of all jobs submitted by this client. */
++ wait_event(kc->destroyq, !atomic_read(&kc->nr_jobs));
++
+ dm_io_put(kc->nr_pages);
+ client_free_pages(kc);
+ client_del(kc);
+diff -Naur linux-2.6.16/drivers/media/dvb/dvb-usb/cxusb.c linux-2.6.16.16/drivers/media/dvb/dvb-usb/cxusb.c
+--- linux-2.6.16/drivers/media/dvb/dvb-usb/cxusb.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/media/dvb/dvb-usb/cxusb.c 2006-05-11 04:56:24.000000000 +0300
+@@ -149,6 +149,15 @@
+ return cxusb_ctrl_msg(d, CMD_POWER_OFF, &b, 1, NULL, 0);
+ }
+
++static int cxusb_bluebird_power_ctrl(struct dvb_usb_device *d, int onoff)
++{
++ u8 b = 0;
++ if (onoff)
++ return cxusb_ctrl_msg(d, CMD_POWER_ON, &b, 1, NULL, 0);
++ else
++ return 0;
++}
++
+ static int cxusb_streaming_ctrl(struct dvb_usb_device *d, int onoff)
+ {
+ u8 buf[2] = { 0x03, 0x00 };
+@@ -505,7 +514,7 @@
+ .size_of_priv = sizeof(struct cxusb_state),
+
+ .streaming_ctrl = cxusb_streaming_ctrl,
+- .power_ctrl = cxusb_power_ctrl,
++ .power_ctrl = cxusb_bluebird_power_ctrl,
+ .frontend_attach = cxusb_lgdt3303_frontend_attach,
+ .tuner_attach = cxusb_lgh064f_tuner_attach,
+
+@@ -545,7 +554,7 @@
+ .size_of_priv = sizeof(struct cxusb_state),
+
+ .streaming_ctrl = cxusb_streaming_ctrl,
+- .power_ctrl = cxusb_power_ctrl,
++ .power_ctrl = cxusb_bluebird_power_ctrl,
+ .frontend_attach = cxusb_dee1601_frontend_attach,
+ .tuner_attach = cxusb_dee1601_tuner_attach,
+
+@@ -594,7 +603,7 @@
+ .size_of_priv = sizeof(struct cxusb_state),
+
+ .streaming_ctrl = cxusb_streaming_ctrl,
+- .power_ctrl = cxusb_power_ctrl,
++ .power_ctrl = cxusb_bluebird_power_ctrl,
+ .frontend_attach = cxusb_mt352_frontend_attach,
+ .tuner_attach = cxusb_lgz201_tuner_attach,
+
+@@ -634,7 +643,7 @@
+ .size_of_priv = sizeof(struct cxusb_state),
+
+ .streaming_ctrl = cxusb_streaming_ctrl,
+- .power_ctrl = cxusb_power_ctrl,
++ .power_ctrl = cxusb_bluebird_power_ctrl,
+ .frontend_attach = cxusb_mt352_frontend_attach,
+ .tuner_attach = cxusb_dtt7579_tuner_attach,
+
+diff -Naur linux-2.6.16/drivers/media/video/Kconfig linux-2.6.16.16/drivers/media/video/Kconfig
+--- linux-2.6.16/drivers/media/video/Kconfig 2006-05-18 01:12:22.000000000 +0300
++++ linux-2.6.16.16/drivers/media/video/Kconfig 2006-05-17 21:41:30.000000000 +0300
+@@ -349,6 +349,7 @@
+ config VIDEO_DECODER
+ tristate "Add support for additional video chipsets"
+ depends on VIDEO_DEV && I2C && EXPERIMENTAL
++ select FW_LOADER
+ ---help---
+ Say Y here to compile drivers for SAA7115, SAA7127 and CX25840
+ video decoders.
+diff -Naur linux-2.6.16/drivers/media/video/saa7127.c linux-2.6.16.16/drivers/media/video/saa7127.c
+--- linux-2.6.16/drivers/media/video/saa7127.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/media/video/saa7127.c 2006-05-11 04:56:24.000000000 +0300
+@@ -141,6 +141,7 @@
+ static const struct i2c_reg_value saa7129_init_config_extra[] = {
+ { SAA7127_REG_OUTPUT_PORT_CONTROL, 0x38 },
+ { SAA7127_REG_VTRIG, 0xfa },
++ { 0, 0 }
+ };
+
+ static const struct i2c_reg_value saa7127_init_config_common[] = {
+diff -Naur linux-2.6.16/drivers/media/video/tuner-types.c linux-2.6.16.16/drivers/media/video/tuner-types.c
+--- linux-2.6.16/drivers/media/video/tuner-types.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/media/video/tuner-types.c 2006-05-11 04:56:24.000000000 +0300
+@@ -1087,8 +1087,8 @@
+ /* ------------ TUNER_SAMSUNG_TCPN_2121P30A - Samsung NTSC ------------ */
+
+ static struct tuner_range tuner_samsung_tcpn_2121p30a_ntsc_ranges[] = {
+- { 16 * 175.75 /*MHz*/, 0x01, },
+- { 16 * 410.25 /*MHz*/, 0x02, },
++ { 16 * 130.00 /*MHz*/, 0x01, },
++ { 16 * 364.50 /*MHz*/, 0x02, },
+ { 16 * 999.99 , 0x08, },
+ };
+
+diff -Naur linux-2.6.16/drivers/mtd/nand/Kconfig linux-2.6.16.16/drivers/mtd/nand/Kconfig
+--- linux-2.6.16/drivers/mtd/nand/Kconfig 2006-05-18 01:12:23.000000000 +0300
++++ linux-2.6.16.16/drivers/mtd/nand/Kconfig 2006-05-17 22:32:57.000000000 +0300
+@@ -184,15 +184,14 @@
+ Even if you leave this disabled, you can enable BBT writes at module
+ load time (assuming you build diskonchip as a module) with the module
+ parameter "inftl_bbt_write=1".
+-
+- config MTD_NAND_SHARPSL
+- bool "Support for NAND Flash on Sharp SL Series (C7xx + others)"
+- depends on MTD_NAND && ARCH_PXA
+-
+- config MTD_NAND_NANDSIM
+- bool "Support for NAND Flash Simulator"
+- depends on MTD_NAND && MTD_PARTITIONS
+
++config MTD_NAND_SHARPSL
++ tristate "Support for NAND Flash on Sharp SL Series (C7xx + others)"
++ depends on MTD_NAND && ARCH_PXA
++
++config MTD_NAND_NANDSIM
++ tristate "Support for NAND Flash Simulator"
++ depends on MTD_NAND && MTD_PARTITIONS
+ help
+ The simulator may simulate verious NAND flash chips for the
+ MTD nand layer.
+@@ -200,7 +199,6 @@
+ config MTD_NAND_OMAP_HW
+ bool "OMAP HW NAND Flash controller support"
+ depends on ARM && ARCH_OMAP16XX && MTD_NAND
+-
+ help
+ Driver for TI OMAP16xx hardware NAND flash controller.
+
+diff -Naur linux-2.6.16/drivers/net/e1000/e1000_main.c linux-2.6.16.16/drivers/net/e1000/e1000_main.c
+--- linux-2.6.16/drivers/net/e1000/e1000_main.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/net/e1000/e1000_main.c 2006-05-11 04:56:24.000000000 +0300
+@@ -3851,6 +3851,7 @@
+ skb_shinfo(skb)->nr_frags++;
+ skb->len += length;
+ skb->data_len += length;
++ skb->truesize += length;
+ }
+
+ e1000_rx_checksum(adapter, staterr,
+diff -Naur linux-2.6.16/drivers/net/irda/irda-usb.c linux-2.6.16.16/drivers/net/irda/irda-usb.c
+--- linux-2.6.16/drivers/net/irda/irda-usb.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/net/irda/irda-usb.c 2006-05-11 04:56:24.000000000 +0300
+@@ -740,7 +740,7 @@
+ struct sk_buff *newskb;
+ struct sk_buff *dataskb;
+ struct urb *next_urb;
+- int docopy;
++ unsigned int len, docopy;
+
+ IRDA_DEBUG(2, "%s(), len=%d\n", __FUNCTION__, urb->actual_length);
+
+@@ -851,10 +851,11 @@
+ dataskb->dev = self->netdev;
+ dataskb->mac.raw = dataskb->data;
+ dataskb->protocol = htons(ETH_P_IRDA);
++ len = dataskb->len;
+ netif_rx(dataskb);
+
+ /* Keep stats up to date */
+- self->stats.rx_bytes += dataskb->len;
++ self->stats.rx_bytes += len;
+ self->stats.rx_packets++;
+ self->netdev->last_rx = jiffies;
+
+diff -Naur linux-2.6.16/drivers/net/sky2.c linux-2.6.16.16/drivers/net/sky2.c
+--- linux-2.6.16/drivers/net/sky2.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/net/sky2.c 2006-05-11 04:56:24.000000000 +0300
+@@ -579,8 +579,8 @@
+ reg = gma_read16(hw, port, GM_PHY_ADDR);
+ gma_write16(hw, port, GM_PHY_ADDR, reg | GM_PAR_MIB_CLR);
+
+- for (i = 0; i < GM_MIB_CNT_SIZE; i++)
+- gma_read16(hw, port, GM_MIB_CNT_BASE + 8 * i);
++ for (i = GM_MIB_CNT_BASE; i <= GM_MIB_CNT_END; i += 4)
++ gma_read16(hw, port, i);
+ gma_write16(hw, port, GM_PHY_ADDR, reg);
+
+ /* transmit control */
+diff -Naur linux-2.6.16/drivers/net/sky2.h linux-2.6.16.16/drivers/net/sky2.h
+--- linux-2.6.16/drivers/net/sky2.h 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/net/sky2.h 2006-05-11 04:56:24.000000000 +0300
+@@ -1380,6 +1380,7 @@
+ /* MIB Counters */
+ #define GM_MIB_CNT_BASE 0x0100 /* Base Address of MIB Counters */
+ #define GM_MIB_CNT_SIZE 44 /* Number of MIB Counters */
++#define GM_MIB_CNT_END 0x025C /* Last MIB counter */
+
+ /*
+ * MIB Counters base address definitions (low word) -
+diff -Naur linux-2.6.16/drivers/net/wireless/hostap/hostap_80211_tx.c linux-2.6.16.16/drivers/net/wireless/hostap/hostap_80211_tx.c
+--- linux-2.6.16/drivers/net/wireless/hostap/hostap_80211_tx.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/net/wireless/hostap/hostap_80211_tx.c 2006-05-11 04:56:24.000000000 +0300
+@@ -469,7 +469,7 @@
+ }
+
+ if (local->ieee_802_1x && meta->ethertype == ETH_P_PAE && tx.crypt &&
+- !(fc & IEEE80211_FCTL_VERS)) {
++ !(fc & IEEE80211_FCTL_PROTECTED)) {
+ no_encrypt = 1;
+ PDEBUG(DEBUG_EXTRA2, "%s: TX: IEEE 802.1X - passing "
+ "unencrypted EAPOL frame\n", dev->name);
+diff -Naur linux-2.6.16/drivers/net/wireless/ipw2200.c linux-2.6.16.16/drivers/net/wireless/ipw2200.c
+--- linux-2.6.16/drivers/net/wireless/ipw2200.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/net/wireless/ipw2200.c 2006-05-11 04:56:24.000000000 +0300
+@@ -9956,9 +9956,8 @@
+ return -EINVAL;
+ down(&p->sem);
+ memcpy(&p->eeprom[eeprom->offset], bytes, eeprom->len);
+- for (i = IPW_EEPROM_DATA;
+- i < IPW_EEPROM_DATA + IPW_EEPROM_IMAGE_SIZE; i++)
+- ipw_write8(p, i, p->eeprom[i]);
++ for (i = 0; i < IPW_EEPROM_IMAGE_SIZE; i++)
++ ipw_write8(p, i + IPW_EEPROM_DATA, p->eeprom[i]);
+ up(&p->sem);
+ return 0;
+ }
+diff -Naur linux-2.6.16/drivers/net/wireless/Kconfig linux-2.6.16.16/drivers/net/wireless/Kconfig
+--- linux-2.6.16/drivers/net/wireless/Kconfig 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/net/wireless/Kconfig 2006-05-11 04:56:24.000000000 +0300
+@@ -239,7 +239,8 @@
+
+ config AIRO
+ tristate "Cisco/Aironet 34X/35X/4500/4800 ISA and PCI cards"
+- depends on NET_RADIO && ISA_DMA_API && CRYPTO && (PCI || BROKEN)
++ depends on NET_RADIO && ISA_DMA_API && (PCI || BROKEN)
++ select CRYPTO
+ ---help---
+ This is the standard Linux driver to support Cisco/Aironet ISA and
+ PCI 802.11 wireless cards.
+@@ -374,6 +375,7 @@
+ config PCMCIA_SPECTRUM
+ tristate "Symbol Spectrum24 Trilogy PCMCIA card support"
+ depends on NET_RADIO && PCMCIA && HERMES
++ select FW_LOADER
+ ---help---
+
+ This is a driver for 802.11b cards using RAM-loadable Symbol
+@@ -387,6 +389,7 @@
+ config AIRO_CS
+ tristate "Cisco/Aironet 34X/35X/4500/4800 PCMCIA cards"
+ depends on NET_RADIO && PCMCIA && (BROKEN || !M32R)
++ select CRYPTO
+ ---help---
+ This is the standard Linux driver to support Cisco/Aironet PCMCIA
+ 802.11 wireless cards. This driver is the same as the Aironet
+diff -Naur linux-2.6.16/drivers/pcmcia/ds.c linux-2.6.16.16/drivers/pcmcia/ds.c
+--- linux-2.6.16/drivers/pcmcia/ds.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/pcmcia/ds.c 2006-05-11 04:56:24.000000000 +0300
+@@ -546,7 +546,7 @@
+ tmp = vers1->str + vers1->ofs[i];
+
+ length = strlen(tmp) + 1;
+- if ((length < 3) || (length > 255))
++ if ((length < 2) || (length > 255))
+ continue;
+
+ p_dev->prod_id[i] = kmalloc(sizeof(char) * length,
+diff -Naur linux-2.6.16/drivers/scsi/3w-9xxx.c linux-2.6.16.16/drivers/scsi/3w-9xxx.c
+--- linux-2.6.16/drivers/scsi/3w-9xxx.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/scsi/3w-9xxx.c 2006-05-11 04:56:24.000000000 +0300
+@@ -85,7 +85,7 @@
+ #include "3w-9xxx.h"
+
+ /* Globals */
+-#define TW_DRIVER_VERSION "2.26.02.005"
++#define TW_DRIVER_VERSION "2.26.02.007"
+ static TW_Device_Extension *twa_device_extension_list[TW_MAX_SLOT];
+ static unsigned int twa_device_extension_count;
+ static int twa_major = -1;
+@@ -1944,9 +1944,13 @@
+ }
+ if (tw_dev->srb[request_id]->use_sg == 1) {
+ struct scatterlist *sg = (struct scatterlist *)tw_dev->srb[request_id]->request_buffer;
+- char *buf = kmap_atomic(sg->page, KM_IRQ0) + sg->offset;
++ char *buf;
++ unsigned long flags = 0;
++ local_irq_save(flags);
++ buf = kmap_atomic(sg->page, KM_IRQ0) + sg->offset;
+ memcpy(buf, tw_dev->generic_buffer_virt[request_id], sg->length);
+ kunmap_atomic(buf - sg->offset, KM_IRQ0);
++ local_irq_restore(flags);
+ }
+ }
+ } /* End twa_scsiop_execute_scsi_complete() */
+diff -Naur linux-2.6.16/drivers/scsi/3w-xxxx.c linux-2.6.16.16/drivers/scsi/3w-xxxx.c
+--- linux-2.6.16/drivers/scsi/3w-xxxx.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/scsi/3w-xxxx.c 2006-05-11 04:56:24.000000000 +0300
+@@ -1508,10 +1508,12 @@
+ struct scsi_cmnd *cmd = tw_dev->srb[request_id];
+ void *buf;
+ unsigned int transfer_len;
++ unsigned long flags = 0;
+
+ if (cmd->use_sg) {
+ struct scatterlist *sg =
+ (struct scatterlist *)cmd->request_buffer;
++ local_irq_save(flags);
+ buf = kmap_atomic(sg->page, KM_IRQ0) + sg->offset;
+ transfer_len = min(sg->length, len);
+ } else {
+@@ -1526,6 +1528,7 @@
+
+ sg = (struct scatterlist *)cmd->request_buffer;
+ kunmap_atomic(buf - sg->offset, KM_IRQ0);
++ local_irq_restore(flags);
+ }
+ }
+
+diff -Naur linux-2.6.16/drivers/scsi/sata_mv.c linux-2.6.16.16/drivers/scsi/sata_mv.c
+--- linux-2.6.16/drivers/scsi/sata_mv.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/scsi/sata_mv.c 2006-05-11 04:56:24.000000000 +0300
+@@ -1102,6 +1102,7 @@
+ void __iomem *port_mmio = mv_ap_base(ap);
+ struct mv_port_priv *pp = ap->private_data;
+ u32 out_ptr;
++ u8 ata_status;
+
+ out_ptr = readl(port_mmio + EDMA_RSP_Q_OUT_PTR_OFS);
+
+@@ -1109,6 +1110,8 @@
+ assert(((out_ptr >> EDMA_RSP_Q_PTR_SHIFT) & MV_MAX_Q_DEPTH_MASK) ==
+ pp->rsp_consumer);
+
++ ata_status = pp->crpb[pp->rsp_consumer].flags >> CRPB_FLAG_STATUS_SHIFT;
++
+ /* increment our consumer index... */
+ pp->rsp_consumer = mv_inc_q_index(&pp->rsp_consumer);
+
+@@ -1123,7 +1126,7 @@
+ writelfl(out_ptr, port_mmio + EDMA_RSP_Q_OUT_PTR_OFS);
+
+ /* Return ATA status register for completed CRPB */
+- return (pp->crpb[pp->rsp_consumer].flags >> CRPB_FLAG_STATUS_SHIFT);
++ return ata_status;
+ }
+
+ /**
+@@ -1192,7 +1195,6 @@
+ u32 hc_irq_cause;
+ int shift, port, port0, hard_port, handled;
+ unsigned int err_mask;
+- u8 ata_status = 0;
+
+ if (hc == 0) {
+ port0 = 0;
+@@ -1210,6 +1212,7 @@
+ hc,relevant,hc_irq_cause);
+
+ for (port = port0; port < port0 + MV_PORTS_PER_HC; port++) {
++ u8 ata_status = 0;
+ ap = host_set->ports[port];
+ hard_port = port & MV_PORT_MASK; /* range 0-3 */
+ handled = 0; /* ensure ata_status is set if handled++ */
+diff -Naur linux-2.6.16/drivers/usb/core/message.c linux-2.6.16.16/drivers/usb/core/message.c
+--- linux-2.6.16/drivers/usb/core/message.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/usb/core/message.c 2006-05-11 04:56:24.000000000 +0300
+@@ -1388,11 +1388,13 @@
+ if (dev->state != USB_STATE_ADDRESS)
+ usb_disable_device (dev, 1); // Skip ep0
+
+- i = dev->bus_mA - cp->desc.bMaxPower * 2;
+- if (i < 0)
+- dev_warn(&dev->dev, "new config #%d exceeds power "
+- "limit by %dmA\n",
+- configuration, -i);
++ if (cp) {
++ i = dev->bus_mA - cp->desc.bMaxPower * 2;
++ if (i < 0)
++ dev_warn(&dev->dev, "new config #%d exceeds power "
++ "limit by %dmA\n",
++ configuration, -i);
++ }
+
+ if ((ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
+ USB_REQ_SET_CONFIGURATION, 0, configuration, 0,
+diff -Naur linux-2.6.16/drivers/usb/host/ehci-sched.c linux-2.6.16.16/drivers/usb/host/ehci-sched.c
+--- linux-2.6.16/drivers/usb/host/ehci-sched.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/usb/host/ehci-sched.c 2006-05-11 04:56:24.000000000 +0300
+@@ -707,6 +707,7 @@
+ } else {
+ u32 addr;
+ int think_time;
++ int hs_transfers;
+
+ addr = dev->ttport << 24;
+ if (!ehci_is_TDI(ehci)
+@@ -719,6 +720,7 @@
+ think_time = dev->tt ? dev->tt->think_time : 0;
+ stream->tt_usecs = NS_TO_US (think_time + usb_calc_bus_time (
+ dev->speed, is_input, 1, maxp));
++ hs_transfers = max (1u, (maxp + 187) / 188);
+ if (is_input) {
+ u32 tmp;
+
+@@ -727,12 +729,11 @@
+ stream->usecs = HS_USECS_ISO (1);
+ stream->raw_mask = 1;
+
+- /* pessimistic c-mask */
+- tmp = usb_calc_bus_time (USB_SPEED_FULL, 1, 0, maxp)
+- / (125 * 1000);
+- stream->raw_mask |= 3 << (tmp + 9);
++ /* c-mask as specified in USB 2.0 11.18.4 3.c */
++ tmp = (1 << (hs_transfers + 2)) - 1;
++ stream->raw_mask |= tmp << (8 + 2);
+ } else
+- stream->raw_mask = smask_out [maxp / 188];
++ stream->raw_mask = smask_out [hs_transfers - 1];
+ bandwidth = stream->usecs + stream->c_usecs;
+ bandwidth /= 1 << (interval + 2);
+
+diff -Naur linux-2.6.16/drivers/usb/serial/console.c linux-2.6.16.16/drivers/usb/serial/console.c
+--- linux-2.6.16/drivers/usb/serial/console.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/usb/serial/console.c 2006-05-11 04:56:24.000000000 +0300
+@@ -54,7 +54,7 @@
+ * serial.c code, except that the specifier is "ttyUSB" instead
+ * of "ttyS".
+ */
+-static int __init usb_console_setup(struct console *co, char *options)
++static int usb_console_setup(struct console *co, char *options)
+ {
+ struct usbcons_info *info = &usbcons_info;
+ int baud = 9600;
+diff -Naur linux-2.6.16/drivers/usb/serial/option.c linux-2.6.16.16/drivers/usb/serial/option.c
+--- linux-2.6.16/drivers/usb/serial/option.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/usb/serial/option.c 2006-05-11 04:56:24.000000000 +0300
+@@ -582,14 +582,14 @@
+ portdata = usb_get_serial_port_data(port);
+
+ /* Do indat endpoints first */
+- for (j = 0; j <= N_IN_URB; ++j) {
++ for (j = 0; j < N_IN_URB; ++j) {
+ portdata->in_urbs[j] = option_setup_urb (serial,
+ port->bulk_in_endpointAddress, USB_DIR_IN, port,
+ portdata->in_buffer[j], IN_BUFLEN, option_indat_callback);
+ }
+
+ /* outdat endpoints */
+- for (j = 0; j <= N_OUT_URB; ++j) {
++ for (j = 0; j < N_OUT_URB; ++j) {
+ portdata->out_urbs[j] = option_setup_urb (serial,
+ port->bulk_out_endpointAddress, USB_DIR_OUT, port,
+ portdata->out_buffer[j], OUT_BUFLEN, option_outdat_callback);
+diff -Naur linux-2.6.16/drivers/usb/storage/Kconfig linux-2.6.16.16/drivers/usb/storage/Kconfig
+--- linux-2.6.16/drivers/usb/storage/Kconfig 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/usb/storage/Kconfig 2006-05-11 04:56:24.000000000 +0300
+@@ -48,7 +48,8 @@
+
+ config USB_STORAGE_ISD200
+ bool "ISD-200 USB/ATA Bridge support"
+- depends on USB_STORAGE && BLK_DEV_IDE
++ depends on USB_STORAGE
++ depends on BLK_DEV_IDE=y || BLK_DEV_IDE=USB_STORAGE
+ ---help---
+ Say Y here if you want to use USB Mass Store devices based
+ on the In-Systems Design ISD-200 USB/ATA bridge.
+diff -Naur linux-2.6.16/drivers/video/cfbimgblt.c linux-2.6.16.16/drivers/video/cfbimgblt.c
+--- linux-2.6.16/drivers/video/cfbimgblt.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/video/cfbimgblt.c 2006-05-11 04:56:24.000000000 +0300
+@@ -169,7 +169,7 @@
+
+ while (j--) {
+ l--;
+- color = (*s & 1 << (FB_BIT_NR(l))) ? fgcolor : bgcolor;
++ color = (*s & (1 << l)) ? fgcolor : bgcolor;
+ val |= FB_SHIFT_HIGH(color, shift);
+
+ /* Did the bitshift spill bits to the next long? */
+diff -Naur linux-2.6.16/drivers/video/fbmem.c linux-2.6.16.16/drivers/video/fbmem.c
+--- linux-2.6.16/drivers/video/fbmem.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/video/fbmem.c 2006-05-11 04:56:24.000000000 +0300
+@@ -669,13 +669,19 @@
+ total_size = info->fix.smem_len;
+
+ if (p > total_size)
+- return 0;
++ return -EFBIG;
+
+- if (count >= total_size)
++ if (count > total_size) {
++ err = -EFBIG;
+ count = total_size;
++ }
++
++ if (count + p > total_size) {
++ if (!err)
++ err = -ENOSPC;
+
+- if (count + p > total_size)
+ count = total_size - p;
++ }
+
+ buffer = kmalloc((count > PAGE_SIZE) ? PAGE_SIZE : count,
+ GFP_KERNEL);
+@@ -717,7 +723,7 @@
+
+ kfree(buffer);
+
+- return (err) ? err : cnt;
++ return (cnt) ? cnt : err;
+ }
+
+ #ifdef CONFIG_KMOD
+diff -Naur linux-2.6.16/drivers/video/i810/i810_main.c linux-2.6.16.16/drivers/video/i810/i810_main.c
+--- linux-2.6.16/drivers/video/i810/i810_main.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/drivers/video/i810/i810_main.c 2006-05-11 04:56:24.000000000 +0300
+@@ -1508,7 +1508,7 @@
+ int size = ((cursor->image.width + 7) >> 3) *
+ cursor->image.height;
+ int i;
+- u8 *data = kmalloc(64 * 8, GFP_KERNEL);
++ u8 *data = kmalloc(64 * 8, GFP_ATOMIC);
+
+ if (data == NULL)
+ return -ENOMEM;
+diff -Naur linux-2.6.16/fs/9p/vfs_inode.c linux-2.6.16.16/fs/9p/vfs_inode.c
+--- linux-2.6.16/fs/9p/vfs_inode.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/fs/9p/vfs_inode.c 2006-05-11 04:56:24.000000000 +0300
+@@ -614,6 +614,7 @@
+
+ sb = dir->i_sb;
+ v9ses = v9fs_inode2v9ses(dir);
++ dentry->d_op = &v9fs_dentry_operations;
+ dirfid = v9fs_fid_lookup(dentry->d_parent);
+
+ if (!dirfid) {
+@@ -681,8 +682,6 @@
+ goto FreeFcall;
+
+ fid->qid = fcall->params.rstat.stat.qid;
+-
+- dentry->d_op = &v9fs_dentry_operations;
+ v9fs_stat2inode(&fcall->params.rstat.stat, inode, inode->i_sb);
+
+ d_add(dentry, inode);
+diff -Naur linux-2.6.16/fs/char_dev.c linux-2.6.16.16/fs/char_dev.c
+--- linux-2.6.16/fs/char_dev.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/fs/char_dev.c 2006-05-11 04:56:24.000000000 +0300
+@@ -15,6 +15,7 @@
+ #include <linux/module.h>
+ #include <linux/smp_lock.h>
+ #include <linux/devfs_fs_kernel.h>
++#include <linux/seq_file.h>
+
+ #include <linux/kobject.h>
+ #include <linux/kobj_map.h>
+@@ -26,8 +27,6 @@
+
+ static struct kobj_map *cdev_map;
+
+-#define MAX_PROBE_HASH 255 /* random */
+-
+ static DECLARE_MUTEX(chrdevs_lock);
+
+ static struct char_device_struct {
+@@ -38,93 +37,29 @@
+ char name[64];
+ struct file_operations *fops;
+ struct cdev *cdev; /* will die */
+-} *chrdevs[MAX_PROBE_HASH];
++} *chrdevs[CHRDEV_MAJOR_HASH_SIZE];
+
+ /* index in the above */
+ static inline int major_to_index(int major)
+ {
+- return major % MAX_PROBE_HASH;
+-}
+-
+-struct chrdev_info {
+- int index;
+- struct char_device_struct *cd;
+-};
+-
+-void *get_next_chrdev(void *dev)
+-{
+- struct chrdev_info *info;
+-
+- if (dev == NULL) {
+- info = kmalloc(sizeof(*info), GFP_KERNEL);
+- if (!info)
+- goto out;
+- info->index=0;
+- info->cd = chrdevs[info->index];
+- if (info->cd)
+- goto out;
+- } else {
+- info = dev;
+- }
+-
+- while (info->index < ARRAY_SIZE(chrdevs)) {
+- if (info->cd)
+- info->cd = info->cd->next;
+- if (info->cd)
+- goto out;
+- /*
+- * No devices on this chain, move to the next
+- */
+- info->index++;
+- info->cd = (info->index < ARRAY_SIZE(chrdevs)) ?
+- chrdevs[info->index] : NULL;
+- if (info->cd)
+- goto out;
+- }
+-
+-out:
+- return info;
+-}
+-
+-void *acquire_chrdev_list(void)
+-{
+- down(&chrdevs_lock);
+- return get_next_chrdev(NULL);
+-}
+-
+-void release_chrdev_list(void *dev)
+-{
+- up(&chrdevs_lock);
+- kfree(dev);
++ return major % CHRDEV_MAJOR_HASH_SIZE;
+ }
+
++#ifdef CONFIG_PROC_FS
+
+-int count_chrdev_list(void)
++void chrdev_show(struct seq_file *f, off_t offset)
+ {
+ struct char_device_struct *cd;
+- int i, count;
+-
+- count = 0;
+
+- for (i = 0; i < ARRAY_SIZE(chrdevs) ; i++) {
+- for (cd = chrdevs[i]; cd; cd = cd->next)
+- count++;
++ if (offset < CHRDEV_MAJOR_HASH_SIZE) {
++ down(&chrdevs_lock);
++ for (cd = chrdevs[offset]; cd; cd = cd->next)
++ seq_printf(f, "%3d %s\n", cd->major, cd->name);
++ up(&chrdevs_lock);
+ }
+-
+- return count;
+ }
+
+-int get_chrdev_info(void *dev, int *major, char **name)
+-{
+- struct chrdev_info *info = dev;
+-
+- if (info->cd == NULL)
+- return 1;
+-
+- *major = info->cd->major;
+- *name = info->cd->name;
+- return 0;
+-}
++#endif /* CONFIG_PROC_FS */
+
+ /*
+ * Register a single major with a specified minor range.
+diff -Naur linux-2.6.16/fs/cifs/cifsencrypt.c linux-2.6.16.16/fs/cifs/cifsencrypt.c
+--- linux-2.6.16/fs/cifs/cifsencrypt.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/fs/cifs/cifsencrypt.c 2006-05-11 04:56:24.000000000 +0300
+@@ -56,9 +56,6 @@
+ int rc = 0;
+ char smb_signature[20];
+
+- /* BB remember to initialize sequence number elsewhere and initialize mac_signing key elsewhere BB */
+- /* BB remember to add code to save expected sequence number in midQ entry BB */
+-
+ if((cifs_pdu == NULL) || (server == NULL))
+ return -EINVAL;
+
+@@ -85,20 +82,33 @@
+ static int cifs_calc_signature2(const struct kvec * iov, int n_vec,
+ const char * key, char * signature)
+ {
+- struct MD5Context context;
+-
+- if((iov == NULL) || (signature == NULL))
+- return -EINVAL;
++ struct MD5Context context;
++ int i;
+
+- MD5Init(&context);
+- MD5Update(&context,key,CIFS_SESSION_KEY_SIZE+16);
++ if((iov == NULL) || (signature == NULL))
++ return -EINVAL;
+
+-/* MD5Update(&context,cifs_pdu->Protocol,cifs_pdu->smb_buf_length); */ /* BB FIXME BB */
++ MD5Init(&context);
++ MD5Update(&context,key,CIFS_SESSION_KEY_SIZE+16);
++ for(i=0;i<n_vec;i++) {
++ if(iov[i].iov_base == NULL) {
++ cERROR(1,("null iovec entry"));
++ return -EIO;
++ } else if(iov[i].iov_len == 0)
++ break; /* bail out if we are sent nothing to sign */
++ /* The first entry includes a length field (which does not get
++ signed that occupies the first 4 bytes before the header */
++ if(i==0) {
++ if (iov[0].iov_len <= 8 ) /* cmd field at offset 9 */
++ break; /* nothing to sign or corrupt header */
++ MD5Update(&context,iov[0].iov_base+4, iov[0].iov_len-4);
++ } else
++ MD5Update(&context,iov[i].iov_base, iov[i].iov_len);
++ }
+
+- MD5Final(signature,&context);
++ MD5Final(signature,&context);
+
+- return -EOPNOTSUPP;
+-/* return 0; */
++ return 0;
+ }
+
+
+diff -Naur linux-2.6.16/fs/cifs/dir.c linux-2.6.16.16/fs/cifs/dir.c
+--- linux-2.6.16/fs/cifs/dir.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/fs/cifs/dir.c 2006-05-11 04:56:24.000000000 +0300
+@@ -441,6 +441,20 @@
+ cifs_sb = CIFS_SB(parent_dir_inode->i_sb);
+ pTcon = cifs_sb->tcon;
+
++ /*
++ * Don't allow the separator character in a path component.
++ * The VFS will not allow "/", but "\" is allowed by posix.
++ */
++ if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS)) {
++ int i;
++ for (i = 0; i < direntry->d_name.len; i++)
++ if (direntry->d_name.name[i] == '\\') {
++ cFYI(1, ("Invalid file name"));
++ FreeXid(xid);
++ return ERR_PTR(-EINVAL);
++ }
++ }
++
+ /* can not grab the rename sem here since it would
+ deadlock in the cases (beginning of sys_rename itself)
+ in which we already have the sb rename sem */
+diff -Naur linux-2.6.16/fs/compat.c linux-2.6.16.16/fs/compat.c
+--- linux-2.6.16/fs/compat.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/fs/compat.c 2006-05-11 04:56:24.000000000 +0300
+@@ -1215,6 +1215,10 @@
+ if (ret < 0)
+ goto out;
+
++ ret = security_file_permission(file, type == READ ? MAY_READ:MAY_WRITE);
++ if (ret)
++ goto out;
++
+ fnv = NULL;
+ if (type == READ) {
+ fn = file->f_op->read;
+diff -Naur linux-2.6.16/fs/ext3/resize.c linux-2.6.16.16/fs/ext3/resize.c
+--- linux-2.6.16/fs/ext3/resize.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/fs/ext3/resize.c 2006-05-11 04:56:24.000000000 +0300
+@@ -974,6 +974,7 @@
+ if (o_blocks_count != le32_to_cpu(es->s_blocks_count)) {
+ ext3_warning(sb, __FUNCTION__,
+ "multiple resizers run on filesystem!");
++ unlock_super(sb);
+ err = -EBUSY;
+ goto exit_put;
+ }
+diff -Naur linux-2.6.16/fs/fuse/file.c linux-2.6.16.16/fs/fuse/file.c
+--- linux-2.6.16/fs/fuse/file.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/fs/fuse/file.c 2006-05-11 04:56:24.000000000 +0300
+@@ -397,8 +397,12 @@
+ return -EINTR;
+
+ err = read_cache_pages(mapping, pages, fuse_readpages_fill, &data);
+- if (!err)
+- fuse_send_readpages(data.req, file, inode);
++ if (!err) {
++ if (data.req->num_pages)
++ fuse_send_readpages(data.req, file, inode);
++ else
++ fuse_put_request(fc, data.req);
++ }
+ return err;
+ }
+
+diff -Naur linux-2.6.16/fs/locks.c linux-2.6.16.16/fs/locks.c
+--- linux-2.6.16/fs/locks.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/fs/locks.c 2006-05-11 04:56:24.000000000 +0300
+@@ -432,15 +432,14 @@
+ */
+ static int lease_init(struct file *filp, int type, struct file_lock *fl)
+ {
++ if (assign_type(fl, type) != 0)
++ return -EINVAL;
++
+ fl->fl_owner = current->files;
+ fl->fl_pid = current->tgid;
+
+ fl->fl_file = filp;
+ fl->fl_flags = FL_LEASE;
+- if (assign_type(fl, type) != 0) {
+- locks_free_lock(fl);
+- return -EINVAL;
+- }
+ fl->fl_start = 0;
+ fl->fl_end = OFFSET_MAX;
+ fl->fl_ops = NULL;
+@@ -452,16 +451,19 @@
+ static int lease_alloc(struct file *filp, int type, struct file_lock **flp)
+ {
+ struct file_lock *fl = locks_alloc_lock();
+- int error;
++ int error = -ENOMEM;
+
+ if (fl == NULL)
+- return -ENOMEM;
++ goto out;
+
+ error = lease_init(filp, type, fl);
+- if (error)
+- return error;
++ if (error) {
++ locks_free_lock(fl);
++ fl = NULL;
++ }
++out:
+ *flp = fl;
+- return 0;
++ return error;
+ }
+
+ /* Check if two locks overlap each other.
+@@ -1337,6 +1339,7 @@
+ goto out;
+
+ if (my_before != NULL) {
++ *flp = *my_before;
+ error = lease->fl_lmops->fl_change(my_before, arg);
+ goto out;
+ }
+@@ -2212,7 +2215,12 @@
+
+ lock_kernel();
+ j = 0;
+- rcu_read_lock();
++
++ /*
++ * We are not taking a ref to the file structures, so
++ * we need to acquire ->file_lock.
++ */
++ spin_lock(&files->file_lock);
+ fdt = files_fdtable(files);
+ for (;;) {
+ unsigned long set;
+@@ -2230,7 +2238,7 @@
+ set >>= 1;
+ }
+ }
+- rcu_read_unlock();
++ spin_unlock(&files->file_lock);
+ unlock_kernel();
+ }
+ EXPORT_SYMBOL(steal_locks);
+diff -Naur linux-2.6.16/fs/nfsd/nfs3proc.c linux-2.6.16.16/fs/nfsd/nfs3proc.c
+--- linux-2.6.16/fs/nfsd/nfs3proc.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/fs/nfsd/nfs3proc.c 2006-05-11 04:56:24.000000000 +0300
+@@ -682,7 +682,7 @@
+ PROC(lookup, dirop, dirop, fhandle2, RC_NOCACHE, ST+FH+pAT+pAT),
+ PROC(access, access, access, fhandle, RC_NOCACHE, ST+pAT+1),
+ PROC(readlink, readlink, readlink, fhandle, RC_NOCACHE, ST+pAT+1+NFS3_MAXPATHLEN/4),
+- PROC(read, read, read, fhandle, RC_NOCACHE, ST+pAT+4+NFSSVC_MAXBLKSIZE),
++ PROC(read, read, read, fhandle, RC_NOCACHE, ST+pAT+4+NFSSVC_MAXBLKSIZE/4),
+ PROC(write, write, write, fhandle, RC_REPLBUFF, ST+WC+4),
+ PROC(create, create, create, fhandle2, RC_REPLBUFF, ST+(1+FH+pAT)+WC),
+ PROC(mkdir, mkdir, create, fhandle2, RC_REPLBUFF, ST+(1+FH+pAT)+WC),
+diff -Naur linux-2.6.16/fs/nfsd/nfs4proc.c linux-2.6.16.16/fs/nfsd/nfs4proc.c
+--- linux-2.6.16/fs/nfsd/nfs4proc.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/fs/nfsd/nfs4proc.c 2006-05-11 04:56:24.000000000 +0300
+@@ -975,7 +975,7 @@
+ */
+ static struct svc_procedure nfsd_procedures4[2] = {
+ PROC(null, void, void, void, RC_NOCACHE, 1),
+- PROC(compound, compound, compound, compound, RC_NOCACHE, NFSD_BUFSIZE)
++ PROC(compound, compound, compound, compound, RC_NOCACHE, NFSD_BUFSIZE/4)
+ };
+
+ struct svc_version nfsd_version4 = {
+diff -Naur linux-2.6.16/fs/nfsd/nfsproc.c linux-2.6.16.16/fs/nfsd/nfsproc.c
+--- linux-2.6.16/fs/nfsd/nfsproc.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/fs/nfsd/nfsproc.c 2006-05-11 04:56:24.000000000 +0300
+@@ -553,7 +553,7 @@
+ PROC(none, void, void, none, RC_NOCACHE, ST),
+ PROC(lookup, diropargs, diropres, fhandle, RC_NOCACHE, ST+FH+AT),
+ PROC(readlink, readlinkargs, readlinkres, none, RC_NOCACHE, ST+1+NFS_MAXPATHLEN/4),
+- PROC(read, readargs, readres, fhandle, RC_NOCACHE, ST+AT+1+NFSSVC_MAXBLKSIZE),
++ PROC(read, readargs, readres, fhandle, RC_NOCACHE, ST+AT+1+NFSSVC_MAXBLKSIZE/4),
+ PROC(none, void, void, none, RC_NOCACHE, ST),
+ PROC(write, writeargs, attrstat, fhandle, RC_REPLBUFF, ST+AT),
+ PROC(create, createargs, diropres, fhandle, RC_REPLBUFF, ST+FH+AT),
+diff -Naur linux-2.6.16/fs/open.c linux-2.6.16.16/fs/open.c
+--- linux-2.6.16/fs/open.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/fs/open.c 2006-05-11 04:56:24.000000000 +0300
+@@ -330,7 +330,10 @@
+
+ asmlinkage long sys_ftruncate(unsigned int fd, unsigned long length)
+ {
+- return do_sys_ftruncate(fd, length, 1);
++ long ret = do_sys_ftruncate(fd, length, 1);
++ /* avoid REGPARM breakage on x86: */
++ prevent_tail_call(ret);
++ return ret;
+ }
+
+ /* LFS versions of truncate are only needed on 32 bit machines */
+@@ -342,7 +345,10 @@
+
+ asmlinkage long sys_ftruncate64(unsigned int fd, loff_t length)
+ {
+- return do_sys_ftruncate(fd, length, 0);
++ long ret = do_sys_ftruncate(fd, length, 0);
++ /* avoid REGPARM breakage on x86: */
++ prevent_tail_call(ret);
++ return ret;
+ }
+ #endif
+
+@@ -1083,20 +1089,30 @@
+
+ asmlinkage long sys_open(const char __user *filename, int flags, int mode)
+ {
++ long ret;
++
+ if (force_o_largefile())
+ flags |= O_LARGEFILE;
+
+- return do_sys_open(AT_FDCWD, filename, flags, mode);
++ ret = do_sys_open(AT_FDCWD, filename, flags, mode);
++ /* avoid REGPARM breakage on x86: */
++ prevent_tail_call(ret);
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(sys_open);
+
+ asmlinkage long sys_openat(int dfd, const char __user *filename, int flags,
+ int mode)
+ {
++ long ret;
++
+ if (force_o_largefile())
+ flags |= O_LARGEFILE;
+
+- return do_sys_open(dfd, filename, flags, mode);
++ ret = do_sys_open(dfd, filename, flags, mode);
++ /* avoid REGPARM breakage on x86: */
++ prevent_tail_call(ret);
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(sys_openat);
+
+diff -Naur linux-2.6.16/fs/partitions/check.c linux-2.6.16.16/fs/partitions/check.c
+--- linux-2.6.16/fs/partitions/check.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/fs/partitions/check.c 2006-05-11 04:56:24.000000000 +0300
+@@ -345,6 +345,7 @@
+ char *name;
+ static char *block_str = "block:";
+ int size;
++ char *s;
+
+ size = strlen(block_str) + strlen(disk->disk_name) + 1;
+ name = kmalloc(size, GFP_KERNEL);
+@@ -352,6 +353,10 @@
+ return NULL;
+ strcpy(name, block_str);
+ strcat(name, disk->disk_name);
++ /* ewww... some of these buggers have / in name... */
++ s = strchr(name, '/');
++ if (s)
++ *s = '!';
+ return name;
+ }
+
+diff -Naur linux-2.6.16/fs/proc/base.c linux-2.6.16.16/fs/proc/base.c
+--- linux-2.6.16/fs/proc/base.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/fs/proc/base.c 2006-05-11 04:56:24.000000000 +0300
+@@ -294,16 +294,20 @@
+
+ files = get_files_struct(task);
+ if (files) {
+- rcu_read_lock();
++ /*
++ * We are not taking a ref to the file structure, so we must
++ * hold ->file_lock.
++ */
++ spin_lock(&files->file_lock);
+ file = fcheck_files(files, fd);
+ if (file) {
+ *mnt = mntget(file->f_vfsmnt);
+ *dentry = dget(file->f_dentry);
+- rcu_read_unlock();
++ spin_unlock(&files->file_lock);
+ put_files_struct(files);
+ return 0;
+ }
+- rcu_read_unlock();
++ spin_unlock(&files->file_lock);
+ put_files_struct(files);
+ }
+ return -ENOENT;
+@@ -1485,7 +1489,12 @@
+ if (!files)
+ goto out_unlock;
+ inode->i_mode = S_IFLNK;
+- rcu_read_lock();
++
++ /*
++ * We are not taking a ref to the file structure, so we must
++ * hold ->file_lock.
++ */
++ spin_lock(&files->file_lock);
+ file = fcheck_files(files, fd);
+ if (!file)
+ goto out_unlock2;
+@@ -1493,7 +1502,7 @@
+ inode->i_mode |= S_IRUSR | S_IXUSR;
+ if (file->f_mode & 2)
+ inode->i_mode |= S_IWUSR | S_IXUSR;
+- rcu_read_unlock();
++ spin_unlock(&files->file_lock);
+ put_files_struct(files);
+ inode->i_op = &proc_pid_link_inode_operations;
+ inode->i_size = 64;
+@@ -1503,7 +1512,7 @@
+ return NULL;
+
+ out_unlock2:
+- rcu_read_unlock();
++ spin_unlock(&files->file_lock);
+ put_files_struct(files);
+ out_unlock:
+ iput(inode);
+diff -Naur linux-2.6.16/fs/proc/proc_misc.c linux-2.6.16.16/fs/proc/proc_misc.c
+--- linux-2.6.16/fs/proc/proc_misc.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/fs/proc/proc_misc.c 2006-05-11 04:56:24.000000000 +0300
+@@ -249,144 +249,60 @@
+ return seq_open(file, &cpuinfo_op);
+ }
+
+-enum devinfo_states {
+- CHR_HDR,
+- CHR_LIST,
+- BLK_HDR,
+- BLK_LIST,
+- DEVINFO_DONE
+-};
+-
+-struct devinfo_state {
+- void *chrdev;
+- void *blkdev;
+- unsigned int num_records;
+- unsigned int cur_record;
+- enum devinfo_states state;
++static struct file_operations proc_cpuinfo_operations = {
++ .open = cpuinfo_open,
++ .read = seq_read,
++ .llseek = seq_lseek,
++ .release = seq_release,
+ };
+
+-static void *devinfo_start(struct seq_file *f, loff_t *pos)
++static int devinfo_show(struct seq_file *f, void *v)
+ {
+- struct devinfo_state *info = f->private;
++ int i = *(loff_t *) v;
+
+- if (*pos) {
+- if ((info) && (*pos <= info->num_records))
+- return info;
+- return NULL;
++ if (i < CHRDEV_MAJOR_HASH_SIZE) {
++ if (i == 0)
++ seq_printf(f, "Character devices:\n");
++ chrdev_show(f, i);
++ } else {
++ i -= CHRDEV_MAJOR_HASH_SIZE;
++ if (i == 0)
++ seq_printf(f, "\nBlock devices:\n");
++ blkdev_show(f, i);
+ }
+- info = kmalloc(sizeof(*info), GFP_KERNEL);
+- f->private = info;
+- info->chrdev = acquire_chrdev_list();
+- info->blkdev = acquire_blkdev_list();
+- info->state = CHR_HDR;
+- info->num_records = count_chrdev_list();
+- info->num_records += count_blkdev_list();
+- info->num_records += 2; /* Character and Block headers */
+- *pos = 1;
+- info->cur_record = *pos;
+- return info;
++ return 0;
+ }
+
+-static void *devinfo_next(struct seq_file *f, void *v, loff_t *pos)
++static void *devinfo_start(struct seq_file *f, loff_t *pos)
+ {
+- int idummy;
+- char *ndummy;
+- struct devinfo_state *info = f->private;
+-
+- switch (info->state) {
+- case CHR_HDR:
+- info->state = CHR_LIST;
+- (*pos)++;
+- /*fallthrough*/
+- case CHR_LIST:
+- if (get_chrdev_info(info->chrdev,&idummy,&ndummy)) {
+- /*
+- * The character dev list is complete
+- */
+- info->state = BLK_HDR;
+- } else {
+- info->chrdev = get_next_chrdev(info->chrdev);
+- }
+- (*pos)++;
+- break;
+- case BLK_HDR:
+- info->state = BLK_LIST;
+- (*pos)++;
+- break;
+- case BLK_LIST:
+- if (get_blkdev_info(info->blkdev,&idummy,&ndummy)) {
+- /*
+- * The block dev list is complete
+- */
+- info->state = DEVINFO_DONE;
+- } else {
+- info->blkdev = get_next_blkdev(info->blkdev);
+- }
+- (*pos)++;
+- break;
+- case DEVINFO_DONE:
+- (*pos)++;
+- info->cur_record = *pos;
+- info = NULL;
+- break;
+- default:
+- break;
+- }
+- if (info)
+- info->cur_record = *pos;
+- return info;
++ if (*pos < (BLKDEV_MAJOR_HASH_SIZE + CHRDEV_MAJOR_HASH_SIZE))
++ return pos;
++ return NULL;
+ }
+
+-static void devinfo_stop(struct seq_file *f, void *v)
++static void *devinfo_next(struct seq_file *f, void *v, loff_t *pos)
+ {
+- struct devinfo_state *info = f->private;
+-
+- if (info) {
+- release_chrdev_list(info->chrdev);
+- release_blkdev_list(info->blkdev);
+- f->private = NULL;
+- kfree(info);
+- }
++ (*pos)++;
++ if (*pos >= (BLKDEV_MAJOR_HASH_SIZE + CHRDEV_MAJOR_HASH_SIZE))
++ return NULL;
++ return pos;
+ }
+
+-static int devinfo_show(struct seq_file *f, void *arg)
++static void devinfo_stop(struct seq_file *f, void *v)
+ {
+- int major;
+- char *name;
+- struct devinfo_state *info = f->private;
+-
+- switch(info->state) {
+- case CHR_HDR:
+- seq_printf(f,"Character devices:\n");
+- /* fallthrough */
+- case CHR_LIST:
+- if (!get_chrdev_info(info->chrdev,&major,&name))
+- seq_printf(f,"%3d %s\n",major,name);
+- break;
+- case BLK_HDR:
+- seq_printf(f,"\nBlock devices:\n");
+- /* fallthrough */
+- case BLK_LIST:
+- if (!get_blkdev_info(info->blkdev,&major,&name))
+- seq_printf(f,"%3d %s\n",major,name);
+- break;
+- default:
+- break;
+- }
+-
+- return 0;
++ /* Nothing to do */
+ }
+
+-static struct seq_operations devinfo_op = {
+- .start = devinfo_start,
+- .next = devinfo_next,
+- .stop = devinfo_stop,
+- .show = devinfo_show,
++static struct seq_operations devinfo_ops = {
++ .start = devinfo_start,
++ .next = devinfo_next,
++ .stop = devinfo_stop,
++ .show = devinfo_show
+ };
+
+-static int devinfo_open(struct inode *inode, struct file *file)
++static int devinfo_open(struct inode *inode, struct file *filp)
+ {
+- return seq_open(file, &devinfo_op);
++ return seq_open(filp, &devinfo_ops);
+ }
+
+ static struct file_operations proc_devinfo_operations = {
+@@ -396,13 +312,6 @@
+ .release = seq_release,
+ };
+
+-static struct file_operations proc_cpuinfo_operations = {
+- .open = cpuinfo_open,
+- .read = seq_read,
+- .llseek = seq_lseek,
+- .release = seq_release,
+-};
+-
+ extern struct seq_operations vmstat_op;
+ static int vmstat_open(struct inode *inode, struct file *file)
+ {
+diff -Naur linux-2.6.16/fs/proc/vmcore.c linux-2.6.16.16/fs/proc/vmcore.c
+--- linux-2.6.16/fs/proc/vmcore.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/fs/proc/vmcore.c 2006-05-11 04:56:24.000000000 +0300
+@@ -103,8 +103,8 @@
+ size_t buflen, loff_t *fpos)
+ {
+ ssize_t acc = 0, tmp;
+- size_t tsz, nr_bytes;
+- u64 start;
++ size_t tsz;
++ u64 start, nr_bytes;
+ struct vmcore *curr_m = NULL;
+
+ if (buflen == 0 || *fpos >= vmcore_size)
+diff -Naur linux-2.6.16/fs/reiserfs/xattr_acl.c linux-2.6.16.16/fs/reiserfs/xattr_acl.c
+--- linux-2.6.16/fs/reiserfs/xattr_acl.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/fs/reiserfs/xattr_acl.c 2006-05-11 04:56:24.000000000 +0300
+@@ -408,8 +408,9 @@
+ acl = reiserfs_get_acl(inode, ACL_TYPE_DEFAULT);
+ reiserfs_read_unlock_xattrs(inode->i_sb);
+ reiserfs_read_unlock_xattr_i(inode);
+- ret = acl ? 1 : 0;
+- posix_acl_release(acl);
++ ret = (acl && !IS_ERR(acl));
++ if (ret)
++ posix_acl_release(acl);
+ }
+
+ return ret;
+diff -Naur linux-2.6.16/fs/smbfs/dir.c linux-2.6.16.16/fs/smbfs/dir.c
+--- linux-2.6.16/fs/smbfs/dir.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/fs/smbfs/dir.c 2006-05-11 04:56:24.000000000 +0300
+@@ -434,6 +434,11 @@
+ if (dentry->d_name.len > SMB_MAXNAMELEN)
+ goto out;
+
++ /* Do not allow lookup of names with backslashes in */
++ error = -EINVAL;
++ if (memchr(dentry->d_name.name, '\\', dentry->d_name.len))
++ goto out;
++
+ lock_kernel();
+ error = smb_proc_getattr(dentry, &finfo);
+ #ifdef SMBFS_PARANOIA
+diff -Naur linux-2.6.16/fs/sysfs/dir.c linux-2.6.16.16/fs/sysfs/dir.c
+--- linux-2.6.16/fs/sysfs/dir.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/fs/sysfs/dir.c 2006-05-11 04:56:24.000000000 +0300
+@@ -302,6 +302,7 @@
+ * Drop reference from dget() on entrance.
+ */
+ dput(dentry);
++ kobj->dentry = NULL;
+ }
+
+ int sysfs_rename_dir(struct kobject * kobj, const char *new_name)
+diff -Naur linux-2.6.16/fs/sysfs/file.c linux-2.6.16.16/fs/sysfs/file.c
+--- linux-2.6.16/fs/sysfs/file.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/fs/sysfs/file.c 2006-05-11 04:56:24.000000000 +0300
+@@ -183,7 +183,7 @@
+ return -ENOMEM;
+
+ if (count >= PAGE_SIZE)
+- count = PAGE_SIZE;
++ count = PAGE_SIZE - 1;
+ error = copy_from_user(buffer->page,buf,count);
+ buffer->needs_read_fill = 1;
+ return error ? -EFAULT : count;
+diff -Naur linux-2.6.16/fs/sysfs/inode.c linux-2.6.16.16/fs/sysfs/inode.c
+--- linux-2.6.16/fs/sysfs/inode.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/fs/sysfs/inode.c 2006-05-11 04:56:24.000000000 +0300
+@@ -227,12 +227,16 @@
+ void sysfs_hash_and_remove(struct dentry * dir, const char * name)
+ {
+ struct sysfs_dirent * sd;
+- struct sysfs_dirent * parent_sd = dir->d_fsdata;
++ struct sysfs_dirent * parent_sd;
++
++ if (!dir)
++ return;
+
+ if (dir->d_inode == NULL)
+ /* no inode means this hasn't been made visible yet */
+ return;
+
++ parent_sd = dir->d_fsdata;
+ mutex_lock(&dir->d_inode->i_mutex);
+ list_for_each_entry(sd, &parent_sd->s_children, s_sibling) {
+ if (!sd->s_element)
+diff -Naur linux-2.6.16/fs/sysfs/symlink.c linux-2.6.16.16/fs/sysfs/symlink.c
+--- linux-2.6.16/fs/sysfs/symlink.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/fs/sysfs/symlink.c 2006-05-11 04:56:24.000000000 +0300
+@@ -66,6 +66,7 @@
+ if (!error)
+ return 0;
+
++ kobject_put(target);
+ kfree(sl->link_name);
+ exit2:
+ kfree(sl);
+diff -Naur linux-2.6.16/fs/xfs/linux-2.6/xfs_aops.c linux-2.6.16.16/fs/xfs/linux-2.6/xfs_aops.c
+--- linux-2.6.16/fs/xfs/linux-2.6/xfs_aops.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/fs/xfs/linux-2.6/xfs_aops.c 2006-05-11 04:56:24.000000000 +0300
+@@ -616,7 +616,7 @@
+ acceptable = (type == IOMAP_UNWRITTEN);
+ else if (buffer_delay(bh))
+ acceptable = (type == IOMAP_DELAY);
+- else if (buffer_mapped(bh))
++ else if (buffer_dirty(bh) && buffer_mapped(bh))
+ acceptable = (type == 0);
+ else
+ break;
+diff -Naur linux-2.6.16/fs/xfs/linux-2.6/xfs_iops.c linux-2.6.16.16/fs/xfs/linux-2.6/xfs_iops.c
+--- linux-2.6.16/fs/xfs/linux-2.6/xfs_iops.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/fs/xfs/linux-2.6/xfs_iops.c 2006-05-11 04:56:24.000000000 +0300
+@@ -673,8 +673,7 @@
+ if (ia_valid & ATTR_ATIME) {
+ vattr.va_mask |= XFS_AT_ATIME;
+ vattr.va_atime = attr->ia_atime;
+- if (ia_valid & ATTR_ATIME_SET)
+- inode->i_atime = attr->ia_atime;
++ inode->i_atime = attr->ia_atime;
+ }
+ if (ia_valid & ATTR_MTIME) {
+ vattr.va_mask |= XFS_AT_MTIME;
+diff -Naur linux-2.6.16/include/asm-i386/cpufeature.h linux-2.6.16.16/include/asm-i386/cpufeature.h
+--- linux-2.6.16/include/asm-i386/cpufeature.h 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/include/asm-i386/cpufeature.h 2006-05-11 04:56:24.000000000 +0300
+@@ -70,6 +70,7 @@
+ #define X86_FEATURE_P3 (3*32+ 6) /* P3 */
+ #define X86_FEATURE_P4 (3*32+ 7) /* P4 */
+ #define X86_FEATURE_CONSTANT_TSC (3*32+ 8) /* TSC ticks at a constant rate */
++#define X86_FEATURE_FXSAVE_LEAK (3*32+10) /* FXSAVE leaks FOP/FIP/FOP */
+
+ /* Intel-defined CPU features, CPUID level 0x00000001 (ecx), word 4 */
+ #define X86_FEATURE_XMM3 (4*32+ 0) /* Streaming SIMD Extensions-3 */
+diff -Naur linux-2.6.16/include/asm-i386/i387.h linux-2.6.16.16/include/asm-i386/i387.h
+--- linux-2.6.16/include/asm-i386/i387.h 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/include/asm-i386/i387.h 2006-05-11 04:56:24.000000000 +0300
+@@ -13,6 +13,7 @@
+
+ #include <linux/sched.h>
+ #include <linux/init.h>
++#include <linux/kernel_stat.h>
+ #include <asm/processor.h>
+ #include <asm/sigcontext.h>
+ #include <asm/user.h>
+@@ -38,17 +39,38 @@
+ extern void kernel_fpu_begin(void);
+ #define kernel_fpu_end() do { stts(); preempt_enable(); } while(0)
+
++/* We need a safe address that is cheap to find and that is already
++ in L1 during context switch. The best choices are unfortunately
++ different for UP and SMP */
++#ifdef CONFIG_SMP
++#define safe_address (__per_cpu_offset[0])
++#else
++#define safe_address (kstat_cpu(0).cpustat.user)
++#endif
++
+ /*
+ * These must be called with preempt disabled
+ */
+ static inline void __save_init_fpu( struct task_struct *tsk )
+ {
++ /* Use more nops than strictly needed in case the compiler
++ varies code */
+ alternative_input(
+- "fnsave %1 ; fwait ;" GENERIC_NOP2,
+- "fxsave %1 ; fnclex",
++ "fnsave %[fx] ;fwait;" GENERIC_NOP8 GENERIC_NOP4,
++ "fxsave %[fx]\n"
++ "bt $7,%[fsw] ; jnc 1f ; fnclex\n1:",
+ X86_FEATURE_FXSR,
+- "m" (tsk->thread.i387.fxsave)
+- :"memory");
++ [fx] "m" (tsk->thread.i387.fxsave),
++ [fsw] "m" (tsk->thread.i387.fxsave.swd) : "memory");
++ /* AMD K7/K8 CPUs don't save/restore FDP/FIP/FOP unless an exception
++ is pending. Clear the x87 state here by setting it to fixed
++ values. safe_address is a random variable that should be in L1 */
++ alternative_input(
++ GENERIC_NOP8 GENERIC_NOP2,
++ "emms\n\t" /* clear stack tags */
++ "fildl %[addr]", /* set F?P to defined value */
++ X86_FEATURE_FXSAVE_LEAK,
++ [addr] "m" (safe_address));
+ task_thread_info(tsk)->status &= ~TS_USEDFPU;
+ }
+
+diff -Naur linux-2.6.16/include/asm-i386/pgtable-2level.h linux-2.6.16.16/include/asm-i386/pgtable-2level.h
+--- linux-2.6.16/include/asm-i386/pgtable-2level.h 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/include/asm-i386/pgtable-2level.h 2006-05-11 04:56:24.000000000 +0300
+@@ -18,6 +18,9 @@
+ #define set_pte_atomic(pteptr, pteval) set_pte(pteptr,pteval)
+ #define set_pmd(pmdptr, pmdval) (*(pmdptr) = (pmdval))
+
++#define pte_clear(mm,addr,xp) do { set_pte_at(mm, addr, xp, __pte(0)); } while (0)
++#define pmd_clear(xp) do { set_pmd(xp, __pmd(0)); } while (0)
++
+ #define ptep_get_and_clear(mm,addr,xp) __pte(xchg(&(xp)->pte_low, 0))
+ #define pte_same(a, b) ((a).pte_low == (b).pte_low)
+ #define pte_page(x) pfn_to_page(pte_pfn(x))
+diff -Naur linux-2.6.16/include/asm-i386/pgtable-3level.h linux-2.6.16.16/include/asm-i386/pgtable-3level.h
+--- linux-2.6.16/include/asm-i386/pgtable-3level.h 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/include/asm-i386/pgtable-3level.h 2006-05-11 04:56:24.000000000 +0300
+@@ -85,6 +85,26 @@
+ #define pmd_offset(pud, address) ((pmd_t *) pud_page(*(pud)) + \
+ pmd_index(address))
+
++/*
++ * For PTEs and PDEs, we must clear the P-bit first when clearing a page table
++ * entry, so clear the bottom half first and enforce ordering with a compiler
++ * barrier.
++ */
++static inline void pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
++{
++ ptep->pte_low = 0;
++ smp_wmb();
++ ptep->pte_high = 0;
++}
++
++static inline void pmd_clear(pmd_t *pmd)
++{
++ u32 *tmp = (u32 *)pmd;
++ *tmp = 0;
++ smp_wmb();
++ *(tmp + 1) = 0;
++}
++
+ static inline pte_t ptep_get_and_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
+ {
+ pte_t res;
+diff -Naur linux-2.6.16/include/asm-i386/pgtable.h linux-2.6.16.16/include/asm-i386/pgtable.h
+--- linux-2.6.16/include/asm-i386/pgtable.h 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/include/asm-i386/pgtable.h 2006-05-11 04:56:24.000000000 +0300
+@@ -204,12 +204,10 @@
+ extern unsigned long pg0[];
+
+ #define pte_present(x) ((x).pte_low & (_PAGE_PRESENT | _PAGE_PROTNONE))
+-#define pte_clear(mm,addr,xp) do { set_pte_at(mm, addr, xp, __pte(0)); } while (0)
+
+ /* To avoid harmful races, pmd_none(x) should check only the lower when PAE */
+ #define pmd_none(x) (!(unsigned long)pmd_val(x))
+ #define pmd_present(x) (pmd_val(x) & _PAGE_PRESENT)
+-#define pmd_clear(xp) do { set_pmd(xp, __pmd(0)); } while (0)
+ #define pmd_bad(x) ((pmd_val(x) & (~PAGE_MASK & ~_PAGE_USER)) != _KERNPG_TABLE)
+
+
+@@ -269,7 +267,7 @@
+ pte_t pte;
+ if (full) {
+ pte = *ptep;
+- *ptep = __pte(0);
++ pte_clear(mm, addr, ptep);
+ } else {
+ pte = ptep_get_and_clear(mm, addr, ptep);
+ }
+diff -Naur linux-2.6.16/include/asm-m32r/smp.h linux-2.6.16.16/include/asm-m32r/smp.h
+--- linux-2.6.16/include/asm-m32r/smp.h 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/include/asm-m32r/smp.h 2006-05-11 04:56:24.000000000 +0300
+@@ -67,7 +67,8 @@
+ #define raw_smp_processor_id() (current_thread_info()->cpu)
+
+ extern cpumask_t cpu_callout_map;
+-#define cpu_possible_map cpu_callout_map
++extern cpumask_t cpu_possible_map;
++extern cpumask_t cpu_present_map;
+
+ static __inline__ int hard_smp_processor_id(void)
+ {
+diff -Naur linux-2.6.16/include/asm-m32r/uaccess.h linux-2.6.16.16/include/asm-m32r/uaccess.h
+--- linux-2.6.16/include/asm-m32r/uaccess.h 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/include/asm-m32r/uaccess.h 2006-05-11 04:56:24.000000000 +0300
+@@ -5,17 +5,9 @@
+ * linux/include/asm-m32r/uaccess.h
+ *
+ * M32R version.
+- * Copyright (C) 2004 Hirokazu Takata <takata at linux-m32r.org>
++ * Copyright (C) 2004, 2006 Hirokazu Takata <takata at linux-m32r.org>
+ */
+
+-#undef UACCESS_DEBUG
+-
+-#ifdef UACCESS_DEBUG
+-#define UAPRINTK(args...) printk(args)
+-#else
+-#define UAPRINTK(args...)
+-#endif /* UACCESS_DEBUG */
+-
+ /*
+ * User space memory access functions
+ */
+@@ -38,27 +30,29 @@
+ #define MAKE_MM_SEG(s) ((mm_segment_t) { (s) })
+
+ #ifdef CONFIG_MMU
++
+ #define KERNEL_DS MAKE_MM_SEG(0xFFFFFFFF)
+ #define USER_DS MAKE_MM_SEG(PAGE_OFFSET)
+-#else
+-#define KERNEL_DS MAKE_MM_SEG(0xFFFFFFFF)
+-#define USER_DS MAKE_MM_SEG(0xFFFFFFFF)
+-#endif /* CONFIG_MMU */
+-
+ #define get_ds() (KERNEL_DS)
+-#ifdef CONFIG_MMU
+ #define get_fs() (current_thread_info()->addr_limit)
+ #define set_fs(x) (current_thread_info()->addr_limit = (x))
+-#else
++
++#else /* not CONFIG_MMU */
++
++#define KERNEL_DS MAKE_MM_SEG(0xFFFFFFFF)
++#define USER_DS MAKE_MM_SEG(0xFFFFFFFF)
++#define get_ds() (KERNEL_DS)
++
+ static inline mm_segment_t get_fs(void)
+ {
+- return USER_DS;
++ return USER_DS;
+ }
+
+ static inline void set_fs(mm_segment_t s)
+ {
+ }
+-#endif /* CONFIG_MMU */
++
++#endif /* not CONFIG_MMU */
+
+ #define segment_eq(a,b) ((a).seg == (b).seg)
+
+@@ -83,9 +77,9 @@
+ " subx %0, %0\n" \
+ " cmpu %4, %1\n" \
+ " subx %0, %5\n" \
+- : "=&r"(flag), "=r"(sum) \
+- : "1"(addr), "r"((int)(size)), \
+- "r"(current_thread_info()->addr_limit.seg), "r"(0) \
++ : "=&r" (flag), "=r" (sum) \
++ : "1" (addr), "r" ((int)(size)), \
++ "r" (current_thread_info()->addr_limit.seg), "r" (0) \
+ : "cbit" ); \
+ flag; })
+
+@@ -113,10 +107,10 @@
+ #else
+ static inline int access_ok(int type, const void *addr, unsigned long size)
+ {
+- extern unsigned long memory_start, memory_end;
+- unsigned long val = (unsigned long)addr;
++ extern unsigned long memory_start, memory_end;
++ unsigned long val = (unsigned long)addr;
+
+- return ((val >= memory_start) && ((val + size) < memory_end));
++ return ((val >= memory_start) && ((val + size) < memory_end));
+ }
+ #endif /* CONFIG_MMU */
+
+@@ -155,39 +149,6 @@
+ * accesses to the same area of user memory).
+ */
+
+-extern void __get_user_1(void);
+-extern void __get_user_2(void);
+-extern void __get_user_4(void);
+-
+-#ifndef MODULE
+-#define __get_user_x(size,ret,x,ptr) \
+- __asm__ __volatile__( \
+- " mv r0, %0\n" \
+- " mv r1, %1\n" \
+- " bl __get_user_" #size "\n" \
+- " mv %0, r0\n" \
+- " mv %1, r1\n" \
+- : "=r"(ret), "=r"(x) \
+- : "0"(ptr) \
+- : "r0", "r1", "r14" )
+-#else /* MODULE */
+-/*
+- * Use "jl" instead of "bl" for MODULE
+- */
+-#define __get_user_x(size,ret,x,ptr) \
+- __asm__ __volatile__( \
+- " mv r0, %0\n" \
+- " mv r1, %1\n" \
+- " seth lr, #high(__get_user_" #size ")\n" \
+- " or3 lr, lr, #low(__get_user_" #size ")\n" \
+- " jl lr\n" \
+- " mv %0, r0\n" \
+- " mv %1, r1\n" \
+- : "=r"(ret), "=r"(x) \
+- : "0"(ptr) \
+- : "r0", "r1", "r14" )
+-#endif
+-
+ /* Careful: we have to cast the result to the type of the pointer for sign
+ reasons */
+ /**
+@@ -208,20 +169,7 @@
+ * On error, the variable @x is set to zero.
+ */
+ #define get_user(x,ptr) \
+-({ int __ret_gu; \
+- unsigned long __val_gu; \
+- __chk_user_ptr(ptr); \
+- switch(sizeof (*(ptr))) { \
+- case 1: __get_user_x(1,__ret_gu,__val_gu,ptr); break; \
+- case 2: __get_user_x(2,__ret_gu,__val_gu,ptr); break; \
+- case 4: __get_user_x(4,__ret_gu,__val_gu,ptr); break; \
+- default: __get_user_x(X,__ret_gu,__val_gu,ptr); break; \
+- } \
+- (x) = (__typeof__(*(ptr)))__val_gu; \
+- __ret_gu; \
+-})
+-
+-extern void __put_user_bad(void);
++ __get_user_check((x),(ptr),sizeof(*(ptr)))
+
+ /**
+ * put_user: - Write a simple value into user space.
+@@ -240,8 +188,7 @@
+ * Returns zero on success, or -EFAULT on error.
+ */
+ #define put_user(x,ptr) \
+- __put_user_check((__typeof__(*(ptr)))(x),(ptr),sizeof(*(ptr)))
+-
++ __put_user_check((__typeof__(*(ptr)))(x),(ptr),sizeof(*(ptr)))
+
+ /**
+ * __get_user: - Get a simple variable from user space, with less checking.
+@@ -264,8 +211,64 @@
+ * On error, the variable @x is set to zero.
+ */
+ #define __get_user(x,ptr) \
+- __get_user_nocheck((x),(ptr),sizeof(*(ptr)))
++ __get_user_nocheck((x),(ptr),sizeof(*(ptr)))
+
++#define __get_user_nocheck(x,ptr,size) \
++({ \
++ long __gu_err = 0; \
++ unsigned long __gu_val; \
++ might_sleep(); \
++ __get_user_size(__gu_val,(ptr),(size),__gu_err); \
++ (x) = (__typeof__(*(ptr)))__gu_val; \
++ __gu_err; \
++})
++
++#define __get_user_check(x,ptr,size) \
++({ \
++ long __gu_err = -EFAULT; \
++ unsigned long __gu_val = 0; \
++ const __typeof__(*(ptr)) __user *__gu_addr = (ptr); \
++ might_sleep(); \
++ if (access_ok(VERIFY_READ,__gu_addr,size)) \
++ __get_user_size(__gu_val,__gu_addr,(size),__gu_err); \
++ (x) = (__typeof__(*(ptr)))__gu_val; \
++ __gu_err; \
++})
++
++extern long __get_user_bad(void);
++
++#define __get_user_size(x,ptr,size,retval) \
++do { \
++ retval = 0; \
++ __chk_user_ptr(ptr); \
++ switch (size) { \
++ case 1: __get_user_asm(x,ptr,retval,"ub"); break; \
++ case 2: __get_user_asm(x,ptr,retval,"uh"); break; \
++ case 4: __get_user_asm(x,ptr,retval,""); break; \
++ default: (x) = __get_user_bad(); \
++ } \
++} while (0)
++
++#define __get_user_asm(x, addr, err, itype) \
++ __asm__ __volatile__( \
++ " .fillinsn\n" \
++ "1: ld"itype" %1,@%2\n" \
++ " .fillinsn\n" \
++ "2:\n" \
++ ".section .fixup,\"ax\"\n" \
++ " .balign 4\n" \
++ "3: ldi %0,%3\n" \
++ " seth r14,#high(2b)\n" \
++ " or3 r14,r14,#low(2b)\n" \
++ " jmp r14\n" \
++ ".previous\n" \
++ ".section __ex_table,\"a\"\n" \
++ " .balign 4\n" \
++ " .long 1b,3b\n" \
++ ".previous" \
++ : "=&r" (err), "=&r" (x) \
++ : "r" (addr), "i" (-EFAULT), "0" (err) \
++ : "r14", "memory")
+
+ /**
+ * __put_user: - Write a simple value into user space, with less checking.
+@@ -287,11 +290,13 @@
+ * Returns zero on success, or -EFAULT on error.
+ */
+ #define __put_user(x,ptr) \
+- __put_user_nocheck((__typeof__(*(ptr)))(x),(ptr),sizeof(*(ptr)))
++ __put_user_nocheck((__typeof__(*(ptr)))(x),(ptr),sizeof(*(ptr)))
++
+
+ #define __put_user_nocheck(x,ptr,size) \
+ ({ \
+ long __pu_err; \
++ might_sleep(); \
+ __put_user_size((x),(ptr),(size),__pu_err); \
+ __pu_err; \
+ })
+@@ -308,28 +313,28 @@
+ })
+
+ #if defined(__LITTLE_ENDIAN__)
+-#define __put_user_u64(x, addr, err) \
+- __asm__ __volatile__( \
+- " .fillinsn\n" \
+- "1: st %L1,@%2\n" \
+- " .fillinsn\n" \
+- "2: st %H1,@(4,%2)\n" \
+- " .fillinsn\n" \
+- "3:\n" \
+- ".section .fixup,\"ax\"\n" \
+- " .balign 4\n" \
+- "4: ldi %0,%3\n" \
+- " seth r14,#high(3b)\n" \
+- " or3 r14,r14,#low(3b)\n" \
+- " jmp r14\n" \
+- ".previous\n" \
+- ".section __ex_table,\"a\"\n" \
+- " .balign 4\n" \
+- " .long 1b,4b\n" \
+- " .long 2b,4b\n" \
+- ".previous" \
+- : "=&r"(err) \
+- : "r"(x), "r"(addr), "i"(-EFAULT), "0"(err) \
++#define __put_user_u64(x, addr, err) \
++ __asm__ __volatile__( \
++ " .fillinsn\n" \
++ "1: st %L1,@%2\n" \
++ " .fillinsn\n" \
++ "2: st %H1,@(4,%2)\n" \
++ " .fillinsn\n" \
++ "3:\n" \
++ ".section .fixup,\"ax\"\n" \
++ " .balign 4\n" \
++ "4: ldi %0,%3\n" \
++ " seth r14,#high(3b)\n" \
++ " or3 r14,r14,#low(3b)\n" \
++ " jmp r14\n" \
++ ".previous\n" \
++ ".section __ex_table,\"a\"\n" \
++ " .balign 4\n" \
++ " .long 1b,4b\n" \
++ " .long 2b,4b\n" \
++ ".previous" \
++ : "=&r" (err) \
++ : "r" (x), "r" (addr), "i" (-EFAULT), "0" (err) \
+ : "r14", "memory")
+
+ #elif defined(__BIG_ENDIAN__)
+@@ -353,13 +358,15 @@
+ " .long 1b,4b\n" \
+ " .long 2b,4b\n" \
+ ".previous" \
+- : "=&r"(err) \
+- : "r"(x), "r"(addr), "i"(-EFAULT), "0"(err) \
++ : "=&r" (err) \
++ : "r" (x), "r" (addr), "i" (-EFAULT), "0" (err) \
+ : "r14", "memory")
+ #else
+ #error no endian defined
+ #endif
+
++extern void __put_user_bad(void);
++
+ #define __put_user_size(x,ptr,size,retval) \
+ do { \
+ retval = 0; \
+@@ -398,52 +405,8 @@
+ " .balign 4\n" \
+ " .long 1b,3b\n" \
+ ".previous" \
+- : "=&r"(err) \
+- : "r"(x), "r"(addr), "i"(-EFAULT), "0"(err) \
+- : "r14", "memory")
+-
+-#define __get_user_nocheck(x,ptr,size) \
+-({ \
+- long __gu_err; \
+- unsigned long __gu_val; \
+- __get_user_size(__gu_val,(ptr),(size),__gu_err); \
+- (x) = (__typeof__(*(ptr)))__gu_val; \
+- __gu_err; \
+-})
+-
+-extern long __get_user_bad(void);
+-
+-#define __get_user_size(x,ptr,size,retval) \
+-do { \
+- retval = 0; \
+- __chk_user_ptr(ptr); \
+- switch (size) { \
+- case 1: __get_user_asm(x,ptr,retval,"ub"); break; \
+- case 2: __get_user_asm(x,ptr,retval,"uh"); break; \
+- case 4: __get_user_asm(x,ptr,retval,""); break; \
+- default: (x) = __get_user_bad(); \
+- } \
+-} while (0)
+-
+-#define __get_user_asm(x, addr, err, itype) \
+- __asm__ __volatile__( \
+- " .fillinsn\n" \
+- "1: ld"itype" %1,@%2\n" \
+- " .fillinsn\n" \
+- "2:\n" \
+- ".section .fixup,\"ax\"\n" \
+- " .balign 4\n" \
+- "3: ldi %0,%3\n" \
+- " seth r14,#high(2b)\n" \
+- " or3 r14,r14,#low(2b)\n" \
+- " jmp r14\n" \
+- ".previous\n" \
+- ".section __ex_table,\"a\"\n" \
+- " .balign 4\n" \
+- " .long 1b,3b\n" \
+- ".previous" \
+- : "=&r"(err), "=&r"(x) \
+- : "r"(addr), "i"(-EFAULT), "0"(err) \
++ : "=&r" (err) \
++ : "r" (x), "r" (addr), "i" (-EFAULT), "0" (err) \
+ : "r14", "memory")
+
+ /*
+@@ -453,7 +416,6 @@
+ * anything, so this is accurate.
+ */
+
+-
+ /*
+ * Copy To/From Userspace
+ */
+@@ -511,8 +473,9 @@
+ " .long 2b,9b\n" \
+ " .long 3b,9b\n" \
+ ".previous\n" \
+- : "=&r"(__dst), "=&r"(__src), "=&r"(size), "=&r"(__c) \
+- : "0"(to), "1"(from), "2"(size), "3"(size / 4) \
++ : "=&r" (__dst), "=&r" (__src), "=&r" (size), \
++ "=&r" (__c) \
++ : "0" (to), "1" (from), "2" (size), "3" (size / 4) \
+ : "r14", "memory"); \
+ } while (0)
+
+@@ -573,8 +536,9 @@
+ " .long 2b,7b\n" \
+ " .long 3b,7b\n" \
+ ".previous\n" \
+- : "=&r"(__dst), "=&r"(__src), "=&r"(size), "=&r"(__c) \
+- : "0"(to), "1"(from), "2"(size), "3"(size / 4) \
++ : "=&r" (__dst), "=&r" (__src), "=&r" (size), \
++ "=&r" (__c) \
++ : "0" (to), "1" (from), "2" (size), "3" (size / 4) \
+ : "r14", "memory"); \
+ } while (0)
+
+@@ -676,7 +640,7 @@
+ #define copy_from_user(to,from,n) \
+ ({ \
+ might_sleep(); \
+-__generic_copy_from_user((to),(from),(n)); \
++ __generic_copy_from_user((to),(from),(n)); \
+ })
+
+ long __must_check strncpy_from_user(char *dst, const char __user *src,
+diff -Naur linux-2.6.16/include/asm-mips/bitops.h linux-2.6.16.16/include/asm-mips/bitops.h
+--- linux-2.6.16/include/asm-mips/bitops.h 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/include/asm-mips/bitops.h 2006-05-11 04:56:24.000000000 +0300
+@@ -654,7 +654,12 @@
+ {
+ #ifdef CONFIG_32BIT
+ #ifdef CONFIG_CPU_MIPS32
+- __asm__ ("clz %0, %1" : "=r" (word) : "r" (word));
++ __asm__ (
++ " .set mips32 \n"
++ " clz %0, %1 \n"
++ " .set mips0 \n"
++ : "=r" (word)
++ : "r" (word));
+
+ return 32 - word;
+ #else
+@@ -678,7 +683,12 @@
+ #ifdef CONFIG_64BIT
+ #ifdef CONFIG_CPU_MIPS64
+
+- __asm__ ("dclz %0, %1" : "=r" (word) : "r" (word));
++ __asm__ (
++ " .set mips64 \n"
++ " dclz %0, %1 \n"
++ " .set mips0 \n"
++ : "=r" (word)
++ : "r" (word));
+
+ return 64 - word;
+ #else
+diff -Naur linux-2.6.16/include/asm-mips/byteorder.h linux-2.6.16.16/include/asm-mips/byteorder.h
+--- linux-2.6.16/include/asm-mips/byteorder.h 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/include/asm-mips/byteorder.h 2006-05-11 04:56:24.000000000 +0300
+@@ -19,7 +19,9 @@
+ static __inline__ __attribute_const__ __u16 ___arch__swab16(__u16 x)
+ {
+ __asm__(
++ " .set mips32r2 \n"
+ " wsbh %0, %1 \n"
++ " .set mips0 \n"
+ : "=r" (x)
+ : "r" (x));
+
+@@ -30,8 +32,10 @@
+ static __inline__ __attribute_const__ __u32 ___arch__swab32(__u32 x)
+ {
+ __asm__(
++ " .set mips32r2 \n"
+ " wsbh %0, %1 \n"
+ " rotr %0, %0, 16 \n"
++ " .set mips0 \n"
+ : "=r" (x)
+ : "r" (x));
+
+diff -Naur linux-2.6.16/include/asm-mips/interrupt.h linux-2.6.16.16/include/asm-mips/interrupt.h
+--- linux-2.6.16/include/asm-mips/interrupt.h 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/include/asm-mips/interrupt.h 2006-05-11 04:56:24.000000000 +0300
+@@ -20,7 +20,9 @@
+ " .set reorder \n"
+ " .set noat \n"
+ #ifdef CONFIG_CPU_MIPSR2
++ " .set mips32r2 \n"
+ " ei \n"
++ " .set mips0 \n"
+ #else
+ " mfc0 $1,$12 \n"
+ " ori $1,0x1f \n"
+@@ -63,7 +65,9 @@
+ " .set push \n"
+ " .set noat \n"
+ #ifdef CONFIG_CPU_MIPSR2
++ " .set mips32r2 \n"
+ " di \n"
++ " .set mips0 \n"
+ #else
+ " mfc0 $1,$12 \n"
+ " ori $1,0x1f \n"
+@@ -103,8 +107,10 @@
+ " .set reorder \n"
+ " .set noat \n"
+ #ifdef CONFIG_CPU_MIPSR2
++ " .set mips32r2 \n"
+ " di \\result \n"
+ " andi \\result, 1 \n"
++ " .set mips0 \n"
+ #else
+ " mfc0 \\result, $12 \n"
+ " ori $1, \\result, 0x1f \n"
+@@ -133,9 +139,11 @@
+ * Slow, but doesn't suffer from a relativly unlikely race
+ * condition we're having since days 1.
+ */
++ " .set mips32r2 \n"
+ " beqz \\flags, 1f \n"
+ " di \n"
+ " ei \n"
++ " .set mips0 \n"
+ "1: \n"
+ #elif defined(CONFIG_CPU_MIPSR2)
+ /*
+diff -Naur linux-2.6.16/include/asm-mips/r4kcache.h linux-2.6.16.16/include/asm-mips/r4kcache.h
+--- linux-2.6.16/include/asm-mips/r4kcache.h 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/include/asm-mips/r4kcache.h 2006-05-11 04:56:24.000000000 +0300
+@@ -37,7 +37,7 @@
+ " cache %0, %1 \n" \
+ " .set pop \n" \
+ : \
+- : "i" (op), "m" (*(unsigned char *)(addr)))
++ : "i" (op), "R" (*(unsigned char *)(addr)))
+
+ static inline void flush_icache_line_indexed(unsigned long addr)
+ {
+diff -Naur linux-2.6.16/include/asm-powerpc/floppy.h linux-2.6.16.16/include/asm-powerpc/floppy.h
+--- linux-2.6.16/include/asm-powerpc/floppy.h 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/include/asm-powerpc/floppy.h 2006-05-11 04:56:24.000000000 +0300
+@@ -35,6 +35,7 @@
+ #ifdef CONFIG_PCI
+
+ #include <linux/pci.h>
++#include <asm/ppc-pci.h> /* for ppc64_isabridge_dev */
+
+ #define fd_dma_setup(addr,size,mode,io) powerpc_fd_dma_setup(addr,size,mode,io)
+
+@@ -52,12 +53,12 @@
+ if (bus_addr
+ && (addr != prev_addr || size != prev_size || dir != prev_dir)) {
+ /* different from last time -- unmap prev */
+- pci_unmap_single(NULL, bus_addr, prev_size, prev_dir);
++ pci_unmap_single(ppc64_isabridge_dev, bus_addr, prev_size, prev_dir);
+ bus_addr = 0;
+ }
+
+ if (!bus_addr) /* need to map it */
+- bus_addr = pci_map_single(NULL, addr, size, dir);
++ bus_addr = pci_map_single(ppc64_isabridge_dev, addr, size, dir);
+
+ /* remember this one as prev */
+ prev_addr = addr;
+diff -Naur linux-2.6.16/include/asm-x86_64/cpufeature.h linux-2.6.16.16/include/asm-x86_64/cpufeature.h
+--- linux-2.6.16/include/asm-x86_64/cpufeature.h 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/include/asm-x86_64/cpufeature.h 2006-05-11 04:56:24.000000000 +0300
+@@ -64,6 +64,7 @@
+ #define X86_FEATURE_REP_GOOD (3*32+ 4) /* rep microcode works well on this CPU */
+ #define X86_FEATURE_CONSTANT_TSC (3*32+5) /* TSC runs at constant rate */
+ #define X86_FEATURE_SYNC_RDTSC (3*32+6) /* RDTSC syncs CPU core */
++#define X86_FEATURE_FXSAVE_LEAK (3*32+7) /* FIP/FOP/FDP leaks through FXSAVE */
+
+ /* Intel-defined CPU features, CPUID level 0x00000001 (ecx), word 4 */
+ #define X86_FEATURE_XMM3 (4*32+ 0) /* Streaming SIMD Extensions-3 */
+diff -Naur linux-2.6.16/include/asm-x86_64/i387.h linux-2.6.16.16/include/asm-x86_64/i387.h
+--- linux-2.6.16/include/asm-x86_64/i387.h 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/include/asm-x86_64/i387.h 2006-05-11 04:56:24.000000000 +0300
+@@ -72,6 +72,23 @@
+ #define set_fpu_swd(t,val) ((t)->thread.i387.fxsave.swd = (val))
+ #define set_fpu_fxsr_twd(t,val) ((t)->thread.i387.fxsave.twd = (val))
+
++#define X87_FSW_ES (1 << 7) /* Exception Summary */
++
++/* AMD CPUs don't save/restore FDP/FIP/FOP unless an exception
++ is pending. Clear the x87 state here by setting it to fixed
++ values. The kernel data segment can be sometimes 0 and sometimes
++ new user value. Both should be ok.
++ Use the PDA as safe address because it should be already in L1. */
++static inline void clear_fpu_state(struct i387_fxsave_struct *fx)
++{
++ if (unlikely(fx->swd & X87_FSW_ES))
++ asm volatile("fnclex");
++ alternative_input(ASM_NOP8 ASM_NOP2,
++ " emms\n" /* clear stack tags */
++ " fildl %%gs:0", /* load to clear state */
++ X86_FEATURE_FXSAVE_LEAK);
++}
++
+ static inline int restore_fpu_checking(struct i387_fxsave_struct *fx)
+ {
+ int err;
+@@ -119,6 +136,7 @@
+ #endif
+ if (unlikely(err))
+ __clear_user(fx, sizeof(struct i387_fxsave_struct));
++ /* No need to clear here because the caller clears USED_MATH */
+ return err;
+ }
+
+@@ -149,7 +167,7 @@
+ "i" (offsetof(__typeof__(*tsk),
+ thread.i387.fxsave)));
+ #endif
+- __asm__ __volatile__("fnclex");
++ clear_fpu_state(&tsk->thread.i387.fxsave);
+ }
+
+ static inline void kernel_fpu_begin(void)
+diff -Naur linux-2.6.16/include/linux/cpu.h linux-2.6.16.16/include/linux/cpu.h
+--- linux-2.6.16/include/linux/cpu.h 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/include/linux/cpu.h 2006-05-11 04:56:24.000000000 +0300
+@@ -32,7 +32,7 @@
+ };
+
+ extern int register_cpu(struct cpu *, int, struct node *);
+-extern struct sys_device *get_cpu_sysdev(int cpu);
++extern struct sys_device *get_cpu_sysdev(unsigned cpu);
+ #ifdef CONFIG_HOTPLUG_CPU
+ extern void unregister_cpu(struct cpu *, struct node *);
+ #endif
+diff -Naur linux-2.6.16/include/linux/cpumask.h linux-2.6.16.16/include/linux/cpumask.h
+--- linux-2.6.16/include/linux/cpumask.h 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/include/linux/cpumask.h 2006-05-11 04:56:24.000000000 +0300
+@@ -408,6 +408,7 @@
+ })
+
+ #define for_each_cpu(cpu) for_each_cpu_mask((cpu), cpu_possible_map)
++#define for_each_possible_cpu(cpu) for_each_cpu_mask((cpu), cpu_possible_map)
+ #define for_each_online_cpu(cpu) for_each_cpu_mask((cpu), cpu_online_map)
+ #define for_each_present_cpu(cpu) for_each_cpu_mask((cpu), cpu_present_map)
+
+diff -Naur linux-2.6.16/include/linux/fb.h linux-2.6.16.16/include/linux/fb.h
+--- linux-2.6.16/include/linux/fb.h 2006-05-18 01:12:24.000000000 +0300
++++ linux-2.6.16.16/include/linux/fb.h 2006-05-17 21:41:31.000000000 +0300
+@@ -840,12 +840,10 @@
+ #define FB_LEFT_POS(bpp) (32 - bpp)
+ #define FB_SHIFT_HIGH(val, bits) ((val) >> (bits))
+ #define FB_SHIFT_LOW(val, bits) ((val) << (bits))
+-#define FB_BIT_NR(b) (7 - (b))
+ #else
+ #define FB_LEFT_POS(bpp) (0)
+ #define FB_SHIFT_HIGH(val, bits) ((val) << (bits))
+ #define FB_SHIFT_LOW(val, bits) ((val) >> (bits))
+-#define FB_BIT_NR(b) (b)
+ #endif
+
+ /*
+diff -Naur linux-2.6.16/include/linux/fs.h linux-2.6.16.16/include/linux/fs.h
+--- linux-2.6.16/include/linux/fs.h 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/include/linux/fs.h 2006-05-11 04:56:24.000000000 +0300
+@@ -1383,6 +1383,7 @@
+ extern void bd_release(struct block_device *);
+
+ /* fs/char_dev.c */
++#define CHRDEV_MAJOR_HASH_SIZE 255
+ extern int alloc_chrdev_region(dev_t *, unsigned, unsigned, const char *);
+ extern int register_chrdev_region(dev_t, unsigned, const char *);
+ extern int register_chrdev(unsigned int, const char *,
+@@ -1390,25 +1391,17 @@
+ extern int unregister_chrdev(unsigned int, const char *);
+ extern void unregister_chrdev_region(dev_t, unsigned);
+ extern int chrdev_open(struct inode *, struct file *);
+-extern int get_chrdev_list(char *);
+-extern void *acquire_chrdev_list(void);
+-extern int count_chrdev_list(void);
+-extern void *get_next_chrdev(void *);
+-extern int get_chrdev_info(void *, int *, char **);
+-extern void release_chrdev_list(void *);
++extern void chrdev_show(struct seq_file *,off_t);
+
+ /* fs/block_dev.c */
++#define BLKDEV_MAJOR_HASH_SIZE 255
+ #define BDEVNAME_SIZE 32 /* Largest string for a blockdev identifier */
+ extern const char *__bdevname(dev_t, char *buffer);
+ extern const char *bdevname(struct block_device *bdev, char *buffer);
+ extern struct block_device *lookup_bdev(const char *);
+ extern struct block_device *open_bdev_excl(const char *, int, void *);
+ extern void close_bdev_excl(struct block_device *);
+-extern void *acquire_blkdev_list(void);
+-extern int count_blkdev_list(void);
+-extern void *get_next_blkdev(void *);
+-extern int get_blkdev_info(void *, int *, char **);
+-extern void release_blkdev_list(void *);
++extern void blkdev_show(struct seq_file *,off_t);
+
+ extern void init_special_inode(struct inode *, umode_t, dev_t);
+
+diff -Naur linux-2.6.16/include/linux/mm.h linux-2.6.16.16/include/linux/mm.h
+--- linux-2.6.16/include/linux/mm.h 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/include/linux/mm.h 2006-05-11 04:56:24.000000000 +0300
+@@ -229,10 +229,9 @@
+ unsigned long private; /* Mapping-private opaque data:
+ * usually used for buffer_heads
+ * if PagePrivate set; used for
+- * swp_entry_t if PageSwapCache.
+- * When page is free, this
++ * swp_entry_t if PageSwapCache;
+ * indicates order in the buddy
+- * system.
++ * system if PG_buddy is set.
+ */
+ struct address_space *mapping; /* If low bit clear, points to
+ * inode address_space, or NULL.
+diff -Naur linux-2.6.16/include/linux/page-flags.h linux-2.6.16.16/include/linux/page-flags.h
+--- linux-2.6.16/include/linux/page-flags.h 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/include/linux/page-flags.h 2006-05-11 04:56:24.000000000 +0300
+@@ -74,7 +74,9 @@
+ #define PG_mappedtodisk 16 /* Has blocks allocated on-disk */
+ #define PG_reclaim 17 /* To be reclaimed asap */
+ #define PG_nosave_free 18 /* Free, should not be written */
+-#define PG_uncached 19 /* Page has been mapped as uncached */
++#define PG_buddy 19 /* Page is free, on buddy lists */
++
++#define PG_uncached 20 /* Page has been mapped as uncached */
+
+ /*
+ * Global page accounting. One instance per CPU. Only unsigned longs are
+@@ -319,6 +321,10 @@
+ #define SetPageNosaveFree(page) set_bit(PG_nosave_free, &(page)->flags)
+ #define ClearPageNosaveFree(page) clear_bit(PG_nosave_free, &(page)->flags)
+
++#define PageBuddy(page) test_bit(PG_buddy, &(page)->flags)
++#define __SetPageBuddy(page) __set_bit(PG_buddy, &(page)->flags)
++#define __ClearPageBuddy(page) __clear_bit(PG_buddy, &(page)->flags)
++
+ #define PageMappedToDisk(page) test_bit(PG_mappedtodisk, &(page)->flags)
+ #define SetPageMappedToDisk(page) set_bit(PG_mappedtodisk, &(page)->flags)
+ #define ClearPageMappedToDisk(page) clear_bit(PG_mappedtodisk, &(page)->flags)
+diff -Naur linux-2.6.16/include/linux/proc_fs.h linux-2.6.16.16/include/linux/proc_fs.h
+--- linux-2.6.16/include/linux/proc_fs.h 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/include/linux/proc_fs.h 2006-05-11 04:56:24.000000000 +0300
+@@ -78,7 +78,7 @@
+ struct vmcore {
+ struct list_head list;
+ unsigned long long paddr;
+- unsigned long size;
++ unsigned long long size;
+ loff_t offset;
+ };
+
+diff -Naur linux-2.6.16/include/linux/raid/raid1.h linux-2.6.16.16/include/linux/raid/raid1.h
+--- linux-2.6.16/include/linux/raid/raid1.h 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/include/linux/raid/raid1.h 2006-05-11 04:56:24.000000000 +0300
+@@ -130,6 +130,6 @@
+ * with failure when last write completes (and all failed).
+ * Record that bi_end_io was called with this flag...
+ */
+-#define R1BIO_Returned 4
++#define R1BIO_Returned 6
+
+ #endif
+diff -Naur linux-2.6.16/include/linux/rtc.h linux-2.6.16.16/include/linux/rtc.h
+--- linux-2.6.16/include/linux/rtc.h 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/include/linux/rtc.h 2006-05-11 04:56:24.000000000 +0300
+@@ -11,8 +11,6 @@
+ #ifndef _LINUX_RTC_H_
+ #define _LINUX_RTC_H_
+
+-#include <linux/interrupt.h>
+-
+ /*
+ * The struct used to pass data via the following ioctl. Similar to the
+ * struct tm in <time.h>, but it needs to be here so that the kernel
+@@ -95,6 +93,8 @@
+
+ #ifdef __KERNEL__
+
++#include <linux/interrupt.h>
++
+ typedef struct rtc_task {
+ void (*func)(void *private_data);
+ void *private_data;
+diff -Naur linux-2.6.16/include/net/ip.h linux-2.6.16.16/include/net/ip.h
+--- linux-2.6.16/include/net/ip.h 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/include/net/ip.h 2006-05-11 04:56:24.000000000 +0300
+@@ -95,6 +95,7 @@
+ extern int ip_mr_input(struct sk_buff *skb);
+ extern int ip_output(struct sk_buff *skb);
+ extern int ip_mc_output(struct sk_buff *skb);
++extern int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *));
+ extern int ip_do_nat(struct sk_buff *skb);
+ extern void ip_send_check(struct iphdr *ip);
+ extern int ip_queue_xmit(struct sk_buff *skb, int ipfragok);
+diff -Naur linux-2.6.16/include/net/sctp/structs.h linux-2.6.16.16/include/net/sctp/structs.h
+--- linux-2.6.16/include/net/sctp/structs.h 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/include/net/sctp/structs.h 2006-05-11 04:56:24.000000000 +0300
+@@ -702,6 +702,7 @@
+ __u8 tsn_gap_acked; /* Is this chunk acked by a GAP ACK? */
+ __s8 fast_retransmit; /* Is this chunk fast retransmitted? */
+ __u8 tsn_missing_report; /* Data chunk missing counter. */
++ __u8 data_accepted; /* At least 1 chunk in this packet accepted */
+ };
+
+ void sctp_chunk_hold(struct sctp_chunk *);
+diff -Naur linux-2.6.16/ipc/shm.c linux-2.6.16.16/ipc/shm.c
+--- linux-2.6.16/ipc/shm.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/ipc/shm.c 2006-05-11 04:56:24.000000000 +0300
+@@ -161,6 +161,8 @@
+ ret = shmem_mmap(file, vma);
+ if (ret == 0) {
+ vma->vm_ops = &shm_vm_ops;
++ if (!(vma->vm_flags & VM_WRITE))
++ vma->vm_flags &= ~VM_MAYWRITE;
+ shm_inc(file->f_dentry->d_inode->i_ino);
+ }
+
+diff -Naur linux-2.6.16/ipc/util.c linux-2.6.16.16/ipc/util.c
+--- linux-2.6.16/ipc/util.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/ipc/util.c 2006-05-11 04:56:24.000000000 +0300
+@@ -182,8 +182,7 @@
+ if(new == NULL)
+ return size;
+ new->size = newsize;
+- memcpy(new->p, ids->entries->p, sizeof(struct kern_ipc_perm *)*size +
+- sizeof(struct ipc_id_ary));
++ memcpy(new->p, ids->entries->p, sizeof(struct kern_ipc_perm *)*size);
+ for(i=size;i<newsize;i++) {
+ new->p[i] = NULL;
+ }
+diff -Naur linux-2.6.16/kernel/auditsc.c linux-2.6.16.16/kernel/auditsc.c
+--- linux-2.6.16/kernel/auditsc.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/kernel/auditsc.c 2006-05-11 04:56:24.000000000 +0300
+@@ -966,11 +966,6 @@
+ if (context->in_syscall) {
+ struct audit_context *newctx;
+
+-#if defined(__NR_vm86) && defined(__NR_vm86old)
+- /* vm86 mode should only be entered once */
+- if (major == __NR_vm86 || major == __NR_vm86old)
+- return;
+-#endif
+ #if AUDIT_DEBUG
+ printk(KERN_ERR
+ "audit(:%d) pid=%d in syscall=%d;"
+diff -Naur linux-2.6.16/kernel/exec_domain.c linux-2.6.16.16/kernel/exec_domain.c
+--- linux-2.6.16/kernel/exec_domain.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/kernel/exec_domain.c 2006-05-11 04:56:24.000000000 +0300
+@@ -140,6 +140,7 @@
+ ep = lookup_exec_domain(personality);
+ if (ep == current_thread_info()->exec_domain) {
+ current->personality = personality;
++ module_put(ep->module);
+ return 0;
+ }
+
+diff -Naur linux-2.6.16/kernel/fork.c linux-2.6.16.16/kernel/fork.c
+--- linux-2.6.16/kernel/fork.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/kernel/fork.c 2006-05-11 04:56:24.000000000 +0300
+@@ -720,7 +720,7 @@
+ free_fdset (new_fdt->open_fds, new_fdt->max_fdset);
+ free_fd_array(new_fdt->fd, new_fdt->max_fds);
+ kmem_cache_free(files_cachep, newf);
+- goto out;
++ return NULL;
+ }
+
+ static int copy_files(unsigned long clone_flags, struct task_struct * tsk)
+diff -Naur linux-2.6.16/kernel/power/process.c linux-2.6.16.16/kernel/power/process.c
+--- linux-2.6.16/kernel/power/process.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/kernel/power/process.c 2006-05-11 04:56:24.000000000 +0300
+@@ -25,8 +25,7 @@
+ (p->flags & PF_NOFREEZE) ||
+ (p->exit_state == EXIT_ZOMBIE) ||
+ (p->exit_state == EXIT_DEAD) ||
+- (p->state == TASK_STOPPED) ||
+- (p->state == TASK_TRACED))
++ (p->state == TASK_STOPPED))
+ return 0;
+ return 1;
+ }
+diff -Naur linux-2.6.16/kernel/ptrace.c linux-2.6.16.16/kernel/ptrace.c
+--- linux-2.6.16/kernel/ptrace.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/kernel/ptrace.c 2006-05-11 04:56:24.000000000 +0300
+@@ -57,10 +57,6 @@
+ signal_wake_up(child, 1);
+ }
+ }
+- if (child->signal->flags & SIGNAL_GROUP_EXIT) {
+- sigaddset(&child->pending.signal, SIGKILL);
+- signal_wake_up(child, 1);
+- }
+ spin_unlock(&child->sighand->siglock);
+ }
+
+@@ -82,7 +78,8 @@
+ SET_LINKS(child);
+ }
+
+- ptrace_untrace(child);
++ if (child->state == TASK_TRACED)
++ ptrace_untrace(child);
+ }
+
+ /*
+diff -Naur linux-2.6.16/kernel/sched.c linux-2.6.16.16/kernel/sched.c
+--- linux-2.6.16/kernel/sched.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/kernel/sched.c 2006-05-11 04:56:24.000000000 +0300
+@@ -237,6 +237,7 @@
+
+ task_t *migration_thread;
+ struct list_head migration_queue;
++ int cpu;
+ #endif
+
+ #ifdef CONFIG_SCHEDSTATS
+@@ -1660,6 +1661,9 @@
+ /*
+ * double_rq_lock - safely lock two runqueues
+ *
++ * We must take them in cpu order to match code in
++ * dependent_sleeper and wake_dependent_sleeper.
++ *
+ * Note this does not disable interrupts like task_rq_lock,
+ * you need to do so manually before calling.
+ */
+@@ -1671,7 +1675,7 @@
+ spin_lock(&rq1->lock);
+ __acquire(rq2->lock); /* Fake it out ;) */
+ } else {
+- if (rq1 < rq2) {
++ if (rq1->cpu < rq2->cpu) {
+ spin_lock(&rq1->lock);
+ spin_lock(&rq2->lock);
+ } else {
+@@ -1707,7 +1711,7 @@
+ __acquires(this_rq->lock)
+ {
+ if (unlikely(!spin_trylock(&busiest->lock))) {
+- if (busiest < this_rq) {
++ if (busiest->cpu < this_rq->cpu) {
+ spin_unlock(&this_rq->lock);
+ spin_lock(&busiest->lock);
+ spin_lock(&this_rq->lock);
+@@ -6035,6 +6039,7 @@
+ rq->push_cpu = 0;
+ rq->migration_thread = NULL;
+ INIT_LIST_HEAD(&rq->migration_queue);
++ rq->cpu = i;
+ #endif
+ atomic_set(&rq->nr_iowait, 0);
+
+diff -Naur linux-2.6.16/kernel/signal.c linux-2.6.16.16/kernel/signal.c
+--- linux-2.6.16/kernel/signal.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/kernel/signal.c 2006-05-11 04:56:24.000000000 +0300
+@@ -975,7 +975,6 @@
+ if (t == NULL)
+ /* restart balancing at this thread */
+ t = p->signal->curr_target = p;
+- BUG_ON(t->tgid != p->tgid);
+
+ while (!wants_signal(sig, t)) {
+ t = next_thread(t);
+@@ -1689,6 +1688,7 @@
+ /* Let the debugger run. */
+ set_current_state(TASK_TRACED);
+ spin_unlock_irq(¤t->sighand->siglock);
++ try_to_freeze();
+ read_lock(&tasklist_lock);
+ if (likely(current->ptrace & PT_PTRACED) &&
+ likely(current->parent != current->real_parent ||
+@@ -1942,9 +1942,9 @@
+ /* Let the debugger run. */
+ ptrace_stop(signr, signr, info);
+
+- /* We're back. Did the debugger cancel the sig or group_exit? */
++ /* We're back. Did the debugger cancel the sig? */
+ signr = current->exit_code;
+- if (signr == 0 || current->signal->flags & SIGNAL_GROUP_EXIT)
++ if (signr == 0)
+ continue;
+
+ current->exit_code = 0;
+diff -Naur linux-2.6.16/kernel/sys.c linux-2.6.16.16/kernel/sys.c
+--- linux-2.6.16/kernel/sys.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/kernel/sys.c 2006-05-11 04:56:24.000000000 +0300
+@@ -1657,7 +1657,19 @@
+ (cputime_eq(current->signal->it_prof_expires, cputime_zero) ||
+ new_rlim.rlim_cur <= cputime_to_secs(
+ current->signal->it_prof_expires))) {
+- cputime_t cputime = secs_to_cputime(new_rlim.rlim_cur);
++ unsigned long rlim_cur = new_rlim.rlim_cur;
++ cputime_t cputime;
++
++ if (rlim_cur == 0) {
++ /*
++ * The caller is asking for an immediate RLIMIT_CPU
++ * expiry. But we use the zero value to mean "it was
++ * never set". So let's cheat and make it one second
++ * instead
++ */
++ rlim_cur = 1;
++ }
++ cputime = secs_to_cputime(rlim_cur);
+ read_lock(&tasklist_lock);
+ spin_lock_irq(¤t->sighand->siglock);
+ set_process_cpu_timer(current, CPUCLOCK_PROF,
+diff -Naur linux-2.6.16/kernel/uid16.c linux-2.6.16.16/kernel/uid16.c
+--- linux-2.6.16/kernel/uid16.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/kernel/uid16.c 2006-05-11 04:56:24.000000000 +0300
+@@ -20,43 +20,67 @@
+
+ asmlinkage long sys_chown16(const char __user * filename, old_uid_t user, old_gid_t group)
+ {
+- return sys_chown(filename, low2highuid(user), low2highgid(group));
++ long ret = sys_chown(filename, low2highuid(user), low2highgid(group));
++ /* avoid REGPARM breakage on x86: */
++ prevent_tail_call(ret);
++ return ret;
+ }
+
+ asmlinkage long sys_lchown16(const char __user * filename, old_uid_t user, old_gid_t group)
+ {
+- return sys_lchown(filename, low2highuid(user), low2highgid(group));
++ long ret = sys_lchown(filename, low2highuid(user), low2highgid(group));
++ /* avoid REGPARM breakage on x86: */
++ prevent_tail_call(ret);
++ return ret;
+ }
+
+ asmlinkage long sys_fchown16(unsigned int fd, old_uid_t user, old_gid_t group)
+ {
+- return sys_fchown(fd, low2highuid(user), low2highgid(group));
++ long ret = sys_fchown(fd, low2highuid(user), low2highgid(group));
++ /* avoid REGPARM breakage on x86: */
++ prevent_tail_call(ret);
++ return ret;
+ }
+
+ asmlinkage long sys_setregid16(old_gid_t rgid, old_gid_t egid)
+ {
+- return sys_setregid(low2highgid(rgid), low2highgid(egid));
++ long ret = sys_setregid(low2highgid(rgid), low2highgid(egid));
++ /* avoid REGPARM breakage on x86: */
++ prevent_tail_call(ret);
++ return ret;
+ }
+
+ asmlinkage long sys_setgid16(old_gid_t gid)
+ {
+- return sys_setgid(low2highgid(gid));
++ long ret = sys_setgid(low2highgid(gid));
++ /* avoid REGPARM breakage on x86: */
++ prevent_tail_call(ret);
++ return ret;
+ }
+
+ asmlinkage long sys_setreuid16(old_uid_t ruid, old_uid_t euid)
+ {
+- return sys_setreuid(low2highuid(ruid), low2highuid(euid));
++ long ret = sys_setreuid(low2highuid(ruid), low2highuid(euid));
++ /* avoid REGPARM breakage on x86: */
++ prevent_tail_call(ret);
++ return ret;
+ }
+
+ asmlinkage long sys_setuid16(old_uid_t uid)
+ {
+- return sys_setuid(low2highuid(uid));
++ long ret = sys_setuid(low2highuid(uid));
++ /* avoid REGPARM breakage on x86: */
++ prevent_tail_call(ret);
++ return ret;
+ }
+
+ asmlinkage long sys_setresuid16(old_uid_t ruid, old_uid_t euid, old_uid_t suid)
+ {
+- return sys_setresuid(low2highuid(ruid), low2highuid(euid),
+- low2highuid(suid));
++ long ret = sys_setresuid(low2highuid(ruid), low2highuid(euid),
++ low2highuid(suid));
++ /* avoid REGPARM breakage on x86: */
++ prevent_tail_call(ret);
++ return ret;
+ }
+
+ asmlinkage long sys_getresuid16(old_uid_t __user *ruid, old_uid_t __user *euid, old_uid_t __user *suid)
+@@ -72,8 +96,11 @@
+
+ asmlinkage long sys_setresgid16(old_gid_t rgid, old_gid_t egid, old_gid_t sgid)
+ {
+- return sys_setresgid(low2highgid(rgid), low2highgid(egid),
+- low2highgid(sgid));
++ long ret = sys_setresgid(low2highgid(rgid), low2highgid(egid),
++ low2highgid(sgid));
++ /* avoid REGPARM breakage on x86: */
++ prevent_tail_call(ret);
++ return ret;
+ }
+
+ asmlinkage long sys_getresgid16(old_gid_t __user *rgid, old_gid_t __user *egid, old_gid_t __user *sgid)
+@@ -89,12 +116,18 @@
+
+ asmlinkage long sys_setfsuid16(old_uid_t uid)
+ {
+- return sys_setfsuid(low2highuid(uid));
++ long ret = sys_setfsuid(low2highuid(uid));
++ /* avoid REGPARM breakage on x86: */
++ prevent_tail_call(ret);
++ return ret;
+ }
+
+ asmlinkage long sys_setfsgid16(old_gid_t gid)
+ {
+- return sys_setfsgid(low2highgid(gid));
++ long ret = sys_setfsgid(low2highgid(gid));
++ /* avoid REGPARM breakage on x86: */
++ prevent_tail_call(ret);
++ return ret;
+ }
+
+ static int groups16_to_user(old_gid_t __user *grouplist,
+diff -Naur linux-2.6.16/Makefile linux-2.6.16.16/Makefile
+--- linux-2.6.16/Makefile 2006-05-18 01:12:20.000000000 +0300
++++ linux-2.6.16.16/Makefile 2006-05-17 21:41:27.000000000 +0300
+@@ -1,7 +1,7 @@
+ VERSION = 2
+ PATCHLEVEL = 6
+ SUBLEVEL = 16
+-EXTRAVERSION =
++EXTRAVERSION = .16
+ NAME=Sliding Snow Leopard
+
+ # *DOCUMENTATION*
+diff -Naur linux-2.6.16/mm/madvise.c linux-2.6.16.16/mm/madvise.c
+--- linux-2.6.16/mm/madvise.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/mm/madvise.c 2006-05-11 04:56:24.000000000 +0300
+@@ -168,6 +168,9 @@
+ return -EINVAL;
+ }
+
++ if ((vma->vm_flags & (VM_SHARED|VM_WRITE)) != (VM_SHARED|VM_WRITE))
++ return -EACCES;
++
+ mapping = vma->vm_file->f_mapping;
+
+ offset = (loff_t)(start - vma->vm_start)
+diff -Naur linux-2.6.16/mm/page_alloc.c linux-2.6.16.16/mm/page_alloc.c
+--- linux-2.6.16/mm/page_alloc.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/mm/page_alloc.c 2006-05-11 04:56:24.000000000 +0300
+@@ -153,7 +153,8 @@
+ 1 << PG_reclaim |
+ 1 << PG_slab |
+ 1 << PG_swapcache |
+- 1 << PG_writeback );
++ 1 << PG_writeback |
++ 1 << PG_buddy );
+ set_page_count(page, 0);
+ reset_page_mapcount(page);
+ page->mapping = NULL;
+@@ -224,12 +225,12 @@
+
+ static inline void set_page_order(struct page *page, int order) {
+ set_page_private(page, order);
+- __SetPagePrivate(page);
++ __SetPageBuddy(page);
+ }
+
+ static inline void rmv_page_order(struct page *page)
+ {
+- __ClearPagePrivate(page);
++ __ClearPageBuddy(page);
+ set_page_private(page, 0);
+ }
+
+@@ -268,11 +269,13 @@
+ * This function checks whether a page is free && is the buddy
+ * we can do coalesce a page and its buddy if
+ * (a) the buddy is not in a hole &&
+- * (b) the buddy is free &&
+- * (c) the buddy is on the buddy system &&
+- * (d) a page and its buddy have the same order.
+- * for recording page's order, we use page_private(page) and PG_private.
++ * (b) the buddy is in the buddy system &&
++ * (c) a page and its buddy have the same order.
++ *
++ * For recording whether a page is in the buddy system, we use PG_buddy.
++ * Setting, clearing, and testing PG_buddy is serialized by zone->lock.
+ *
++ * For recording page's order, we use page_private(page).
+ */
+ static inline int page_is_buddy(struct page *page, int order)
+ {
+@@ -281,10 +284,10 @@
+ return 0;
+ #endif
+
+- if (PagePrivate(page) &&
+- (page_order(page) == order) &&
+- page_count(page) == 0)
++ if (PageBuddy(page) && page_order(page) == order) {
++ BUG_ON(page_count(page) != 0);
+ return 1;
++ }
+ return 0;
+ }
+
+@@ -301,7 +304,7 @@
+ * as necessary, plus some accounting needed to play nicely with other
+ * parts of the VM system.
+ * At each level, we keep a list of pages, which are heads of continuous
+- * free pages of length of (1 << order) and marked with PG_Private.Page's
++ * free pages of length of (1 << order) and marked with PG_buddy. Page's
+ * order is recorded in page_private(page) field.
+ * So when we are allocating or freeing one, we can derive the state of the
+ * other. That is, if we allocate a small block, and both were
+@@ -364,7 +367,8 @@
+ 1 << PG_slab |
+ 1 << PG_swapcache |
+ 1 << PG_writeback |
+- 1 << PG_reserved ))))
++ 1 << PG_reserved |
++ 1 << PG_buddy ))))
+ bad_page(page);
+ if (PageDirty(page))
+ __ClearPageDirty(page);
+@@ -522,7 +526,8 @@
+ 1 << PG_slab |
+ 1 << PG_swapcache |
+ 1 << PG_writeback |
+- 1 << PG_reserved ))))
++ 1 << PG_reserved |
++ 1 << PG_buddy ))))
+ bad_page(page);
+
+ /*
+diff -Naur linux-2.6.16/net/atm/clip.c linux-2.6.16.16/net/atm/clip.c
+--- linux-2.6.16/net/atm/clip.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/net/atm/clip.c 2006-05-11 04:56:24.000000000 +0300
+@@ -613,12 +613,19 @@
+
+
+ static int clip_device_event(struct notifier_block *this,unsigned long event,
+- void *dev)
++ void *arg)
+ {
++ struct net_device *dev = arg;
++
++ if (event == NETDEV_UNREGISTER) {
++ neigh_ifdown(&clip_tbl, dev);
++ return NOTIFY_DONE;
++ }
++
+ /* ignore non-CLIP devices */
+- if (((struct net_device *) dev)->type != ARPHRD_ATM ||
+- ((struct net_device *) dev)->hard_start_xmit != clip_start_xmit)
++ if (dev->type != ARPHRD_ATM || dev->hard_start_xmit != clip_start_xmit)
+ return NOTIFY_DONE;
++
+ switch (event) {
+ case NETDEV_UP:
+ DPRINTK("clip_device_event NETDEV_UP\n");
+@@ -686,14 +693,12 @@
+ static void atmarpd_close(struct atm_vcc *vcc)
+ {
+ DPRINTK("atmarpd_close\n");
+- atmarpd = NULL; /* assumed to be atomic */
+- barrier();
+- unregister_inetaddr_notifier(&clip_inet_notifier);
+- unregister_netdevice_notifier(&clip_dev_notifier);
+- if (skb_peek(&sk_atm(vcc)->sk_receive_queue))
+- printk(KERN_ERR "atmarpd_close: closing with requests "
+- "pending\n");
++
++ rtnl_lock();
++ atmarpd = NULL;
+ skb_queue_purge(&sk_atm(vcc)->sk_receive_queue);
++ rtnl_unlock();
++
+ DPRINTK("(done)\n");
+ module_put(THIS_MODULE);
+ }
+@@ -714,7 +719,12 @@
+
+ static int atm_init_atmarp(struct atm_vcc *vcc)
+ {
+- if (atmarpd) return -EADDRINUSE;
++ rtnl_lock();
++ if (atmarpd) {
++ rtnl_unlock();
++ return -EADDRINUSE;
++ }
++
+ if (start_timer) {
+ start_timer = 0;
+ init_timer(&idle_timer);
+@@ -731,10 +741,7 @@
+ vcc->push = NULL;
+ vcc->pop = NULL; /* crash */
+ vcc->push_oam = NULL; /* crash */
+- if (register_netdevice_notifier(&clip_dev_notifier))
+- printk(KERN_ERR "register_netdevice_notifier failed\n");
+- if (register_inetaddr_notifier(&clip_inet_notifier))
+- printk(KERN_ERR "register_inetaddr_notifier failed\n");
++ rtnl_unlock();
+ return 0;
+ }
+
+@@ -992,6 +999,8 @@
+
+ clip_tbl_hook = &clip_tbl;
+ register_atm_ioctl(&clip_ioctl_ops);
++ register_netdevice_notifier(&clip_dev_notifier);
++ register_inetaddr_notifier(&clip_inet_notifier);
+
+ #ifdef CONFIG_PROC_FS
+ {
+@@ -1012,6 +1021,9 @@
+
+ remove_proc_entry("arp", atm_proc_root);
+
++ unregister_inetaddr_notifier(&clip_inet_notifier);
++ unregister_netdevice_notifier(&clip_dev_notifier);
++
+ deregister_atm_ioctl(&clip_ioctl_ops);
+
+ /* First, stop the idle timer, so it stops banging
+diff -Naur linux-2.6.16/net/bridge/br_netfilter.c linux-2.6.16.16/net/bridge/br_netfilter.c
+--- linux-2.6.16/net/bridge/br_netfilter.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/net/bridge/br_netfilter.c 2006-05-11 04:56:24.000000000 +0300
+@@ -739,6 +739,15 @@
+ return NF_STOLEN;
+ }
+
++static int br_nf_dev_queue_xmit(struct sk_buff *skb)
++{
++ if (skb->protocol == htons(ETH_P_IP) &&
++ skb->len > skb->dev->mtu &&
++ !(skb_shinfo(skb)->ufo_size || skb_shinfo(skb)->tso_size))
++ return ip_fragment(skb, br_dev_queue_push_xmit);
++ else
++ return br_dev_queue_push_xmit(skb);
++}
+
+ /* PF_BRIDGE/POST_ROUTING ********************************************/
+ static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff **pskb,
+@@ -798,7 +807,7 @@
+ realoutdev = nf_bridge->netoutdev;
+ #endif
+ NF_HOOK(pf, NF_IP_POST_ROUTING, skb, NULL, realoutdev,
+- br_dev_queue_push_xmit);
++ br_nf_dev_queue_xmit);
+
+ return NF_STOLEN;
+
+@@ -843,7 +852,7 @@
+ if ((out->hard_start_xmit == br_dev_xmit &&
+ okfn != br_nf_forward_finish &&
+ okfn != br_nf_local_out_finish &&
+- okfn != br_dev_queue_push_xmit)
++ okfn != br_nf_dev_queue_xmit)
+ #if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
+ || ((out->priv_flags & IFF_802_1Q_VLAN) &&
+ VLAN_DEV_INFO(out)->real_dev->hard_start_xmit == br_dev_xmit)
+diff -Naur linux-2.6.16/net/core/dev.c linux-2.6.16.16/net/core/dev.c
+--- linux-2.6.16/net/core/dev.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/net/core/dev.c 2006-05-11 04:56:24.000000000 +0300
+@@ -2932,11 +2932,11 @@
+
+ switch(dev->reg_state) {
+ case NETREG_REGISTERING:
++ dev->reg_state = NETREG_REGISTERED;
+ err = netdev_register_sysfs(dev);
+ if (err)
+ printk(KERN_ERR "%s: failed sysfs registration (%d)\n",
+ dev->name, err);
+- dev->reg_state = NETREG_REGISTERED;
+ break;
+
+ case NETREG_UNREGISTERING:
+diff -Naur linux-2.6.16/net/core/sock.c linux-2.6.16.16/net/core/sock.c
+--- linux-2.6.16/net/core/sock.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/net/core/sock.c 2006-05-11 04:56:24.000000000 +0300
+@@ -404,8 +404,9 @@
+ if (!valbool) {
+ sk->sk_bound_dev_if = 0;
+ } else {
+- if (optlen > IFNAMSIZ)
+- optlen = IFNAMSIZ;
++ if (optlen > IFNAMSIZ - 1)
++ optlen = IFNAMSIZ - 1;
++ memset(devname, 0, sizeof(devname));
+ if (copy_from_user(devname, optval, optlen)) {
+ ret = -EFAULT;
+ break;
+diff -Naur linux-2.6.16/net/ipv4/fib_trie.c linux-2.6.16.16/net/ipv4/fib_trie.c
+--- linux-2.6.16/net/ipv4/fib_trie.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/net/ipv4/fib_trie.c 2006-05-11 04:56:24.000000000 +0300
+@@ -314,11 +314,6 @@
+ kfree(container_of(head, struct leaf, rcu));
+ }
+
+-static inline void free_leaf(struct leaf *leaf)
+-{
+- call_rcu(&leaf->rcu, __leaf_free_rcu);
+-}
+-
+ static void __leaf_info_free_rcu(struct rcu_head *head)
+ {
+ kfree(container_of(head, struct leaf_info, rcu));
+@@ -357,7 +352,12 @@
+
+ static inline void tnode_free(struct tnode *tn)
+ {
+- call_rcu(&tn->rcu, __tnode_free_rcu);
++ if(IS_LEAF(tn)) {
++ struct leaf *l = (struct leaf *) tn;
++ call_rcu_bh(&l->rcu, __leaf_free_rcu);
++ }
++ else
++ call_rcu(&tn->rcu, __tnode_free_rcu);
+ }
+
+ static struct leaf *leaf_new(void)
+diff -Naur linux-2.6.16/net/ipv4/ip_output.c linux-2.6.16.16/net/ipv4/ip_output.c
+--- linux-2.6.16/net/ipv4/ip_output.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/net/ipv4/ip_output.c 2006-05-11 04:56:24.000000000 +0300
+@@ -86,8 +86,6 @@
+
+ int sysctl_ip_default_ttl = IPDEFTTL;
+
+-static int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff*));
+-
+ /* Generate a checksum for an outgoing IP datagram. */
+ __inline__ void ip_send_check(struct iphdr *iph)
+ {
+@@ -421,7 +419,7 @@
+ * single device frame, and queue such a frame for sending.
+ */
+
+-static int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff*))
++int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff*))
+ {
+ struct iphdr *iph;
+ int raw = 0;
+@@ -673,6 +671,8 @@
+ return err;
+ }
+
++EXPORT_SYMBOL(ip_fragment);
++
+ int
+ ip_generic_getfrag(void *from, char *to, int offset, int len, int odd, struct sk_buff *skb)
+ {
+@@ -1249,11 +1249,7 @@
+ iph->tos = inet->tos;
+ iph->tot_len = htons(skb->len);
+ iph->frag_off = df;
+- if (!df) {
+- __ip_select_ident(iph, &rt->u.dst, 0);
+- } else {
+- iph->id = htons(inet->id++);
+- }
++ ip_select_ident(iph, &rt->u.dst, sk);
+ iph->ttl = ttl;
+ iph->protocol = sk->sk_protocol;
+ iph->saddr = rt->rt_src;
+diff -Naur linux-2.6.16/net/ipv4/netfilter/ip_conntrack_netlink.c linux-2.6.16.16/net/ipv4/netfilter/ip_conntrack_netlink.c
+--- linux-2.6.16/net/ipv4/netfilter/ip_conntrack_netlink.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/net/ipv4/netfilter/ip_conntrack_netlink.c 2006-05-11 04:56:24.000000000 +0300
+@@ -1619,7 +1619,7 @@
+ printk("ctnetlink: unregistering from nfnetlink.\n");
+
+ #ifdef CONFIG_IP_NF_CONNTRACK_EVENTS
+- ip_conntrack_unregister_notifier(&ctnl_notifier_exp);
++ ip_conntrack_expect_unregister_notifier(&ctnl_notifier_exp);
+ ip_conntrack_unregister_notifier(&ctnl_notifier);
+ #endif
+
+diff -Naur linux-2.6.16/net/ipv4/netfilter/ip_conntrack_proto_sctp.c linux-2.6.16.16/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
+--- linux-2.6.16/net/ipv4/netfilter/ip_conntrack_proto_sctp.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/net/ipv4/netfilter/ip_conntrack_proto_sctp.c 2006-05-11 04:56:24.000000000 +0300
+@@ -235,12 +235,15 @@
+ flag = 1;
+ }
+
+- /* Cookie Ack/Echo chunks not the first OR
+- Init / Init Ack / Shutdown compl chunks not the only chunks */
+- if ((sch->type == SCTP_CID_COOKIE_ACK
++ /*
++ * Cookie Ack/Echo chunks not the first OR
++ * Init / Init Ack / Shutdown compl chunks not the only chunks
++ * OR zero-length.
++ */
++ if (((sch->type == SCTP_CID_COOKIE_ACK
+ || sch->type == SCTP_CID_COOKIE_ECHO
+ || flag)
+- && count !=0 ) {
++ && count !=0) || !sch->length) {
+ DEBUGP("Basic checks failed\n");
+ return 1;
+ }
+diff -Naur linux-2.6.16/net/ipv4/route.c linux-2.6.16.16/net/ipv4/route.c
+--- linux-2.6.16/net/ipv4/route.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/net/ipv4/route.c 2006-05-11 04:56:24.000000000 +0300
+@@ -2750,7 +2750,10 @@
+ /* Reserve room for dummy headers, this skb can pass
+ through good chunk of routing engine.
+ */
+- skb->mac.raw = skb->data;
++ skb->mac.raw = skb->nh.raw = skb->data;
++
++ /* Bugfix: need to give ip_route_input enough of an IP header to not gag. */
++ skb->nh.iph->protocol = IPPROTO_ICMP;
+ skb_reserve(skb, MAX_HEADER + sizeof(struct iphdr));
+
+ if (rta[RTA_SRC - 1])
+diff -Naur linux-2.6.16/net/ipv4/tcp_output.c linux-2.6.16.16/net/ipv4/tcp_output.c
+--- linux-2.6.16/net/ipv4/tcp_output.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/net/ipv4/tcp_output.c 2006-05-11 04:56:24.000000000 +0300
+@@ -537,7 +537,9 @@
+ buff = sk_stream_alloc_skb(sk, nsize, GFP_ATOMIC);
+ if (buff == NULL)
+ return -ENOMEM; /* We'll just try again later. */
+- sk_charge_skb(sk, buff);
++
++ buff->truesize = skb->len - len;
++ skb->truesize -= buff->truesize;
+
+ /* Correct the sequence numbers. */
+ TCP_SKB_CB(buff)->seq = TCP_SKB_CB(skb)->seq + len;
+diff -Naur linux-2.6.16/net/ipv6/exthdrs.c linux-2.6.16.16/net/ipv6/exthdrs.c
+--- linux-2.6.16/net/ipv6/exthdrs.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/net/ipv6/exthdrs.c 2006-05-11 04:56:24.000000000 +0300
+@@ -489,6 +489,18 @@
+ {
+ struct inet6_skb_parm *opt = IP6CB(skb);
+
++ /*
++ * skb->nh.raw is equal to skb->data, and
++ * skb->h.raw - skb->nh.raw is always equal to
++ * sizeof(struct ipv6hdr) by definition of
++ * hop-by-hop options.
++ */
++ if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + 8) ||
++ !pskb_may_pull(skb, sizeof(struct ipv6hdr) + ((skb->h.raw[1] + 1) << 3))) {
++ kfree_skb(skb);
++ return -1;
++ }
++
+ opt->hop = sizeof(struct ipv6hdr);
+ if (ip6_parse_tlv(tlvprochopopt_lst, skb)) {
+ skb->h.raw += (skb->h.raw[1]+1)<<3;
+diff -Naur linux-2.6.16/net/ipv6/xfrm6_policy.c linux-2.6.16.16/net/ipv6/xfrm6_policy.c
+--- linux-2.6.16/net/ipv6/xfrm6_policy.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/net/ipv6/xfrm6_policy.c 2006-05-11 04:56:24.000000000 +0300
+@@ -191,16 +191,18 @@
+ static inline void
+ _decode_session6(struct sk_buff *skb, struct flowi *fl)
+ {
+- u16 offset = sizeof(struct ipv6hdr);
++ u16 offset = skb->h.raw - skb->nh.raw;
+ struct ipv6hdr *hdr = skb->nh.ipv6h;
+- struct ipv6_opt_hdr *exthdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
+- u8 nexthdr = skb->nh.ipv6h->nexthdr;
++ struct ipv6_opt_hdr *exthdr;
++ u8 nexthdr = skb->nh.raw[IP6CB(skb)->nhoff];
+
+ memset(fl, 0, sizeof(struct flowi));
+ ipv6_addr_copy(&fl->fl6_dst, &hdr->daddr);
+ ipv6_addr_copy(&fl->fl6_src, &hdr->saddr);
+
+ while (pskb_may_pull(skb, skb->nh.raw + offset + 1 - skb->data)) {
++ exthdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
++
+ switch (nexthdr) {
+ case NEXTHDR_ROUTING:
+ case NEXTHDR_HOP:
+diff -Naur linux-2.6.16/net/netfilter/nf_conntrack_netlink.c linux-2.6.16.16/net/netfilter/nf_conntrack_netlink.c
+--- linux-2.6.16/net/netfilter/nf_conntrack_netlink.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/net/netfilter/nf_conntrack_netlink.c 2006-05-11 04:56:24.000000000 +0300
+@@ -1641,7 +1641,7 @@
+ printk("ctnetlink: unregistering from nfnetlink.\n");
+
+ #ifdef CONFIG_NF_CONNTRACK_EVENTS
+- nf_conntrack_unregister_notifier(&ctnl_notifier_exp);
++ nf_conntrack_expect_unregister_notifier(&ctnl_notifier_exp);
+ nf_conntrack_unregister_notifier(&ctnl_notifier);
+ #endif
+
+diff -Naur linux-2.6.16/net/netfilter/nf_conntrack_proto_sctp.c linux-2.6.16.16/net/netfilter/nf_conntrack_proto_sctp.c
+--- linux-2.6.16/net/netfilter/nf_conntrack_proto_sctp.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/net/netfilter/nf_conntrack_proto_sctp.c 2006-05-11 04:56:24.000000000 +0300
+@@ -240,12 +240,15 @@
+ flag = 1;
+ }
+
+- /* Cookie Ack/Echo chunks not the first OR
+- Init / Init Ack / Shutdown compl chunks not the only chunks */
+- if ((sch->type == SCTP_CID_COOKIE_ACK
++ /*
++ * Cookie Ack/Echo chunks not the first OR
++ * Init / Init Ack / Shutdown compl chunks not the only chunks
++ * OR zero-length.
++ */
++ if (((sch->type == SCTP_CID_COOKIE_ACK
+ || sch->type == SCTP_CID_COOKIE_ECHO
+ || flag)
+- && count !=0 ) {
++ && count !=0) || !sch->length) {
+ DEBUGP("Basic checks failed\n");
+ return 1;
+ }
+diff -Naur linux-2.6.16/net/sctp/inqueue.c linux-2.6.16.16/net/sctp/inqueue.c
+--- linux-2.6.16/net/sctp/inqueue.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/net/sctp/inqueue.c 2006-05-11 04:56:24.000000000 +0300
+@@ -149,6 +149,7 @@
+ /* This is the first chunk in the packet. */
+ chunk->singleton = 1;
+ ch = (sctp_chunkhdr_t *) chunk->skb->data;
++ chunk->data_accepted = 0;
+ }
+
+ chunk->chunk_hdr = ch;
+diff -Naur linux-2.6.16/net/sctp/sm_statefuns.c linux-2.6.16.16/net/sctp/sm_statefuns.c
+--- linux-2.6.16/net/sctp/sm_statefuns.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/net/sctp/sm_statefuns.c 2006-05-11 04:56:24.000000000 +0300
+@@ -636,8 +636,9 @@
+ */
+ chunk->subh.cookie_hdr =
+ (struct sctp_signed_cookie *)chunk->skb->data;
+- skb_pull(chunk->skb,
+- ntohs(chunk->chunk_hdr->length) - sizeof(sctp_chunkhdr_t));
++ if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
++ sizeof(sctp_chunkhdr_t)))
++ goto nomem;
+
+ /* 5.1 D) Upon reception of the COOKIE ECHO chunk, Endpoint
+ * "Z" will reply with a COOKIE ACK chunk after building a TCB
+@@ -965,7 +966,8 @@
+ */
+ chunk->subh.hb_hdr = (sctp_heartbeathdr_t *) chunk->skb->data;
+ paylen = ntohs(chunk->chunk_hdr->length) - sizeof(sctp_chunkhdr_t);
+- skb_pull(chunk->skb, paylen);
++ if (!pskb_pull(chunk->skb, paylen))
++ goto nomem;
+
+ reply = sctp_make_heartbeat_ack(asoc, chunk,
+ chunk->subh.hb_hdr, paylen);
+@@ -1860,8 +1862,9 @@
+ * are in good shape.
+ */
+ chunk->subh.cookie_hdr = (struct sctp_signed_cookie *)chunk->skb->data;
+- skb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
+- sizeof(sctp_chunkhdr_t));
++ if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
++ sizeof(sctp_chunkhdr_t)))
++ goto nomem;
+
+ /* In RFC 2960 5.2.4 3, if both Verification Tags in the State Cookie
+ * of a duplicate COOKIE ECHO match the Verification Tags of the
+@@ -5151,7 +5154,9 @@
+ int tmp;
+ __u32 tsn;
+ int account_value;
++ struct sctp_tsnmap *map = (struct sctp_tsnmap *)&asoc->peer.tsn_map;
+ struct sock *sk = asoc->base.sk;
++ int rcvbuf_over = 0;
+
+ data_hdr = chunk->subh.data_hdr = (sctp_datahdr_t *)chunk->skb->data;
+ skb_pull(chunk->skb, sizeof(sctp_datahdr_t));
+@@ -5162,10 +5167,16 @@
+ /* ASSERT: Now skb->data is really the user data. */
+
+ /*
+- * if we are established, and we have used up our receive
+- * buffer memory, drop the frame
++ * If we are established, and we have used up our receive buffer
++ * memory, think about droping the frame.
++ * Note that we have an opportunity to improve performance here.
++ * If we accept one chunk from an skbuff, we have to keep all the
++ * memory of that skbuff around until the chunk is read into user
++ * space. Therefore, once we accept 1 chunk we may as well accept all
++ * remaining chunks in the skbuff. The data_accepted flag helps us do
++ * that.
+ */
+- if (asoc->state == SCTP_STATE_ESTABLISHED) {
++ if ((asoc->state == SCTP_STATE_ESTABLISHED) && (!chunk->data_accepted)) {
+ /*
+ * If the receive buffer policy is 1, then each
+ * association can allocate up to sk_rcvbuf bytes
+@@ -5176,9 +5187,25 @@
+ account_value = atomic_read(&asoc->rmem_alloc);
+ else
+ account_value = atomic_read(&sk->sk_rmem_alloc);
+-
+- if (account_value > sk->sk_rcvbuf)
+- return SCTP_IERROR_IGNORE_TSN;
++ if (account_value > sk->sk_rcvbuf) {
++ /*
++ * We need to make forward progress, even when we are
++ * under memory pressure, so we always allow the
++ * next tsn after the ctsn ack point to be accepted.
++ * This lets us avoid deadlocks in which we have to
++ * drop frames that would otherwise let us drain the
++ * receive queue.
++ */
++ if ((sctp_tsnmap_get_ctsn(map) + 1) != tsn)
++ return SCTP_IERROR_IGNORE_TSN;
++
++ /*
++ * We're going to accept the frame but we should renege
++ * to make space for it. This will send us down that
++ * path later in this function.
++ */
++ rcvbuf_over = 1;
++ }
+ }
+
+ /* Process ECN based congestion.
+@@ -5226,6 +5253,7 @@
+ datalen -= sizeof(sctp_data_chunk_t);
+
+ deliver = SCTP_CMD_CHUNK_ULP;
++ chunk->data_accepted = 1;
+
+ /* Think about partial delivery. */
+ if ((datalen >= asoc->rwnd) && (!asoc->ulpq.pd_mode)) {
+@@ -5242,7 +5270,8 @@
+ * large spill over.
+ */
+ if (!asoc->rwnd || asoc->rwnd_over ||
+- (datalen > asoc->rwnd + asoc->frag_point)) {
++ (datalen > asoc->rwnd + asoc->frag_point) ||
++ rcvbuf_over) {
+
+ /* If this is the next TSN, consider reneging to make
+ * room. Note: Playing nice with a confused sender. A
+@@ -5250,8 +5279,8 @@
+ * space and in the future we may want to detect and
+ * do more drastic reneging.
+ */
+- if (sctp_tsnmap_has_gap(&asoc->peer.tsn_map) &&
+- (sctp_tsnmap_get_ctsn(&asoc->peer.tsn_map) + 1) == tsn) {
++ if (sctp_tsnmap_has_gap(map) &&
++ (sctp_tsnmap_get_ctsn(map) + 1) == tsn) {
+ SCTP_DEBUG_PRINTK("Reneging for tsn:%u\n", tsn);
+ deliver = SCTP_CMD_RENEGE;
+ } else {
+diff -Naur linux-2.6.16/net/sctp/sm_statetable.c linux-2.6.16.16/net/sctp/sm_statetable.c
+--- linux-2.6.16/net/sctp/sm_statetable.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/net/sctp/sm_statetable.c 2006-05-11 04:56:24.000000000 +0300
+@@ -366,9 +366,9 @@
+ /* SCTP_STATE_EMPTY */ \
+ {.fn = sctp_sf_ootb, .name = "sctp_sf_ootb"}, \
+ /* SCTP_STATE_CLOSED */ \
+- {.fn = sctp_sf_bug, .name = "sctp_sf_bug"}, \
++ {.fn = sctp_sf_discard_chunk, .name = "sctp_sf_discard_chunk"}, \
+ /* SCTP_STATE_COOKIE_WAIT */ \
+- {.fn = sctp_sf_bug, .name = "sctp_sf_bug"}, \
++ {.fn = sctp_sf_discard_chunk, .name = "sctp_sf_discard_chunk"}, \
+ /* SCTP_STATE_COOKIE_ECHOED */ \
+ {.fn = sctp_sf_do_ecne, .name = "sctp_sf_do_ecne"}, \
+ /* SCTP_STATE_ESTABLISHED */ \
+@@ -380,7 +380,7 @@
+ /* SCTP_STATE_SHUTDOWN_RECEIVED */ \
+ {.fn = sctp_sf_do_ecne, .name = "sctp_sf_do_ecne"}, \
+ /* SCTP_STATE_SHUTDOWN_ACK_SENT */ \
+- {.fn = sctp_sf_bug, .name = "sctp_sf_bug"}, \
++ {.fn = sctp_sf_discard_chunk, .name = "sctp_sf_discard_chunk"}, \
+ } /* TYPE_SCTP_ECN_ECNE */
+
+ #define TYPE_SCTP_ECN_CWR { \
+@@ -401,7 +401,7 @@
+ /* SCTP_STATE_SHUTDOWN_RECEIVED */ \
+ {.fn = sctp_sf_discard_chunk, .name = "sctp_sf_discard_chunk"}, \
+ /* SCTP_STATE_SHUTDOWN_ACK_SENT */ \
+- {.fn = sctp_sf_bug, .name = "sctp_sf_bug"}, \
++ {.fn = sctp_sf_discard_chunk, .name = "sctp_sf_discard_chunk"}, \
+ } /* TYPE_SCTP_ECN_CWR */
+
+ #define TYPE_SCTP_SHUTDOWN_COMPLETE { \
+@@ -647,7 +647,7 @@
+ /* SCTP_STATE_EMPTY */ \
+ {.fn = sctp_sf_bug, .name = "sctp_sf_bug"}, \
+ /* SCTP_STATE_CLOSED */ \
+- {.fn = sctp_sf_bug, .name = "sctp_sf_bug"}, \
++ {.fn = sctp_sf_error_closed, .name = "sctp_sf_error_closed"}, \
+ /* SCTP_STATE_COOKIE_WAIT */ \
+ {.fn = sctp_sf_do_prm_requestheartbeat, \
+ .name = "sctp_sf_do_prm_requestheartbeat"}, \
+diff -Naur linux-2.6.16/net/sctp/ulpqueue.c linux-2.6.16.16/net/sctp/ulpqueue.c
+--- linux-2.6.16/net/sctp/ulpqueue.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/net/sctp/ulpqueue.c 2006-05-11 04:56:24.000000000 +0300
+@@ -279,6 +279,7 @@
+ static struct sctp_ulpevent *sctp_make_reassembled_event(struct sk_buff_head *queue, struct sk_buff *f_frag, struct sk_buff *l_frag)
+ {
+ struct sk_buff *pos;
++ struct sk_buff *new = NULL;
+ struct sctp_ulpevent *event;
+ struct sk_buff *pnext, *last;
+ struct sk_buff *list = skb_shinfo(f_frag)->frag_list;
+@@ -297,11 +298,33 @@
+ */
+ if (last)
+ last->next = pos;
+- else
+- skb_shinfo(f_frag)->frag_list = pos;
++ else {
++ if (skb_cloned(f_frag)) {
++ /* This is a cloned skb, we can't just modify
++ * the frag_list. We need a new skb to do that.
++ * Instead of calling skb_unshare(), we'll do it
++ * ourselves since we need to delay the free.
++ */
++ new = skb_copy(f_frag, GFP_ATOMIC);
++ if (!new)
++ return NULL; /* try again later */
++
++ new->sk = f_frag->sk;
++
++ skb_shinfo(new)->frag_list = pos;
++ } else
++ skb_shinfo(f_frag)->frag_list = pos;
++ }
+
+ /* Remove the first fragment from the reassembly queue. */
+ __skb_unlink(f_frag, queue);
++
++ /* if we did unshare, then free the old skb and re-assign */
++ if (new) {
++ kfree_skb(f_frag);
++ f_frag = new;
++ }
++
+ while (pos) {
+
+ pnext = pos->next;
+diff -Naur linux-2.6.16/security/keys/key.c linux-2.6.16.16/security/keys/key.c
+--- linux-2.6.16/security/keys/key.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/security/keys/key.c 2006-05-11 04:56:24.000000000 +0300
+@@ -785,6 +785,10 @@
+
+ key_check(keyring);
+
++ key_ref = ERR_PTR(-ENOTDIR);
++ if (keyring->type != &key_type_keyring)
++ goto error_2;
++
+ down_write(&keyring->sem);
+
+ /* if we're going to allocate a new key, we're going to have
+diff -Naur linux-2.6.16/security/keys/keyring.c linux-2.6.16.16/security/keys/keyring.c
+--- linux-2.6.16/security/keys/keyring.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/security/keys/keyring.c 2006-05-11 04:56:24.000000000 +0300
+@@ -437,6 +437,7 @@
+ /*
+ * search the given keyring only (no recursion)
+ * - keyring must be locked by caller
++ * - caller must guarantee that the keyring is a keyring
+ */
+ key_ref_t __keyring_search_one(key_ref_t keyring_ref,
+ const struct key_type *ktype,
+diff -Naur linux-2.6.16/security/selinux/ss/mls.c linux-2.6.16.16/security/selinux/ss/mls.c
+--- linux-2.6.16/security/selinux/ss/mls.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/security/selinux/ss/mls.c 2006-05-11 04:56:24.000000000 +0300
+@@ -264,7 +264,7 @@
+
+ if (!selinux_mls_enabled) {
+ if (def_sid != SECSID_NULL && oldc)
+- *scontext += strlen(*scontext);
++ *scontext += strlen(*scontext)+1;
+ return 0;
+ }
+
+diff -Naur linux-2.6.16/sound/isa/opti9xx/opti92x-ad1848.c linux-2.6.16.16/sound/isa/opti9xx/opti92x-ad1848.c
+--- linux-2.6.16/sound/isa/opti9xx/opti92x-ad1848.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/sound/isa/opti9xx/opti92x-ad1848.c 2006-05-11 04:56:24.000000000 +0300
+@@ -2088,9 +2088,11 @@
+ int error;
+ struct platform_device *device;
+
++#ifdef CONFIG_PNP
+ pnp_register_card_driver(&opti9xx_pnpc_driver);
+ if (snd_opti9xx_pnp_is_probed)
+ return 0;
++#endif
+ if (! is_isapnp_selected()) {
+ error = platform_driver_register(&snd_opti9xx_driver);
+ if (error < 0)
+@@ -2102,7 +2104,9 @@
+ }
+ platform_driver_unregister(&snd_opti9xx_driver);
+ }
++#ifdef CONFIG_PNP
+ pnp_unregister_card_driver(&opti9xx_pnpc_driver);
++#endif
+ #ifdef MODULE
+ printk(KERN_ERR "no OPTi " CHIP_NAME " soundcard found\n");
+ #endif
+@@ -2115,7 +2119,9 @@
+ platform_device_unregister(snd_opti9xx_platform_device);
+ platform_driver_unregister(&snd_opti9xx_driver);
+ }
++#ifdef CONFIG_PNP
+ pnp_unregister_card_driver(&opti9xx_pnpc_driver);
++#endif
+ }
+
+ module_init(alsa_card_opti9xx_init)
+diff -Naur linux-2.6.16/sound/oss/dmasound/tas_common.c linux-2.6.16.16/sound/oss/dmasound/tas_common.c
+--- linux-2.6.16/sound/oss/dmasound/tas_common.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/sound/oss/dmasound/tas_common.c 2006-05-11 04:56:24.000000000 +0300
+@@ -195,8 +195,8 @@
+
+ printk(KERN_INFO "tas driver [%s])\n", driver_name);
+
+-#ifndef CONFIG_I2C_KEYWEST
+- request_module("i2c-keywest");
++#ifndef CONFIG_I2C_POWERMAC
++ request_module("i2c-powermac");
+ #endif
+ tas_node = find_devices("deq");
+ if (tas_node == NULL)
+diff -Naur linux-2.6.16/sound/pci/hda/patch_realtek.c linux-2.6.16.16/sound/pci/hda/patch_realtek.c
+--- linux-2.6.16/sound/pci/hda/patch_realtek.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/sound/pci/hda/patch_realtek.c 2006-05-11 04:56:24.000000000 +0300
+@@ -2948,6 +2948,8 @@
+ { .modelname = "basic", .config = ALC260_BASIC },
+ { .pci_subvendor = 0x104d, .pci_subdevice = 0x81bb,
+ .config = ALC260_BASIC }, /* Sony VAIO */
++ { .pci_subvendor = 0x152d, .pci_subdevice = 0x0729,
++ .config = ALC260_BASIC }, /* CTL Travel Master U553W */
+ { .modelname = "hp", .config = ALC260_HP },
+ { .pci_subvendor = 0x103c, .pci_subdevice = 0x3010, .config = ALC260_HP },
+ { .pci_subvendor = 0x103c, .pci_subdevice = 0x3011, .config = ALC260_HP },
+diff -Naur linux-2.6.16/sound/ppc/daca.c linux-2.6.16.16/sound/ppc/daca.c
+--- linux-2.6.16/sound/ppc/daca.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/sound/ppc/daca.c 2006-05-11 04:56:24.000000000 +0300
+@@ -256,7 +256,7 @@
+
+ #ifdef CONFIG_KMOD
+ if (current->fs->root)
+- request_module("i2c-keywest");
++ request_module("i2c-powermac");
+ #endif /* CONFIG_KMOD */
+
+ mix = kmalloc(sizeof(*mix), GFP_KERNEL);
+diff -Naur linux-2.6.16/sound/ppc/tumbler.c linux-2.6.16.16/sound/ppc/tumbler.c
+--- linux-2.6.16/sound/ppc/tumbler.c 2006-03-20 07:53:29.000000000 +0200
++++ linux-2.6.16.16/sound/ppc/tumbler.c 2006-05-11 04:56:24.000000000 +0300
+@@ -1314,7 +1314,7 @@
+
+ #ifdef CONFIG_KMOD
+ if (current->fs->root)
+- request_module("i2c-keywest");
++ request_module("i2c-powermac");
+ #endif /* CONFIG_KMOD */
+
+ mix = kmalloc(sizeof(*mix), GFP_KERNEL);
--- /dev/null
+Index: linux-2.6.16/arch/arm/boot/compressed/misc.c
+===================================================================
+--- linux-2.6.16.orig/arch/arm/boot/compressed/misc.c 2006-03-20 06:53:29.000000000 +0100
++++ linux-2.6.16/arch/arm/boot/compressed/misc.c 2007-04-12 10:36:19.000000000 +0200
+@@ -22,6 +22,19 @@
+
+ #include <asm/arch/uncompress.h>
+
++#include <linux/autoconf.h>
++
++#ifdef CONFIG_EFB_DEBUG
++# define SCREEN_W 240
++# define SCREEN_H 320
++#endif
++
++
++static unsigned short *vram = 0;
++static unsigned int current_pix = 0;
++static unsigned int y = 0;
++
++
+ #ifdef STANDALONE_DEBUG
+ #define putstr printf
+ #endif
+@@ -260,6 +273,38 @@
+ return inbuf[0];
+ }
+
++#ifdef CONFIG_EFB_DEBUG
++/*
++ * put a new pixel. on the frame buffer
++ */
++static void putpix(void)
++{
++ if (current_pix == SCREEN_W) {
++ current_pix = 0;
++ }
++ vram[current_pix] = 0xFFFF;
++ ++current_pix;
++ vram[current_pix] = 0x0;
++ ++current_pix;
++}
++
++/*
++ * clear the whole screen
++ */
++static void clear_screen(void)
++{
++ unsigned int i;
++
++ vram = (unsigned short *)0x20001020;
++ current_pix = 0;
++
++ for (i = 0; i < SCREEN_W * SCREEN_H; ++i) {
++ vram[i] = 0;
++ }
++}
++#endif
++
++
+ /* ===========================================================================
+ * Write the output window window[0..outcnt-1] and update crc and bytes_out.
+ * (Used for the decompressed data only.)
+@@ -280,7 +325,8 @@
+ bytes_out += (ulg)outcnt;
+ output_ptr += (ulg)outcnt;
+ outcnt = 0;
+- putstr(".");
++/* putstr("."); */
++ putpix();
+ }
+
+ #ifndef arch_error
+@@ -291,7 +337,7 @@
+ {
+ arch_error(x);
+
+- putstr("\n\n");
++/* putstr("\n\n"); */
+ putstr(x);
+ putstr("\n\n -- System halted");
+
+@@ -309,12 +355,16 @@
+ free_mem_ptr_end = free_mem_ptr_end_p;
+ __machine_arch_type = arch_id;
+
++#ifdef CONFIG_EFB_DEBUG
++ clear_screen();
++#endif
++
+ arch_decomp_setup();
+
+ makecrc();
+- putstr("Uncompressing Linux...");
++/* putstr("Uncompressing Linux..."); */
+ gunzip();
+- putstr(" done, booting the kernel.\n");
++/* putstr(" done, booting the kernel.\n"); */
+ return output_ptr;
+ }
+ #else
+Index: linux-2.6.16/arch/arm/configs/tornado_ccboot_defconfig
+===================================================================
+--- /dev/null 1970-01-01 00:00:00.000000000 +0000
++++ linux-2.6.16/arch/arm/configs/tornado_ccboot_defconfig 2007-04-12 10:36:19.000000000 +0200
+@@ -0,0 +1,797 @@
++#
++# Automatically generated make config: don't edit
++# Linux kernel version: 2.6.16.2-omap1
++# Tue Aug 1 01:17:51 2006
++#
++CONFIG_ARM=y
++CONFIG_MMU=y
++CONFIG_RWSEM_GENERIC_SPINLOCK=y
++CONFIG_GENERIC_CALIBRATE_DELAY=y
++
++#
++# Code maturity level options
++#
++CONFIG_EXPERIMENTAL=y
++CONFIG_BROKEN_ON_SMP=y
++CONFIG_LOCK_KERNEL=y
++CONFIG_INIT_ENV_ARG_LIMIT=32
++
++#
++# General setup
++#
++CONFIG_LOCALVERSION=""
++CONFIG_LOCALVERSION_AUTO=y
++CONFIG_SWAP=y
++# CONFIG_SYSVIPC is not set
++# CONFIG_POSIX_MQUEUE is not set
++# CONFIG_BSD_PROCESS_ACCT is not set
++# CONFIG_SYSCTL is not set
++# CONFIG_AUDIT is not set
++# CONFIG_IKCONFIG is not set
++CONFIG_INITRAMFS_SOURCE=""
++CONFIG_UID16=y
++CONFIG_CC_OPTIMIZE_FOR_SIZE=y
++CONFIG_EMBEDDED=y
++# CONFIG_KALLSYMS is not set
++CONFIG_HOTPLUG=y
++# CONFIG_PRINTK is not set
++# CONFIG_BUG is not set
++# CONFIG_ELF_CORE is not set
++# CONFIG_BASE_FULL is not set
++# CONFIG_FUTEX is not set
++# CONFIG_EPOLL is not set
++# CONFIG_SHMEM is not set
++CONFIG_CC_ALIGN_FUNCTIONS=0
++CONFIG_CC_ALIGN_LABELS=0
++CONFIG_CC_ALIGN_LOOPS=0
++CONFIG_CC_ALIGN_JUMPS=0
++CONFIG_SLAB=y
++CONFIG_TINY_SHMEM=y
++CONFIG_BASE_SMALL=1
++# CONFIG_SLOB is not set
++
++#
++# Loadable module support
++#
++# CONFIG_MODULES is not set
++
++#
++# Block layer
++#
++
++#
++# IO Schedulers
++#
++CONFIG_IOSCHED_NOOP=y
++# CONFIG_IOSCHED_AS is not set
++CONFIG_IOSCHED_DEADLINE=y
++# CONFIG_IOSCHED_CFQ is not set
++# CONFIG_DEFAULT_AS is not set
++CONFIG_DEFAULT_DEADLINE=y
++# CONFIG_DEFAULT_CFQ is not set
++# CONFIG_DEFAULT_NOOP is not set
++CONFIG_DEFAULT_IOSCHED="deadline"
++
++#
++# System Type
++#
++# CONFIG_ARCH_CLPS7500 is not set
++# CONFIG_ARCH_CLPS711X is not set
++# CONFIG_ARCH_CO285 is not set
++# CONFIG_ARCH_EBSA110 is not set
++# CONFIG_ARCH_FOOTBRIDGE is not set
++# CONFIG_ARCH_INTEGRATOR is not set
++# CONFIG_ARCH_IOP3XX is not set
++# CONFIG_ARCH_IXP4XX is not set
++# CONFIG_ARCH_IXP2000 is not set
++# CONFIG_ARCH_L7200 is not set
++# CONFIG_ARCH_PXA is not set
++# CONFIG_ARCH_RPC is not set
++# CONFIG_ARCH_SA1100 is not set
++# CONFIG_ARCH_S3C2410 is not set
++# CONFIG_ARCH_SHARK is not set
++# CONFIG_ARCH_LH7A40X is not set
++CONFIG_ARCH_OMAP=y
++# CONFIG_ARCH_VERSATILE is not set
++# CONFIG_ARCH_REALVIEW is not set
++# CONFIG_ARCH_IMX is not set
++# CONFIG_ARCH_H720X is not set
++# CONFIG_ARCH_AAEC2000 is not set
++# CONFIG_ARCH_AT91RM9200 is not set
++
++#
++# TI OMAP Implementations
++#
++CONFIG_ARCH_OMAP_OTG=y
++CONFIG_ARCH_OMAP1=y
++# CONFIG_ARCH_OMAP2 is not set
++
++#
++# OMAP Feature Selections
++#
++# CONFIG_OMAP_RESET_CLOCKS is not set
++# CONFIG_OMAP_BOOT_TAG is not set
++# CONFIG_OMAP_MUX is not set
++CONFIG_OMAP_MPU_TIMER=y
++# CONFIG_OMAP_32K_TIMER is not set
++CONFIG_OMAP_LL_DEBUG_UART1=y
++# CONFIG_OMAP_LL_DEBUG_UART2 is not set
++# CONFIG_OMAP_LL_DEBUG_UART3 is not set
++
++#
++# OMAP Core Type
++#
++CONFIG_ARCH_OMAP730=y
++# CONFIG_ARCH_OMAP15XX is not set
++# CONFIG_ARCH_OMAP16XX is not set
++
++#
++# OMAP Board Type
++#
++# CONFIG_MACH_OMAP_PERSEUS2 is not set
++
++#
++# OMAP CPU Speed
++#
++# CONFIG_OMAP_CLOCKS_SET_BY_BOOTLOADER is not set
++CONFIG_OMAP_ARM_195MHZ=y
++# CONFIG_OMAP_ARM_182MHZ is not set
++# CONFIG_OMAP_ARM_168MHZ is not set
++# CONFIG_OMAP_ARM_120MHZ is not set
++# CONFIG_OMAP_ARM_60MHZ is not set
++# CONFIG_OMAP_ARM_30MHZ is not set
++CONFIG_MACH_TORNADO=y
++CONFIG_EFB_DEBUG=y
++
++#
++# Processor Type
++#
++CONFIG_CPU_32=y
++CONFIG_CPU_ARM926T=y
++CONFIG_CPU_32v5=y
++CONFIG_CPU_ABRT_EV5TJ=y
++CONFIG_CPU_CACHE_VIVT=y
++CONFIG_CPU_COPY_V4WB=y
++CONFIG_CPU_TLB_V4WBI=y
++
++#
++# Processor Features
++#
++# CONFIG_ARM_THUMB is not set
++# CONFIG_CPU_ICACHE_DISABLE is not set
++# CONFIG_CPU_DCACHE_DISABLE is not set
++# CONFIG_CPU_DCACHE_WRITETHROUGH is not set
++# CONFIG_CPU_CACHE_ROUND_ROBIN is not set
++CONFIG_KEXEC=y
++
++#
++# Bus support
++#
++
++#
++# PCCARD (PCMCIA/CardBus) support
++#
++# CONFIG_PCCARD is not set
++
++#
++# Kernel Features
++#
++CONFIG_PREEMPT=y
++# CONFIG_NO_IDLE_HZ is not set
++# CONFIG_AEABI is not set
++# CONFIG_ARCH_DISCONTIGMEM_ENABLE is not set
++CONFIG_SELECT_MEMORY_MODEL=y
++CONFIG_FLATMEM_MANUAL=y
++# CONFIG_DISCONTIGMEM_MANUAL is not set
++# CONFIG_SPARSEMEM_MANUAL is not set
++CONFIG_FLATMEM=y
++CONFIG_FLAT_NODE_MEM_MAP=y
++# CONFIG_SPARSEMEM_STATIC is not set
++CONFIG_SPLIT_PTLOCK_CPUS=4096
++# CONFIG_LEDS is not set
++CONFIG_ALIGNMENT_TRAP=y
++
++#
++# Boot options
++#
++CONFIG_ZBOOT_ROM_TEXT=0x0
++CONFIG_ZBOOT_ROM_BSS=0x0
++CONFIG_CMDLINE=""
++# CONFIG_XIP_KERNEL is not set
++
++#
++# CPU Frequency scaling
++#
++# CONFIG_CPU_FREQ is not set
++
++#
++# Floating point emulation
++#
++
++#
++# At least one emulation must be selected
++#
++CONFIG_FPE_NWFPE=y
++# CONFIG_FPE_NWFPE_XP is not set
++# CONFIG_FPE_FASTFPE is not set
++# CONFIG_VFP is not set
++
++#
++# Userspace binary formats
++#
++CONFIG_BINFMT_ELF=y
++# CONFIG_BINFMT_AOUT is not set
++# CONFIG_BINFMT_MISC is not set
++# CONFIG_ARTHUR is not set
++
++#
++# Power management options
++#
++# CONFIG_PM is not set
++# CONFIG_APM is not set
++
++#
++# Networking
++#
++CONFIG_NET=y
++
++#
++# Networking options
++#
++# CONFIG_NETDEBUG is not set
++CONFIG_PACKET=y
++# CONFIG_PACKET_MMAP is not set
++CONFIG_UNIX=y
++CONFIG_XFRM=y
++# CONFIG_XFRM_USER is not set
++CONFIG_NET_KEY=y
++CONFIG_INET=y
++# CONFIG_IP_MULTICAST is not set
++# CONFIG_IP_ADVANCED_ROUTER is not set
++CONFIG_IP_FIB_HASH=y
++# CONFIG_IP_PNP is not set
++# CONFIG_NET_IPIP is not set
++# CONFIG_NET_IPGRE is not set
++# CONFIG_ARPD is not set
++# CONFIG_SYN_COOKIES is not set
++# CONFIG_INET_AH is not set
++# CONFIG_INET_ESP is not set
++# CONFIG_INET_IPCOMP is not set
++# CONFIG_INET_TUNNEL is not set
++CONFIG_INET_DIAG=y
++CONFIG_INET_TCP_DIAG=y
++# CONFIG_TCP_CONG_ADVANCED is not set
++CONFIG_TCP_CONG_BIC=y
++# CONFIG_IPV6 is not set
++# CONFIG_NETFILTER is not set
++
++#
++# DCCP Configuration (EXPERIMENTAL)
++#
++# CONFIG_IP_DCCP is not set
++
++#
++# SCTP Configuration (EXPERIMENTAL)
++#
++# CONFIG_IP_SCTP is not set
++
++#
++# TIPC Configuration (EXPERIMENTAL)
++#
++# CONFIG_TIPC is not set
++# CONFIG_ATM is not set
++# CONFIG_BRIDGE is not set
++# CONFIG_VLAN_8021Q is not set
++# CONFIG_DECNET is not set
++# CONFIG_LLC2 is not set
++# CONFIG_IPX is not set
++# CONFIG_ATALK is not set
++# CONFIG_X25 is not set
++# CONFIG_LAPB is not set
++# CONFIG_NET_DIVERT is not set
++# CONFIG_ECONET is not set
++# CONFIG_WAN_ROUTER is not set
++
++#
++# QoS and/or fair queueing
++#
++# CONFIG_NET_SCHED is not set
++
++#
++# Network testing
++#
++# CONFIG_NET_PKTGEN is not set
++# CONFIG_HAMRADIO is not set
++# CONFIG_IRDA is not set
++# CONFIG_BT is not set
++# CONFIG_IEEE80211 is not set
++
++#
++# Device Drivers
++#
++
++#
++# Generic Driver Options
++#
++CONFIG_STANDALONE=y
++CONFIG_PREVENT_FIRMWARE_BUILD=y
++CONFIG_FW_LOADER=y
++# CONFIG_DEBUG_DRIVER is not set
++
++#
++# Connector - unified userspace <-> kernelspace linker
++#
++# CONFIG_CONNECTOR is not set
++
++#
++# Memory Technology Devices (MTD)
++#
++# CONFIG_MTD is not set
++
++#
++# Parallel port support
++#
++# CONFIG_PARPORT is not set
++
++#
++# Plug and Play support
++#
++
++#
++# Block devices
++#
++# CONFIG_BLK_DEV_COW_COMMON is not set
++# CONFIG_BLK_DEV_LOOP is not set
++# CONFIG_BLK_DEV_NBD is not set
++CONFIG_BLK_DEV_RAM=y
++CONFIG_BLK_DEV_RAM_COUNT=1
++CONFIG_BLK_DEV_RAM_SIZE=4096
++CONFIG_BLK_DEV_INITRD=y
++# CONFIG_CDROM_PKTCDVD is not set
++# CONFIG_ATA_OVER_ETH is not set
++
++#
++# SCSI device support
++#
++# CONFIG_RAID_ATTRS is not set
++# CONFIG_SCSI is not set
++
++#
++# Multi-device support (RAID and LVM)
++#
++# CONFIG_MD is not set
++
++#
++# Fusion MPT device support
++#
++# CONFIG_FUSION is not set
++
++#
++# IEEE 1394 (FireWire) support
++#
++
++#
++# I2O device support
++#
++
++#
++# Network device support
++#
++# CONFIG_NETDEVICES is not set
++# CONFIG_DUMMY is not set
++# CONFIG_BONDING is not set
++# CONFIG_EQUALIZER is not set
++# CONFIG_TUN is not set
++
++#
++# PHY device support
++#
++
++#
++# Ethernet (10 or 100Mbit)
++#
++# CONFIG_NET_ETHERNET is not set
++
++#
++# Ethernet (1000 Mbit)
++#
++
++#
++# Ethernet (10000 Mbit)
++#
++# CONFIG_PPP is not set
++# CONFIG_SLIP is not set
++# CONFIG_SHAPER is not set
++# CONFIG_NETCONSOLE is not set
++# CONFIG_NETPOLL is not set
++# CONFIG_NET_POLL_CONTROLLER is not set
++
++#
++# ISDN subsystem
++#
++# CONFIG_ISDN is not set
++
++#
++# Input device support
++#
++CONFIG_INPUT=y
++
++#
++# Userland interfaces
++#
++CONFIG_INPUT_MOUSEDEV=y
++# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
++CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
++CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
++# CONFIG_INPUT_JOYDEV is not set
++# CONFIG_INPUT_TSDEV is not set
++# CONFIG_INPUT_EVDEV is not set
++# CONFIG_INPUT_EVBUG is not set
++
++#
++# Input Device Drivers
++#
++CONFIG_INPUT_KEYBOARD=y
++# CONFIG_KEYBOARD_ATKBD is not set
++# CONFIG_KEYBOARD_SUNKBD is not set
++# CONFIG_KEYBOARD_LKKBD is not set
++# CONFIG_KEYBOARD_XTKBD is not set
++# CONFIG_KEYBOARD_NEWTON is not set
++# CONFIG_KEYBOARD_OMAP is not set
++CONFIG_TORNADO_KEYPAD=y
++# CONFIG_INPUT_MOUSE is not set
++# CONFIG_INPUT_JOYSTICK is not set
++# CONFIG_INPUT_TOUCHSCREEN is not set
++# CONFIG_INPUT_MISC is not set
++
++#
++# Hardware I/O ports
++#
++# CONFIG_SERIO is not set
++# CONFIG_GAMEPORT is not set
++
++#
++# Character devices
++#
++CONFIG_VT=y
++CONFIG_VT_CONSOLE=y
++CONFIG_HW_CONSOLE=y
++# CONFIG_SERIAL_NONSTANDARD is not set
++
++#
++# Serial drivers
++#
++# CONFIG_SERIAL_8250 is not set
++
++#
++# Non-8250 serial port support
++#
++CONFIG_UNIX98_PTYS=y
++CONFIG_LEGACY_PTYS=y
++CONFIG_LEGACY_PTY_COUNT=256
++
++#
++# IPMI
++#
++# CONFIG_IPMI_HANDLER is not set
++
++#
++# Watchdog Cards
++#
++CONFIG_WATCHDOG=y
++# CONFIG_WATCHDOG_NOWAYOUT is not set
++
++#
++# Watchdog Device Drivers
++#
++# CONFIG_SOFT_WATCHDOG is not set
++CONFIG_OMAP730_WATCHDOG=y
++CONFIG_TORNADO_VIBRATOR=y
++CONFIG_TORNADO_LEDS=y
++# CONFIG_NVRAM is not set
++# CONFIG_RTC is not set
++# CONFIG_OMAP_RTC is not set
++# CONFIG_DTLK is not set
++# CONFIG_R3964 is not set
++
++#
++# Ftape, the floppy tape device driver
++#
++# CONFIG_RAW_DRIVER is not set
++
++#
++# TPM devices
++#
++# CONFIG_TCG_TPM is not set
++# CONFIG_TELCLOCK is not set
++
++#
++# I2C support
++#
++# CONFIG_I2C is not set
++
++#
++# SPI support
++#
++# CONFIG_SPI is not set
++# CONFIG_SPI_MASTER is not set
++
++#
++# Dallas's 1-wire bus
++#
++# CONFIG_W1 is not set
++
++#
++# Hardware Monitoring support
++#
++# CONFIG_HWMON is not set
++# CONFIG_HWMON_VID is not set
++
++#
++# Misc devices
++#
++
++#
++# Multimedia Capabilities Port drivers
++#
++
++#
++# Multimedia devices
++#
++# CONFIG_VIDEO_DEV is not set
++
++#
++# Digital Video Broadcasting Devices
++#
++# CONFIG_DVB is not set
++
++#
++# Graphics support
++#
++CONFIG_FB=y
++CONFIG_FB_CFB_FILLRECT=y
++CONFIG_FB_CFB_COPYAREA=y
++CONFIG_FB_CFB_IMAGEBLIT=y
++# CONFIG_FB_MACMODES is not set
++# CONFIG_FB_MODE_HELPERS is not set
++# CONFIG_FB_TILEBLITTING is not set
++# CONFIG_FB_S1D13XXX is not set
++# CONFIG_FB_OMAP is not set
++CONFIG_FB_VSFB=y
++# CONFIG_FB_VIRTUAL is not set
++
++#
++# Console display driver support
++#
++# CONFIG_VGA_CONSOLE is not set
++CONFIG_DUMMY_CONSOLE=y
++CONFIG_FRAMEBUFFER_CONSOLE=y
++CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y
++CONFIG_FONTS=y
++# CONFIG_FONT_8x8 is not set
++# CONFIG_FONT_8x16 is not set
++CONFIG_FONT_6x11=y
++# CONFIG_FONT_7x14 is not set
++# CONFIG_FONT_PEARL_8x8 is not set
++# CONFIG_FONT_ACORN_8x8 is not set
++# CONFIG_FONT_MINI_4x6 is not set
++# CONFIG_FONT_SUN8x16 is not set
++# CONFIG_FONT_SUN12x22 is not set
++# CONFIG_FONT_10x18 is not set
++
++#
++# Logo configuration
++#
++# CONFIG_LOGO is not set
++CONFIG_BACKLIGHT_LCD_SUPPORT=y
++CONFIG_BACKLIGHT_CLASS_DEVICE=y
++CONFIG_BACKLIGHT_DEVICE=y
++# CONFIG_LCD_CLASS_DEVICE is not set
++CONFIG_BACKLIGHT_TORNADO=y
++
++#
++# Sound
++#
++# CONFIG_SOUND is not set
++
++#
++# USB support
++#
++CONFIG_USB_ARCH_HAS_HCD=y
++CONFIG_USB_ARCH_HAS_OHCI=y
++# CONFIG_USB is not set
++
++#
++# NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support'
++#
++
++#
++# USB Gadget Support
++#
++CONFIG_USB_GADGET=y
++CONFIG_USB_GADGET_DEBUG_FILES=y
++CONFIG_USB_GADGET_SELECTED=y
++# CONFIG_USB_GADGET_NET2280 is not set
++# CONFIG_USB_GADGET_PXA2XX is not set
++# CONFIG_USB_GADGET_GOKU is not set
++# CONFIG_USB_GADGET_LH7A40X is not set
++CONFIG_USB_GADGET_OMAP=y
++CONFIG_USB_OMAP=y
++# CONFIG_USB_GADGET_DUMMY_HCD is not set
++# CONFIG_USB_GADGET_DUALSPEED is not set
++# CONFIG_USB_ZERO is not set
++CONFIG_USB_ETH=y
++# CONFIG_USB_ETH_RNDIS is not set
++# CONFIG_USB_GADGETFS is not set
++# CONFIG_USB_FILE_STORAGE is not set
++# CONFIG_USB_G_SERIAL is not set
++
++#
++# MMC/SD Card support
++#
++CONFIG_MMC=y
++# CONFIG_MMC_DEBUG is not set
++CONFIG_MMC_BLOCK=y
++# CONFIG_MMC_BLOCK_BROKEN_RFD is not set
++# CONFIG_MMC_BULKTRANSFER is not set
++CONFIG_MMC_OMAP=y
++
++#
++# Synchronous Serial Interfaces (SSI)
++#
++# CONFIG_OMAP_UWIRE is not set
++# CONFIG_OMAP_TSC2101 is not set
++
++#
++# CBUS support
++#
++# CONFIG_CBUS is not set
++
++#
++# File systems
++#
++CONFIG_EXT2_FS=y
++# CONFIG_EXT2_FS_XATTR is not set
++# CONFIG_EXT2_FS_XIP is not set
++# CONFIG_EXT3_FS is not set
++# CONFIG_REISERFS_FS is not set
++# CONFIG_JFS_FS is not set
++# CONFIG_FS_POSIX_ACL is not set
++# CONFIG_XFS_FS is not set
++# CONFIG_OCFS2_FS is not set
++# CONFIG_MINIX_FS is not set
++CONFIG_ROMFS_FS=y
++# CONFIG_INOTIFY is not set
++# CONFIG_QUOTA is not set
++CONFIG_DNOTIFY=y
++# CONFIG_AUTOFS_FS is not set
++# CONFIG_AUTOFS4_FS is not set
++# CONFIG_FUSE_FS is not set
++
++#
++# CD-ROM/DVD Filesystems
++#
++# CONFIG_ISO9660_FS is not set
++# CONFIG_UDF_FS is not set
++
++#
++# DOS/FAT/NT Filesystems
++#
++# CONFIG_MSDOS_FS is not set
++# CONFIG_VFAT_FS is not set
++# CONFIG_NTFS_FS is not set
++
++#
++# Pseudo filesystems
++#
++CONFIG_PROC_FS=y
++CONFIG_SYSFS=y
++# CONFIG_TMPFS is not set
++# CONFIG_HUGETLB_PAGE is not set
++CONFIG_RAMFS=y
++# CONFIG_RELAYFS_FS is not set
++# CONFIG_CONFIGFS_FS is not set
++
++#
++# Miscellaneous filesystems
++#
++# CONFIG_ADFS_FS is not set
++# CONFIG_AFFS_FS is not set
++# CONFIG_HFS_FS is not set
++# CONFIG_HFSPLUS_FS is not set
++# CONFIG_BEFS_FS is not set
++# CONFIG_BFS_FS is not set
++# CONFIG_EFS_FS is not set
++# CONFIG_CRAMFS is not set
++# CONFIG_VXFS_FS is not set
++# CONFIG_HPFS_FS is not set
++# CONFIG_QNX4FS_FS is not set
++# CONFIG_SYSV_FS is not set
++# CONFIG_UFS_FS is not set
++
++#
++# Network File Systems
++#
++CONFIG_NFS_FS=y
++CONFIG_NFS_V3=y
++# CONFIG_NFS_V3_ACL is not set
++# CONFIG_NFS_V4 is not set
++# CONFIG_NFS_DIRECTIO is not set
++# CONFIG_NFSD is not set
++CONFIG_LOCKD=y
++CONFIG_LOCKD_V4=y
++CONFIG_NFS_COMMON=y
++CONFIG_SUNRPC=y
++# CONFIG_RPCSEC_GSS_KRB5 is not set
++# CONFIG_RPCSEC_GSS_SPKM3 is not set
++# CONFIG_SMB_FS is not set
++# CONFIG_CIFS is not set
++# CONFIG_NCP_FS is not set
++# CONFIG_CODA_FS is not set
++# CONFIG_AFS_FS is not set
++# CONFIG_9P_FS is not set
++
++#
++# Partition Types
++#
++# CONFIG_PARTITION_ADVANCED is not set
++CONFIG_MSDOS_PARTITION=y
++
++#
++# Native Language Support
++#
++# CONFIG_NLS is not set
++
++#
++# Profiling support
++#
++# CONFIG_PROFILING is not set
++
++#
++# Kernel hacking
++#
++# CONFIG_PRINTK_TIME is not set
++# CONFIG_MAGIC_SYSRQ is not set
++CONFIG_DEBUG_KERNEL=y
++CONFIG_LOG_BUF_SHIFT=14
++# CONFIG_DETECT_SOFTLOCKUP is not set
++# CONFIG_SCHEDSTATS is not set
++# CONFIG_DEBUG_SLAB is not set
++CONFIG_DEBUG_PREEMPT=y
++# CONFIG_DEBUG_MUTEXES is not set
++# CONFIG_DEBUG_SPINLOCK is not set
++# CONFIG_DEBUG_SPINLOCK_SLEEP is not set
++# CONFIG_DEBUG_KOBJECT is not set
++# CONFIG_DEBUG_INFO is not set
++# CONFIG_DEBUG_FS is not set
++# CONFIG_DEBUG_VM is not set
++CONFIG_FRAME_POINTER=y
++# CONFIG_FORCED_INLINING is not set
++# CONFIG_RCU_TORTURE_TEST is not set
++# CONFIG_DEBUG_USER is not set
++# CONFIG_DEBUG_WAITQ is not set
++CONFIG_DEBUG_ERRORS=y
++# CONFIG_DEBUG_LL is not set
++
++#
++# Security options
++#
++# CONFIG_KEYS is not set
++# CONFIG_SECURITY is not set
++
++#
++# Cryptographic options
++#
++# CONFIG_CRYPTO is not set
++
++#
++# Hardware crypto devices
++#
++
++#
++# Library routines
++#
++# CONFIG_CRC_CCITT is not set
++# CONFIG_CRC16 is not set
++CONFIG_CRC32=y
++# CONFIG_LIBCRC32C is not set
+Index: linux-2.6.16/arch/arm/configs/tornado_defconfig
+===================================================================
+--- /dev/null 1970-01-01 00:00:00.000000000 +0000
++++ linux-2.6.16/arch/arm/configs/tornado_defconfig 2007-04-12 10:36:19.000000000 +0200
+@@ -0,0 +1,849 @@
++#
++# Automatically generated make config: don't edit
++# Linux kernel version: 2.6.16.9-omap1
++# Tue Mar 20 11:07:50 2007
++#
++CONFIG_ARM=y
++CONFIG_MMU=y
++CONFIG_RWSEM_GENERIC_SPINLOCK=y
++CONFIG_GENERIC_CALIBRATE_DELAY=y
++
++#
++# Code maturity level options
++#
++CONFIG_EXPERIMENTAL=y
++CONFIG_BROKEN_ON_SMP=y
++CONFIG_LOCK_KERNEL=y
++CONFIG_INIT_ENV_ARG_LIMIT=32
++
++#
++# General setup
++#
++CONFIG_LOCALVERSION=""
++CONFIG_LOCALVERSION_AUTO=y
++CONFIG_SWAP=y
++# CONFIG_SYSVIPC is not set
++CONFIG_POSIX_MQUEUE=y
++# CONFIG_BSD_PROCESS_ACCT is not set
++CONFIG_SYSCTL=y
++# CONFIG_AUDIT is not set
++# CONFIG_IKCONFIG is not set
++CONFIG_INITRAMFS_SOURCE=""
++CONFIG_UID16=y
++CONFIG_CC_OPTIMIZE_FOR_SIZE=y
++CONFIG_EMBEDDED=y
++CONFIG_KALLSYMS=y
++# CONFIG_KALLSYMS_ALL is not set
++# CONFIG_KALLSYMS_EXTRA_PASS is not set
++CONFIG_HOTPLUG=y
++CONFIG_PRINTK=y
++CONFIG_BUG=y
++# CONFIG_ELF_CORE is not set
++# CONFIG_BASE_FULL is not set
++CONFIG_FUTEX=y
++CONFIG_EPOLL=y
++CONFIG_SHMEM=y
++CONFIG_CC_ALIGN_FUNCTIONS=0
++CONFIG_CC_ALIGN_LABELS=0
++CONFIG_CC_ALIGN_LOOPS=0
++CONFIG_CC_ALIGN_JUMPS=0
++CONFIG_SLAB=y
++CONFIG_TINY_SHMEM=y
++CONFIG_BASE_SMALL=1
++# CONFIG_SLOB is not set
++
++#
++# Loadable module support
++#
++CONFIG_MODULES=y
++CONFIG_MODULE_UNLOAD=y
++# CONFIG_MODULE_FORCE_UNLOAD is not set
++CONFIG_OBSOLETE_MODPARM=y
++# CONFIG_MODVERSIONS is not set
++# CONFIG_MODULE_SRCVERSION_ALL is not set
++# CONFIG_KMOD is not set
++
++#
++# Block layer
++#
++
++#
++# IO Schedulers
++#
++CONFIG_IOSCHED_NOOP=y
++# CONFIG_IOSCHED_AS is not set
++CONFIG_IOSCHED_DEADLINE=y
++# CONFIG_IOSCHED_CFQ is not set
++# CONFIG_DEFAULT_AS is not set
++CONFIG_DEFAULT_DEADLINE=y
++# CONFIG_DEFAULT_CFQ is not set
++# CONFIG_DEFAULT_NOOP is not set
++CONFIG_DEFAULT_IOSCHED="deadline"
++
++#
++# System Type
++#
++# CONFIG_ARCH_CLPS7500 is not set
++# CONFIG_ARCH_CLPS711X is not set
++# CONFIG_ARCH_CO285 is not set
++# CONFIG_ARCH_EBSA110 is not set
++# CONFIG_ARCH_FOOTBRIDGE is not set
++# CONFIG_ARCH_INTEGRATOR is not set
++# CONFIG_ARCH_IOP3XX is not set
++# CONFIG_ARCH_IXP4XX is not set
++# CONFIG_ARCH_IXP2000 is not set
++# CONFIG_ARCH_L7200 is not set
++# CONFIG_ARCH_PXA is not set
++# CONFIG_ARCH_RPC is not set
++# CONFIG_ARCH_SA1100 is not set
++# CONFIG_ARCH_S3C2410 is not set
++# CONFIG_ARCH_SHARK is not set
++# CONFIG_ARCH_LH7A40X is not set
++CONFIG_ARCH_OMAP=y
++# CONFIG_ARCH_VERSATILE is not set
++# CONFIG_ARCH_REALVIEW is not set
++# CONFIG_ARCH_IMX is not set
++# CONFIG_ARCH_H720X is not set
++# CONFIG_ARCH_AAEC2000 is not set
++# CONFIG_ARCH_AT91RM9200 is not set
++
++#
++# TI OMAP Implementations
++#
++CONFIG_ARCH_OMAP_OTG=y
++CONFIG_ARCH_OMAP1=y
++# CONFIG_ARCH_OMAP2 is not set
++
++#
++# OMAP Feature Selections
++#
++# CONFIG_OMAP_RESET_CLOCKS is not set
++# CONFIG_OMAP_BOOT_TAG is not set
++# CONFIG_OMAP_MUX is not set
++CONFIG_OMAP_MPU_TIMER=y
++# CONFIG_OMAP_32K_TIMER is not set
++CONFIG_OMAP_LL_DEBUG_UART1=y
++# CONFIG_OMAP_LL_DEBUG_UART2 is not set
++# CONFIG_OMAP_LL_DEBUG_UART3 is not set
++
++#
++# OMAP Core Type
++#
++CONFIG_ARCH_OMAP730=y
++# CONFIG_ARCH_OMAP15XX is not set
++# CONFIG_ARCH_OMAP16XX is not set
++
++#
++# OMAP Board Type
++#
++# CONFIG_MACH_OMAP_PERSEUS2 is not set
++
++#
++# OMAP CPU Speed
++#
++# CONFIG_OMAP_CLOCKS_SET_BY_BOOTLOADER is not set
++CONFIG_OMAP_ARM_195MHZ=y
++# CONFIG_OMAP_ARM_182MHZ is not set
++# CONFIG_OMAP_ARM_168MHZ is not set
++# CONFIG_OMAP_ARM_120MHZ is not set
++# CONFIG_OMAP_ARM_60MHZ is not set
++# CONFIG_OMAP_ARM_30MHZ is not set
++CONFIG_MACH_TORNADO=y
++CONFIG_EFB_DEBUG=y
++
++#
++# Processor Type
++#
++CONFIG_CPU_32=y
++CONFIG_CPU_ARM926T=y
++CONFIG_CPU_32v5=y
++CONFIG_CPU_ABRT_EV5TJ=y
++CONFIG_CPU_CACHE_VIVT=y
++CONFIG_CPU_COPY_V4WB=y
++CONFIG_CPU_TLB_V4WBI=y
++
++#
++# Processor Features
++#
++# CONFIG_ARM_THUMB is not set
++# CONFIG_CPU_ICACHE_DISABLE is not set
++# CONFIG_CPU_DCACHE_DISABLE is not set
++# CONFIG_CPU_DCACHE_WRITETHROUGH is not set
++# CONFIG_CPU_CACHE_ROUND_ROBIN is not set
++CONFIG_KEXEC=y
++
++#
++# Bus support
++#
++
++#
++# PCCARD (PCMCIA/CardBus) support
++#
++# CONFIG_PCCARD is not set
++
++#
++# Kernel Features
++#
++CONFIG_PREEMPT=y
++# CONFIG_NO_IDLE_HZ is not set
++# CONFIG_AEABI is not set
++# CONFIG_ARCH_DISCONTIGMEM_ENABLE is not set
++CONFIG_SELECT_MEMORY_MODEL=y
++CONFIG_FLATMEM_MANUAL=y
++# CONFIG_DISCONTIGMEM_MANUAL is not set
++# CONFIG_SPARSEMEM_MANUAL is not set
++CONFIG_FLATMEM=y
++CONFIG_FLAT_NODE_MEM_MAP=y
++# CONFIG_SPARSEMEM_STATIC is not set
++CONFIG_SPLIT_PTLOCK_CPUS=4096
++# CONFIG_LEDS is not set
++CONFIG_ALIGNMENT_TRAP=y
++
++#
++# Boot options
++#
++CONFIG_ZBOOT_ROM_TEXT=0x0
++CONFIG_ZBOOT_ROM_BSS=0x0
++CONFIG_CMDLINE=""
++# CONFIG_XIP_KERNEL is not set
++
++#
++# CPU Frequency scaling
++#
++# CONFIG_CPU_FREQ is not set
++
++#
++# Floating point emulation
++#
++
++#
++# At least one emulation must be selected
++#
++CONFIG_FPE_NWFPE=y
++# CONFIG_FPE_NWFPE_XP is not set
++# CONFIG_FPE_FASTFPE is not set
++# CONFIG_VFP is not set
++
++#
++# Userspace binary formats
++#
++CONFIG_BINFMT_ELF=y
++# CONFIG_BINFMT_AOUT is not set
++# CONFIG_BINFMT_MISC is not set
++# CONFIG_ARTHUR is not set
++
++#
++# Power management options
++#
++CONFIG_PM=y
++CONFIG_PM_LEGACY=y
++# CONFIG_PM_DEBUG is not set
++CONFIG_APM=y
++
++#
++# Networking
++#
++CONFIG_NET=y
++
++#
++# Networking options
++#
++# CONFIG_NETDEBUG is not set
++CONFIG_PACKET=y
++# CONFIG_PACKET_MMAP is not set
++CONFIG_UNIX=y
++CONFIG_XFRM=y
++# CONFIG_XFRM_USER is not set
++CONFIG_NET_KEY=y
++CONFIG_INET=y
++# CONFIG_IP_MULTICAST is not set
++# CONFIG_IP_ADVANCED_ROUTER is not set
++CONFIG_IP_FIB_HASH=y
++# CONFIG_IP_PNP is not set
++# CONFIG_NET_IPIP is not set
++# CONFIG_NET_IPGRE is not set
++# CONFIG_ARPD is not set
++# CONFIG_SYN_COOKIES is not set
++# CONFIG_INET_AH is not set
++# CONFIG_INET_ESP is not set
++# CONFIG_INET_IPCOMP is not set
++# CONFIG_INET_TUNNEL is not set
++CONFIG_INET_DIAG=y
++CONFIG_INET_TCP_DIAG=y
++# CONFIG_TCP_CONG_ADVANCED is not set
++CONFIG_TCP_CONG_BIC=y
++# CONFIG_IPV6 is not set
++# CONFIG_NETFILTER is not set
++
++#
++# DCCP Configuration (EXPERIMENTAL)
++#
++# CONFIG_IP_DCCP is not set
++
++#
++# SCTP Configuration (EXPERIMENTAL)
++#
++# CONFIG_IP_SCTP is not set
++
++#
++# TIPC Configuration (EXPERIMENTAL)
++#
++# CONFIG_TIPC is not set
++# CONFIG_ATM is not set
++# CONFIG_BRIDGE is not set
++# CONFIG_VLAN_8021Q is not set
++# CONFIG_DECNET is not set
++# CONFIG_LLC2 is not set
++# CONFIG_IPX is not set
++# CONFIG_ATALK is not set
++# CONFIG_X25 is not set
++# CONFIG_LAPB is not set
++# CONFIG_NET_DIVERT is not set
++# CONFIG_ECONET is not set
++# CONFIG_WAN_ROUTER is not set
++
++#
++# QoS and/or fair queueing
++#
++# CONFIG_NET_SCHED is not set
++
++#
++# Network testing
++#
++# CONFIG_NET_PKTGEN is not set
++# CONFIG_HAMRADIO is not set
++# CONFIG_IRDA is not set
++# CONFIG_BT is not set
++# CONFIG_IEEE80211 is not set
++
++#
++# Device Drivers
++#
++
++#
++# Generic Driver Options
++#
++CONFIG_STANDALONE=y
++CONFIG_PREVENT_FIRMWARE_BUILD=y
++CONFIG_FW_LOADER=y
++# CONFIG_DEBUG_DRIVER is not set
++
++#
++# Connector - unified userspace <-> kernelspace linker
++#
++# CONFIG_CONNECTOR is not set
++
++#
++# Memory Technology Devices (MTD)
++#
++# CONFIG_MTD is not set
++
++#
++# Parallel port support
++#
++# CONFIG_PARPORT is not set
++
++#
++# Plug and Play support
++#
++
++#
++# Block devices
++#
++# CONFIG_BLK_DEV_COW_COMMON is not set
++# CONFIG_BLK_DEV_LOOP is not set
++# CONFIG_BLK_DEV_NBD is not set
++CONFIG_BLK_DEV_RAM=y
++CONFIG_BLK_DEV_RAM_COUNT=1
++CONFIG_BLK_DEV_RAM_SIZE=4096
++CONFIG_BLK_DEV_INITRD=y
++# CONFIG_CDROM_PKTCDVD is not set
++# CONFIG_ATA_OVER_ETH is not set
++
++#
++# SCSI device support
++#
++# CONFIG_RAID_ATTRS is not set
++# CONFIG_SCSI is not set
++
++#
++# Multi-device support (RAID and LVM)
++#
++# CONFIG_MD is not set
++
++#
++# Fusion MPT device support
++#
++# CONFIG_FUSION is not set
++
++#
++# IEEE 1394 (FireWire) support
++#
++
++#
++# I2O device support
++#
++
++#
++# Network device support
++#
++# CONFIG_NETDEVICES is not set
++# CONFIG_DUMMY is not set
++# CONFIG_BONDING is not set
++# CONFIG_EQUALIZER is not set
++# CONFIG_TUN is not set
++
++#
++# PHY device support
++#
++
++#
++# Ethernet (10 or 100Mbit)
++#
++# CONFIG_NET_ETHERNET is not set
++
++#
++# Ethernet (1000 Mbit)
++#
++
++#
++# Ethernet (10000 Mbit)
++#
++# CONFIG_PPP is not set
++# CONFIG_SLIP is not set
++# CONFIG_SHAPER is not set
++# CONFIG_NETCONSOLE is not set
++# CONFIG_NETPOLL is not set
++# CONFIG_NET_POLL_CONTROLLER is not set
++
++#
++# ISDN subsystem
++#
++# CONFIG_ISDN is not set
++
++#
++# Input device support
++#
++CONFIG_INPUT=y
++
++#
++# Userland interfaces
++#
++CONFIG_INPUT_MOUSEDEV=y
++# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
++CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
++CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
++# CONFIG_INPUT_JOYDEV is not set
++# CONFIG_INPUT_TSDEV is not set
++# CONFIG_INPUT_EVDEV is not set
++# CONFIG_INPUT_EVBUG is not set
++
++#
++# Input Device Drivers
++#
++CONFIG_INPUT_KEYBOARD=y
++# CONFIG_KEYBOARD_ATKBD is not set
++# CONFIG_KEYBOARD_SUNKBD is not set
++# CONFIG_KEYBOARD_LKKBD is not set
++# CONFIG_KEYBOARD_XTKBD is not set
++# CONFIG_KEYBOARD_NEWTON is not set
++# CONFIG_KEYBOARD_OMAP is not set
++CONFIG_TORNADO_KEYPAD=y
++# CONFIG_INPUT_MOUSE is not set
++# CONFIG_INPUT_JOYSTICK is not set
++# CONFIG_INPUT_TOUCHSCREEN is not set
++# CONFIG_INPUT_MISC is not set
++
++#
++# Hardware I/O ports
++#
++# CONFIG_SERIO is not set
++# CONFIG_GAMEPORT is not set
++
++#
++# Character devices
++#
++CONFIG_VT=y
++CONFIG_VT_CONSOLE=y
++CONFIG_HW_CONSOLE=y
++# CONFIG_SERIAL_NONSTANDARD is not set
++
++#
++# Serial drivers
++#
++# CONFIG_SERIAL_8250 is not set
++
++#
++# Non-8250 serial port support
++#
++CONFIG_UNIX98_PTYS=y
++CONFIG_LEGACY_PTYS=y
++CONFIG_LEGACY_PTY_COUNT=256
++
++#
++# IPMI
++#
++# CONFIG_IPMI_HANDLER is not set
++
++#
++# Watchdog Cards
++#
++CONFIG_WATCHDOG=y
++# CONFIG_WATCHDOG_NOWAYOUT is not set
++
++#
++# Watchdog Device Drivers
++#
++# CONFIG_SOFT_WATCHDOG is not set
++CONFIG_OMAP730_WATCHDOG=y
++CONFIG_TORNADO_VIBRATOR=y
++CONFIG_TORNADO_LEDS=y
++# CONFIG_NVRAM is not set
++# CONFIG_RTC is not set
++# CONFIG_OMAP_RTC is not set
++# CONFIG_DTLK is not set
++# CONFIG_R3964 is not set
++
++#
++# Ftape, the floppy tape device driver
++#
++# CONFIG_RAW_DRIVER is not set
++
++#
++# TPM devices
++#
++# CONFIG_TCG_TPM is not set
++# CONFIG_TELCLOCK is not set
++
++#
++# I2C support
++#
++# CONFIG_I2C is not set
++
++#
++# SPI support
++#
++# CONFIG_SPI is not set
++# CONFIG_SPI_MASTER is not set
++
++#
++# Dallas's 1-wire bus
++#
++# CONFIG_W1 is not set
++
++#
++# Hardware Monitoring support
++#
++# CONFIG_HWMON is not set
++# CONFIG_HWMON_VID is not set
++
++#
++# Misc devices
++#
++
++#
++# Multimedia Capabilities Port drivers
++#
++
++#
++# Multimedia devices
++#
++# CONFIG_VIDEO_DEV is not set
++
++#
++# Digital Video Broadcasting Devices
++#
++# CONFIG_DVB is not set
++
++#
++# Graphics support
++#
++CONFIG_FB=y
++CONFIG_FB_CFB_FILLRECT=y
++CONFIG_FB_CFB_COPYAREA=y
++CONFIG_FB_CFB_IMAGEBLIT=y
++# CONFIG_FB_MACMODES is not set
++# CONFIG_FB_MODE_HELPERS is not set
++# CONFIG_FB_TILEBLITTING is not set
++# CONFIG_FB_S1D13XXX is not set
++# CONFIG_FB_OMAP is not set
++CONFIG_FB_VSFB=y
++# CONFIG_FB_VIRTUAL is not set
++
++#
++# Console display driver support
++#
++# CONFIG_VGA_CONSOLE is not set
++CONFIG_DUMMY_CONSOLE=y
++CONFIG_FRAMEBUFFER_CONSOLE=y
++CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y
++CONFIG_FONTS=y
++# CONFIG_FONT_8x8 is not set
++# CONFIG_FONT_8x16 is not set
++CONFIG_FONT_6x11=y
++# CONFIG_FONT_7x14 is not set
++# CONFIG_FONT_PEARL_8x8 is not set
++# CONFIG_FONT_ACORN_8x8 is not set
++# CONFIG_FONT_MINI_4x6 is not set
++# CONFIG_FONT_SUN8x16 is not set
++# CONFIG_FONT_SUN12x22 is not set
++# CONFIG_FONT_10x18 is not set
++
++#
++# Logo configuration
++#
++# CONFIG_LOGO is not set
++CONFIG_BACKLIGHT_LCD_SUPPORT=y
++CONFIG_BACKLIGHT_CLASS_DEVICE=y
++CONFIG_BACKLIGHT_DEVICE=y
++# CONFIG_LCD_CLASS_DEVICE is not set
++CONFIG_BACKLIGHT_TORNADO=y
++
++#
++# Sound
++#
++CONFIG_SOUND=y
++
++#
++# Advanced Linux Sound Architecture
++#
++CONFIG_SND=y
++CONFIG_SND_TIMER=y
++CONFIG_SND_PCM=y
++CONFIG_SND_SEQUENCER=y
++# CONFIG_SND_SEQ_DUMMY is not set
++CONFIG_SND_OSSEMUL=y
++CONFIG_SND_MIXER_OSS=y
++CONFIG_SND_PCM_OSS=y
++CONFIG_SND_SEQUENCER_OSS=y
++# CONFIG_SND_DYNAMIC_MINORS is not set
++CONFIG_SND_SUPPORT_OLD_API=y
++# CONFIG_SND_VERBOSE_PRINTK is not set
++# CONFIG_SND_DEBUG is not set
++
++#
++# Generic devices
++#
++# CONFIG_SND_DUMMY is not set
++# CONFIG_SND_VIRMIDI is not set
++# CONFIG_SND_MTPAV is not set
++# CONFIG_SND_SERIAL_U16550 is not set
++# CONFIG_SND_MPU401 is not set
++
++#
++# ALSA ARM devices
++#
++# CONFIG_SND_OMAP_AIC23 is not set
++# CONFIG_SND_OMAP_TSC2101 is not set
++
++#
++# Open Sound System
++#
++# CONFIG_SOUND_PRIME is not set
++
++#
++# USB support
++#
++CONFIG_USB_ARCH_HAS_HCD=y
++CONFIG_USB_ARCH_HAS_OHCI=y
++# CONFIG_USB is not set
++
++#
++# NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support'
++#
++
++#
++# USB Gadget Support
++#
++CONFIG_USB_GADGET=y
++CONFIG_USB_GADGET_DEBUG_FILES=y
++CONFIG_USB_GADGET_SELECTED=y
++# CONFIG_USB_GADGET_NET2280 is not set
++# CONFIG_USB_GADGET_PXA2XX is not set
++# CONFIG_USB_GADGET_GOKU is not set
++# CONFIG_USB_GADGET_LH7A40X is not set
++CONFIG_USB_GADGET_OMAP=y
++CONFIG_USB_OMAP=y
++# CONFIG_USB_GADGET_DUMMY_HCD is not set
++# CONFIG_USB_GADGET_DUALSPEED is not set
++# CONFIG_USB_ZERO is not set
++CONFIG_USB_ETH=y
++# CONFIG_USB_ETH_RNDIS is not set
++# CONFIG_USB_GADGETFS is not set
++# CONFIG_USB_FILE_STORAGE is not set
++# CONFIG_USB_G_SERIAL is not set
++
++#
++# MMC/SD Card support
++#
++CONFIG_MMC=y
++# CONFIG_MMC_DEBUG is not set
++CONFIG_MMC_BLOCK=y
++# CONFIG_MMC_BLOCK_BROKEN_RFD is not set
++# CONFIG_MMC_BULKTRANSFER is not set
++CONFIG_MMC_OMAP=y
++
++#
++# Synchronous Serial Interfaces (SSI)
++#
++# CONFIG_OMAP_UWIRE is not set
++# CONFIG_OMAP_TSC2101 is not set
++
++#
++# CBUS support
++#
++# CONFIG_CBUS is not set
++
++#
++# File systems
++#
++CONFIG_EXT2_FS=y
++# CONFIG_EXT2_FS_XATTR is not set
++# CONFIG_EXT2_FS_XIP is not set
++# CONFIG_EXT3_FS is not set
++# CONFIG_REISERFS_FS is not set
++# CONFIG_JFS_FS is not set
++# CONFIG_FS_POSIX_ACL is not set
++# CONFIG_XFS_FS is not set
++# CONFIG_OCFS2_FS is not set
++# CONFIG_MINIX_FS is not set
++CONFIG_ROMFS_FS=y
++# CONFIG_INOTIFY is not set
++# CONFIG_QUOTA is not set
++CONFIG_DNOTIFY=y
++# CONFIG_AUTOFS_FS is not set
++# CONFIG_AUTOFS4_FS is not set
++# CONFIG_FUSE_FS is not set
++
++#
++# CD-ROM/DVD Filesystems
++#
++# CONFIG_ISO9660_FS is not set
++# CONFIG_UDF_FS is not set
++
++#
++# DOS/FAT/NT Filesystems
++#
++# CONFIG_MSDOS_FS is not set
++# CONFIG_VFAT_FS is not set
++# CONFIG_NTFS_FS is not set
++
++#
++# Pseudo filesystems
++#
++CONFIG_PROC_FS=y
++CONFIG_SYSFS=y
++# CONFIG_TMPFS is not set
++# CONFIG_HUGETLB_PAGE is not set
++CONFIG_RAMFS=y
++# CONFIG_RELAYFS_FS is not set
++# CONFIG_CONFIGFS_FS is not set
++
++#
++# Miscellaneous filesystems
++#
++# CONFIG_ADFS_FS is not set
++# CONFIG_AFFS_FS is not set
++# CONFIG_HFS_FS is not set
++# CONFIG_HFSPLUS_FS is not set
++# CONFIG_BEFS_FS is not set
++# CONFIG_BFS_FS is not set
++# CONFIG_EFS_FS is not set
++# CONFIG_CRAMFS is not set
++# CONFIG_VXFS_FS is not set
++# CONFIG_HPFS_FS is not set
++# CONFIG_QNX4FS_FS is not set
++# CONFIG_SYSV_FS is not set
++# CONFIG_UFS_FS is not set
++
++#
++# Network File Systems
++#
++CONFIG_NFS_FS=y
++CONFIG_NFS_V3=y
++# CONFIG_NFS_V3_ACL is not set
++# CONFIG_NFS_V4 is not set
++# CONFIG_NFS_DIRECTIO is not set
++# CONFIG_NFSD is not set
++CONFIG_LOCKD=y
++CONFIG_LOCKD_V4=y
++CONFIG_NFS_COMMON=y
++CONFIG_SUNRPC=y
++# CONFIG_RPCSEC_GSS_KRB5 is not set
++# CONFIG_RPCSEC_GSS_SPKM3 is not set
++# CONFIG_SMB_FS is not set
++# CONFIG_CIFS is not set
++# CONFIG_NCP_FS is not set
++# CONFIG_CODA_FS is not set
++# CONFIG_AFS_FS is not set
++# CONFIG_9P_FS is not set
++
++#
++# Partition Types
++#
++# CONFIG_PARTITION_ADVANCED is not set
++CONFIG_MSDOS_PARTITION=y
++
++#
++# Native Language Support
++#
++# CONFIG_NLS is not set
++
++#
++# Profiling support
++#
++# CONFIG_PROFILING is not set
++
++#
++# Kernel hacking
++#
++# CONFIG_PRINTK_TIME is not set
++# CONFIG_MAGIC_SYSRQ is not set
++CONFIG_DEBUG_KERNEL=y
++CONFIG_LOG_BUF_SHIFT=14
++# CONFIG_DETECT_SOFTLOCKUP is not set
++# CONFIG_SCHEDSTATS is not set
++# CONFIG_DEBUG_SLAB is not set
++CONFIG_DEBUG_PREEMPT=y
++# CONFIG_DEBUG_MUTEXES is not set
++# CONFIG_DEBUG_SPINLOCK is not set
++# CONFIG_DEBUG_SPINLOCK_SLEEP is not set
++# CONFIG_DEBUG_KOBJECT is not set
++# CONFIG_DEBUG_BUGVERBOSE is not set
++# CONFIG_DEBUG_INFO is not set
++# CONFIG_DEBUG_FS is not set
++# CONFIG_DEBUG_VM is not set
++CONFIG_FRAME_POINTER=y
++# CONFIG_FORCED_INLINING is not set
++# CONFIG_RCU_TORTURE_TEST is not set
++# CONFIG_DEBUG_USER is not set
++# CONFIG_DEBUG_WAITQ is not set
++CONFIG_DEBUG_ERRORS=y
++# CONFIG_DEBUG_LL is not set
++
++#
++# Security options
++#
++# CONFIG_KEYS is not set
++CONFIG_SECURITY=y
++CONFIG_SECURITY_NETWORK=y
++# CONFIG_SECURITY_NETWORK_XFRM is not set
++# CONFIG_SECURITY_CAPABILITIES is not set
++# CONFIG_SECURITY_SECLVL is not set
++
++#
++# Cryptographic options
++#
++# CONFIG_CRYPTO is not set
++
++#
++# Hardware crypto devices
++#
++
++#
++# Library routines
++#
++# CONFIG_CRC_CCITT is not set
++# CONFIG_CRC16 is not set
++CONFIG_CRC32=y
++# CONFIG_LIBCRC32C is not set
+Index: linux-2.6.16/arch/arm/Kconfig
+===================================================================
+--- linux-2.6.16.orig/arch/arm/Kconfig 2007-04-12 10:36:06.000000000 +0200
++++ linux-2.6.16/arch/arm/Kconfig 2007-04-12 10:36:19.000000000 +0200
+@@ -298,6 +298,23 @@
+ depends on CPU_XSCALE && !XSCALE_PMU_TIMER
+ default y
+
++config KEXEC
++ bool "Kexec system call (EXPERIMENTAL)"
++ depends on EXPERIMENTAL
++ help
++ kexec is a system call that implements the ability to shutdown your
++ current kernel, and to start another kernel. It is like a reboot
++ but it is indepedent of the system firmware. And like a reboot
++ you can start any kernel with it, not just Linux.
++
++ The name comes from the similiarity to the exec system call.
++
++ It is an ongoing process to be certain the hardware in a machine
++ is properly shutdown, so do not be surprised if this code does not
++ initially work for you. It may help to enable device hotplugging
++ support. As of this writing the exact hardware interface is
++ strongly in flux, so no good recommendation can be made.
++
+ endmenu
+
+ source "arch/arm/common/Kconfig"
+Index: linux-2.6.16/arch/arm/kernel/calls.S
+===================================================================
+--- linux-2.6.16.orig/arch/arm/kernel/calls.S 2006-03-20 06:53:29.000000000 +0100
++++ linux-2.6.16/arch/arm/kernel/calls.S 2007-04-12 10:36:19.000000000 +0200
+@@ -198,7 +198,7 @@
+ CALL(sys_sigaltstack_wrapper)
+ CALL(sys_sendfile)
+ CALL(sys_ni_syscall)
+- CALL(sys_ni_syscall)
++ CALL(sys_kexec_load)
+ /* 190 */ CALL(sys_vfork_wrapper)
+ CALL(sys_getrlimit)
+ CALL(sys_mmap2)
+Index: linux-2.6.16/arch/arm/kernel/head.S
+===================================================================
+--- linux-2.6.16.orig/arch/arm/kernel/head.S 2006-03-20 06:53:29.000000000 +0100
++++ linux-2.6.16/arch/arm/kernel/head.S 2007-04-12 10:36:19.000000000 +0200
+@@ -36,6 +36,79 @@
+ #define KERNEL_RAM_ADDR (PAGE_OFFSET + TEXT_OFFSET)
+
+ /*
++ * debug macros, while the MMU is of
++ */
++.macro pix_ok /* blue */
++#ifdef CONFIG_EFB_DEBUG
++ mov r12, #0x0014
++ add r12, r12, #0x00140000
++ str r12, [r11]
++ add r11, r11, #4
++ str r12, [r11]
++ add r11, r11, #4
++ str r12, [r11]
++ add r11, r11, #4
++ str r12, [r11]
++ add r11, r11, #4
++ add r11, r11, #4
++#endif
++.endm
++
++.macro pix_ko /* red */
++#ifdef CONFIG_EFB_DEBUG
++ mov r12, #0xF800
++ add r12, r12, #0xF8000000
++ str r12, [r11]
++ add r11, r11, #4
++ str r12, [r11]
++ add r11, r11, #4
++ str r12, [r11]
++ add r11, r11, #4
++ str r12, [r11]
++ add r11, r11, #4
++ add r11, r11, #4
++#endif
++.endm
++
++.macro pix_ctr /* white */
++#ifdef CONFIG_EFB_DEBUG
++ mov r12, #-1
++ str r12, [r11]
++ add r11, r11, #4
++ str r12, [r11]
++ add r11, r11, #4
++ str r12, [r11]
++ add r11, r11, #4
++ str r12, [r11]
++ add r11, r11, #4
++ add r11, r11, #4
++#endif
++.endm
++
++/*
++ * a more mmu aware code: the frame buffer is mapped at 0xD0001020,
++ * see arch/arm/mach-omap/debug.c
++ */
++.macro pix_mmu /* black pixel */
++#ifdef CONFIG_EFB_DEBUG
++ mov r11, #0xD0000000
++ add r11, r11, #0x1000
++ add r11, r11, #0x20
++/* mov r12, #0x00FF */
++/* add r12, r12, #0x00FF0000 */
++ mov r12, #0
++ str r12, [r11]
++ add r11, r11, #4
++ str r12, [r11]
++ add r11, r11, #4
++ str r12, [r11]
++ add r11, r11, #4
++ str r12, [r11]
++ add r11, r11, #4
++#endif
++.endm
++
++/*
+ * swapper_pg_dir is the virtual address of the initial page table.
+ * We place the page tables 16K below KERNEL_RAM_ADDR. Therefore, we must
+ * make sure that KERNEL_RAM_ADDR is correctly set. Currently, we expect
+@@ -80,14 +153,31 @@
+ __INIT
+ .type stext, %function
+ ENTRY(stext)
++
++ /*
++ * r11 stores the beginning of the VRAM (0x20001020)
++ */
++ mov r11, #0x20000000
++ add r11, r11, #0x1000
++ add r11, r11, #0x20
++
++ pix_ok
++
+ msr cpsr_c, #PSR_F_BIT | PSR_I_BIT | MODE_SVC @ ensure svc mode
+ @ and irqs disabled
+ bl __lookup_processor_type @ r5=procinfo r9=cpuid
+ movs r10, r5 @ invalid processor (r5=0)?
+ beq __error_p @ yes, error 'p'
++
++ pix_ok
++
+ bl __lookup_machine_type @ r5=machinfo
+ movs r8, r5 @ invalid machine (r5=0)?
+ beq __error_a @ yes, error 'a'
++
++ pix_ok
++
++
+ bl __create_page_tables
+
+ /*
+@@ -232,14 +322,22 @@
+ .align 5
+ .type __turn_mmu_on, %function
+ __turn_mmu_on:
++
++ pix_ok
++
+ mov r0, r0
+ mcr p15, 0, r0, c1, c0, 0 @ write control reg
+ mrc p15, 0, r3, c0, c0, 0 @ read id reg
+ mov r3, r3
+ mov r3, r3
++
++ pix_mmu
++
+ mov pc, r13
+
+
++1:
++ b 1b
+
+ /*
+ * Setup the initial page tables. We only setup the barest
+@@ -363,6 +461,18 @@
+ str r3, [r0]
+ #endif
+ #endif
++
++#ifdef CONFIG_EFB_DEBUG
++ /*
++ * map frame buffer from 0x20000000 to 0xD0000000
++ * in order to help debugging
++ */
++ add r0, r4, #0xD0000000 >> 18
++ mov r3, #0x20000000
++ add r3, r3, r7
++ str r3, [r0]
++#endif
++
+ mov pc, lr
+ .ltorg
+
+@@ -380,6 +490,7 @@
+
+ .type __error_p, %function
+ __error_p:
++ pix_ko
+ #ifdef CONFIG_DEBUG_LL
+ adr r0, str_p1
+ bl printascii
+@@ -390,6 +501,7 @@
+
+ .type __error_a, %function
+ __error_a:
++ pix_ko
+ #ifdef CONFIG_DEBUG_LL
+ mov r4, r1 @ preserve machine ID
+ adr r0, str_a1
+Index: linux-2.6.16/arch/arm/kernel/machine_kexec.c
+===================================================================
+--- /dev/null 1970-01-01 00:00:00.000000000 +0000
++++ linux-2.6.16/arch/arm/kernel/machine_kexec.c 2007-04-12 10:36:19.000000000 +0200
+@@ -0,0 +1,77 @@
++/*
++ * machine_kexec.c - handle transition of Linux booting another kernel
++ */
++
++#include <linux/mm.h>
++#include <linux/kexec.h>
++#include <linux/delay.h>
++#include <linux/reboot.h>
++#include <asm/pgtable.h>
++#include <asm/pgalloc.h>
++#include <asm/mmu_context.h>
++#include <asm/io.h>
++#include <asm/cacheflush.h>
++#include <asm/mach-types.h>
++
++const extern unsigned char relocate_new_kernel[];
++const extern unsigned int relocate_new_kernel_size;
++
++extern unsigned long kexec_start_address;
++extern unsigned long kexec_indirection_page;
++extern unsigned long kexec_mach_type;
++
++/*
++ * Provide a dummy crash_notes definition while crash dump arrives to arm.
++ * This prevents breakage of crash_notes attribute in kernel/ksysfs.c.
++ */
++/* note_buf_t *crash_notes; */
++
++int machine_kexec_prepare(struct kimage *image)
++{
++ return 0;
++}
++
++void machine_kexec_cleanup(struct kimage *image)
++{
++}
++
++void machine_shutdown(void)
++{
++}
++
++void machine_crash_shutdown(struct pt_regs *regs)
++{
++}
++
++void machine_kexec(struct kimage *image)
++{
++ unsigned long page_list;
++ unsigned long reboot_code_buffer_phys;
++ void *reboot_code_buffer;
++
++
++ page_list = image->head & PAGE_MASK;
++
++ /* we need both effective and real address here */
++ reboot_code_buffer_phys =
++ page_to_pfn(image->control_code_page) << PAGE_SHIFT;
++ reboot_code_buffer = page_address(image->control_code_page);
++
++ /* Prepare parameters for reboot_code_buffer*/
++ kexec_start_address = image->start;
++ kexec_indirection_page = page_list;
++ kexec_mach_type = machine_arch_type;
++
++ /* copy our kernel relocation code to the control code page */
++ memcpy(reboot_code_buffer,
++ relocate_new_kernel, relocate_new_kernel_size);
++
++
++ flush_icache_range(reboot_code_buffer,
++ reboot_code_buffer + KEXEC_CONTROL_CODE_SIZE);
++ printk(KERN_INFO "Bye!\n");
++
++ cpu_proc_fin();
++ setup_mm_for_reboot(0); /* mode is not used, so just pass 0*/
++ cpu_reset(reboot_code_buffer_phys);
++}
+Index: linux-2.6.16/arch/arm/kernel/Makefile
+===================================================================
+--- linux-2.6.16.orig/arch/arm/kernel/Makefile 2006-03-20 06:53:29.000000000 +0100
++++ linux-2.6.16/arch/arm/kernel/Makefile 2007-04-12 10:36:19.000000000 +0200
+@@ -21,6 +21,7 @@
+ obj-$(CONFIG_PCI) += bios32.o
+ obj-$(CONFIG_SMP) += smp.o
+ obj-$(CONFIG_OABI_COMPAT) += sys_oabi-compat.o
++obj-$(CONFIG_KEXEC) += machine_kexec.o relocate_kernel.o
+
+ obj-$(CONFIG_IWMMXT) += iwmmxt.o
+ AFLAGS_iwmmxt.o := -Wa,-mcpu=iwmmxt
+Index: linux-2.6.16/arch/arm/kernel/relocate_kernel.S
+===================================================================
+--- /dev/null 1970-01-01 00:00:00.000000000 +0000
++++ linux-2.6.16/arch/arm/kernel/relocate_kernel.S 2007-04-12 10:36:19.000000000 +0200
+@@ -0,0 +1,74 @@
++/*
++ * relocate_kernel.S - put the kernel image in place to boot
++ */
++
++#include <asm/kexec.h>
++
++ .globl relocate_new_kernel
++relocate_new_kernel:
++
++ ldr r0,kexec_indirection_page
++ ldr r1,kexec_start_address
++
++
++0: /* top, read another word for the indirection page */
++ ldr r3, [r0],#4
++
++ /* Is it a destination page. Put destination address to r4 */
++ tst r3,#1,0
++ beq 1f
++ bic r4,r3,#1
++ b 0b
++1:
++ /* Is it an indirection page */
++ tst r3,#2,0
++ beq 1f
++ bic r0,r3,#2
++ b 0b
++1:
++
++ /* are we done ? */
++ tst r3,#4,0
++ beq 1f
++ b 2f
++
++1:
++ /* is it source ? */
++ tst r3,#8,0
++ beq 0b
++ bic r3,r3,#8
++ mov r6,#1024
++9:
++ ldr r5,[r3],#4
++ str r5,[r4],#4
++ subs r6,r6,#1
++ bne 9b
++ b 0b
++
++2:
++ /* Jump to relocated kernel */
++ mov lr,r1
++ mov r0,#0
++ ldr r1,kexec_mach_type
++ mov r2,#0
++ mov pc,lr
++
++ .globl kexec_start_address
++kexec_start_address:
++ .long 0x0
++
++ .globl kexec_indirection_page
++kexec_indirection_page:
++ .long 0x0
++
++ .globl kexec_mach_type
++kexec_mach_type:
++ .long 0x0
++
++relocate_new_kernel_end:
++
++ .globl relocate_new_kernel_size
++relocate_new_kernel_size:
++ .long relocate_new_kernel_end - relocate_new_kernel
++
++
+Index: linux-2.6.16/arch/arm/kernel/setup.c
+===================================================================
+--- linux-2.6.16.orig/arch/arm/kernel/setup.c 2006-03-20 06:53:29.000000000 +0100
++++ linux-2.6.16/arch/arm/kernel/setup.c 2007-04-12 10:36:19.000000000 +0200
+@@ -768,6 +768,16 @@
+ memcpy(saved_command_line, from, COMMAND_LINE_SIZE);
+ saved_command_line[COMMAND_LINE_SIZE-1] = '\0';
+ parse_cmdline(cmdline_p, from);
++
++#ifdef CONFIG_EFB_DEBUG
++ /*
++ * paging_init is going to wipe out any section other than the
++ * kernel code and data allocated in head.S so the framebuffer
++ * is going not to be available during paging_init.
++ */
++ efb_disable();
++#endif
++
+ paging_init(&meminfo, mdesc);
+ request_standard_resources(&meminfo, mdesc);
+
+Index: linux-2.6.16/arch/arm/kernel/traps.c
+===================================================================
+--- linux-2.6.16.orig/arch/arm/kernel/traps.c 2006-03-20 06:53:29.000000000 +0100
++++ linux-2.6.16/arch/arm/kernel/traps.c 2007-04-12 10:36:19.000000000 +0200
+@@ -55,10 +55,10 @@
+ void dump_backtrace_entry(unsigned long where, unsigned long from)
+ {
+ #ifdef CONFIG_KALLSYMS
+- printk("[<%08lx>] ", where);
++/* printk("[<%08lx>] ", where); */
+ print_symbol("(%s) ", where);
+- printk("from [<%08lx>] ", from);
+- print_symbol("(%s)\n", from);
++/* printk("from [<%08lx>] ", from); */
++/* print_symbol("(%s)\n", from); */
+ #else
+ printk("Function entered at [<%08lx>] from [<%08lx>]\n", where, from);
+ #endif
+@@ -205,7 +205,7 @@
+
+ printk("Internal error: %s: %x [#%d]\n", str, err, ++die_counter);
+ print_modules();
+- __show_regs(regs);
++/* __show_regs(regs); */
+ printk("Process %s (pid: %d, stack limit = 0x%p)\n",
+ tsk->comm, tsk->pid, thread + 1);
+
+@@ -547,7 +547,7 @@
+ current->pid, current->comm, no);
+ dump_instr(regs);
+ if (user_mode(regs)) {
+- __show_regs(regs);
++/* __show_regs(regs); */
+ c_backtrace(regs->ARM_fp, processor_mode(regs));
+ }
+ }
+Index: linux-2.6.16/arch/arm/lib/backtrace.S
+===================================================================
+--- linux-2.6.16.orig/arch/arm/lib/backtrace.S 2006-03-20 06:53:29.000000000 +0100
++++ linux-2.6.16/arch/arm/lib/backtrace.S 2007-04-12 10:36:19.000000000 +0200
+@@ -103,7 +103,9 @@
+ .align 0
+ 1007: ldr r0, =.Lbad
+ mov r1, frame
++#ifdef CONFIG_PRINTK
+ bl printk
++#endif
+ LOADREGS(fd, sp!, {r4 - r8, pc})
+ .ltorg
+ .previous
+@@ -138,12 +140,16 @@
+ ldr r2, [stack], #-4
+ mov r1, reg
+ adr r0, .Lfp
++#ifdef CONFIG_PRINTK
+ bl printk
++#endif
+ 2: subs reg, reg, #1
+ bpl 1b
+ teq r7, #0
+ adrne r0, .Lcr
++#ifdef CONFIG_PRINTK
+ blne printk
++#endif
+ mov r0, stack
+ LOADREGS(fd, sp!, {instr, reg, stack, r7, pc})
+
+Index: linux-2.6.16/arch/arm/mach-omap1/clock.c
+===================================================================
+--- linux-2.6.16.orig/arch/arm/mach-omap1/clock.c 2007-04-12 10:36:07.000000000 +0200
++++ linux-2.6.16/arch/arm/mach-omap1/clock.c 2007-04-12 10:36:19.000000000 +0200
+@@ -267,11 +267,13 @@
+ if (!ptr->rate)
+ return -EINVAL;
+
++#if 0
+ /*
+ * In most cases we should not need to reprogram DPLL.
+ * Reprogramming the DPLL is tricky, it must be done from SRAM.
+ */
+ omap_sram_reprogram_clock(ptr->dpllctl_val, ptr->ckctl_val);
++#endif
+
+ ck_dpll1.rate = ptr->pll_rate;
+ propagate_rate(&ck_dpll1);
+@@ -774,12 +776,13 @@
+ omap_writew(1, ARM_RSTCT2);
+ omap_writew(0x400, ARM_IDLECT1);
+
++
+ /*
+ * According to OMAP5910 Erratum SYS_DMA_1, bit DMACK_REQ (bit 8)
+ * of the ARM_IDLECT2 register must be set to zero. The power-on
+ * default value of this bit is one.
+ */
+- omap_writew(0x0000, ARM_IDLECT2); /* Turn LCD clock off also */
++ omap_writew(0x0008, ARM_IDLECT2); /* But keep LCD clock active ... */
+
+ /*
+ * Only enable those clocks we will need, let the drivers
+Index: linux-2.6.16/arch/arm/mach-omap1/clock.h
+===================================================================
+--- linux-2.6.16.orig/arch/arm/mach-omap1/clock.h 2007-04-12 10:36:07.000000000 +0200
++++ linux-2.6.16/arch/arm/mach-omap1/clock.h 2007-04-12 10:36:19.000000000 +0200
+@@ -182,7 +182,7 @@
+ static struct clk arm_ck = {
+ .name = "arm_ck",
+ .parent = &ck_dpll1,
+- .flags = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX |
++ .flags = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP730 |
+ CLOCK_IN_OMAP310 | RATE_CKCTL | RATE_PROPAGATES |
+ ALWAYS_ENABLED,
+ .rate_offset = CKCTL_ARMDIV_OFFSET,
+@@ -196,7 +196,7 @@
+ .name = "armper_ck",
+ .parent = &ck_dpll1,
+ .flags = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX |
+- CLOCK_IN_OMAP310 | RATE_CKCTL |
++ CLOCK_IN_OMAP310 | CLOCK_IN_OMAP730 | RATE_CKCTL |
+ CLOCK_IDLE_CONTROL,
+ .enable_reg = (void __iomem *)ARM_IDLECT2,
+ .enable_bit = EN_PERCK,
+@@ -715,6 +715,20 @@
+ .disable = &omap1_clk_disable_generic,
+ };
+
++static struct clk mmc_ck_730 = {
++ .name = "mmc_ck",
++ .id = 3,
++ /* Functional clock is direct from ULPD, interface clock is ARMPER */
++ .parent = &armper_ck.clk,
++ .rate = 48000000,
++ .flags = CLOCK_IN_OMAP730 |
++ RATE_FIXED | ENABLE_REG_32BIT | CLOCK_NO_IDLE_PARENT,
++ .enable_reg = (void __iomem *)SOFT_REQ_REG,
++ .enable_bit = 12,
++ .enable = &omap1_clk_enable_generic,
++ .disable = &omap1_clk_disable_generic,
++};
++
+ static struct clk virtual_ck_mpu = {
+ .name = "mpu",
+ .flags = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX |
+@@ -799,6 +813,7 @@
+ &bclk_1510, &bclk_16xx,
+ &mmc1_ck,
+ &mmc2_ck,
++ &mmc_ck_730,
+ /* Virtual clocks */
+ &virtual_ck_mpu,
+ &i2c_fck,
+Index: linux-2.6.16/arch/arm/mach-omap1/efb.c
+===================================================================
+--- /dev/null 1970-01-01 00:00:00.000000000 +0000
++++ linux-2.6.16/arch/arm/mach-omap1/efb.c 2007-04-12 10:36:19.000000000 +0200
+@@ -0,0 +1,200 @@
++/*
++** efb.c for efb in /home/nico/work/tornado/linux-tornado
++**
++** Made by nico
++** Login <nico@chac.le-poulpe.net>
++**
++** Started on Wed Apr 5 18:55:08 2006 nico
++** Last update Thu May 11 13:50:52 2006 nico
++*/
++
++/*
++ *
++ * early frame buffer debug routines.
++ * Copyright (C) 2006 Nicolas Schichan
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License as
++ * published by the Free Software Foundation; either version 2 of the
++ * License, or (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ * General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
++ * 02110-1301, USA.
++ *
++ */
++
++#include <asm/mach-types.h>
++#include <asm/arch/efb.h>
++
++static void efb_move_screen_up(void);
++static void blit_char(unsigned int x, unsigned int y, char c);
++
++#define PIX16(R, G, B) (((R >> 3) << 11) | ((G >> 2) << 5) | ((B >> 3)))
++
++
++/* 0xD0000000 is where OMAP730_SRAM is mapped by head.S */
++/*
++ * Windows CE seems to have physical frame buffer mapped to
++ * 0x20001020. we try to keep this space available at virtual address
++ * 0xD0001020 during kernel boot. This is strange as this is not page
++ * aligned. However even if I don't know how to do it, there must be a
++ * way to configure the framebuffer location inside the sram.
++ *
++ * TODO: see omap730 TRM.
++ */
++static unsigned short __initdata *vram = (unsigned short *)0xD0001020;
++
++/*
++ * no attribute since it is used by efb_putstr which has no
++ * attribute ...
++ */
++static int enabled = 0;
++
++unsigned int efb_width;
++unsigned int efb_height;
++
++void __init efb_init(void)
++{
++ unsigned int i;
++
++ /*
++ * only htc typhoon is known to have 176x220 screen. all other
++ * machines have 320x240 screens.
++ */
++ if (machine_is_typhoon()) {
++ efb_width = 176;
++ efb_height = 220;
++ } else {
++ efb_width = 240;
++ efb_height = 320;
++ }
++
++ for (i = 0; i < efb_width * efb_height; ++i) {
++ vram[i] = 0;
++ }
++
++ efb_enable();
++}
++
++
++/*
++ * Write a pixel with color (r,g,b) at screen coordinate (x,y)
++ */
++static void __init dbg_pix(int x, int y, int r, int g, int b)
++{
++ unsigned short pix = PIX16(r, g, b);
++
++ vram[y * efb_width + x] = pix;
++}
++
++
++static __initdata int x = 1;
++static __initdata int y = 0;
++
++
++/*
++ * put string s to the frame buffer using the 5x5 font.
++ *
++ * this functions has no __init attribute since it is can be called in printk.
++ */
++void efb_putstr(const char *s)
++{
++ if (enabled == 0)
++ return ;
++
++ while (*s) {
++ if (*s == '\n')
++ goto newline;
++ blit_char(x, y, *s);
++ x += 6;
++
++ if (x + 6 > efb_width) {
++ newline:
++ if (y + 6 > efb_height - 6)
++ efb_move_screen_up();
++ else
++ y += 6;
++ x = 1;
++ }
++ ++s;
++ }
++}
++
++#define NR_LINE (efb_height / 6)
++
++#define FONT_WIDTH 5
++#define FONT_HEIGHT 5
++
++/*
++ * blit a char on the screen at position (x,y)
++ */
++static __init void blit_char(unsigned int x, unsigned int y, char c)
++{
++ const char *cur_font;
++ int i, j;
++
++ /*
++ * do not blit glyph if some part of it are ofscreen.
++ */
++ if (x + FONT_WIDTH > efb_width)
++ return;
++ if (y + FONT_HEIGHT > efb_height)
++ return;
++
++ cur_font = efb_font[(unsigned int)c];
++ for (j= 0; j < FONT_HEIGHT; ++j) {
++ for (i = 0; i < FONT_WIDTH; ++i) {
++ if (cur_font[j * FONT_WIDTH + i])
++ dbg_pix(x + i, y + j, 255, 255, 255);
++ else
++ dbg_pix(x + i, y + j, 0, 0, 0);
++ }
++ }
++}
++
++/*
++ * perform some basic one way scrolling.
++ *
++ * for each line l do
++ * clear line l
++ * break if l is the last line
++ * copy next line over l
++ * done
++ *
++ * It is not possible to scroll back.
++ */
++static void __init efb_move_screen_up(void)
++{
++ int i, k;
++ int start1, start2;
++
++ for (k = 0; 1; ++k) {
++ start1 = efb_width * 6 * k;
++ start2 = efb_width * 6 * (k + 1);
++ /* clear the n current line */
++ for (i = 0; i < 6 * efb_width; ++i)
++ vram[start1 + i] = 0;
++ if (k == NR_LINE - 1)
++ break;
++ /* copy the next line to the current line */
++ for (i = 0; i < 6 * efb_width; ++i)
++ vram[start1 + i] = vram[start2 +i];
++ }
++}
++
++void __init efb_disable(void)
++{
++ enabled = 0;
++}
++
++void __init efb_enable(void)
++{
++ enabled = 1;
++}
+Index: linux-2.6.16/arch/arm/mach-omap1/efb-font5x5.c
+===================================================================
+--- /dev/null 1970-01-01 00:00:00.000000000 +0000
++++ linux-2.6.16/arch/arm/mach-omap1/efb-font5x5.c 2007-04-12 10:36:19.000000000 +0200
+@@ -0,0 +1,982 @@
++
++/*
++ * file generated by makecfont.pl and bmp2c
++ * resources for a simple 5x5 font
++ */
++
++const char efb_font[255][25] = {
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* lpar.bmp */
++ {
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0xFF, 0x00, 0x00, 0x00,
++ 0x00, 0xFF, 0x00, 0x00, 0x00,
++ 0x00, 0xFF, 0x00, 0x00, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ },
++ /* rpar.bmp */
++ {
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0x00, 0x00, 0xFF, 0x00,
++ 0x00, 0x00, 0x00, 0xFF, 0x00,
++ 0x00, 0x00, 0x00, 0xFF, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ },
++ /* star.bmp */
++ {
++ 0xFF, 0x00, 0xFF, 0x00, 0xFF,
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ 0xFF, 0x00, 0xFF, 0x00, 0xFF,
++ },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* dash.bmp */
++ {
++ 0x00, 0x00, 0x00, 0x00, 0x00,
++ 0x00, 0x00, 0x00, 0x00, 0x00,
++ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++ 0x00, 0x00, 0x00, 0x00, 0x00,
++ 0x00, 0x00, 0x00, 0x00, 0x00,
++ },
++ /* dot.bmp */
++ {
++ 0x00, 0x00, 0x00, 0x00, 0x00,
++ 0x00, 0x00, 0x00, 0x00, 0x00,
++ 0x00, 0x00, 0x00, 0x00, 0x00,
++ 0x00, 0x00, 0x00, 0x00, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ },
++ /* slash.bmp */
++ {
++ 0x00, 0x00, 0x00, 0x00, 0xFF,
++ 0x00, 0x00, 0x00, 0xFF, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0xFF, 0x00, 0x00, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0x00,
++ },
++ /* 0.bmp */
++ {
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0xFF, 0xFF,
++ 0xFF, 0x00, 0xFF, 0x00, 0xFF,
++ 0xFF, 0xFF, 0x00, 0x00, 0xFF,
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ },
++ /* 1.bmp */
++ {
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0xFF, 0xFF, 0x00, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ },
++ /* 2.bmp */
++ {
++ 0x00, 0xFF, 0xFF, 0x00, 0x00,
++ 0x00, 0x00, 0x00, 0xFF, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0xFF, 0x00, 0x00, 0x00,
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ },
++ /* 3.bmp */
++ {
++ 0xFF, 0xFF, 0xFF, 0xFF, 0x00,
++ 0x00, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0xFF, 0xFF, 0xFF, 0x00,
++ 0x00, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0xFF, 0xFF, 0xFF, 0x00,
++ },
++ /* 4.bmp */
++ {
++ 0xFF, 0x00, 0xFF, 0x00, 0x00,
++ 0xFF, 0x00, 0xFF, 0x00, 0x00,
++ 0xFF, 0xFF, 0xFF, 0xFF, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ },
++ /* 5.bmp */
++ {
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ 0x00, 0xFF, 0x00, 0x00, 0x00,
++ 0x00, 0xFF, 0xFF, 0x00, 0x00,
++ 0x00, 0x00, 0x00, 0xFF, 0x00,
++ 0x00, 0xFF, 0xFF, 0x00, 0x00,
++ },
++ /* 6.bmp */
++ {
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0x00,
++ 0xFF, 0xFF, 0xFF, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ },
++ /* 7.bmp */
++ {
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ 0x00, 0x00, 0x00, 0xFF, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ },
++ /* 8.bmp */
++ {
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ },
++ /* 9.bmp */
++ {
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0x00, 0xFF, 0xFF, 0xFF, 0xFF,
++ 0x00, 0x00, 0x00, 0x00, 0xFF,
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ },
++ /* ddot.bmp */
++ {
++ 0x00, 0x00, 0x00, 0x00, 0x00,
++ 0x00, 0x00, 0x00, 0x00, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0x00, 0x00, 0x00, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ },
++ /* not available */
++ { 0x00 },
++ /* lchev.bmp */
++ {
++ 0x00, 0x00, 0x00, 0x00, 0xFF,
++ 0x00, 0x00, 0xFF, 0xFF, 0x00,
++ 0xFF, 0xFF, 0x00, 0x00, 0x00,
++ 0x00, 0x00, 0xFF, 0xFF, 0x00,
++ 0x00, 0x00, 0x00, 0x00, 0xFF,
++ },
++ /* eq.bmp */
++ {
++ 0x00, 0x00, 0x00, 0x00, 0x00,
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ 0x00, 0x00, 0x00, 0x00, 0x00,
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ 0x00, 0x00, 0x00, 0x00, 0x00,
++ },
++ /* rchev.bmp */
++ {
++ 0xFF, 0x00, 0x00, 0x00, 0x00,
++ 0x00, 0xFF, 0xFF, 0x00, 0x00,
++ 0x00, 0x00, 0x00, 0xFF, 0xFF,
++ 0x00, 0xFF, 0xFF, 0x00, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0x00,
++ },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* A.bmp */
++ {
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0xFF, 0x00, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ },
++ /* B.bmp */
++ {
++ 0xFF, 0xFF, 0xFF, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0xFF, 0xFF, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0xFF, 0xFF, 0xFF, 0x00,
++ },
++ /* C.bmp */
++ {
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ },
++ /* D.bmp */
++ {
++ 0xFF, 0xFF, 0xFF, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0xFF, 0xFF, 0xFF, 0x00,
++ },
++ /* E.bmp */
++ {
++ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0x00,
++ 0xFF, 0xFF, 0xFF, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0x00,
++ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++ },
++ /* F.bmp */
++ {
++ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0x00,
++ 0xFF, 0xFF, 0xFF, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0x00,
++ },
++ /* G.bmp */
++ {
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0x00,
++ 0xFF, 0x00, 0x00, 0xFF, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ },
++ /* H.bmp */
++ {
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ },
++ /* I.bmp */
++ {
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ },
++ /* J.bmp */
++ {
++ 0x00, 0x00, 0x00, 0x00, 0xFF,
++ 0x00, 0x00, 0x00, 0x00, 0xFF,
++ 0x00, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ },
++ /* K.bmp */
++ {
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0xFF, 0xFF, 0x00,
++ 0xFF, 0xFF, 0x00, 0x00, 0x00,
++ 0xFF, 0x00, 0xFF, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ },
++ /* L.bmp */
++ {
++ 0xFF, 0x00, 0x00, 0x00, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0x00,
++ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++ },
++ /* M.bmp */
++ {
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0xFF, 0x00, 0xFF, 0xFF,
++ 0xFF, 0x00, 0xFF, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ },
++ /* N.bmp */
++ {
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0xFF, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0xFF, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0xFF, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ },
++ /* O.bmp */
++ {
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ },
++ /* P.bmp */
++ {
++ 0xFF, 0xFF, 0xFF, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0xFF, 0xFF, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0x00,
++ },
++ /* Q.bmp */
++ {
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0xFF, 0x00,
++ 0x00, 0xFF, 0xFF, 0x00, 0xFF,
++ },
++ /* R.bmp */
++ {
++ 0xFF, 0xFF, 0xFF, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0xFF, 0xFF, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ },
++ /* S.bmp */
++ {
++ 0x00, 0xFF, 0xFF, 0xFF, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0x00,
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ 0x00, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0xFF, 0xFF, 0xFF, 0x00,
++ },
++ /* T.bmp */
++ {
++ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ },
++ /* U.bmp */
++ {
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ },
++ /* V.bmp */
++ {
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0x00, 0xFF, 0x00, 0xFF, 0x00,
++ 0x00, 0xFF, 0x00, 0xFF, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ },
++ /* W.bmp */
++ {
++ 0xFF, 0x00, 0xFF, 0x00, 0xFF,
++ 0xFF, 0x00, 0xFF, 0x00, 0xFF,
++ 0xFF, 0x00, 0xFF, 0x00, 0xFF,
++ 0x00, 0xFF, 0x00, 0xFF, 0x00,
++ 0x00, 0xFF, 0x00, 0xFF, 0x00,
++ },
++ /* X.bmp */
++ {
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0x00, 0xFF, 0x00, 0xFF, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0xFF, 0x00, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ },
++ /* Y.bmp */
++ {
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0x00, 0xFF, 0x00, 0xFF, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0xFF, 0x00, 0x00, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0x00,
++ },
++ /* Z.bmp */
++ {
++ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++ 0x00, 0x00, 0x00, 0xFF, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0xFF, 0x00, 0x00, 0x00,
++ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++ },
++ /* ldash.bmp */
++ {
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ 0x00, 0xFF, 0x00, 0x00, 0x00,
++ 0x00, 0xFF, 0x00, 0x00, 0x00,
++ 0x00, 0xFF, 0x00, 0x00, 0x00,
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ },
++ /* aslash.bmp */
++ {
++ 0xFF, 0x00, 0x00, 0x00, 0x00,
++ 0x00, 0xFF, 0x00, 0x00, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0x00, 0x00, 0xFF, 0x00,
++ 0x00, 0x00, 0x00, 0x00, 0xFF,
++ },
++ /* rdash.bmp */
++ {
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ 0x00, 0x00, 0x00, 0xFF, 0x00,
++ 0x00, 0x00, 0x00, 0xFF, 0x00,
++ 0x00, 0x00, 0x00, 0xFF, 0x00,
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ },
++ /* not available */
++ { 0x00 },
++ /* _.bmp */
++ {
++ 0x00, 0x00, 0x00, 0x00, 0x00,
++ 0x00, 0x00, 0x00, 0x00, 0x00,
++ 0x00, 0x00, 0x00, 0x00, 0x00,
++ 0x00, 0x00, 0x00, 0x00, 0x00,
++ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++ },
++ /* not available */
++ { 0x00 },
++ /* a.bmp */
++ {
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0xFF, 0x00, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ },
++ /* b.bmp */
++ {
++ 0xFF, 0xFF, 0xFF, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0xFF, 0xFF, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0xFF, 0xFF, 0xFF, 0x00,
++ },
++ /* c.bmp */
++ {
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ },
++ /* d.bmp */
++ {
++ 0xFF, 0xFF, 0xFF, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0xFF, 0xFF, 0xFF, 0x00,
++ },
++ /* e.bmp */
++ {
++ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0x00,
++ 0xFF, 0xFF, 0xFF, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0x00,
++ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++ },
++ /* f.bmp */
++ {
++ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0x00,
++ 0xFF, 0xFF, 0xFF, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0x00,
++ },
++ /* g.bmp */
++ {
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0x00,
++ 0xFF, 0x00, 0x00, 0xFF, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ },
++ /* h.bmp */
++ {
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ },
++ /* i.bmp */
++ {
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ },
++ /* j.bmp */
++ {
++ 0x00, 0x00, 0x00, 0x00, 0xFF,
++ 0x00, 0x00, 0x00, 0x00, 0xFF,
++ 0x00, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ },
++ /* k.bmp */
++ {
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0xFF, 0xFF, 0x00,
++ 0xFF, 0xFF, 0x00, 0x00, 0x00,
++ 0xFF, 0x00, 0xFF, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ },
++ /* l.bmp */
++ {
++ 0xFF, 0x00, 0x00, 0x00, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0x00,
++ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++ },
++ /* m.bmp */
++ {
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0xFF, 0x00, 0xFF, 0xFF,
++ 0xFF, 0x00, 0xFF, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ },
++ /* n.bmp */
++ {
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0xFF, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0xFF, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0xFF, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ },
++ /* o.bmp */
++ {
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ },
++ /* p.bmp */
++ {
++ 0xFF, 0xFF, 0xFF, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0xFF, 0xFF, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0x00,
++ },
++ /* q.bmp */
++ {
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0xFF, 0x00,
++ 0x00, 0xFF, 0xFF, 0x00, 0xFF,
++ },
++ /* r.bmp */
++ {
++ 0xFF, 0xFF, 0xFF, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0xFF, 0xFF, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ },
++ /* s.bmp */
++ {
++ 0x00, 0xFF, 0xFF, 0xFF, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0x00,
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ 0x00, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0xFF, 0xFF, 0xFF, 0x00,
++ },
++ /* t.bmp */
++ {
++ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ },
++ /* u.bmp */
++ {
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0x00, 0xFF, 0xFF, 0xFF, 0x00,
++ },
++ /* v.bmp */
++ {
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0x00, 0xFF, 0x00, 0xFF, 0x00,
++ 0x00, 0xFF, 0x00, 0xFF, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ },
++ /* w.bmp */
++ {
++ 0xFF, 0x00, 0xFF, 0x00, 0xFF,
++ 0xFF, 0x00, 0xFF, 0x00, 0xFF,
++ 0xFF, 0x00, 0xFF, 0x00, 0xFF,
++ 0x00, 0xFF, 0x00, 0xFF, 0x00,
++ 0x00, 0xFF, 0x00, 0xFF, 0x00,
++ },
++ /* x.bmp */
++ {
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0x00, 0xFF, 0x00, 0xFF, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0xFF, 0x00, 0xFF, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ },
++ /* y.bmp */
++ {
++ 0xFF, 0x00, 0x00, 0x00, 0xFF,
++ 0x00, 0xFF, 0x00, 0xFF, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0xFF, 0x00, 0x00, 0x00,
++ 0xFF, 0x00, 0x00, 0x00, 0x00,
++ },
++ /* z.bmp */
++ {
++ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++ 0x00, 0x00, 0x00, 0xFF, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0xFF, 0x00, 0x00, 0x00,
++ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++ },
++ /* not available */
++ { 0x00 },
++ /* pipe.bmp */
++ {
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ 0x00, 0x00, 0xFF, 0x00, 0x00,
++ },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++ /* not available */
++ { 0x00 },
++};
++
++/* c'étais vraiment tres intéressant */
+Index: linux-2.6.16/arch/arm/mach-omap1/io.c
+===================================================================
+--- linux-2.6.16.orig/arch/arm/mach-omap1/io.c 2007-04-12 10:36:07.000000000 +0200
++++ linux-2.6.16/arch/arm/mach-omap1/io.c 2007-04-12 10:36:19.000000000 +0200
+@@ -20,6 +20,8 @@
+ #include <asm/arch/tc.h>
+ #include <asm/arch/omapfb.h>
+
++#include <asm/arch/efb.h>
++
+ extern int omap1_clk_init(void);
+ extern void omap_check_revision(void);
+ extern void omap_sram_init(void);
+@@ -49,7 +51,7 @@
+ .pfn = __phys_to_pfn(OMAP730_DSPREG_START),
+ .length = OMAP730_DSPREG_SIZE,
+ .type = MT_DEVICE
+- }
++ },
+ };
+ #endif
+
+@@ -143,4 +145,3 @@
+
+ omap1_mux_init();
+ }
+-
+Index: linux-2.6.16/arch/arm/mach-omap1/Kconfig
+===================================================================
+--- linux-2.6.16.orig/arch/arm/mach-omap1/Kconfig 2007-04-12 10:36:07.000000000 +0200
++++ linux-2.6.16/arch/arm/mach-omap1/Kconfig 2007-04-12 10:36:19.000000000 +0200
+@@ -171,3 +171,10 @@
+
+ source "arch/arm/plat-omap/dsp/Kconfig"
+
++source "arch/arm/mach-omap1/tornado/Kconfig"
++
++config EFB_DEBUG
++ bool "Early Frame Buffer debugging routines"
++ depends on MACH_TORNADO
++ help
++ Output in the framebuffer of the HTC phones as early as possible (experimental, ...).
+Index: linux-2.6.16/arch/arm/mach-omap1/Makefile
+===================================================================
+--- linux-2.6.16.orig/arch/arm/mach-omap1/Makefile 2007-04-12 10:36:07.000000000 +0200
++++ linux-2.6.16/arch/arm/mach-omap1/Makefile 2007-04-12 10:36:19.000000000 +0200
+@@ -37,3 +37,5 @@
+ led-$(CONFIG_MACH_OMAP_OSK) += leds-osk.o
+ obj-$(CONFIG_LEDS) += $(led-y)
+
++obj-y += tornado/
++obj-$(CONFIG_EFB_DEBUG) += efb.o efb-font5x5.o
+Index: linux-2.6.16/arch/arm/mach-omap1/tornado/Kconfig
+===================================================================
+--- /dev/null 1970-01-01 00:00:00.000000000 +0000
++++ linux-2.6.16/arch/arm/mach-omap1/tornado/Kconfig 2007-04-12 10:36:19.000000000 +0200
+@@ -0,0 +1,5 @@
++config MACH_TORNADO
++ bool "HTC Tornado Support"
++ depends on ARCH_OMAP730
++ help
++ HTC Tornado smartphone support (AKA SPV C600, QTEK 8310, ...)
+Index: linux-2.6.16/arch/arm/mach-omap1/tornado/Makefile
+===================================================================
+--- /dev/null 1970-01-01 00:00:00.000000000 +0000
++++ linux-2.6.16/arch/arm/mach-omap1/tornado/Makefile 2007-04-12 10:36:19.000000000 +0200
+@@ -0,0 +1,11 @@
++##
++## Makefile for linux-on-tornado in /home/nico/work/tornado/linux-tornado
++##
++## Made by nico
++## Login <nico@chac.le-poulpe.net>
++##
++## Started on Wed Apr 5 17:20:58 2006 nico
++## Last update Thu May 11 12:34:33 2006 nico
++##
++
++obj-$(CONFIG_MACH_TORNADO) += tornado.o
+Index: linux-2.6.16/arch/arm/mach-omap1/tornado/tornado.c
+===================================================================
+--- /dev/null 1970-01-01 00:00:00.000000000 +0000
++++ linux-2.6.16/arch/arm/mach-omap1/tornado/tornado.c 2007-04-12 10:36:19.000000000 +0200
+@@ -0,0 +1,242 @@
++/*
++** tornado.c for linux-on-tornado in /home/nico/work/tornado/linux-tornado
++**
++** Made by nico
++** Login <nico@chac.le-poulpe.net>
++**
++** Started on Wed Apr 5 17:20:24 2006 nico
++** Last update Fri Jul 7 01:31:54 2006 nico
++*/
++
++/*
++ *
++ * HTC Tornado init stuff
++ * Copyright (C) 2006 Nicolas Schichan
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License as
++ * published by the Free Software Foundation; either version 2 of the
++ * License, or (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ * General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
++ * 02110-1301, USA.
++ *
++ */
++
++#include <linux/kernel.h>
++#include <linux/init.h>
++#include <linux/platform_device.h>
++
++#include <asm/mach-types.h>
++#include <asm/mach/arch.h>
++#include <asm/mach/map.h>
++#include <asm/arch/omap730.h>
++#include <asm/page.h>
++#include <asm/memory.h>
++#include <asm/arch/common.h>
++#include <asm/arch/board.h>
++#include <asm/arch/efb.h>
++#include <asm/arch/io.h>
++#include <asm/arch/irqs.h>
++#include <asm/arch/gpio.h>
++
++#include <linux/delay.h>
++
++#define TORNADO_GPIO_DM 35
++#define TORNADO_GPIO_DP 36
++
++static void __init
++tornado_map_io(void)
++{
++
++ omap1_map_common_io();
++
++#ifdef CONFIG_EFB_DEBUG
++ /*
++ * reenable simple framebuffer output on HTC typhoon:
++ * now safe to do it: sram has been remapped.
++ */
++ efb_enable();
++#endif
++ printk("tornado_map_io done.\n");
++}
++
++static void __init
++tornado_usb_enable(void)
++{
++ unsigned int tries = 20;
++ printk("trying to enable USB.\n");
++
++ /* force USB_EN GPIO to 0 */
++ do {
++ omap_set_gpio_direction(33, 0); /* output */
++ omap_set_gpio_dataout(33, 0); /* low */
++ --tries;
++ } while(omap_get_gpio_datain(33) && tries);
++ if (tries) {
++ printk("unable to reset USB_EN GPIO after 20 tries.\n");
++ printk("I will try to continue anyway: USB may not be available.\n");
++ }
++ printk("USB_EN to 0 after %i tries.\n", tries);
++
++ omap_set_gpio_dataout(73, 0);
++
++ omap_set_gpio_direction(TORNADO_GPIO_DM, 1); /* input */
++
++ /* get uart control from GSM */
++
++ /* select GPIO35 for D_MCLK_OUT */
++ /* select GPIO36 for D_CRESET */
++ omap_writel(omap_readl(OMAP730_IO_CONF_3) & 0xffffffcc, OMAP730_IO_CONF_3);
++ omap_writel(omap_readl(OMAP730_IO_CONF_3) | 0x000000cc, OMAP730_IO_CONF_3);
++
++
++ omap_set_gpio_direction(TORNADO_GPIO_DP, 1); /* input */
++
++ /* select D_DM, D_DP for D_DM and disable PE_DM control */
++ omap_writel(omap_readl(OMAP730_IO_CONF_2) & 0xff1fffff, OMAP730_IO_CONF_2);
++ omap_writel(omap_readl(OMAP730_IO_CONF_2) | 0x00100000, OMAP730_IO_CONF_2);
++ mdelay(100);
++
++ /* select USB_VBUSI for D_VBUSI, enable PE_VIBUSI pull enable control */
++ omap_writel(omap_readl(OMAP730_IO_CONF_2) & 0xf1ffffff, OMAP730_IO_CONF_2);
++ omap_writel(omap_readl(OMAP730_IO_CONF_2) | 0x01000000, OMAP730_IO_CONF_2);
++
++ /* set USB_VBUS_CTRL */
++ omap_writel(omap_readl(OMAP730_MODE_1) | (1 << 25), OMAP730_MODE_1);
++}
++
++static void __init
++tornado_usb_otg(void)
++{
++ /* clock configuration */
++ omap_writew(omap_readw(ULPD_SOFT_REQ) | (1 << 8) | SOFT_USB_CLK_REQ, ULPD_SOFT_REQ);
++
++ // clk_enable(&l3_ocpi_ck);
++ omap_writew(omap_readw(ARM_IDLECT3) | (1 << 0), ARM_IDLECT3);
++
++ /* pin muxing */
++ omap_writel(omap_readl(OMAP730_MODE_1) & ~(1 << 2), OMAP730_MODE_1);
++ omap_writel(omap_readl(OMAP730_MODE_1) & ~(1 << 3), OMAP730_MODE_1);
++ omap_writel(omap_readl(OMAP730_MODE_1) | (1 << 15), OMAP730_MODE_1);
++ omap_writel(omap_readl(OMAP730_MODE_1) | (1 << 23), OMAP730_MODE_1);
++ omap_writel(omap_readl(OMAP730_MODE_1) | (1 << 26), OMAP730_MODE_1);
++ omap_writel(omap_readl(OMAP730_MODE_1) | (1 << 25), OMAP730_MODE_1);
++ omap_writel(omap_readl(OMAP730_MODE_1) & ~(1 << 24), OMAP730_MODE_1);
++ omap_writel(omap_readl(OMAP730_MODE_1) & ~(1 << 10), OMAP730_MODE_1);
++ omap_writel(omap_readl(OMAP730_MODE_1) & ~(1 << 11), OMAP730_MODE_1);
++}
++
++static struct omap_usb_config tornado_usb_config __initdata =
++{
++ .register_dev = 1,
++ .register_host = 0,
++ .otg = 0,
++ .hmc_mode = 4,
++ .pins[0] = 2,
++ .pins[1] = 0,
++ .pins[2] = 0,
++};
++
++static struct omap_mmc_config tornado_mmc_config __initdata =
++{
++ .mmc[0] = {
++ .enabled = 1,
++ .nomux = 1,
++ .wire4 = 1,
++ .power_pin = -1,
++ .switch_pin = -1,
++ }
++};
++
++static struct omap_board_config_kernel tornado_config[] =
++{
++ { OMAP_TAG_USB, &tornado_usb_config },
++ { OMAP_TAG_MMC, &tornado_mmc_config },
++};
++
++static void __init
++tornado_mmc_init(void)
++{
++ unsigned int tries;
++
++# define OMAP_MMC_REG_SYSC (0xfffb7800 + 0x32)
++# define OMAP_MMC_REG_SYSS (0xfffb7800 + 0x34)
++# define OMAP_MMC_REG_CTO (0xfffb7800 + 0x0e)
++# define OMAP_MMC_REG_DTO (0xfffb7800 + 0x1c)
++
++ /* put mmc host into reset ... */
++ omap_writew(1, OMAP_MMC_REG_SYSC);
++
++ tries = 100;
++ while (omap_readw(OMAP_MMC_REG_SYSS) == 0 && tries) {
++ mdelay(50);
++ --tries;
++ }
++ printk("MMC host reset done: remaining tries: %i\n", tries);
++
++ /* force mode 0 for D_SMC_DAT3, D_SMC_DAT2, D_SMC, no pull up enable */
++ omap_writel(omap_readl(OMAP730_IO_CONF_2) & ~(0xF << 8), OMAP730_IO_CONF_2);
++ omap_writel(omap_readl(OMAP730_IO_CONF_2) & ~(0xF << 12), OMAP730_IO_CONF_2);
++ omap_writel(omap_readl(OMAP730_IO_CONF_2) & ~(0xF << 16), OMAP730_IO_CONF_2);
++}
++
++struct platform_device gsm_device = {
++ .name = "typhoon-gsm",
++ .id = 1
++};
++
++static struct platform_device *devices[] __initdata = {
++ &gsm_device,
++};
++
++static void __init
++tornado_init(void)
++{
++ printk("Tornado init.\n");
++ omap_board_config = tornado_config;
++ omap_board_config_size = ARRAY_SIZE(tornado_config);
++
++ platform_add_devices(devices, ARRAY_SIZE(devices));
++
++ if (omap_readl(OMAP_WDT_TIMER_MODE) & 0x8000) {
++ /*
++ * disable a potentially running watchdog timer before
++ * it kills us.
++ */
++ printk("OMAP730 Watchdog seems to be activated, disabling it for now.\n");
++ omap_writel(0xF5, OMAP_WDT_TIMER_MODE);
++ omap_writel(0xA0, OMAP_WDT_TIMER_MODE);
++ }
++
++ tornado_usb_otg();
++ tornado_usb_enable();
++ tornado_mmc_init();
++}
++
++static void __init
++tornado_init_irq(void)
++{
++ printk("tornado_init_irq.\n");
++ omap1_init_common_hw();
++ omap_init_irq();
++ omap_gpio_init();
++}
++
++MACHINE_START(TORNADO, "HTC Tornado")
++ /* Maintainer: Nicolas Schichan <nico@chac.le-poulpe.net> */
++ .phys_io = 0xfff00000,
++ .io_pg_offst = ((0xfef00000) >> 18) & 0xfffc,
++ .boot_params = 0x10000100,
++ .map_io = tornado_map_io,
++ .init_irq = tornado_init_irq,
++ .init_machine = tornado_init,
++ .timer = &omap_timer,
++MACHINE_END
+Index: linux-2.6.16/arch/arm/plat-omap/sram.c
+===================================================================
+--- linux-2.6.16.orig/arch/arm/plat-omap/sram.c 2007-04-12 10:36:07.000000000 +0200
++++ linux-2.6.16/arch/arm/plat-omap/sram.c 2007-04-12 10:36:19.000000000 +0200
+@@ -33,9 +33,12 @@
+ #define OMAP2_SRAM_PUB_VA 0xd0000800
+
+ #if defined(CONFIG_ARCH_OMAP24XX)
+-#define SRAM_BOOTLOADER_SZ 0x00
++# define SRAM_BOOTLOADER_SZ 0x00
++#elif defined(CONFIG_EFB_DEBUG)
++/* reserve memory for frame buffer too ... */
++# define SRAM_BOOTLOADER_SZ (0x1020 + 320 * 240 * 2)
+ #else
+-#define SRAM_BOOTLOADER_SZ 0x80
++# define SRAM_BOOTLOADER_SZ 0x80
+ #endif
+
+ #define VA_REQINFOPERM0 IO_ADDRESS(0x68005048)
+Index: linux-2.6.16/arch/arm/plat-omap/usb.c
+===================================================================
+--- linux-2.6.16.orig/arch/arm/plat-omap/usb.c 2006-03-20 06:53:29.000000000 +0100
++++ linux-2.6.16/arch/arm/plat-omap/usb.c 2007-04-12 10:36:19.000000000 +0200
+@@ -123,11 +123,11 @@
+ * - only peripherals may use the internal D+/D- pulldowns
+ * - OTG support on this port not yet written
+ */
+-
+- USB_TRANSCEIVER_CTRL_REG &= ~(7 << 4);
+- if (!is_device)
+- USB_TRANSCEIVER_CTRL_REG |= (3 << 1);
+-
++ if (!cpu_is_omap730()) {
++ USB_TRANSCEIVER_CTRL_REG &= ~(7 << 4);
++ if (!is_device)
++ USB_TRANSCEIVER_CTRL_REG |= (3 << 1);
++ }
+ return 3 << 16;
+ }
+
+@@ -457,6 +457,11 @@
+ syscon &= ~DEV_IDLE_EN;
+ udc_device.dev.platform_data = config;
+ /* FIXME patch IRQ numbers for omap730 */
++ if (cpu_is_omap730()) {
++ udc_resources[1].start = INT_730_USB_GENI;
++ udc_resources[2].start = INT_730_USB_NON_ISO;
++ udc_resources[3].start = INT_730_USB_ISO;
++ }
+ status = platform_device_register(&udc_device);
+ if (status)
+ pr_debug("can't register UDC device, %d\n", status);
+Index: linux-2.6.16/arch/arm/tools/mach-types
+===================================================================
+--- linux-2.6.16.orig/arch/arm/tools/mach-types 2006-03-20 06:53:29.000000000 +0100
++++ linux-2.6.16/arch/arm/tools/mach-types 2007-04-12 10:36:19.000000000 +0200
+@@ -969,3 +969,4 @@
+ fujitsu_wimaxsoc MACH_FUJITSU_WIMAXSOC FUJITSU_WIMAXSOC 956
+ dualpcmodem MACH_DUALPCMODEM DUALPCMODEM 957
+ gesbc9312 MACH_GESBC9312 GESBC9312 958
++htc_tornado MACH_TORNADO TORNADO 6665
+Index: linux-2.6.16/ChangeLog
+===================================================================
+--- /dev/null 1970-01-01 00:00:00.000000000 +0000
++++ linux-2.6.16/ChangeLog 2007-04-12 10:36:19.000000000 +0200
+@@ -0,0 +1,3 @@
++2006-04-10 nico <nico@localhost.localdomain>
++
++ * wizard-keypad.c: support for arrow keys (GPIO based).
+Index: linux-2.6.16/drivers/char/Kconfig
+===================================================================
+--- linux-2.6.16.orig/drivers/char/Kconfig 2007-04-12 10:36:08.000000000 +0200
++++ linux-2.6.16/drivers/char/Kconfig 2007-04-12 10:36:19.000000000 +0200
+@@ -678,6 +678,21 @@
+
+ If unsure, say N.
+
++config TORNADO_VIBRATOR
++ tristate "HTC Tornado vibrator"
++ depends on MACH_TORNADO
++ help
++ HTC Tornado vibrator support. supports for misc
++ device with minor number 240. implements two IOCTLs:
++ VIBRATOR_ENABLE and VIBRATOR_DISABLE.
++
++config TORNADO_LEDS
++ tristate "HTC Tornado led driver"
++ depends on MACH_TORNADO
++ help
++ HTC Tornado led driver. misc device with minor
++ number 241.
++
+ config NVRAM
+ tristate "/dev/nvram support"
+ depends on ATARI || X86 || ARM || GENERIC_NVRAM
+Index: linux-2.6.16/drivers/char/Makefile
+===================================================================
+--- linux-2.6.16.orig/drivers/char/Makefile 2007-04-12 10:36:07.000000000 +0200
++++ linux-2.6.16/drivers/char/Makefile 2007-04-12 10:36:19.000000000 +0200
+@@ -97,6 +97,10 @@
+
+ obj-$(CONFIG_HANGCHECK_TIMER) += hangcheck-timer.o
+ obj-$(CONFIG_TCG_TPM) += tpm/
++
++obj-$(CONFIG_TORNADO_VIBRATOR) += tornado-vibrator.o
++obj-$(CONFIG_TORNADO_LEDS) += tornado-leds.o
++
+ # Files generated that shall be removed upon make clean
+ clean-files := consolemap_deftbl.c defkeymap.c qtronixmap.c
+
+Index: linux-2.6.16/drivers/char/tornado-leds.c
+===================================================================
+--- /dev/null 1970-01-01 00:00:00.000000000 +0000
++++ linux-2.6.16/drivers/char/tornado-leds.c 2007-04-12 10:36:19.000000000 +0200
+@@ -0,0 +1,253 @@
++/*
++** tornado-leds.c for leds in /home/nico/work/tornado/linux-tornado
++**
++** Made by nico
++** Login <nico@chac.le-poulpe.net>
++**
++** Started on Mon Apr 17 11:19:59 2006 nico
++** Last update Thu May 25 15:32:23 2006 nico
++*/
++
++/*
++ *
++ * HTC Tornado LED driver.
++ * Copyright (C) 2006 Nicolas Schichan
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License as
++ * published by the Free Software Foundation; either version 2 of the
++ * License, or (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ * General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
++ * 02110-1301, USA.
++ *
++ */
++
++#include <linux/init.h>
++#include <linux/miscdevice.h>
++#include <linux/moduleparam.h>
++#include <linux/fs.h>
++#include <linux/bitops.h>
++
++#include <asm/arch/gpio.h>
++
++#define LEDS_MINOR 241
++
++/*
++ * ioctl definitions.
++ */
++#define IOCTL_LED_ENABLE 0x4242 /* param: color */
++#define IOCTL_LED_BLINK 0x4243 /* param: color */
++#define IOCTL_LED_DISABLE 0x4244 /* no param */
++#define IOCTL_KPLED_ENABLE 0x4245 /* no param */
++#define IOCTL_KPLED_DISABLE 0x4246 /* no param */
++
++#define PARAM_LED_RED 0x666
++#define PARAM_LED_GREEN 0x667
++#define PARAM_LED_BLUE 0x668
++
++/*
++ * hw def
++ */
++#define TORNADO_LED_BASE 0xFFFBA800
++/* PM Reg: enable led clock when set to 1 */
++#define TORNADO_LED_PMR 0xFFFBA801
++
++/* TORNADO_LED_ENABLE register layout */
++/*
++ bit 7: ON
++ bit 6: BLINK
++ bit 5-3: off time.
++ bit 0-2: on time.
++
++*/
++
++#define TORNADO_GPIO_LED_GREEN 79
++#define TORNADO_GPIO_LED_RED 128
++#define TORNADO_GPIO_LED_BLUE 140
++#define TORNADO_GPIO_KPLED 16
++
++
++/* in TORNADO_LED_ENABLE */
++#define LED_ON (1 << 7)
++#define LED_BLINK (1 << 6)
++#define LED_ONTIME(x) ((x) & 0x7)
++#define LED_OFFTIME(x) (((x) & 0x7) << 3)
++
++#define LED_BASE_REG __REG8(TORNADO_LED_BASE)
++#define LED_PM_REG __REG8(TORNADO_LED_PMR)
++
++static unsigned long use;
++
++static int
++tornado_leds_open(struct inode *inode, struct file *file)
++{
++ /* ensure exclusive access */
++ if (test_and_set_bit(0, &use))
++ return -EBUSY;
++
++ return 0;
++}
++
++static int led_set_color(unsigned long color)
++{
++ switch (color) {
++ case PARAM_LED_RED:
++ omap_set_gpio_dataout(TORNADO_GPIO_LED_RED, 1);
++ omap_set_gpio_dataout(TORNADO_GPIO_LED_GREEN, 0);
++ omap_set_gpio_dataout(TORNADO_GPIO_LED_BLUE, 0);
++ break;
++ case PARAM_LED_GREEN:
++ omap_set_gpio_dataout(TORNADO_GPIO_LED_RED, 0);
++ omap_set_gpio_dataout(TORNADO_GPIO_LED_GREEN, 1);
++ omap_set_gpio_dataout(TORNADO_GPIO_LED_BLUE, 0);
++ break;
++ case PARAM_LED_BLUE:
++ omap_set_gpio_dataout(TORNADO_GPIO_LED_RED, 0);
++ omap_set_gpio_dataout(TORNADO_GPIO_LED_GREEN, 0);
++ omap_set_gpio_dataout(TORNADO_GPIO_LED_BLUE, 1);
++ break;
++ default:
++ return -EINVAL;
++ }
++ return 0;
++}
++
++/*
++ * FIXME: on the HTC Tornado, the blue led is not the same as the
++ * red/green led, there may be some gpio changes / special register
++ * settings for this.
++ */
++static int
++tornado_leds_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned long arg)
++{
++ switch (cmd) {
++ case IOCTL_LED_ENABLE:
++ LED_PM_REG = 0; /* disable blink clock */
++ LED_BASE_REG = LED_ON;
++ return led_set_color(arg);
++
++ case IOCTL_LED_BLINK:
++ LED_PM_REG = 1;
++ LED_BASE_REG = 0x7F; /* LED_BLINK | LED_ONTIME(1) | LED_OFFTIME(3); */
++ printk("IOCTL_LED_BLINK (reg = %02x).\n", LED_BASE_REG);
++ return led_set_color(arg);
++
++ case IOCTL_LED_DISABLE:
++ LED_PM_REG = 0;
++ LED_BASE_REG = 0;
++ omap_set_gpio_dataout(TORNADO_GPIO_LED_RED, 0);
++ omap_set_gpio_dataout(TORNADO_GPIO_LED_GREEN, 0);
++ break;
++
++ case IOCTL_KPLED_ENABLE:
++ omap_set_gpio_dataout(TORNADO_GPIO_KPLED, 1);
++ break;
++
++ case IOCTL_KPLED_DISABLE:
++ omap_set_gpio_dataout(TORNADO_GPIO_KPLED, 0);
++ break;
++ default:
++ return -EINVAL;
++ }
++ return 0;
++}
++
++static int
++tornado_leds_release(struct inode *inode, struct file *file)
++{
++ use = 0;
++ return 0;
++}
++
++struct file_operations tornado_leds_fops =
++{
++ .owner = THIS_MODULE,
++ .ioctl = tornado_leds_ioctl,
++ .open = tornado_leds_open,
++ .release = tornado_leds_release,
++};
++
++struct miscdevice tornado_leds_device =
++{
++ .minor = LEDS_MINOR,
++ .name = "tornado-leds",
++ .fops = &tornado_leds_fops,
++};
++
++static int __init
++tornado_leds_init(void)
++{
++ int ret;
++
++ omap_request_gpio(TORNADO_GPIO_LED_RED);
++ omap_request_gpio(TORNADO_GPIO_LED_GREEN);
++ omap_request_gpio(TORNADO_GPIO_LED_BLUE);
++ omap_request_gpio(TORNADO_GPIO_KPLED);
++
++ ret = misc_register(&tornado_leds_device);
++ if (ret)
++ return ret;
++
++ /*
++ * init hw
++ */
++ /* clear GSM_LPG1 and select GPIO_140 & LPG1 pullup enable control */
++ omap_writel(omap_readl(OMAP730_IO_CONF_10) & ~0x20, OMAP730_IO_CONF_10);
++ omap_writel(omap_readl(OMAP730_IO_CONF_10) | 0xd0, OMAP730_IO_CONF_10);
++
++/* omap_set_gpio_dataout(140, 1); */
++
++ /* clear GSM_LPG2 and select GPIO_141 & LPG2 pullup enable control */
++ omap_writel(omap_readl(OMAP730_IO_CONF_10) & ~0x200, OMAP730_IO_CONF_10);
++ omap_writel(omap_readl(OMAP730_IO_CONF_10) | 0xd00, OMAP730_IO_CONF_10);
++
++/* omap_set_gpio_dataout(141, 1); */
++
++ omap_set_gpio_direction(TORNADO_GPIO_LED_RED, 0); /* out */
++ omap_set_gpio_direction(TORNADO_GPIO_LED_GREEN, 0); /* out */
++ omap_set_gpio_direction(TORNADO_GPIO_LED_BLUE, 0); /* out */
++ omap_set_gpio_direction(TORNADO_GPIO_KPLED, 0); /* out */
++
++ /* enable lpg1 and lpg2 */
++ omap_writel(omap_readl(OMAP730_MODE_1) | (3 << 28), OMAP730_MODE_1);
++
++ /* disable led activation */
++ LED_PM_REG = 0;
++ LED_BASE_REG = 0;
++ omap_set_gpio_dataout(TORNADO_GPIO_LED_RED, 0);
++ omap_set_gpio_dataout(TORNADO_GPIO_LED_GREEN, 0);
++ omap_set_gpio_dataout(TORNADO_GPIO_LED_BLUE, 0);
++ omap_set_gpio_dataout(TORNADO_GPIO_KPLED, 0);
++
++ printk("HTC Tornado led driver.\n");
++ return 0;
++}
++
++static void __exit
++tornado_leds_exit(void)
++{
++ misc_deregister(&tornado_leds_device);
++
++ /* disable lpg 1 and lpg2 */
++ omap_writel(omap_readl(OMAP730_MODE_1) & ~(3 << 28), OMAP730_MODE_1);
++ LED_BASE_REG = 0;
++ LED_PM_REG = 0;
++ omap_free_gpio(TORNADO_GPIO_LED_RED);
++ omap_free_gpio(TORNADO_GPIO_LED_GREEN);
++ omap_free_gpio(TORNADO_GPIO_LED_BLUE);
++ omap_free_gpio(TORNADO_GPIO_KPLED);
++}
++
++module_init(tornado_leds_init);
++module_exit(tornado_leds_exit);
++
++MODULE_AUTHOR("Nicolas Schichan");
++MODULE_LICENSE("GPL");
+Index: linux-2.6.16/drivers/char/tornado-vibrator.c
+===================================================================
+--- /dev/null 1970-01-01 00:00:00.000000000 +0000
++++ linux-2.6.16/drivers/char/tornado-vibrator.c 2007-04-12 10:36:19.000000000 +0200
+@@ -0,0 +1,144 @@
++/*
++** tornado-vibrator.c for vibrator in /home/nico/work/tornado/linux-tornado
++**
++** Made by nico
++** Login <nico@chac.le-poulpe.net>
++**
++** Started on Mon Apr 10 15:21:27 2006 nico
++** Last update Thu May 25 13:44:23 2006 nico
++*/
++
++#include <linux/init.h>
++#include <linux/miscdevice.h>
++#include <linux/moduleparam.h>
++#include <linux/fs.h>
++#include <linux/bitops.h>
++
++#include <asm/arch/gpio.h>
++#include "tornado-vibrator.h"
++
++/*
++ *
++ * HTC Tornado vibrator driver.
++ * Copyright (C) 2006 Nicolas Schichan
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License as
++ * published by the Free Software Foundation; either version 2 of the
++ * License, or (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ * General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
++ * 02110-1301, USA.
++ *
++ */
++
++/*
++ * quite a simple driver: only put GPIO 34 in OUT mode and set it to 1
++ * to enable the vibrator or 0 to disable it.
++ */
++
++static long use;
++
++/*
++ * ensure only process opens the file, ad set GPIO direction to 0 (OUT)
++ */
++static int
++tornado_vibrator_open(struct inode *inode, struct file *file)
++{
++ if (test_and_set_bit(0, &use))
++ return -EBUSY;
++
++
++ /* out GPIO */
++ omap_set_gpio_direction(TORNADO_VIBRATOR_GPIO, 0);
++ return 0;
++}
++
++/*
++ * device ioctl handler. only VIBRATOR_ENABLE or VIBRATOR_DISABLE are
++ * recognized.
++ */
++static int
++tornado_vibrator_ioctl(struct inode *inode, struct file *file,
++ unsigned int cmd, unsigned long arg)
++{
++ switch (cmd) {
++ case VIBRATOR_ENABLE:
++ omap_set_gpio_dataout(TORNADO_VIBRATOR_GPIO, 1);
++ return 0;
++ case VIBRATOR_DISABLE:
++ omap_set_gpio_dataout(TORNADO_VIBRATOR_GPIO, 0);
++ return 0;
++ default:
++ return -EOPNOTSUPP;
++ }
++}
++
++/*
++ * set use variable to zero so that the next open on the file
++ * successes.
++ */
++static int
++tornado_vibrator_release(struct inode *inode, struct file *file)
++{
++ use = 0;
++ return 0;
++}
++
++struct file_operations tornado_vibrator_fops =
++{
++ .owner = THIS_MODULE,
++ .ioctl = tornado_vibrator_ioctl,
++ .open = tornado_vibrator_open,
++ .release = tornado_vibrator_release,
++};
++
++struct miscdevice tornado_vibrator_dev =
++{
++ .minor = VIBRATOR_MINOR,
++ .name = "tornado-vibrator",
++ .fops = &tornado_vibrator_fops,
++};
++
++/*
++ * make sure we can use the GPIO and register the device.
++ */
++static int __init
++tornado_vibrator_init(void)
++{
++ int ret;
++
++ if (omap_request_gpio(TORNADO_VIBRATOR_GPIO))
++ return -EBUSY;
++
++ ret = misc_register(&tornado_vibrator_dev);
++ if (ret)
++ return ret;
++
++ printk("HTC Tornado Vibrator driver.\n");
++ return 0;
++}
++
++/*
++ * deregister device and free the GPIO.
++ */
++static void __init
++tornado_vibrator_exit(void)
++{
++ misc_deregister(&tornado_vibrator_dev);
++ omap_set_gpio_dataout(TORNADO_VIBRATOR_GPIO, 0);
++ omap_free_gpio(TORNADO_VIBRATOR_GPIO);
++}
++
++module_init(tornado_vibrator_init);
++module_exit(tornado_vibrator_exit);
++
++MODULE_AUTHOR("Nicolas Schichan");
++MODULE_LICENSE("GPL");
+Index: linux-2.6.16/drivers/char/tornado-vibrator.h
+===================================================================
+--- /dev/null 1970-01-01 00:00:00.000000000 +0000
++++ linux-2.6.16/drivers/char/tornado-vibrator.h 2007-04-12 10:36:19.000000000 +0200
+@@ -0,0 +1,44 @@
++/*
++** tornado-vibrator.h for vibrator in /home/nico/work/tornado/linux-tornado
++**
++** Made by nico
++** Login <nico@chac.le-poulpe.net>
++**
++** Started on Mon Apr 10 15:54:33 2006 nico
++** Last update Thu May 25 13:44:38 2006 nico
++*/
++
++/*
++ *
++ * HTC Tornado vibrator driver
++ * Copyright (C) 2006 Nicolas Schichan
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License as
++ * published by the Free Software Foundation; either version 2 of the
++ * License, or (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ * General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
++ * 02110-1301, USA.
++ *
++ */
++
++
++#ifndef __TORNADO_VIBRATOR
++# define __TORNADO_VIBRATOR
++
++# define VIBRATOR_ENABLE 0x42
++# define VIBRATOR_DISABLE 0x43
++
++# define VIBRATOR_MINOR 240
++
++# define TORNADO_VIBRATOR_GPIO 34
++
++#endif /* !__TORNADO_VIBRATOR */
+Index: linux-2.6.16/drivers/char/vt.c
+===================================================================
+--- linux-2.6.16.orig/drivers/char/vt.c 2006-03-20 06:53:29.000000000 +0100
++++ linux-2.6.16/drivers/char/vt.c 2007-04-12 10:36:19.000000000 +0200
+@@ -2155,6 +2155,8 @@
+
+ #ifdef CONFIG_VT_CONSOLE
+
++extern int in_printk;
++
+ /*
+ * Console on virtual terminal
+ *
+@@ -2169,6 +2171,7 @@
+ const ushort *start;
+ ushort cnt = 0;
+ ushort myx;
++ unsigned char old_color = 0;
+
+ /* console busy or not yet initialized */
+ if (!printable || test_and_set_bit(0, &printing))
+@@ -2196,6 +2199,11 @@
+
+ start = (ushort *)vc->vc_pos;
+
++ if (in_printk) {
++ old_color = vc->vc_color;
++ vc->vc_color = 0x2;
++ update_attr(vc);
++ }
+ /* Contrived structure to try to emulate original need_wrap behaviour
+ * Problems caused when we have need_wrap set on '\n' character */
+ while (count--) {
+@@ -2242,6 +2250,10 @@
+ }
+ }
+ set_cursor(vc);
++ if (in_printk) {
++ vc->vc_color = old_color;
++ update_attr(vc);
++ }
+
+ quit:
+ clear_bit(0, &printing);
+Index: linux-2.6.16/drivers/char/watchdog/Kconfig
+===================================================================
+--- linux-2.6.16.orig/drivers/char/watchdog/Kconfig 2007-04-12 10:36:07.000000000 +0200
++++ linux-2.6.16/drivers/char/watchdog/Kconfig 2007-04-12 10:36:19.000000000 +0200
+@@ -656,4 +656,10 @@
+ Support for TI OMAP1610/OMAP1710/OMAP2420 watchdog. Say 'Y' here to enable the
+ OMAP1610/OMAP1710 watchdog timer.
+
++config OMAP730_WATCHDOG
++ tristate "OMAP730/OMAP850 Watchdog"
++ depends on WATCHDOG && ARCH_OMAP730
++ help
++ Support for TI OMAP730/OMAP850 Watchdog.
++
+ endmenu
+Index: linux-2.6.16/drivers/char/watchdog/Makefile
+===================================================================
+--- linux-2.6.16.orig/drivers/char/watchdog/Makefile 2007-04-12 10:36:07.000000000 +0200
++++ linux-2.6.16/drivers/char/watchdog/Makefile 2007-04-12 10:36:19.000000000 +0200
+@@ -28,6 +28,7 @@
+ obj-$(CONFIG_IXP2000_WATCHDOG) += ixp2000_wdt.o
+ obj-$(CONFIG_IXP4XX_WATCHDOG) += ixp4xx_wdt.o
+ obj-$(CONFIG_OMAP_WATCHDOG) += omap_wdt.o
++obj-$(CONFIG_OMAP730_WATCHDOG) += omap730_wdt.o
+ obj-$(CONFIG_S3C2410_WATCHDOG) += s3c2410_wdt.o
+ obj-$(CONFIG_SA1100_WATCHDOG) += sa1100_wdt.o
+ obj-$(CONFIG_MPCORE_WATCHDOG) += mpcore_wdt.o
+Index: linux-2.6.16/drivers/char/watchdog/omap730_wdt.c
+===================================================================
+--- /dev/null 1970-01-01 00:00:00.000000000 +0000
++++ linux-2.6.16/drivers/char/watchdog/omap730_wdt.c 2007-04-12 10:36:19.000000000 +0200
+@@ -0,0 +1,225 @@
++/*
++** omap730_wdt.c for linux-typhoon/tornado in /home/nico/work/spvc500/linux-omap-typhoon
++**
++** Made by nico
++** Login <nico@chac.le-poulpe.net>
++**
++** Started on Thu Mar 16 14:42:35 2006 nico
++** Last update Thu May 11 13:56:24 2006 nico
++*/
++
++/*
++ *
++ * OMAP730 watchdog driver.
++ * Copyright (C) 2006 Nicolas Schichan
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License as
++ * published by the Free Software Foundation; either version 2 of the
++ * License, or (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ * General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
++ * 02110-1301, USA.
++ *
++ */
++
++/*
++ * based on omap_wdt.c.
++ */
++
++#include <linux/module.h>
++#include <linux/config.h>
++#include <linux/types.h>
++#include <linux/kernel.h>
++#include <linux/fs.h>
++#include <linux/mm.h>
++#include <linux/miscdevice.h>
++#include <linux/watchdog.h>
++#include <linux/reboot.h>
++#include <linux/smp_lock.h>
++#include <linux/init.h>
++#include <linux/err.h>
++
++#include <asm/io.h>
++#include <asm/uaccess.h>
++#include <asm/hardware.h>
++#include <asm/bitops.h>
++/* #include <asm/hardware/clock.h> */
++
++#include <linux/moduleparam.h>
++
++#include <asm/arch/hardware.h>
++#include <asm/delay.h>
++
++#define WDT_EN 0
++#define WDT_DISABLE_ON_CLOSE 1
++
++static unsigned long omap_wdt_users;
++static struct miscdevice omap_wdt_miscdev; /* Forward declaration */
++
++/*
++ * TRM says that the same value cannot be used to reinitialize the
++ * watchdog timer, so alternate 0xFFFF 0xFFFE.
++ */
++static void
++omap730_wdt_ping(void)
++{
++ static int mod = 0;
++
++ if (mod)
++ omap_writel(0xFFFF, OMAP_WDT_LOAD_TIM);
++ else
++ omap_writel(0xFFFE, OMAP_WDT_LOAD_TIM);
++
++ mod = (mod + 1) & 0x1;
++}
++
++static void
++omap730_wdt_enable(void)
++{
++ unsigned long wdt_ctl;
++ unsigned long arm_idlect2;
++
++ omap_writel(0x8000, OMAP_WDT_TIMER_MODE);
++ wdt_ctl = omap_readl(OMAP_WDT_TIMER);
++
++ arm_idlect2 = omap_readl(ARM_IDLECT2);
++ arm_idlect2 |= 0x1; /* enable watchdog clock */
++ omap_writel(arm_idlect2, ARM_IDLECT2);
++
++}
++
++static void
++omap730_wdt_disable(void)
++{
++ unsigned long arm_idlect2;
++
++ if ((omap_readl(OMAP_WDT_TIMER_MODE) & 0x8000) == 0x8000) {
++
++ arm_idlect2 = omap_readl(ARM_IDLECT2);
++ arm_idlect2 &= ~0x1; /* disable watchdog clock */
++ omap_writel(arm_idlect2, ARM_IDLECT2);
++
++ /*
++ * sequence required to disable watchdog. do not try
++ * to disable watchdog if timer is not active (see
++ * TRM).
++ */
++ omap_writel(0xF5, OMAP_WDT_TIMER_MODE);
++ omap_writel(0xA0, OMAP_WDT_TIMER_MODE);
++ }
++}
++
++/*
++ * Allow only one person to hold it open
++ */
++static int
++omap730_wdt_open(struct inode *inode, struct file *file)
++{
++ if (test_and_set_bit(WDT_EN, &omap_wdt_users))
++ return -EBUSY;
++
++ omap730_wdt_enable();
++ return 0;
++}
++
++static int
++omap730_wdt_release(struct inode *inode, struct file *file)
++{
++ if (omap_wdt_users && test_bit(WDT_DISABLE_ON_CLOSE, &omap_wdt_users)) {
++ printk("omap730_wdt: disabling watchdog.\n");
++ omap730_wdt_disable();
++ } else {
++ printk(KERN_CRIT "omap730_wdt: Unexpected close: watchdog still active !\n");
++ }
++ omap_wdt_users = 0;
++ return 0;
++}
++
++static ssize_t
++omap730_wdt_write(struct file *file, const char *data, size_t len, loff_t * ppos)
++{
++ if (len) {
++#ifndef CONFIG_WATCHDOG_NOWAYOUT
++ size_t i;
++
++ for (i = 0; i < len; ++i) {
++ char c;
++ if (get_user(c, data + i))
++ return -EFAULT;
++ if (c == 'V') {
++ printk("watchdog will be disabled on close.\n");
++ set_bit(WDT_DISABLE_ON_CLOSE, (unsigned long*)&omap_wdt_users);
++ }
++ }
++#endif
++ omap730_wdt_ping();
++ return 1;
++ }
++ return 0;
++}
++
++/*
++ * KISS: only support KEEPALIVE for now.
++ */
++static int
++omap730_wdt_ioctl(struct inode *inode, struct file *file,
++ unsigned int cmd, unsigned long arg)
++{
++ switch (cmd) {
++ case WDIOC_KEEPALIVE:
++ omap730_wdt_ping();
++ return 0;
++ default:
++ return -ENOIOCTLCMD;
++ }
++}
++
++static struct file_operations omap_wdt_fops = {
++ .owner = THIS_MODULE,
++ .write = omap730_wdt_write,
++ .ioctl = omap730_wdt_ioctl,
++ .open = omap730_wdt_open,
++ .release = omap730_wdt_release,
++};
++
++static struct miscdevice omap_wdt_miscdev = {
++ .minor = WATCHDOG_MINOR,
++ .name = "omap730_wdt",
++ .fops = &omap_wdt_fops
++};
++
++static int __init
++omap730_wdt_init(void)
++{
++ int ret;
++
++ ret = misc_register(&omap_wdt_miscdev);
++
++ if (ret)
++ return ret;
++
++ omap730_wdt_disable();
++ printk(KERN_INFO "TI OMAP Watchdog Timer for OMAP730\n");
++
++ return 0;
++}
++
++static void __exit
++omap730_wdt_exit(void)
++{
++ misc_deregister(&omap_wdt_miscdev);
++}
++
++module_init(omap730_wdt_init);
++module_exit(omap730_wdt_exit);
++
++MODULE_AUTHOR("Nicolas Schichan");
++MODULE_LICENSE("GPL");
+Index: linux-2.6.16/drivers/input/keyboard/Kconfig
+===================================================================
+--- linux-2.6.16.orig/drivers/input/keyboard/Kconfig 2007-04-12 10:36:07.000000000 +0200
++++ linux-2.6.16/drivers/input/keyboard/Kconfig 2007-04-12 10:36:19.000000000 +0200
+@@ -193,6 +193,13 @@
+ To compile this driver as a module, choose M here: the
+ module will be called omap-keypad.
+
++config TORNADO_KEYPAD
++ bool "HTC Tornado keypad support"
++ depends on MACH_TORNADO
++ help
++ Say y here if you want to use the keypad of your HTC Tornado
++ Phone.
++
+ config OMAP_PS2
+ tristate "TI OMAP Innovator 1510 PS/2 keyboard & mouse support"
+ depends on ARCH_OMAP15XX && MACH_OMAP_INNOVATOR
+Index: linux-2.6.16/drivers/input/keyboard/Makefile
+===================================================================
+--- linux-2.6.16.orig/drivers/input/keyboard/Makefile 2007-04-12 10:36:07.000000000 +0200
++++ linux-2.6.16/drivers/input/keyboard/Makefile 2007-04-12 10:36:19.000000000 +0200
+@@ -16,4 +16,5 @@
+ obj-$(CONFIG_KEYBOARD_HIL) += hil_kbd.o
+ obj-$(CONFIG_KEYBOARD_HIL_OLD) += hilkbd.o
+ obj-$(CONFIG_KEYBOARD_OMAP) += omap-keypad.o
++obj-$(CONFIG_TORNADO_KEYPAD) += tornado-keypad.o
+ obj-$(CONFIG_OMAP_PS2) += innovator_ps2.o
+Index: linux-2.6.16/drivers/input/keyboard/omap-keypad.c
+===================================================================
+--- linux-2.6.16.orig/drivers/input/keyboard/omap-keypad.c 2007-04-12 10:36:07.000000000 +0200
++++ linux-2.6.16/drivers/input/keyboard/omap-keypad.c 2007-04-12 10:36:19.000000000 +0200
+@@ -43,7 +43,7 @@
+ #include <asm/mach-types.h>
+ #include <asm/arch/mux.h>
+
+-#undef NEW_BOARD_LEARNING_MODE
++#define NEW_BOARD_LEARNING_MODE
+
+ static void omap_kp_tasklet(unsigned long);
+ static void omap_kp_timer(unsigned long);
+@@ -292,6 +292,7 @@
+ struct omap_kp_platform_data *pdata = pdev->dev.platform_data;
+ int i;
+
++ printk("omap_kp_probe.\n");
+ if (!pdata->rows || !pdata->cols || !pdata->keymap) {
+ printk(KERN_ERR "No rows, cols or keymap from pdata\n");
+ return -EINVAL;
+Index: linux-2.6.16/drivers/input/keyboard/tornado-keypad.c
+===================================================================
+--- /dev/null 1970-01-01 00:00:00.000000000 +0000
++++ linux-2.6.16/drivers/input/keyboard/tornado-keypad.c 2007-04-12 10:36:19.000000000 +0200
+@@ -0,0 +1,463 @@
++/*
++** wizard-keypad.c for wizard-keypad in /home/nico/work/tornado/linux-tornado
++**
++** Made by nico
++** Login <nico@chac.le-poulpe.net>
++**
++** Started on Thu Apr 6 17:27:18 2006 nico
++** Last update Thu May 25 14:12:34 2006 nico
++*/
++
++/*
++ * HTC Tornado keypad driver.
++ * Copyright (C) 2006 Nicolas Schichan
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License as
++ * published by the Free Software Foundation; either version 2 of the
++ * License, or (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ * General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
++ * 02110-1301, USA.
++ *
++ */
++
++/*
++ * based on omap-keypad.c
++ */
++
++#include <linux/init.h>
++#include <linux/kernel.h>
++#include <linux/interrupt.h>
++#include <linux/types.h>
++#include <linux/input.h>
++
++#include <asm/arch/gpio.h>
++#include <asm/arch/io.h>
++#include <asm/mach-types.h>
++#include <asm/delay.h>
++
++#undef DEBUG
++// #define DEBUG
++
++struct input_dev *tornado_kp_dev = NULL;
++
++static unsigned char kp_state[8];
++static void tornado_kp_tasklet(unsigned long);
++static void tornado_kp_gpio_tasklet(unsigned long);
++static DECLARE_TASKLET_DISABLED(kp_tasklet, tornado_kp_tasklet, 0);
++static DECLARE_TASKLET_DISABLED(kp_gpio_tasklet, tornado_kp_gpio_tasklet, 0);
++static struct timer_list kp_timer;
++static struct timer_list kp_gpio_timer;
++
++unsigned int gpio_mask = 0;
++unsigned int kp_gpio = 0;
++
++#define TORNADO_KP_GPIO 76
++
++/*
++ * key tables. a bit more complex than those in the omap-keypad
++ * driver: HTC devices keys events tends to trigger two or more
++ * row/col.
++ */
++struct htc_key
++{
++ /*
++ * input key constant as defined in input.h
++ */
++ int key;
++ /* rc stands for row/col
++ * 2 * k -> col;
++ * 2 * k + 1-> row
++ */
++ char rc[6];
++};
++
++struct gpio_key
++{
++ int key;
++ unsigned int mask;
++};
++
++static struct htc_key *htc_keys = NULL;
++static unsigned int htc_keys_size = 0;
++static struct gpio_key *gpio_keys = 0;
++static unsigned int gpio_keys_size= 0;
++
++
++/*
++ * Tornado stuff ...
++ */
++static struct htc_key tornado_keys[] =
++{
++ /* misc keys below the screen */
++ { KEY_F3, { 1,3 } }, /* SK1 */
++ { KEY_BACKSPACE, { 4,3 } },
++ { KEY_HOME, { 3,3 } },
++ { KEY_F4, { 2,3 } }, /* SK2 */
++ { KEY_F5, { 3,5 } }, /* compose */
++ { KEY_ESC, { 4,5 } }, /* hangup */
++
++ /* digit keys */
++ { KEY_1, { 1,0 } },
++ { KEY_2, { 2,0 } },
++ { KEY_3, { 3,0 } },
++ { KEY_4, { 4,0 } },
++ { KEY_5, { 1,1 } },
++ { KEY_6, { 2,1 } },
++ { KEY_7, { 3,1 } },
++ { KEY_8, { 4,1 } },
++ { KEY_9, { 1,2 } },
++ { KEY_0, { 2,2 } },
++ { KEY_KPASTERISK, { 3,2 } },
++ { KEY_SPACE, { 4,2 } },
++
++ /* side buttons: currently bogus */
++/* { KEY_CAMERA, { 5,6, 6,6 } }, */
++/* { KEY_VOLUMEUP, { 4,6, 5,6 } }, */
++/* { KEY_VOLUMEDOWN, { 7,6, 6,6 } }, */
++/* { KEY_FAVORITES, { 2,6, 3,6 } } */
++
++ /* add side keys: photo, volume, ...*/
++
++};
++
++static struct gpio_key tornado_gpio_keys[] =
++{
++ { KEY_ENTER, 0x1 },
++ { KEY_LEFT, 0x19 },
++ { KEY_RIGHT, 0x7 },
++ { KEY_UP, 0x15 },
++ { KEY_DOWN, 0xB },
++};
++
++/*
++ * handy macros for kp register manipulation
++ */
++# define KBD_MASKIT __REG16((long)OMAP_MPUIO_BASE + OMAP_MPUIO_KBD_MASKIT)
++# define KBC __REG16((long)OMAP_MPUIO_BASE + OMAP_MPUIO_KBC)
++# define KBR_LATCH __REG16((long)OMAP_MPUIO_BASE + OMAP_MPUIO_KBR_LATCH)
++
++/*
++ * return the key code understood by input_report_key
++ */
++static int
++tornado_find_key(unsigned char *new_state, unsigned int *key_state)
++{
++ int i;
++ unsigned char changed;
++
++ /* scan normal keypad keys*/
++ for (i = 0; i < htc_keys_size; ++i) {
++ struct htc_key *wk = &htc_keys[i];
++ int j;
++ int pressed = 0;
++
++ for (j = 0; j < 3; ++j) {
++ int col;
++ int row;
++
++ col = wk->rc[2 * j];
++ row = wk->rc[2 * j + 1];
++
++
++ /* end of key list reached: OK */
++ if (row == 0 && col == 0) {
++ goto ok;
++ }
++
++ changed = new_state[col] ^ kp_state[col];
++ pressed |= new_state[col] & (1 << row);
++
++
++ /* if state of the row/col has not changed, try another key */
++ if ( (changed & (1 << row)) == 0) {
++ break ;
++ }
++
++ if (j == 2) {
++ ok:
++ /*
++ * all events have been scanned for
++ * this key: we found it !
++ */
++ *key_state = pressed;
++ return wk->key;
++ }
++ }
++ }
++ return -1;
++}
++
++/*
++ * read row and col register and update the state array.
++ */
++static void
++tornado_scan_keypad(unsigned char *state)
++{
++ unsigned int col;
++
++ /* scan MPUIO keypad keys */
++ KBC = 0xFF;
++ for (col = 0; col < 8; ++col) {
++ KBC = ~(1 << col) & 0xFF;
++ udelay(4);
++ state[col] = ~(KBR_LATCH) & 0xFF;
++ }
++ KBC = 0x00;
++
++ udelay(2);
++}
++
++/*
++ * returns 1 if a key was pressed or 0 if a key was released.
++ */
++static int
++tornado_key_pressed(unsigned char *state)
++{
++ unsigned int col;
++ int key_down = 0;
++
++ for (col = 0; col < 8; ++col) {
++#ifdef DEBUG
++ unsigned char changed;
++ unsigned int row;
++
++ changed = kp_state[col] ^ state[col];
++
++ for (row = 0; row < 8; ++row) {
++ unsigned int pressed;
++
++ pressed = state[col] & (1 << row);
++ if (changed & (1 << row)) {
++ printk("key down: %i-%i: %s\n", col, row, pressed ? "pressed" : "released");
++ }
++
++ }
++#endif
++ key_down |= state[col];
++ }
++
++ return key_down;
++}
++
++/*
++ * the real work is done here: at the end, if a key is pressed, keep
++ * kp interrupt masked and schedule a call to the tasklet after a bit
++ * (mod_timer ...). this is done to avoid the trigger of too much kp
++ * interrupts .
++ */
++static void
++tornado_kp_tasklet(unsigned long param)
++{
++ unsigned char state[8];
++ int key_down;
++ int pressed = 0;
++ int key;
++
++ tornado_scan_keypad(state);
++ key_down = tornado_key_pressed(state);
++
++ key = tornado_find_key(state, &pressed);
++ if (key != -1) {
++
++ input_report_key(tornado_kp_dev, key, pressed);
++ }
++
++ memcpy(kp_state, state, sizeof (kp_state));
++
++ if (key_down) {
++ /*
++ * if a key is down, poll the keypad and keep irq
++ * disabled
++ */
++ int delay = HZ / 20;
++
++ mod_timer(&kp_timer, jiffies + delay);
++ } else
++ KBD_MASKIT = 0;
++}
++
++static void
++tornado_kp_timer(unsigned long data)
++{
++ tasklet_schedule(&kp_tasklet);
++}
++
++/*
++ * nothing is done here: disable KP interrupts and schedule a call to
++ * tornado_kp_tasklet.
++ */
++static irqreturn_t
++tornado_kp_interrupt(int irq, void *dev_id, struct pt_regs *regs)
++{
++ /* disable keypad interrupts and schedule the tasklet */
++ KBD_MASKIT = 1;
++ tasklet_schedule(&kp_tasklet);
++
++ return IRQ_HANDLED;
++}
++
++static void
++tornado_kp_gpio_tasklet(unsigned long param)
++{
++ unsigned int mask;
++ unsigned int changed;
++ unsigned int pressed;
++ static int old_key = 0;
++ int key;
++ int i;
++
++
++ /* GPIO are active low ! */
++ mask = !omap_get_gpio_datain(76);
++ mask |= !omap_get_gpio_datain(80) << 1;
++ mask |= !omap_get_gpio_datain(81) << 2;
++ mask |= !omap_get_gpio_datain(82) << 3;
++ mask |= !omap_get_gpio_datain(83) << 4;
++
++ pressed = mask & 0x1;
++
++
++ changed = mask ^ gpio_mask;
++ if (changed == 0)
++ goto end;
++
++ if (pressed == 0)
++ key = 0;
++ else {
++ key = 0;
++ for (i = 0; i < 5; ++i) {
++ if (gpio_keys[i].mask == mask) {
++ key = gpio_keys[i].key;
++ break;
++ }
++ }
++ }
++
++ if (key != old_key) {
++ if (old_key)
++ input_report_key(tornado_kp_dev, old_key, 0);
++ if (key)
++ input_report_key(tornado_kp_dev, key, 1);
++ old_key = key;
++ }
++
++ gpio_mask = mask;
++
++ end:
++ if (pressed) {
++ int delay = HZ / 20;
++ mod_timer(&kp_gpio_timer, jiffies + delay);
++ } else {
++ enable_irq(OMAP_GPIO_IRQ(kp_gpio));
++ }
++}
++
++static irqreturn_t
++tornado_kp_gpio_interrupt(int irq, void *dev_id, struct pt_regs *regs)
++{
++ disable_irq(OMAP_GPIO_IRQ(kp_gpio));
++ tasklet_schedule(&kp_gpio_tasklet);
++ return IRQ_HANDLED;
++}
++
++static void
++tornado_kp_gpio_timer(unsigned long data)
++{
++ tasklet_schedule(&kp_gpio_tasklet);
++}
++
++static int __init
++tornado_kp_init(void)
++{
++ unsigned int i;
++
++ printk("HTC Tornado Keypad Driver.\n");
++
++ KBD_MASKIT = 1;
++
++ /* select key tables */
++ if (machine_is_htc_tornado()) {
++ htc_keys = tornado_keys;
++ htc_keys_size = ARRAY_SIZE(tornado_keys);
++ gpio_keys = tornado_gpio_keys;
++ gpio_keys_size = ARRAY_SIZE(tornado_gpio_keys);
++ kp_gpio = TORNADO_KP_GPIO;
++
++ printk("Using HTC Tornado keymap.\n");
++ } else {
++ printk("machine is unknown: not loading driver.\n");
++ return -EINVAL;
++ }
++
++ tornado_kp_dev = input_allocate_device();
++ if (tornado_kp_dev == NULL) {
++ printk("unable to allocate tornado_kp_dev.\n");
++ return -ENOMEM;
++ }
++ tornado_kp_dev->name = "tornado-keypad";
++
++
++ init_timer(&kp_timer);
++ kp_timer.function = tornado_kp_timer;
++ tasklet_enable(&kp_tasklet);
++ if (request_irq(INT_730_MPUIO_KEYPAD, tornado_kp_interrupt, 0, "tornado-keypad", 0)) {
++ printk("unable to get IRQ for tornado-keypad.\n");
++ return -EBUSY;
++ }
++
++ set_bit(EV_KEY, tornado_kp_dev->evbit);
++ for (i = 0; i < KEY_MAX; ++i) {
++ set_bit(i, tornado_kp_dev->keybit);
++ }
++ input_register_device(tornado_kp_dev);
++
++ if (kp_gpio) {
++ /* request arrow keys GPIOS */
++ if (omap_request_gpio(kp_gpio) < 0) {
++ printk("unable to request GPIO %i\n", 76);
++ return -EBUSY;
++ }
++ /* set gpio mode to IN for all kp gpios */
++ omap_set_gpio_direction(kp_gpio, 1);
++ omap_set_gpio_direction(80, 1);
++ omap_set_gpio_direction(81, 1);
++ omap_set_gpio_direction(82, 1);
++ omap_set_gpio_direction(83, 1);
++
++ init_timer(&kp_gpio_timer);
++ kp_gpio_timer.function = tornado_kp_gpio_timer;
++ tasklet_enable(&kp_gpio_tasklet);
++
++ /* be notified when keys are pressed */
++ if (request_irq(OMAP_GPIO_IRQ(kp_gpio), tornado_kp_gpio_interrupt, SA_TRIGGER_FALLING, "tornado-kp-gpio", 0)) {
++ printk("unable to request GPIO IRQ %i\n", 76);
++ return -EBUSY;
++ }
++ }
++
++ tornado_scan_keypad(kp_state);
++ KBD_MASKIT = 0;
++ return 0;
++}
++
++void __exit
++tornado_kp_exit(void)
++{
++ KBD_MASKIT = 1;
++}
++
++module_init(tornado_kp_init);
++module_exit(tornado_kp_exit);
++
++MODULE_AUTHOR("Nicolas Schichan <nico@chac.le-poulpe.net>");
++MODULE_LICENSE("GPL");
++MODULE_DESCRIPTION("HTC Tornado Keypad Driver");
+Index: linux-2.6.16/drivers/mmc/omap.c
+===================================================================
+--- linux-2.6.16.orig/drivers/mmc/omap.c 2007-04-12 10:36:07.000000000 +0200
++++ linux-2.6.16/drivers/mmc/omap.c 2007-04-12 10:36:19.000000000 +0200
+@@ -160,10 +160,10 @@
+ u32 resptype;
+ u32 cmdtype;
+
+- pr_debug("MMC%d: CMD%d, argument 0x%08x%s%s%s%s\n",
++ pr_debug("MMC%d: CMD%d, argument 0x%08x%s%s\n",
+ host->id, cmd->opcode, cmd->arg,
+- (cmd->flags & MMC_RSP_SHORT) ? ", 32-bit response" : "",
+- (cmd->flags & MMC_RSP_LONG) ? ", 128-bit response" : "",
++/* (cmd->flags & MMC_RSP_SHORT) ? ", 32-bit response" : "", */
++/* (cmd->flags & MMC_RSP_LONG) ? ", 128-bit response" : "", */
+ (cmd->flags & MMC_RSP_CRC) ? ", CRC" : "",
+ (cmd->flags & MMC_RSP_BUSY) ? ", busy notification" : "");
+
+Index: linux-2.6.16/drivers/mmc/omap.h
+===================================================================
+--- linux-2.6.16.orig/drivers/mmc/omap.h 2007-04-12 10:36:07.000000000 +0200
++++ linux-2.6.16/drivers/mmc/omap.h 2007-04-12 10:36:19.000000000 +0200
+@@ -1,31 +1,66 @@
+ #ifndef DRIVERS_MEDIA_MMC_OMAP_H
+ #define DRIVERS_MEDIA_MMC_OMAP_H
+
+-#define OMAP_MMC_REG_CMD 0x00
+-#define OMAP_MMC_REG_ARGL 0x04
+-#define OMAP_MMC_REG_ARGH 0x08
+-#define OMAP_MMC_REG_CON 0x0c
+-#define OMAP_MMC_REG_STAT 0x10
+-#define OMAP_MMC_REG_IE 0x14
+-#define OMAP_MMC_REG_CTO 0x18
+-#define OMAP_MMC_REG_DTO 0x1c
+-#define OMAP_MMC_REG_DATA 0x20
+-#define OMAP_MMC_REG_BLEN 0x24
+-#define OMAP_MMC_REG_NBLK 0x28
+-#define OMAP_MMC_REG_BUF 0x2c
+-#define OMAP_MMC_REG_SDIO 0x34
+-#define OMAP_MMC_REG_REV 0x3c
+-#define OMAP_MMC_REG_RSP0 0x40
+-#define OMAP_MMC_REG_RSP1 0x44
+-#define OMAP_MMC_REG_RSP2 0x48
+-#define OMAP_MMC_REG_RSP3 0x4c
+-#define OMAP_MMC_REG_RSP4 0x50
+-#define OMAP_MMC_REG_RSP5 0x54
+-#define OMAP_MMC_REG_RSP6 0x58
+-#define OMAP_MMC_REG_RSP7 0x5c
+-#define OMAP_MMC_REG_IOSR 0x60
+-#define OMAP_MMC_REG_SYSC 0x64
+-#define OMAP_MMC_REG_SYSS 0x68
++#ifdef CONFIG_ARCH_OMAP730
++/*
++ * unlike other omap architectures, omap730 has 16bits MMC register
++ * offsets ...
++ */
++# define OMAP_MMC_REG_CMD 0x00
++# define OMAP_MMC_REG_ARGL 0x02
++# define OMAP_MMC_REG_ARGH 0x04
++# define OMAP_MMC_REG_CON 0x06
++# define OMAP_MMC_REG_STAT 0x08
++# define OMAP_MMC_REG_IE 0x0a
++# define OMAP_MMC_REG_CTO 0x0c
++# define OMAP_MMC_REG_DTO 0x0e
++# define OMAP_MMC_REG_DATA 0x10
++# define OMAP_MMC_REG_BLEN 0x12
++# define OMAP_MMC_REG_NBLK 0x14
++# define OMAP_MMC_REG_BUF 0x16
++# define OMAP_MMC_REG_SDIO 0x1a
++# define OMAP_MMC_REG_REV 0x1e
++# define OMAP_MMC_REG_RSP0 0x20
++# define OMAP_MMC_REG_RSP1 0x22
++# define OMAP_MMC_REG_RSP2 0x24
++# define OMAP_MMC_REG_RSP3 0x26
++# define OMAP_MMC_REG_RSP4 0x28
++# define OMAP_MMC_REG_RSP5 0x2a
++# define OMAP_MMC_REG_RSP6 0x2c
++# define OMAP_MMC_REG_RSP7 0x2e
++# define OMAP_MMC_REG_IOSR 0x30
++# define OMAP_MMC_REG_SYSC 0x32
++# define OMAP_MMC_REG_SYSS 0x34
++
++#else
++
++# define OMAP_MMC_REG_CMD 0x00
++# define OMAP_MMC_REG_ARGL 0x04
++# define OMAP_MMC_REG_ARGH 0x08
++# define OMAP_MMC_REG_CON 0x0c
++# define OMAP_MMC_REG_STAT 0x10
++# define OMAP_MMC_REG_IE 0x14
++# define OMAP_MMC_REG_CTO 0x18
++# define OMAP_MMC_REG_DTO 0x1c
++# define OMAP_MMC_REG_DATA 0x20
++# define OMAP_MMC_REG_BLEN 0x24
++# define OMAP_MMC_REG_NBLK 0x28
++# define OMAP_MMC_REG_BUF 0x2c
++# define OMAP_MMC_REG_SDIO 0x34
++# define OMAP_MMC_REG_REV 0x3c
++# define OMAP_MMC_REG_RSP0 0x40
++# define OMAP_MMC_REG_RSP1 0x44
++# define OMAP_MMC_REG_RSP2 0x48
++# define OMAP_MMC_REG_RSP3 0x4c
++# define OMAP_MMC_REG_RSP4 0x50
++# define OMAP_MMC_REG_RSP5 0x54
++# define OMAP_MMC_REG_RSP6 0x58
++# define OMAP_MMC_REG_RSP7 0x5c
++# define OMAP_MMC_REG_IOSR 0x60
++# define OMAP_MMC_REG_SYSC 0x64
++# define OMAP_MMC_REG_SYSS 0x68
++
++#endif
+
+ #define OMAP_MMC_STAT_CARD_ERR (1 << 14)
+ #define OMAP_MMC_STAT_CARD_IRQ (1 << 13)
+Index: linux-2.6.16/drivers/usb/gadget/omap_udc.c
+===================================================================
+--- linux-2.6.16.orig/drivers/usb/gadget/omap_udc.c 2007-04-12 10:36:07.000000000 +0200
++++ linux-2.6.16/drivers/usb/gadget/omap_udc.c 2007-04-12 10:36:19.000000000 +0200
+@@ -60,7 +60,7 @@
+ #undef USB_TRACE
+
+ /* bulk DMA seems to be behaving for both IN and OUT */
+-#define USE_DMA
++/* #define USE_DMA */
+
+ /* ISO too */
+ #define USE_ISO
+@@ -2147,7 +2147,8 @@
+ /* boards that don't have VBUS sensing can't autogate 48MHz;
+ * can't enter deep sleep while a gadget driver is active.
+ */
+- if (machine_is_omap_innovator() || machine_is_omap_osk())
++ if (machine_is_omap_innovator() || machine_is_omap_osk() ||
++ machine_is_htc_tornado())
+ omap_vbus_session(&udc->gadget, 1);
+
+ done:
+@@ -2170,7 +2171,8 @@
+ if (udc->dc_clk != NULL)
+ omap_udc_enable_clock(1);
+
+- if (machine_is_omap_innovator() || machine_is_omap_osk())
++ if (machine_is_omap_innovator() || machine_is_omap_osk() ||
++ machine_is_htc_tornado())
+ omap_vbus_session(&udc->gadget, 0);
+
+ if (udc->transceiver)
+Index: linux-2.6.16/drivers/video/backlight/Kconfig
+===================================================================
+--- linux-2.6.16.orig/drivers/video/backlight/Kconfig 2006-03-20 06:53:29.000000000 +0100
++++ linux-2.6.16/drivers/video/backlight/Kconfig 2007-04-12 10:36:19.000000000 +0200
+@@ -58,3 +58,10 @@
+ If you have a HP Jornada 680, say y to enable the
+ backlight driver.
+
++
++config BACKLIGHT_TORNADO
++ tristate "HTC Tornado Backlight Driver."
++ depends on BACKLIGHT_DEVICE && MACH_TORNADO
++ default y
++ help
++ Backlight driver for the HTC Tornado smartphones.
+Index: linux-2.6.16/drivers/video/backlight/Makefile
+===================================================================
+--- linux-2.6.16.orig/drivers/video/backlight/Makefile 2006-03-20 06:53:29.000000000 +0100
++++ linux-2.6.16/drivers/video/backlight/Makefile 2007-04-12 10:36:19.000000000 +0200
+@@ -5,3 +5,4 @@
+ obj-$(CONFIG_BACKLIGHT_CORGI) += corgi_bl.o
+ obj-$(CONFIG_BACKLIGHT_HP680) += hp680_bl.o
+ obj-$(CONFIG_SHARP_LOCOMO) += locomolcd.o
++obj-$(CONFIG_BACKLIGHT_TORNADO) += tornado-bl.o
+\ No newline at end of file
+Index: linux-2.6.16/drivers/video/backlight/tornado-bl.c
+===================================================================
+--- /dev/null 1970-01-01 00:00:00.000000000 +0000
++++ linux-2.6.16/drivers/video/backlight/tornado-bl.c 2007-04-12 10:36:19.000000000 +0200
+@@ -0,0 +1,224 @@
++/*
++** tornado-bl.c for bl in /home/nico/work/tornado/linux-tornado
++**
++** Made by nico
++** Login <nico@chac.le-poulpe.net>
++**
++** Started on Wed Apr 12 16:53:40 2006 nico
++** Last update Thu May 25 13:53:14 2006 nico
++*/
++
++/*
++ *
++ * HTC Tornado & Typhoon backlight driver.
++ * Copyright (C) 2006 Nicolas Schichan
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License as
++ * published by the Free Software Foundation; either version 2 of the
++ * License, or (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ * General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
++ * 02110-1301, USA.
++ *
++ */
++
++#include <linux/module.h>
++#include <linux/kernel.h>
++#include <linux/init.h>
++#include <linux/device.h>
++#include <linux/spinlock.h>
++#include <linux/fb.h>
++#include <linux/backlight.h>
++#include <linux/platform_device.h>
++
++#include <asm/mach-types.h>
++#include <asm/arch/gpio.h>
++#include <linux/delay.h>
++
++#define TORNADO_LCD_RESET_GPIO 15
++#define TORNADO_LCD_OUT_EN_GPIO 77
++#define TORNADO_LCD_POWER_GPIO 121
++#define TORNADO_BL_GPIO 126
++#define TORNADO_LCD_INTENSITY_GPIO 124
++#define TORNADO_LCD_CLOCK_GPIO 127
++
++static int tornado_bl_powermode = FB_BLANK_UNBLANK;
++static int current_intensity = 1;
++
++
++/*
++ * TODO: see TRM to disable also the internal lcd clock and reenable
++ * it when needed.
++ */
++static int
++tornado_bl_set_power(struct backlight_device *bd, int state)
++{
++ if (state == tornado_bl_powermode)
++ return 0;
++ switch (state) {
++ case FB_BLANK_NORMAL:
++ case FB_BLANK_VSYNC_SUSPEND:
++ case FB_BLANK_HSYNC_SUSPEND:
++ case FB_BLANK_POWERDOWN:
++ omap_set_gpio_dataout(TORNADO_BL_GPIO, 0);
++ omap_set_gpio_dataout(TORNADO_LCD_CLOCK_GPIO, 0);
++ omap_set_gpio_dataout(TORNADO_LCD_INTENSITY_GPIO, 0);
++
++ omap_set_gpio_dataout(TORNADO_LCD_OUT_EN_GPIO, 0);
++ omap_set_gpio_dataout(TORNADO_LCD_RESET_GPIO, 0);
++ omap_set_gpio_dataout(TORNADO_LCD_POWER_GPIO, 0);
++ break;
++
++ case FB_BLANK_UNBLANK:
++ omap_set_gpio_dataout(TORNADO_LCD_POWER_GPIO, 1);
++ omap_set_gpio_dataout(TORNADO_LCD_RESET_GPIO, 1);
++ omap_set_gpio_dataout(TORNADO_LCD_OUT_EN_GPIO, 1);
++
++ omap_set_gpio_dataout(TORNADO_LCD_CLOCK_GPIO, 1);
++ /* restore previous lcd intensity */
++ omap_set_gpio_dataout(TORNADO_LCD_INTENSITY_GPIO, current_intensity);
++ /*
++ * need to sleep a little bit to allow lcd clock to
++ * resume completly. avoids a white flickering screen
++ * that would otherwise be visible for a few
++ * milliseconds.
++ *
++ * we use schedule timoueout here to allow any process
++ * that might want to use the CPU to run. this should
++ * not be a problem here.
++ */
++ schedule_timeout_interruptible(10);
++ omap_set_gpio_dataout(TORNADO_BL_GPIO, 1);
++ break;
++ }
++ tornado_bl_powermode = state;
++ return 0;
++}
++
++static int
++tornado_bl_get_power(struct backlight_device *bd)
++{
++ return tornado_bl_powermode;
++}
++
++static int
++tornado_bl_get_intensity(struct backlight_device *bd)
++{
++ return current_intensity;
++}
++
++static int
++tornado_bl_set_intensity(struct backlight_device *bd, int intensity)
++{
++ if (intensity < 0)
++ intensity = 0;
++ if (intensity > 1)
++ intensity = 1;
++ omap_set_gpio_dataout(TORNADO_LCD_INTENSITY_GPIO, intensity);
++ current_intensity = intensity;
++
++ return 0;
++}
++
++static struct backlight_properties tornado_bl = {
++ .owner = THIS_MODULE,
++ .get_power = tornado_bl_get_power,
++ .max_brightness = 1,
++ .set_power = tornado_bl_set_power,
++ .set_brightness = tornado_bl_set_intensity,
++ .get_brightness = tornado_bl_get_intensity,
++};
++
++static struct backlight_device *tornado_backlight_device;
++
++static int __init
++tornado_bl_probe(struct device *dev)
++{
++ tornado_backlight_device = backlight_device_register("tornado-bl", NULL, &tornado_bl);
++ if (IS_ERR(tornado_backlight_device))
++ return PTR_ERR(tornado_backlight_device);
++ return 0;
++}
++
++static int __init
++tornado_bl_remove(struct device *dev)
++{
++ printk("deregistering tornado-bl device.\n");
++ backlight_device_unregister(tornado_backlight_device);
++ return 0;
++}
++
++static struct device_driver tornado_bl_driver = {
++ .name = "tornado-bl",
++ .bus = &platform_bus_type,
++ .probe = tornado_bl_probe,
++ .remove = tornado_bl_remove,
++ .suspend = NULL,
++ .resume = NULL,
++};
++
++static struct platform_device tornado_bl_device = {
++ .name = "tornado-bl",
++ .id = -1,
++};
++
++
++static int __init
++tornado_bl_init(void)
++{
++ int ret;
++
++ omap_request_gpio(TORNADO_LCD_RESET_GPIO);
++ omap_request_gpio(TORNADO_LCD_OUT_EN_GPIO);
++ omap_request_gpio(TORNADO_LCD_POWER_GPIO);
++ omap_request_gpio(TORNADO_BL_GPIO);
++ omap_request_gpio(TORNADO_LCD_INTENSITY_GPIO);
++ omap_request_gpio(TORNADO_LCD_CLOCK_GPIO);
++
++ ret = driver_register(&tornado_bl_driver);
++ if (ret)
++ goto error;
++
++ ret = platform_device_register(&tornado_bl_device);
++ if (ret)
++ goto error;
++
++ omap_set_gpio_direction(TORNADO_BL_GPIO, 0); /* out */
++ printk("HTC Tornado Backlight driver.\n");
++ return 0;
++
++ error:
++ platform_device_unregister(&tornado_bl_device);
++ driver_unregister(&tornado_bl_driver);
++ omap_free_gpio(TORNADO_BL_GPIO);
++ return ret;
++}
++
++static void __exit
++tornado_bl_exit(void)
++{
++ /* FIXME: this freezes the system when unloading ... */
++ platform_device_unregister(&tornado_bl_device);
++ driver_unregister(&tornado_bl_driver);
++ omap_request_gpio(TORNADO_LCD_RESET_GPIO);
++ omap_request_gpio(TORNADO_LCD_OUT_EN_GPIO);
++ omap_request_gpio(TORNADO_LCD_POWER_GPIO);
++ omap_request_gpio(TORNADO_BL_GPIO);
++ omap_request_gpio(TORNADO_LCD_INTENSITY_GPIO);
++ omap_request_gpio(TORNADO_LCD_CLOCK_GPIO);
++}
++
++module_init(tornado_bl_init);
++module_exit(tornado_bl_exit);
++
++MODULE_AUTHOR("Nicolas Schichan");
++MODULE_DESCRIPTION("HTC Tornado LCD Backlight driver.");
++MODULE_LICENSE("GPL");
+Index: linux-2.6.16/drivers/video/Kconfig
+===================================================================
+--- linux-2.6.16.orig/drivers/video/Kconfig 2007-04-12 10:36:07.000000000 +0200
++++ linux-2.6.16/drivers/video/Kconfig 2007-04-12 10:36:19.000000000 +0200
+@@ -1428,6 +1428,16 @@
+
+ source "drivers/video/omap/Kconfig"
+
++config FB_VSFB
++ bool "VSFB for HTC OMAP based phones"
++ depends on FB && MACH_TORNADO
++ select FB_CFB_FILLRECT
++ select FB_CFB_COPYAREA
++ select FB_CFB_IMAGEBLIT
++ help
++ Hacked version of the original VSFB for HTC based OMAP
++ smartphones (320x240 screen and vram at 0x20001020).
++
+ config FB_VIRTUAL
+ tristate "Virtual Frame Buffer support (ONLY FOR TESTING!)"
+ depends on FB
+Index: linux-2.6.16/drivers/video/logo/Kconfig
+===================================================================
+--- linux-2.6.16.orig/drivers/video/logo/Kconfig 2006-03-20 06:53:29.000000000 +0100
++++ linux-2.6.16/drivers/video/logo/Kconfig 2007-04-12 10:36:20.000000000 +0200
+@@ -71,4 +71,3 @@
+ default y
+
+ endmenu
+-
+Index: linux-2.6.16/drivers/video/logo/logo.c
+===================================================================
+--- linux-2.6.16.orig/drivers/video/logo/logo.c 2006-03-20 06:53:29.000000000 +0100
++++ linux-2.6.16/drivers/video/logo/logo.c 2007-04-12 10:36:20.000000000 +0200
+@@ -35,7 +35,6 @@
+ extern const struct linux_logo logo_superh_clut224;
+ extern const struct linux_logo logo_m32r_clut224;
+
+-
+ const struct linux_logo *fb_find_logo(int depth)
+ {
+ const struct linux_logo *logo = NULL;
+@@ -102,6 +101,7 @@
+ /* M32R Linux logo */
+ logo = &logo_m32r_clut224;
+ #endif
++
+ }
+ return logo;
+ }
+Index: linux-2.6.16/drivers/video/Makefile
+===================================================================
+--- linux-2.6.16.orig/drivers/video/Makefile 2007-04-12 10:36:07.000000000 +0200
++++ linux-2.6.16/drivers/video/Makefile 2007-04-12 10:36:20.000000000 +0200
+@@ -100,6 +100,7 @@
+ obj-$(CONFIG_FB_VGA16) += vga16fb.o vgastate.o
+ obj-$(CONFIG_FB_OF) += offb.o
+ obj-$(CONFIG_FB_OMAP) += omap/ cfbcopyarea.o cfbfillrect.o cfbimgblt.o
++obj-$(CONFIG_FB_VSFB) += vsfb.o
+
+ # the test framebuffer is last
+ obj-$(CONFIG_FB_VIRTUAL) += vfb.o
+Index: linux-2.6.16/drivers/video/vsfb.c
+===================================================================
+--- /dev/null 1970-01-01 00:00:00.000000000 +0000
++++ linux-2.6.16/drivers/video/vsfb.c 2007-04-12 10:36:20.000000000 +0200
+@@ -0,0 +1,187 @@
++/*
++ * linux/drivers/video/vsfb.c
++ *
++ * Copyright (C) 2003 Ian Molton
++ *
++ * Based on acornfb by Russell King
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ *
++ * Frame buffer code for Simple platforms
++ *
++ */
++
++#include <linux/config.h>
++#include <linux/module.h>
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/errno.h>
++#include <linux/string.h>
++#include <linux/ctype.h>
++#include <linux/mm.h>
++#include <linux/tty.h>
++#include <linux/slab.h>
++#include <linux/init.h>
++#include <linux/fb.h>
++#include <linux/ioport.h>
++
++#include <asm/hardware.h>
++#include <asm/io.h>
++#include <asm/irq.h>
++#include <asm/mach-types.h>
++#include <asm/uaccess.h>
++
++#include <linux/config.h>
++
++#undef FBCON_HAS_CFB8
++#undef FBCON_HAS_CFB2
++#undef FBCON_HAS_CFB4
++#undef FBCON_HAS_CFB32
++
++/* for screen geometry information */
++#include <asm/arch/efb.h>
++
++#define DEFAULT_BPP 16
++#define SCREEN_BASE (0x20001020)
++
++static struct fb_info fb_info;
++static u32 colreg[17]; // Copied from other driver - but is 17 correct?
++
++
++static int
++vsfb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
++ u_int trans, struct fb_info *info)
++{
++ if (regno > 16)
++ return 1;
++
++ ((u32 *)(info->pseudo_palette))[regno] = (red & 0xf800) | ((green & 0xfc00) >> 5) | ((blue & 0xf800) >> 11);
++
++ return 0;
++}
++
++/* extern int soft_cursor(struct fb_info *info, struct fb_cursor *cursor); */
++
++static struct fb_ops vsfb_ops = {
++ .owner = THIS_MODULE,
++ .fb_setcolreg = vsfb_setcolreg,
++ .fb_fillrect = cfb_fillrect,
++ .fb_copyarea = cfb_copyarea,
++ .fb_imageblit = cfb_imageblit,
++ .fb_cursor = NULL,
++};
++
++/*
++ * some members are initialized with 0: they will be properly
++ * initialized at run time, depending on the machine we are running
++ * on.
++ */
++static struct fb_var_screeninfo vsfb_var = {
++ .xres = 0,
++ .yres = 0,
++ .xres_virtual = 0,
++ .yres_virtual = 0,
++ .bits_per_pixel = 16,
++ .red = { 11, 5, 0 },
++ .green = { 5, 6, 0 },
++ .blue = { 0, 5, 0 },
++ .activate = FB_ACTIVATE_NOW,
++ .height = -1,
++ .width = -1,
++ .vmode = FB_VMODE_NONINTERLACED,
++ .pixclock = 12500, /* same as pixclock as P2 frame buffer driver. */
++};
++
++static struct fb_fix_screeninfo vsfb_fix = {
++ .id = "HTC VSFB",
++ .smem_start = SCREEN_BASE,
++ .smem_len = 0,
++ .type = FB_TYPE_PACKED_PIXELS,
++ .visual = FB_VISUAL_TRUECOLOR,
++ .line_length = 0,
++ .accel = FB_ACCEL_NONE,
++};
++
++#define OMAP_LCDC_BASE 0xfffec000
++#define OMAP_LCDC_CONTROL (OMAP_LCDC_BASE + 0x00)
++#define OMAP_LCDC_STATUS (OMAP_LCDC_BASE + 0x10)
++#define OMAP_DMA_LCD_BASE 0xfffee300
++#define OMAP_DMA_LCD_CCR (OMAP_DMA_LCD_BASE + 0xc2)
++#define OMAP_DMA_LCD_CTRL (OMAP_DMA_LCD_BASE + 0xc4)
++
++int __init
++vsfb_init(void)
++{
++
++ printk("VSFB Frame buffer driver for HTC OMAP Based Phones.\n");
++
++ fb_info.fix = vsfb_fix;
++ fb_info.var = vsfb_var;
++
++ fb_info.fbops = &vsfb_ops;
++ fb_info.flags = FBINFO_FLAG_DEFAULT;
++ fb_info.pseudo_palette = colreg;
++ fb_alloc_cmap(&fb_info.cmap, 16, 0);
++
++ if (machine_is_typhoon()) {
++ fb_info.var.xres = 176;
++ fb_info.var.yres = 220;
++ } else {
++ fb_info.var.xres = 240;
++ fb_info.var.yres = 320;
++ }
++
++ fb_info.var.xres_virtual = fb_info.var.xres;
++ fb_info.var.yres_virtual = fb_info.var.yres;
++ fb_info.fix.line_length = fb_info.var.xres * 2;
++ fb_info.fix.smem_len = fb_info.var.xres * fb_info.var.yres * 2;
++
++#ifdef CONFIG_EFB_DEBUG
++ /*
++ * disable efb so that only one acces the frame buffer
++ */
++ efb_disable();
++#endif
++
++
++ /* Try to grab our phys memory space... */
++ if (!(request_mem_region(fb_info.fix.smem_start, fb_info.fix.smem_len, "HTC vsfb"))){
++#ifdef CONFIG_EFB_DEBUG
++ efb_enable();
++#endif
++ printk("unable to request addr %p (len %i) for HTC VSFB.\n", fb_info.fix.smem_start, fb_info.fix.smem_len);
++ return -ENOMEM;
++ }
++
++ /* Try to map this so we can access it */
++ fb_info.screen_base = ioremap(fb_info.fix.smem_start, fb_info.fix.smem_len);
++ if (!fb_info.screen_base) {
++#ifdef CONFIG_EFB_DEBUG
++ efb_enable();
++#endif
++ printk("unable to ioremap %p for HTC vsfb.\n", fb_info.fix.smem_start);
++ release_mem_region(fb_info.fix.smem_start, fb_info.fix.smem_len);
++ return -EIO;
++ }
++
++ printk(KERN_INFO "vsfb: framebuffer at 0x%lx, mapped to 0x%p, size %dk\n",
++ fb_info.fix.smem_start, fb_info.screen_base, fb_info.fix.smem_len/1024);
++
++ if (register_framebuffer(&fb_info) < 0){
++#ifdef CONFIG_EFB_DEBUG
++ efb_enable();
++#endif
++ iounmap(fb_info.screen_base);
++ release_mem_region(fb_info.fix.smem_start, fb_info.fix.smem_len);
++ return -EINVAL;
++ }
++
++ return 0;
++}
++
++module_init(vsfb_init);
++MODULE_AUTHOR("Nicolas Schichan (based on VSFB by Ian Molton (based on acornfb by RMK and parts of anakinfb))");
++MODULE_DESCRIPTION("HTC Very Simple framebuffer driver");
++MODULE_LICENSE("GPL");
+Index: linux-2.6.16/include/asm-arm/arch-omap/efb.h
+===================================================================
+--- /dev/null 1970-01-01 00:00:00.000000000 +0000
++++ linux-2.6.16/include/asm-arm/arch-omap/efb.h 2007-04-12 10:36:20.000000000 +0200
+@@ -0,0 +1,56 @@
++/*
++** efb.h for efb in /home/nico/work/tornado/linux-tornado
++**
++** Made by nico
++** Login <nico@chac.le-poulpe.net>
++**
++** Started on Wed Apr 5 18:58:04 2006 nico
++** Last update Thu May 11 13:58:28 2006 nico
++*/
++
++/*
++ *
++ *
++ * Copyright (C) 2006 Nicolas Schichan
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License as
++ * published by the Free Software Foundation; either version 2 of the
++ * License, or (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ * General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
++ * 02110-1301, USA.
++ *
++ */
++
++#ifndef _EFB_H
++# define _EFB_H
++
++# include <linux/init.h>
++
++/*
++ * TODO: add __init and __initdata where applicable.
++ */
++
++void efb_init(void);
++void efb_putstr(const char *str);
++
++void efb_disable(void);
++void efb_enable(void);
++
++/* #define EFB_WIDTH 240 */
++/* #define EFB_HEIGHT 320 */
++
++extern const char efb_font[255][25];
++
++extern unsigned int efb_width;
++extern unsigned int efb_height;
++
++#endif /* !_EFB_H */
+Index: linux-2.6.16/include/asm-arm/arch-omap/omap730.h
+===================================================================
+--- linux-2.6.16.orig/include/asm-arm/arch-omap/omap730.h 2006-03-20 06:53:29.000000000 +0100
++++ linux-2.6.16/include/asm-arm/arch-omap/omap730.h 2007-04-12 10:36:20.000000000 +0200
+@@ -99,4 +99,3 @@
+ #define OMAP730_PCC_UPLD_CTRL (OMAP730_PCC_UPLD_CTRL_BASE + 0x00)
+
+ #endif /* __ASM_ARCH_OMAP730_H */
+-
+Index: linux-2.6.16/include/asm-arm/kexec.h
+===================================================================
+--- /dev/null 1970-01-01 00:00:00.000000000 +0000
++++ linux-2.6.16/include/asm-arm/kexec.h 2007-04-12 10:36:20.000000000 +0200
+@@ -0,0 +1,33 @@
++#ifndef _ARM_KEXEC_H
++#define _ARM_KEXEC_H
++
++#ifdef CONFIG_KEXEC
++
++/* Maximum physical address we can use pages from */
++#define KEXEC_SOURCE_MEMORY_LIMIT (-1UL)
++/* Maximum address we can reach in physical address mode */
++#define KEXEC_DESTINATION_MEMORY_LIMIT (-1UL)
++/* Maximum address we can use for the control code buffer */
++#define KEXEC_CONTROL_MEMORY_LIMIT TASK_SIZE
++
++#define KEXEC_CONTROL_CODE_SIZE 4096
++
++#define KEXEC_ARCH KEXEC_ARCH_ARM
++
++#ifndef __ASSEMBLY__
++
++#define MAX_NOTE_BYTES 1024
++
++struct kimage;
++
++static inline void crash_setup_regs(struct pt_regs *newregs,
++ struct pt_regs *oldregs)
++{
++ /* Dummy implementation for now */
++}
++
++#endif /* __ASSEMBLY__ */
++
++#endif /* CONFIG_KEXEC */
++
++#endif /* _ARM_KEXEC_H */
+Index: linux-2.6.16/include/asm-arm/unistd.h
+===================================================================
+--- linux-2.6.16.orig/include/asm-arm/unistd.h 2006-03-20 06:53:29.000000000 +0100
++++ linux-2.6.16/include/asm-arm/unistd.h 2007-04-12 10:36:20.000000000 +0200
+@@ -216,7 +216,7 @@
+ #define __NR_sigaltstack (__NR_SYSCALL_BASE+186)
+ #define __NR_sendfile (__NR_SYSCALL_BASE+187)
+ /* 188 reserved */
+- /* 189 reserved */
++#define __NR_sys_kexec_load (__NR_SYSCALL_BASE+189) /* 189 was reserved, temporarily use it for sys_kexec_load */
+ #define __NR_vfork (__NR_SYSCALL_BASE+190)
+ #define __NR_ugetrlimit (__NR_SYSCALL_BASE+191) /* SuS compliant getrlimit */
+ #define __NR_mmap2 (__NR_SYSCALL_BASE+192)
+Index: linux-2.6.16/include/linux/kexec.h
+===================================================================
+--- linux-2.6.16.orig/include/linux/kexec.h 2006-03-20 06:53:29.000000000 +0100
++++ linux-2.6.16/include/linux/kexec.h 2007-04-12 10:36:20.000000000 +0200
+@@ -119,6 +119,7 @@
+ #define KEXEC_ARCH_PPC (20 << 16)
+ #define KEXEC_ARCH_PPC64 (21 << 16)
+ #define KEXEC_ARCH_IA_64 (50 << 16)
++#define KEXEC_ARCH_ARM (40 << 16)
+ #define KEXEC_ARCH_S390 (22 << 16)
+ #define KEXEC_ARCH_SH (42 << 16)
+
+Index: linux-2.6.16/init/main.c
+===================================================================
+--- linux-2.6.16.orig/init/main.c 2006-03-20 06:53:29.000000000 +0100
++++ linux-2.6.16/init/main.c 2007-04-12 10:36:20.000000000 +0200
+@@ -58,6 +58,10 @@
+ #include <asm/smp.h>
+ #endif
+
++#ifdef CONFIG_EFB_DEBUG
++#include <asm/arch/efb.h>
++#endif
++
+ /*
+ * This is one of the first .c files built. Error out early if we have compiler
+ * trouble.
+@@ -442,6 +446,12 @@
+ {
+ char * command_line;
+ extern struct kernel_param __start___param[], __stop___param[];
++
++#ifdef CONFIG_EFB_DEBUG
++ efb_init();
++ efb_putstr("Rock'n Roll !\n");
++#endif
++
+ /*
+ * Interrupts are still disabled. Do necessary setups, then
+ * enable them
+Index: linux-2.6.16/kernel/printk.c
+===================================================================
+--- linux-2.6.16.orig/kernel/printk.c 2007-04-12 10:36:08.000000000 +0200
++++ linux-2.6.16/kernel/printk.c 2007-04-12 10:36:20.000000000 +0200
+@@ -34,12 +34,16 @@
+
+ #include <asm/uaccess.h>
+
++#include <asm/arch/efb.h>
++
+ #define __LOG_BUF_LEN (1 << CONFIG_LOG_BUF_SHIFT)
+
+-#ifdef CONFIG_DEBUG_LL
+-extern void printascii(char *);
++#ifdef CONFIG_EFB_DEBUG
++#include <asm/arch/efb.h>
+ #endif
+
++int in_printk;
++
+ /* printk's without a loglevel use this.. */
+ #define DEFAULT_MESSAGE_LOGLEVEL 4 /* KERN_WARNING */
+
+@@ -367,10 +371,12 @@
+ {
+ struct console *con;
+
++ in_printk = 1;
+ for (con = console_drivers; con; con = con->next) {
+ if ((con->flags & CON_ENABLED) && con->write)
+ con->write(con, &LOG_BUF(start), end - start);
+ }
++ in_printk = 0;
+ }
+
+ /*
+@@ -551,8 +557,8 @@
+ /* Emit the output into the temporary buffer */
+ printed_len = vscnprintf(printk_buf, sizeof(printk_buf), fmt, args);
+
+-#ifdef CONFIG_DEBUG_LL
+- printascii(printk_buf);
++#ifdef CONFIG_EFB_DEBUG
++ efb_putstr(printk_buf);
+ #endif
+
+ /*
projects / vuplus_openembedded / commitdiff